forgexa-cli 1.48.2__tar.gz → 1.48.3__tar.gz

{forgexa_cli-1.48.2 → forgexa_cli-1.48.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.48.2
+Version: 1.48.3
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.48.2 → forgexa_cli-1.48.3}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.48.2"
+__version__ = "1.48.3"

{forgexa_cli-1.48.2 → forgexa_cli-1.48.3}/forgexa_cli/daemon.py

@@ -1120,7 +1120,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.48.2"
+DAEMON_VERSION = "1.48.3"
 
 
 def _detect_client_type() -> str:
@@ -5189,6 +5189,10 @@ class _IdleTimeoutError(asyncio.TimeoutError):
         self.stderr = ""
 
 
+class _TaskAttachmentDownloadError(RuntimeError):
+    """Raised when a required task attachment cannot be staged safely."""
+
+
 def _workspace_has_recent_activity(
     workspace_path: "Path", since_monotonic: float, max_depth: int = 4
 ) -> bool:
@@ -8224,6 +8228,7 @@ class ServerConnection:
                 "platform": platform.platform(),
                 "python_version": platform.python_version(),
                 "local_workspace_bindings": {"protocol_version": 3},
+                "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True},
             },
             "server_url": self.server_url,
             "expires_in_days": 90,
@@ -8623,7 +8628,7 @@ class ServerConnection:
                     "python_version": platform.python_version(),
                     "local_workspace_bindings": {"protocol_version": 3},
                     "local_evidence": {"protocol_version": 1, "structured_summary": True},
-                    "local_evidence": {"protocol_version": 1, "structured_summary": True},
+                    "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True},
                 },
                 "server_url": self.server_url,
             }
@@ -9257,6 +9262,10 @@ class RuntimeDaemon:
     """
 
     AGENT_REFRESH_INTERVAL_SECONDS = 60
+    _TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS = 120
+    _TASK_ATTACHMENT_MAX_BYTES = 50 * 1024 * 1024
+    _TASK_ATTACHMENT_MAX_COUNT = 20
+    _TASK_ATTACHMENT_MAX_TOTAL_BYTES = 100 * 1024 * 1024
 
     def __init__(self):
         # Compute stable hardware fingerprint from machine-id / MAC address.
@@ -9448,6 +9457,296 @@ class RuntimeDaemon:
 
         target_dir.mkdir(parents=True, exist_ok=True)
 
+    @staticmethod
+    def _task_attachments_to_stage(task: TaskInfo) -> list[dict]:
+        input_data = task.input_data if isinstance(task.input_data, dict) else {}
+        attachment_groups = [input_data.get("attachments")]
+        context = input_data.get("context")
+        if isinstance(context, dict):
+            attachment_groups.append(context.get("attachments"))
+        fix_context = input_data.get("fix_context")
+        if isinstance(fix_context, dict):
+            attachment_groups.append(fix_context.get("gate_attachments"))
+
+        attachments: list[dict] = []
+        attachments_by_artifact_id: dict[str, dict] = {}
+        attachments_by_url: dict[str, dict] = {}
+        for group in attachment_groups:
+            if not isinstance(group, list):
+                continue
+            for attachment in group:
+                if not isinstance(attachment, dict):
+                    continue
+                artifact_id = str(attachment.get("artifact_id") or attachment.get("id") or "").strip()
+                raw_download_url = attachment.get("download_url")
+                download_url = raw_download_url.strip() if isinstance(raw_download_url, str) else ""
+                if not artifact_id and not download_url:
+                    continue
+                existing = (
+                    attachments_by_artifact_id.get(artifact_id)
+                    if artifact_id else None
+                ) or (attachments_by_url.get(download_url) if download_url else None)
+                if existing is None:
+                    existing = dict(attachment)
+                    attachments.append(existing)
+                else:
+                    for field, value in attachment.items():
+                        if value and not existing.get(field):
+                            existing[field] = value
+                existing_artifact_id = str(
+                    existing.get("artifact_id") or existing.get("id") or ""
+                ).strip()
+                if existing_artifact_id:
+                    attachments_by_artifact_id[existing_artifact_id] = existing
+                if download_url:
+                    attachments_by_url[download_url] = existing
+
+        def _artifact_id_is_valid(attachment: dict) -> bool:
+            try:
+                UUID(str(attachment.get("artifact_id") or attachment.get("id") or ""))
+                return True
+            except (TypeError, ValueError, AttributeError):
+                return False
+
+        def _legacy_key(attachment: dict) -> tuple[str, str, int]:
+            try:
+                size_bytes = int(attachment.get("size_bytes") or 0)
+            except (TypeError, ValueError):
+                size_bytes = 0
+            return (
+                str(attachment.get("file_path") or attachment.get("file_name") or ""),
+                str(attachment.get("mime_type") or ""),
+                size_bytes,
+            )
+
+        identified_by_key: dict[tuple[str, str, int], list[dict]] = {}
+        for attachment in attachments:
+            if _artifact_id_is_valid(attachment):
+                identified_by_key.setdefault(_legacy_key(attachment), []).append(attachment)
+
+        deduplicated: list[dict] = []
+        for attachment in attachments:
+            if _artifact_id_is_valid(attachment):
+                deduplicated.append(attachment)
+                continue
+            candidates = identified_by_key.get(_legacy_key(attachment), [])
+            if len(candidates) != 1:
+                deduplicated.append(attachment)
+                continue
+            identified = candidates[0]
+            for field, value in attachment.items():
+                if value and not identified.get(field):
+                    identified[field] = value
+        return deduplicated
+
+    @staticmethod
+    def _task_attachment_filename(attachment: dict, position: int) -> str:
+        raw_name = str(
+            attachment.get("file_path") or attachment.get("file_name") or "attachment"
+        )
+        file_name = Path(raw_name.replace("\\", "/")).name
+        file_name = re.sub(r"[^A-Za-z0-9._-]+", "_", file_name).strip("._")
+        return f"{position:02d}-{file_name[:160] or 'attachment'}"
+
+    @staticmethod
+    def _rewrite_staged_attachment_references(
+        prompt: str,
+        staged: list[tuple[str, str, str]],
+    ) -> str:
+        if not staged:
+            return prompt
+
+        local_files = []
+        for file_name, download_url, local_path in staged:
+            if download_url:
+                command_pattern = r"`curl -L '" + re.escape(download_url) + r"' -o /tmp/[^`]+`"
+                prompt = re.sub(command_pattern, lambda _match, path=local_path: f"`{path}`", prompt)
+                prompt = prompt.replace(f"Download: {download_url}", f"Staged local file: `{local_path}`")
+                prompt = prompt.replace(download_url, local_path)
+            local_files.append(f"- `{local_path}` ({file_name})")
+
+        preamble = "\n".join([
+            "## Runtime-Prepared Attachments",
+            "The runtime downloaded these files before this task began. Use the local copies directly; do not download attachment URLs yourself.",
+            *local_files,
+        ])
+        return f"{preamble}\n\n{prompt}" if prompt else preamble
+
+    async def _download_task_attachment(
+        self,
+        client: httpx.AsyncClient,
+        url: str,
+        destination: Path,
+        *,
+        attachment_name: str,
+        expected_size: int | None,
+        expected_checksum: str | None,
+        max_bytes: int,
+        timeout_seconds: float,
+    ) -> None:
+        parsed_url = urlparse(url)
+        if parsed_url.scheme not in {"http", "https"} or not parsed_url.netloc:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' has an unsupported download URL"
+            )
+        if expected_size is not None and expected_size < 0:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' has an invalid size"
+            )
+        if expected_size is not None and expected_size > max_bytes:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' exceeds the task download budget"
+            )
+        if expected_checksum and not re.fullmatch(r"[0-9a-fA-F]{64}", expected_checksum):
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' has an invalid integrity checksum"
+            )
+
+        temporary_path = destination.with_name(f"{destination.name}.part")
+
+        async def download() -> None:
+            try:
+                async with client.stream(
+                    "GET",
+                    url,
+                    timeout=httpx.Timeout(connect=10.0, read=30.0, write=10.0, pool=10.0),
+                ) as response:
+                    if not 200 <= response.status_code < 300:
+                        raise _TaskAttachmentDownloadError(
+                            f"Attachment '{attachment_name}' download failed with HTTP {response.status_code}"
+                        )
+                    content_length = response.headers.get("content-length")
+                    if content_length:
+                        try:
+                            if int(content_length) > max_bytes:
+                                raise _TaskAttachmentDownloadError(
+                                    f"Attachment '{attachment_name}' exceeds the task download budget"
+                                )
+                        except ValueError:
+                            pass
+
+                    total_bytes = 0
+                    digest = hashlib.sha256()
+                    with temporary_path.open("wb") as output:
+                        try:
+                            os.chmod(temporary_path, 0o600)
+                        except OSError:
+                            pass
+                        async for chunk in response.aiter_bytes():
+                            total_bytes += len(chunk)
+                            if total_bytes > max_bytes:
+                                raise _TaskAttachmentDownloadError(
+                                    f"Attachment '{attachment_name}' exceeds the task download budget"
+                                )
+                            output.write(chunk)
+                            digest.update(chunk)
+                    if expected_checksum:
+                        if not secrets.compare_digest(digest.hexdigest(), expected_checksum.lower()):
+                            raise _TaskAttachmentDownloadError(
+                                f"Attachment '{attachment_name}' failed its integrity check"
+                            )
+                    temporary_path.replace(destination)
+            except _TaskAttachmentDownloadError:
+                raise
+            except httpx.HTTPError as exc:
+                raise _TaskAttachmentDownloadError(
+                    f"Attachment '{attachment_name}' download failed ({type(exc).__name__})"
+                ) from exc
+            except OSError as exc:
+                raise _TaskAttachmentDownloadError(
+                    f"Attachment '{attachment_name}' could not be saved ({exc})"
+                ) from exc
+
+        try:
+            await asyncio.wait_for(
+                download(),
+                timeout=timeout_seconds,
+            )
+        except asyncio.TimeoutError as exc:
+            raise _TaskAttachmentDownloadError(
+                f"Attachment '{attachment_name}' download timed out after "
+                f"{timeout_seconds:.0f}s"
+            ) from exc
+        finally:
+            temporary_path.unlink(missing_ok=True)
+
+    async def _stage_task_attachments(
+        self,
+        task: TaskInfo,
+        conn: ServerConnection,
+    ) -> Path | None:
+        attachments = self._task_attachments_to_stage(task)
+        if not attachments:
+            return None
+        if len(attachments) > self._TASK_ATTACHMENT_MAX_COUNT:
+            raise _TaskAttachmentDownloadError(
+                f"Task has {len(attachments)} attachments; the runtime limit is "
+                f"{self._TASK_ATTACHMENT_MAX_COUNT}"
+            )
+
+        staging_dir = Path(tempfile.mkdtemp(prefix=f"forgexa-attachments-{task.task_id[:8]}-"))
+        staged: list[tuple[str, str, str]] = []
+        deadline = time.monotonic() + self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS
+        remaining_bytes = self._TASK_ATTACHMENT_MAX_TOTAL_BYTES
+        try:
+            for position, attachment in enumerate(attachments, start=1):
+                file_name = str(
+                    attachment.get("file_path") or attachment.get("file_name") or "attachment"
+                )
+                download_url = str(attachment.get("download_url") or "")
+                destination = staging_dir / self._task_attachment_filename(attachment, position)
+                try:
+                    expected_size = int(attachment.get("size_bytes") or 0)
+                except (TypeError, ValueError):
+                    expected_size = 0
+                if expected_size > remaining_bytes:
+                    raise _TaskAttachmentDownloadError(
+                        f"Attachment '{file_name}' exceeds the task download budget"
+                    )
+                artifact_id = str(attachment.get("artifact_id") or attachment.get("id") or "")
+                try:
+                    UUID(artifact_id)
+                except (TypeError, ValueError, AttributeError):
+                    raise _TaskAttachmentDownloadError(
+                        f"Attachment '{file_name}' cannot be staged securely because it has no artifact ID"
+                    )
+                remaining_seconds = deadline - time.monotonic()
+                if remaining_seconds <= 0:
+                    raise _TaskAttachmentDownloadError(
+                        f"Task attachment staging timed out after "
+                        f"{self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS}s"
+                    )
+                if not conn.runtime_id:
+                    raise _TaskAttachmentDownloadError(
+                        f"Attachment '{file_name}' cannot be staged because this runtime is not registered"
+                    )
+                source_url = (
+                    f"{conn.server_url.rstrip('/')}/api/v1/runtimes/{conn.runtime_id}/"
+                    f"tasks/{task.task_id}/attachments/{artifact_id}"
+                )
+                await self._download_task_attachment(
+                    conn.client,
+                    source_url,
+                    destination,
+                    attachment_name=file_name,
+                    expected_size=expected_size or None,
+                    expected_checksum=str(attachment.get("checksum") or ""),
+                    max_bytes=min(self._TASK_ATTACHMENT_MAX_BYTES, remaining_bytes),
+                    timeout_seconds=remaining_seconds,
+                )
+                remaining_bytes -= destination.stat().st_size
+                staged.append((file_name, download_url, str(destination)))
+        except Exception:
+            shutil.rmtree(staging_dir, ignore_errors=True)
+            raise
+
+        task.input_prompt = self._rewrite_staged_attachment_references(task.input_prompt, staged)
+        input_data = dict(task.input_data or {})
+        input_data["prompt"] = task.input_prompt
+        task.input_data = input_data
+        logger.info("Prepared %d attachment(s) for task %s", len(staged), task.task_id)
+        return staging_dir
+
     @staticmethod
     async def _mint_local_dev_token() -> str:
         """Mint a JWT for local development when no explicit token is configured.
@@ -10292,6 +10591,7 @@ class RuntimeDaemon:
         await project_lock.acquire()
         workspace_execution_lock: _WorkspaceFileLock | None = None
         local_bind_file_lock = None
+        attachment_staging_dir: Path | None = None
         if is_local_bind and task.local_workspace_binding_id:
             # OS-level file lock keyed by binding_id (docs/designs/forgexa-
             # ide-design.md §6.3): the DB lease (orchestrator.py) prevents
@@ -10387,6 +10687,34 @@ class RuntimeDaemon:
             logger.info("Workspace ready: %s", workspace_path)
             self._ensure_task_output_dir(workspace_path, task)
 
+            try:
+                if self._task_attachments_to_stage(task):
+                    await reporter.report_progress(
+                        task.task_id,
+                        8,
+                        "preparing_attachments",
+                        output_lines=["[daemon] Preparing task attachments"],
+                    )
+                attachment_staging_dir = await self._stage_task_attachments(task, conn)
+            except _TaskAttachmentDownloadError as exc:
+                logger.warning("Task %s could not stage attachments: %s", task.task_id, exc)
+                await reporter.report_progress(
+                    task.task_id,
+                    8,
+                    "attachment_download_failed",
+                    output_lines=["[daemon] Required task attachment could not be downloaded"],
+                )
+                await report_task_complete(TaskResult(
+                    status="failed",
+                    exit_code=-1,
+                    stdout="",
+                    stderr="",
+                    error=str(exc),
+                    failure_code="attachment_download_failed",
+                    execution_attempt_id=task.execution_attempt_id,
+                ))
+                return
+
             # 2.1 Workspace health check: detect broken checkout — skipped for
             # local_bind (the user's own real directory, not a disposable
             # checkout the daemon controls). See
@@ -11131,6 +11459,8 @@ class RuntimeDaemon:
                 execution_attempt_id=task.execution_attempt_id,
             ))
         finally:
+            if attachment_staging_dir is not None:
+                shutil.rmtree(attachment_staging_dir, ignore_errors=True)
             if workspace_execution_lock is not None:
                 workspace_execution_lock.release()
             project_lock.release()

{forgexa_cli-1.48.2 → forgexa_cli-1.48.3}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.48.2
+Version: 1.48.3
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.48.2 → forgexa_cli-1.48.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.48.2"
+version = "1.48.3"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"