forgexa-cli 1.57.5__tar.gz → 1.57.7__tar.gz

{forgexa_cli-1.57.5 → forgexa_cli-1.57.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.57.5
+Version: 1.57.7
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.57.5 → forgexa_cli-1.57.7}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.57.5"
+__version__ = "1.57.7"

{forgexa_cli-1.57.5 → forgexa_cli-1.57.7}/forgexa_cli/daemon.py

@@ -1150,7 +1150,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.57.5"
+DAEMON_VERSION = "1.57.7"
 
 
 def _detect_client_type() -> str:
@@ -1736,6 +1736,7 @@ def _filter_local_bind_task_result(result: "TaskResult") -> None:
     result.stdout = ""
     result.stderr = ""
     result.observations = []
+    result.metrics.pop("validation_issues", None)
     critic_review = result.critic_review
     if isinstance(critic_review, dict) and isinstance(critic_review.get("result"), dict):
         result.critic_review = {
@@ -1755,8 +1756,11 @@ def _filter_local_bind_task_result(result: "TaskResult") -> None:
         }
     if result.error:
         result.error = (
-            "Local task failed. Review this task in Forgexa Desktop on the "
-            "running device."
+            "Task verification is incomplete: acceptance criteria remain uncovered. "
+            "Review the validation log in Forgexa Desktop; resolve the criteria and "
+            "commit or stash local changes before retrying."
+            if result.failure_code == "acceptance_criteria_uncovered"
+            else "Local task failed. Review this task in Forgexa Desktop on the running device."
         )
 
 def _prepare_ai_job_output(
@@ -5503,6 +5507,10 @@ class _TaskAttachmentDownloadError(RuntimeError):
     """Raised when a required task attachment cannot be staged safely."""
 
 
+class _TaskAttachmentUnavailableError(_TaskAttachmentDownloadError):
+    """Raised when the attachment source is unavailable but the task can proceed."""
+
+
 def _workspace_has_recent_activity(
     workspace_path: "Path", since_monotonic: float, max_depth: int = 4
 ) -> bool:
@@ -5623,6 +5631,8 @@ class ProcessManager:
         "authentication required",
         "authenticate with the github",
         "gh auth login",
+        "your github token may be invalid",
+        "rejected the cli github credential",
     ]
 
     def __init__(self):
@@ -5726,7 +5736,9 @@ class ProcessManager:
     @staticmethod
     def agent_failure_kind(result: "TaskResult") -> str | None:
         """Classify a fallback-eligible failure without conflating its cause."""
-        if result.failure_code in {"all_agents_rate_limited", "all_agents_unavailable"}:
+        if result.failure_code in {
+            "all_agents_rate_limited", "all_agents_unavailable", "acceptance_criteria_uncovered",
+        }:
             return None
         if result.failure_code == "agent_platform_unsupported":
             return "agent_unavailable"
@@ -7634,6 +7646,59 @@ class ProcessManager:
                     return retry_result
                 _auth_state["persist"] = False
 
+            auth_detail = " ".join(
+                [*structured_errors, stderr]
+            ).lower()
+            token_auth_error = (
+                "your github token may be invalid" in auth_detail
+                or "rejected the cli github credential" in auth_detail
+            )
+            if token_auth_error and not (copilot_exit == 0 and returncode == 0):
+                _auth_state["persist"] = False
+            if (
+                token_auth_error
+                and not (copilot_exit == 0 and returncode == 0)
+                and not signals["has_meaningful_content"]
+                and not self._copilot_called_any_tools(stdout)
+            ):
+                recovery_home = (
+                    Path(_master_copilot_home)
+                    if auth_env_var and _master_copilot_home
+                    else agent_core.copilot_recovery_home(_isolated_copilot_home)
+                )
+                if (
+                    not _retry_without_token_env
+                    and recovery_home
+                    and (recovery_home / "config.json").is_file()
+                ):
+                    restored = await asyncio.to_thread(
+                        agent_core.replace_copilot_auth_state,
+                        recovery_home,
+                        _isolated_copilot_home,
+                    )
+                    can_retry_with_login = bool(auth_env_var or restored)
+                else:
+                    can_retry_with_login = False
+                if can_retry_with_login:
+                    logger.warning(
+                        "Copilot token authentication failed before work for task %s; "
+                        "retrying once with stored login and token environment variables removed",
+                        task_id,
+                    )
+                    retry_result = await self._run_copilot(
+                        agent, prompt, cwd, timeout, task_id, on_chunk,
+                        stream_stderr=stream_stderr,
+                        disable_builtin_mcps=disable_builtin_mcps,
+                        _retry_without_effort=_retry_without_effort,
+                        _retry_without_token_env=True,
+                        _isolated_copilot_home=_isolated_copilot_home,
+                        _auth_state=_auth_state,
+                    )
+                    _auth_state["persist"] = retry_result.status == "success"
+                    retry_result.metrics["copilot_auth_recovery"] = True
+                    return retry_result
+                _auth_state["persist"] = False
+
             if copilot_exit == 0 and returncode == 0:
                 return TaskResult(
                     status="success",
@@ -7731,6 +7796,12 @@ class ProcessManager:
                     failure_error = f"Copilot exited with code {effective_rc}: {stderr[-500:].strip()}"
                 else:
                     failure_error = f"Copilot exited with code {effective_rc}"
+                if token_auth_error:
+                    auth_source = auth_env_var or "stored Copilot login"
+                    failure_error = (
+                        f"Copilot authentication failed using {auth_source}. "
+                        f"{failure_error}"
+                    )
                 logger.error(
                     "Copilot task %s failed (process_rc=%s, result_exit=%s): %s",
                     task_id,
@@ -10568,9 +10639,22 @@ class RuntimeDaemon:
                     timeout=httpx.Timeout(connect=10.0, read=30.0, write=10.0, pool=10.0),
                 ) as response:
                     if not 200 <= response.status_code < 300:
-                        raise _TaskAttachmentDownloadError(
-                            f"Attachment '{attachment_name}' download failed with HTTP {response.status_code}"
-                        )
+                        error = f"Attachment '{attachment_name}' download failed with HTTP {response.status_code}"
+                        if response.status_code in {409, 502}:
+                            await response.aread()
+                            try:
+                                detail = response.json()
+                            except ValueError:
+                                detail = None
+                            if isinstance(detail, dict) and detail.get("detail") == "Task attachment integrity check failed":
+                                raise _TaskAttachmentDownloadError(error)
+                            if response.status_code == 409 and isinstance(detail, dict) and detail.get("detail") == "Task attachment source no longer matches stored checksum":
+                                raise _TaskAttachmentUnavailableError(
+                                    f"Attachment '{attachment_name}' is unavailable: {detail['detail']}"
+                                )
+                        if response.status_code in {404, 502, 503, 504}:
+                            raise _TaskAttachmentUnavailableError(error)
+                        raise _TaskAttachmentDownloadError(error)
                     content_length = response.headers.get("content-length")
                     if content_length:
                         try:
@@ -10604,6 +10688,10 @@ class RuntimeDaemon:
                     temporary_path.replace(destination)
             except _TaskAttachmentDownloadError:
                 raise
+            except httpx.RequestError as exc:
+                raise _TaskAttachmentUnavailableError(
+                    f"Attachment '{attachment_name}' download failed ({type(exc).__name__})"
+                ) from exc
             except httpx.HTTPError as exc:
                 raise _TaskAttachmentDownloadError(
                     f"Attachment '{attachment_name}' download failed ({type(exc).__name__})"
@@ -10619,7 +10707,7 @@ class RuntimeDaemon:
                 timeout=timeout_seconds,
             )
         except asyncio.TimeoutError as exc:
-            raise _TaskAttachmentDownloadError(
+            raise _TaskAttachmentUnavailableError(
                 f"Attachment '{attachment_name}' download timed out after "
                 f"{timeout_seconds:.0f}s"
             ) from exc
@@ -10642,6 +10730,7 @@ class RuntimeDaemon:
 
         staging_dir = Path(tempfile.mkdtemp(prefix=f"forgexa-attachments-{task.task_id[:8]}-"))
         staged: list[tuple[str, list[str], str]] = []
+        unavailable: list[tuple[str, list[str], str]] = []
         deadline = time.monotonic() + self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS
         remaining_bytes = self._TASK_ATTACHMENT_MAX_TOTAL_BYTES
         try:
@@ -10670,12 +10759,6 @@ class RuntimeDaemon:
                     raise _TaskAttachmentDownloadError(
                         f"Attachment '{file_name}' cannot be staged securely because it has no artifact ID"
                     )
-                remaining_seconds = deadline - time.monotonic()
-                if remaining_seconds <= 0:
-                    raise _TaskAttachmentDownloadError(
-                        f"Task attachment staging timed out after "
-                        f"{self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS}s"
-                    )
                 if not conn.runtime_id:
                     raise _TaskAttachmentDownloadError(
                         f"Attachment '{file_name}' cannot be staged because this runtime is not registered"
@@ -10684,16 +10767,27 @@ class RuntimeDaemon:
                     f"{conn.server_url.rstrip('/')}/api/v1/runtimes/{conn.runtime_id}/"
                     f"tasks/{task.task_id}/attachments/{artifact_id}"
                 )
-                await self._download_task_attachment(
-                    conn.client,
-                    source_url,
-                    destination,
-                    attachment_name=file_name,
-                    expected_size=expected_size or None,
-                    expected_checksum=str(attachment.get("checksum") or ""),
-                    max_bytes=min(self._TASK_ATTACHMENT_MAX_BYTES, remaining_bytes),
-                    timeout_seconds=remaining_seconds,
-                )
+                try:
+                    remaining_seconds = deadline - time.monotonic()
+                    if remaining_seconds <= 0:
+                        raise _TaskAttachmentUnavailableError(
+                            f"Task attachment staging timed out after "
+                            f"{self._TASK_ATTACHMENT_DOWNLOAD_TIMEOUT_SECONDS}s"
+                        )
+                    await self._download_task_attachment(
+                        conn.client,
+                        source_url,
+                        destination,
+                        attachment_name=file_name,
+                        expected_size=expected_size or None,
+                        expected_checksum=str(attachment.get("checksum") or ""),
+                        max_bytes=min(self._TASK_ATTACHMENT_MAX_BYTES, remaining_bytes),
+                        timeout_seconds=remaining_seconds,
+                    )
+                except _TaskAttachmentUnavailableError as exc:
+                    logger.warning("Task %s attachment unavailable: %s", task.task_id, exc)
+                    unavailable.append((file_name, download_url_aliases, str(exc)))
+                    continue
                 remaining_bytes -= destination.stat().st_size
                 staged.append((file_name, download_url_aliases, str(destination)))
         except Exception:
@@ -10701,10 +10795,29 @@ class RuntimeDaemon:
             raise
 
         task.input_prompt = self._rewrite_staged_attachment_references(task.input_prompt, staged)
+        if unavailable:
+            notices = []
+            for file_name, download_urls, error in unavailable:
+                notices.append(f"- `{file_name}`: {error}")
+                for download_url in download_urls:
+                    command_pattern = r"`curl -L '" + re.escape(download_url) + r"' -o /tmp/[^`]+`"
+                    task.input_prompt = re.sub(command_pattern, "[attachment unavailable]", task.input_prompt)
+                    task.input_prompt = task.input_prompt.replace(f"Download: {download_url}", "Attachment unavailable")
+                    task.input_prompt = task.input_prompt.replace(download_url, "[attachment unavailable]")
+            task.input_prompt = "\n".join([
+                "## Unavailable Attachments",
+                "These files could not be retrieved. Continue with available inputs and report any missing evidence; do not retry their download URLs.",
+                *notices,
+                "",
+                task.input_prompt,
+            ])
         input_data = dict(task.input_data or {})
         input_data["prompt"] = task.input_prompt
         task.input_data = input_data
         logger.info("Prepared %d attachment(s) for task %s", len(staged), task.task_id)
+        if not staged:
+            shutil.rmtree(staging_dir, ignore_errors=True)
+            return None
         return staging_dir
 
     @staticmethod
@@ -13052,7 +13165,7 @@ class RuntimeDaemon:
                 #   are *optional*: if they exist they are validated, but their
                 #   absence is not an error (the agent only writes regression
                 #   tests + test-report.md).
-                _skip_test_artifacts = False
+                _skip_test_artifacts = req_type == "task"
                 _requires_structured_artifacts = False
                 # Scope-adaptive pipeline (Phase 1): a content_only change
                 # scope (analysis-predicted, machine-verified server-side)
@@ -13074,19 +13187,28 @@ class RuntimeDaemon:
                     # importable (standalone vendored daemon execution).
                     _skip_test_artifacts = True
 
-                # The type-profile test_coverage skip (e.g. "task") is a
-                # lightweight-verify default — NOT an exemption from the e2e
-                # grounding chain or from a frozen enforce-mode artifact
-                # contract that was injected into the prompt. Both apply to
-                # every requirement type: SI-1616 (task verify) failed the e2e
-                # evidence chain because the skip semantics diverged between
-                # server daemons (profile skip applied) and standalone desktop
-                # daemons (profile import fails → nothing skipped).
+                # Keep e2e evidence validation active for any requirement type.
+                # An enforced policy requires artifacts only when the analysis
+                # contract expects test intent or the analysis supplied one.
+                _analysis_dir = (
+                    input_data.get("analysis_output_dir")
+                    or (input_data.get("context") or {}).get("analysis_output_dir")
+                    or ""
+                )
+                _has_test_intent = bool(_analysis_dir) and (
+                    workspace_path / str(_analysis_dir) / "test-intent.json"
+                ).is_file()
                 if (
                     _skip_test_artifacts
                     and _change_scope != "content_only"
                     and (
-                        (qa_policy or {}).get("enforcement") == "enforce"
+                        (
+                            (qa_policy or {}).get("enforcement") == "enforce"
+                            and (
+                                "test-intent.json" in _get_analysis_outputs_for_type(req_type, _change_scope)
+                                or _has_test_intent
+                            )
+                        )
                         or _testing_intents_have_e2e(workspace_path, input_data)
                     )
                 ):
@@ -13261,15 +13383,30 @@ class RuntimeDaemon:
                         ))
 
                     # --- coverage-matrix.json validation ---
+                    if req_type == "task":
+                        result.metrics.pop("acceptance_criteria_manual_review_required", None)
                     cm_path = base / "coverage-matrix.json"
                     if cm_path.exists():
                         try:
-                            cm_data = _json.loads(cm_path.read_text(encoding="utf-8"))
-                            ac_list = cm_data.get("acceptance_criteria", [])
-                            uncovered = [ac for ac in ac_list if ac.get("status") != "covered"]
-                            if uncovered:
-                                ids = ", ".join(ac.get("id", "?") for ac in uncovered[:5])
-                                issues.append(f"Uncovered acceptance criteria in coverage-matrix.json: {ids}")
+                            cm_content = cm_path.read_text(encoding="utf-8")
+                            cm_data = _json.loads(cm_content)
+                            if req_type == "task":
+                                coverage = runtime_evidence.parse_acceptance_criteria_coverage_artifacts(
+                                    _json.dumps(_tc_data) if _tc_data is not None else None,
+                                    cm_content,
+                                )
+                                links = coverage.get("coverage_links") or []
+                                if coverage.get("collection_status") != "completed" or not links:
+                                    reason = coverage.get("failure_reason") or "coverage_matrix_empty"
+                                    issues.append(f"coverage-matrix.json has invalid acceptance criteria: {reason}")
+                                else:
+                                    result.metrics["acceptance_criteria_manual_review_required"] = True
+                            else:
+                                ac_list = cm_data.get("acceptance_criteria", [])
+                                uncovered = [ac for ac in ac_list if ac.get("status") != "covered"]
+                                if uncovered:
+                                    ids = ", ".join(ac.get("id", "?") for ac in uncovered[:5])
+                                    issues.append(f"Uncovered acceptance criteria in coverage-matrix.json: {ids}")
                         except (_json.JSONDecodeError, UnicodeDecodeError) as e:
                             issues.append(f"coverage-matrix.json is not valid JSON: {e}")
                     elif _requires_structured_artifacts or _requires_e2e_artifacts:
@@ -14693,6 +14830,29 @@ class RuntimeDaemon:
                 )
                 return result  # All validations passed
 
+            if getattr(task, "workspace_resolution", None) == "local_bind":
+                _append_local_bind_output_log(task.task_id, [
+                    "[daemon] Output validation found these issues:",
+                    *[f"[daemon] {issue}" for issue in issues],
+                ])
+
+            if (
+                task.node_type == "testing"
+                and (task.input_data or {}).get("requirement_type") == "task"
+                and all(
+                    issue.startswith("Uncovered acceptance criteria in coverage-matrix.json:")
+                    for issue in issues
+                )
+            ):
+                result.status = "failed"
+                result.failure_code = "acceptance_criteria_uncovered"
+                result.error = f"Task verification is incomplete: {issues[0]}"
+                result.metrics["validation_issues"] = issues
+                self._record_testing_telemetry(
+                    workspace_path, task, result, retries_used=attempt
+                )
+                return result
+
             issues_text = "\n".join(f"- {iss}" for iss in issues)
             logger.warning(
                 "Validation gate: %d issues found for task %s (attempt %d/%d):\n%s",
@@ -14786,6 +14946,27 @@ class RuntimeDaemon:
         )
         remaining = self._validate_outputs(workspace_path, task, result)
         if remaining:
+            if getattr(task, "workspace_resolution", None) == "local_bind":
+                _append_local_bind_output_log(task.task_id, [
+                    "[daemon] Output validation remains incomplete:",
+                    *[f"[daemon] {issue}" for issue in remaining],
+                ])
+            if (
+                task.node_type == "testing"
+                and (task.input_data or {}).get("requirement_type") == "task"
+                and all(
+                    issue.startswith("Uncovered acceptance criteria in coverage-matrix.json:")
+                    for issue in remaining
+                )
+            ):
+                result.status = "failed"
+                result.failure_code = "acceptance_criteria_uncovered"
+                result.error = f"Task verification is incomplete: {remaining[0]}"
+                result.metrics["validation_issues"] = remaining
+                self._record_testing_telemetry(
+                    workspace_path, task, result, retries_used=max_retries
+                )
+                return result
             # Distinguish blocking artifact-contract failures from advisory syntax
             # warnings. Evidence coverage and references are release-blocking even
             # when the file itself exists.
@@ -14799,6 +14980,7 @@ class RuntimeDaemon:
                 "not found",
                 "is empty",
                 "not valid json",
+                "invalid acceptance criteria",
                 "case_evidence",
                 "test-evidence.json has no",
                 "evidence item",

{forgexa_cli-1.57.5 → forgexa_cli-1.57.7}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.57.5
+Version: 1.57.7
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.57.5 → forgexa_cli-1.57.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.57.5"
+version = "1.57.7"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"