forgexa-cli 1.55.0__tar.gz → 1.55.1__tar.gz

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.55.0
+Version: 1.55.1
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.55.0"
+__version__ = "1.55.1"

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/forgexa_cli/agent_core.py

@@ -2311,15 +2311,46 @@ def zcode_binary_fingerprint(binary: str | Path) -> str:
     return digest.hexdigest()
 
 
-def zcode_build_verification_issue(binary: str | Path, env: dict[str, str] | None = None) -> str | None:
-    """Return a fail-closed reason unless the binary fingerprint is allowlisted."""
+ZCODE_ALLOWED_SHA256_FILE = Path.home() / ".forgexa" / "zcode-allowed-sha256"
+
+
+def zcode_allowed_fingerprints(env: dict[str, str] | None = None) -> set[str]:
+    """Union of the env allowlist and the persistent approval file.
+
+    GUI-launched daemons (macOS Dock/Finder) never inherit shell exports, so
+    an explicit `forgexa zcode approve-build` writes the approval here where
+    every runtime can read it regardless of how it was launched.
+    """
     source_env = os.environ if env is None else env
     allowed = {
         value.strip().lower()
         for value in source_env.get("FORGEXA_ZCODE_ALLOWED_SHA256", "").split(",")
         if value.strip()
     }
+    try:
+        lines = ZCODE_ALLOWED_SHA256_FILE.read_text(encoding="utf-8").splitlines()
+    except OSError:
+        lines = []
+    for line in lines:
+        value = line.split("#", 1)[0].strip()
+        if value:
+            allowed.add(value.lower())
+    return allowed
+
+
+def zcode_build_verification_issue(binary: str | Path, env: dict[str, str] | None = None) -> str | None:
+    """Return a fail-closed reason unless the binary fingerprint is allowlisted."""
+    allowed = zcode_allowed_fingerprints(env)
     if not allowed:
+        try:
+            actual = zcode_binary_fingerprint(binary)
+        except OSError:
+            actual = ""
+        if actual:
+            return (
+                "ZCode build is not approved; run `forgexa zcode approve-build` or set "
+                f"FORGEXA_ZCODE_ALLOWED_SHA256={actual}"
+            )
         return "ZCode build is not approved; configure FORGEXA_ZCODE_ALLOWED_SHA256"
     try:
         actual = zcode_binary_fingerprint(binary)

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/forgexa_cli/daemon.py

@@ -1150,7 +1150,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.55.0"
+DAEMON_VERSION = "1.55.1"
 
 
 def _detect_client_type() -> str:

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/forgexa_cli/main.py

@@ -3573,6 +3573,45 @@ def cmd_upgrade(args: argparse.Namespace) -> None:
 # ── Argument parser ──
 
 
+def cmd_zcode_approve_build(args: argparse.Namespace) -> None:
+    from . import agent_core
+
+    binary = os.environ.get("FACTORY_ZCODE_PATH") or args.binary or shutil.which("zcode")
+    if not binary:
+        print("error: zcode binary not found; install it or pass --binary PATH", file=sys.stderr)
+        return
+    try:
+        fingerprint = agent_core.zcode_binary_fingerprint(binary)
+    except OSError as exc:
+        print(f"error: could not fingerprint {binary}: {exc}", file=sys.stderr)
+        return
+    path = agent_core.ZCODE_ALLOWED_SHA256_FILE
+    existing = ""
+    try:
+        existing = path.read_text(encoding="utf-8")
+    except OSError:
+        pass
+    approved = {
+        line.split("#", 1)[0].strip().lower()
+        for line in existing.splitlines() if line.split("#", 1)[0].strip()
+    }
+    if fingerprint.lower() in approved:
+        print(f"already approved: {fingerprint}")
+        print(f"allowlist file: {path}")
+        return
+    path.parent.mkdir(parents=True, exist_ok=True)
+    suffix = "" if (not existing or existing.endswith("\n")) else "\n"
+    path.write_text(
+        existing + suffix
+        + f"{fingerprint}  # {binary} approved by `forgexa zcode approve-build`\n",
+        encoding="utf-8",
+    )
+    print(f"approved ZCode build: {fingerprint}")
+    print(f"binary: {binary}")
+    print(f"written to: {path}")
+    print("running daemons and desktop sidecars pick this up on their next probe (no restart needed)")
+
+
 def main() -> None:
     global _SERVER_URL_OVERRIDE, _output_format
 
@@ -3789,6 +3828,19 @@ def main() -> None:
         help="Per-agent timeout for the live execution test (default: 90)",
     )
 
+    # zcode
+    zcode_p = sub.add_parser("zcode", help="ZCode integration helpers")
+    zcode_sub = zcode_p.add_subparsers(dest="zcode_cmd")
+    zcode_approve_p = zcode_sub.add_parser(
+        "approve-build",
+        help="Persistently approve the installed ZCode binary fingerprint "
+             "(works for GUI-launched daemons that never see shell exports)",
+    )
+    zcode_approve_p.add_argument(
+        "--binary", default=None, metavar="PATH",
+        help="Path to the zcode binary (default: $FACTORY_ZCODE_PATH or `zcode` on PATH)",
+    )
+
     # runtimes
     rt_p = sub.add_parser("runtimes", help="Runtime management")
     rt_sub = rt_p.add_subparsers(dest="rt_cmd")
@@ -3918,6 +3970,9 @@ def main() -> None:
         "logs":    cmd_daemon_logs,
         "agents":  cmd_daemon_agents,
         "check":   cmd_check,
+        "zcode": lambda a: {
+            "approve-build": cmd_zcode_approve_build,
+        }.get(a.zcode_cmd, lambda _: zcode_p.print_help())(a),
         "runtimes": lambda a: {
             "list": cmd_runtimes_list,
         }.get(a.rt_cmd, lambda _: rt_p.print_help())(a),

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.55.0
+Version: 1.55.1
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.55.0 → forgexa_cli-1.55.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.55.0"
+version = "1.55.1"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"