forgexa-cli 1.63.1__tar.gz → 1.64.1__tar.gz

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.63.1
+Version: 1.64.1
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.63.1"
+__version__ = "1.64.1"

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/forgexa_cli/agent_core.py

@@ -2871,6 +2871,7 @@ def mimo_base_env(env: dict[str, str]) -> dict[str, str]:
             },
             "external_directory": "deny",
             "task": "allow",
+            "actor": "allow",
             "skill": {"*": "allow", "compose:*": "deny"},
             "webfetch": "deny",
             "websearch": "deny",
@@ -3663,8 +3664,9 @@ def build_copilot_command(
     stdin instead - verified live on CLI 1.0.86, where piped stdin is a full
     non-interactive prompt source.  The daemon uses it for native launchers
     to avoid single-argument and total command-line limits; Windows batch
-    wrappers retain task-file redirection.  The host uses it when the argv
-    form would exceed the platform command-line limit.
+    wrappers retain task-file redirection.  The host uses it for every prompt
+    so task text never passes through Windows batch argument parsing or
+    command-line limits, including when attachments are inlined.
     """
     cmd = [
         binary,

forgexa_cli-1.64.1/forgexa_cli/aws_evidence.py

@@ -0,0 +1,279 @@
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from datetime import datetime
+from typing import Any
+from urllib.parse import urlsplit
+from uuid import UUID
+
+PAYLOAD_MAX_BYTES = 10 * 1024 * 1024
+SUMMARY_MAX_BYTES = 32 * 1024
+REFERENCE_FIELDS = frozenset(
+    {
+        "issuer",
+        "workspace_id",
+        "project_id",
+        "user_id",
+        "snapshot_id",
+        "payload_sha256",
+        "summary_sha256",
+    }
+)
+SECRET_FIELDS = frozenset(
+    {
+        "access_key_id",
+        "secret_access_key",
+        "session_token",
+        "private_key",
+        "encrypted_material",
+        "aws_access_key_id",
+        "aws_secret_access_key",
+        "aws_session_token",
+        "authorization",
+    }
+)
+
+
+class EvidenceError(ValueError):
+    pass
+
+
+def canonical_json(value: Any) -> str:
+    return json.dumps(
+        value, sort_keys=True, separators=(",", ":"), ensure_ascii=True, allow_nan=False
+    )
+
+
+def digest(value: Any) -> str:
+    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
+
+
+def model_destination(driver_id: str, environment: dict) -> dict:
+    if any(
+        environment.get(key) not in (None, "", "0", "false")
+        for key in (
+            "CLAUDE_CODE_USE_BEDROCK",
+            "CLAUDE_CODE_USE_VERTEX",
+            "CLAUDE_CODE_USE_FOUNDRY",
+        )
+    ):
+        raise EvidenceError("aws_evidence_unknown_provider")
+    defaults = {
+        "claude": ("anthropic", "https://api.anthropic.com"),
+        "copilot": ("github", "https://api.githubcopilot.com"),
+        "gemini": ("google", "https://generativelanguage.googleapis.com"),
+    }
+    explicit_keys = {
+        "claude": ("ANTHROPIC_BASE_URL",),
+        "mimo": ("ANTHROPIC_BASE_URL",),
+        "deepseek": ("DEEPSEEK_BASE_URL", "ANTHROPIC_BASE_URL"),
+        "copilot": ("COPILOT_API_URL", "GITHUB_COPILOT_BASE_URL", "GH_HOST"),
+        "gemini": ("GOOGLE_GEMINI_BASE_URL", "GEMINI_API_BASE_URL"),
+        "kimi": ("KIMI_BASE_URL", "OPENAI_BASE_URL"),
+    }
+    if driver_id not in explicit_keys:
+        raise EvidenceError("aws_evidence_unknown_provider")
+    endpoints = [environment[key] for key in explicit_keys[driver_id] if environment.get(key)]
+    if len(set(endpoints)) > 1 or (not endpoints and driver_id not in defaults):
+        raise EvidenceError("aws_evidence_unknown_provider")
+    endpoint = endpoints[0] if endpoints else defaults[driver_id][1]
+    parsed = urlsplit(endpoint)
+    known_hosts = {
+        "api.anthropic.com": "anthropic",
+        "api.githubcopilot.com": "github",
+        "api.individual.githubcopilot.com": "github",
+        "api.business.githubcopilot.com": "github",
+        "api.enterprise.githubcopilot.com": "github",
+        "generativelanguage.googleapis.com": "google",
+        "api.kimi.com": "moonshot",
+        "api.moonshot.cn": "moonshot",
+        "api.moonshot.ai": "moonshot",
+        "api.xiaomimimo.com": "xiaomi",
+        "api.deepseek.com": "deepseek",
+    }
+    provider = known_hosts.get(parsed.hostname or "")
+    if (
+        parsed.scheme != "https"
+        or parsed.username
+        or parsed.password
+        or not provider
+        or parsed.port not in (None, 443)
+    ):
+        raise EvidenceError("aws_evidence_unknown_provider")
+    return {"model_provider": provider, "endpoint": endpoint.rstrip("/")}
+
+
+def validate_reference(reference: Any) -> dict:
+    if not isinstance(reference, dict) or set(reference) != REFERENCE_FIELDS:
+        raise EvidenceError("aws_evidence_invalid_reference")
+    for field in ("workspace_id", "project_id", "user_id", "snapshot_id"):
+        value = reference[field]
+        if not isinstance(value, str):
+            raise EvidenceError("aws_evidence_invalid_reference")
+        try:
+            if str(UUID(value)) != value:
+                raise ValueError("Noncanonical identifier")
+        except ValueError:
+            raise EvidenceError("aws_evidence_invalid_reference") from None
+    for field in ("payload_sha256", "summary_sha256"):
+        if not isinstance(reference[field], str) or not re.fullmatch(
+            r"[0-9a-f]{64}", reference[field]
+        ):
+            raise EvidenceError("aws_evidence_invalid_reference")
+    issuer = reference["issuer"]
+    if (
+        not isinstance(issuer, str)
+        or len(issuer) > 2048
+        or not issuer.startswith(("https://", "http://"))
+    ):
+        raise EvidenceError("aws_evidence_invalid_reference")
+    return dict(reference)
+
+
+def _unique_object(pairs: list) -> dict:
+    result = {}
+    for key, value in pairs:
+        if key in result or key.lower() in SECRET_FIELDS:
+            raise EvidenceError("aws_evidence_invalid_payload")
+        result[key] = value
+    return result
+
+
+def _reject_constant(value: str) -> None:
+    raise EvidenceError("aws_evidence_invalid_payload")
+
+
+def validate_payload(reference: Any, metadata: Any, payload: Any, model_provider: str) -> dict:
+    reference = validate_reference(reference)
+    if not isinstance(payload, str) or len(payload.encode("utf-8")) > PAYLOAD_MAX_BYTES:
+        raise EvidenceError("aws_evidence_size_limit")
+    if hashlib.sha256(payload.encode("utf-8")).hexdigest() != reference["payload_sha256"]:
+        raise EvidenceError("aws_evidence_integrity_failed")
+    if not isinstance(metadata, dict) or metadata.get("status") not in ("ready", "partial"):
+        raise EvidenceError("aws_evidence_unavailable")
+    for field in REFERENCE_FIELDS - {"issuer"}:
+        if metadata.get(field) != reference[field]:
+            raise EvidenceError("aws_evidence_identity_mismatch")
+    policy = metadata.get("data_policy")
+    if (
+        not isinstance(policy, dict)
+        or policy.get("allow_agent_transfer") is not True
+        or not isinstance(policy.get("allowed_model_providers"), list)
+        or not model_provider
+        or model_provider not in policy.get("allowed_model_providers", [])
+        or type(policy.get("policy_version")) is not int
+        or policy["policy_version"] < 1
+    ):
+        raise EvidenceError("aws_evidence_policy_denied")
+    try:
+        expires = datetime.fromisoformat(str(metadata["expires_at"]).replace("Z", "+00:00"))
+        if expires.tzinfo is None or expires <= datetime.now(expires.tzinfo):
+            raise ValueError("Expired")
+        evidence = json.loads(
+            payload, object_pairs_hook=_unique_object, parse_constant=_reject_constant
+        )
+    except (ValueError, TypeError, KeyError, RecursionError):
+        raise EvidenceError("aws_evidence_invalid_payload") from None
+    if (
+        not isinstance(evidence, dict)
+        or evidence.get("schema_version") != 1
+        or evidence.get("provider") != "aws_metrics"
+    ):
+        raise EvidenceError("aws_evidence_invalid_payload")
+    if evidence.get("snapshot_id") != reference["snapshot_id"]:
+        raise EvidenceError("aws_evidence_identity_mismatch")
+    origin = evidence.get("origin")
+    if not isinstance(origin, dict) or any(
+        origin.get(key) != reference[field]
+        for key, field in (
+            ("issuer", "issuer"),
+            ("workspace_id", "workspace_id"),
+            ("project_id", "project_id"),
+            ("created_by_user_id", "user_id"),
+        )
+    ):
+        raise EvidenceError("aws_evidence_identity_mismatch")
+    sources, resources, metrics = (
+        evidence.get("sources"),
+        evidence.get("resources"),
+        evidence.get("metrics"),
+    )
+    if not isinstance(sources, list) or not 1 <= len(sources) <= 8:
+        raise EvidenceError("aws_evidence_invalid_sources")
+    source_ids = set()
+    for source in sources:
+        if (
+            not isinstance(source, dict)
+            or not isinstance(source.get("source_id"), str)
+            or source["source_id"] in source_ids
+            or not re.fullmatch(r"\d{12}", str(source.get("account_id", "")))
+            or source.get("partition") not in ("aws", "aws-cn", "aws-us-gov")
+            or not isinstance(source.get("region"), str)
+            or not isinstance(source.get("aws_profile_id"), str)
+            or type(source.get("credential_version")) is not int
+            or source["credential_version"] < 1
+        ):
+            raise EvidenceError("aws_evidence_invalid_sources")
+        source_ids.add(source["source_id"])
+    if (
+        not isinstance(resources, list)
+        or len(resources) > 20
+        or not isinstance(metrics, list)
+        or len(metrics) > 100
+    ):
+        raise EvidenceError("aws_evidence_size_limit")
+    resource_sources = {}
+    for resource in resources:
+        if (
+            not isinstance(resource, dict)
+            or not isinstance(resource.get("resource_ref"), str)
+            or not isinstance(resource.get("source_id"), str)
+            or resource["resource_ref"] in resource_sources
+            or resource.get("source_id") not in source_ids
+        ):
+            raise EvidenceError("aws_evidence_invalid_resources")
+        resource_sources[resource["resource_ref"]] = resource["source_id"]
+    metric_ids = set()
+    for metric in metrics:
+        if (
+            not isinstance(metric, dict)
+            or not isinstance(metric.get("evidence_ref"), str)
+            or not isinstance(metric.get("source_id"), str)
+            or not isinstance(metric.get("resource_ref"), str)
+            or metric["evidence_ref"] in metric_ids
+            or metric.get("source_id") not in source_ids
+            or resource_sources.get(metric.get("resource_ref")) != metric["source_id"]
+            or not isinstance(metric.get("data_status"), str)
+        ):
+            raise EvidenceError("aws_evidence_invalid_metrics")
+        metric_ids.add(metric["evidence_ref"])
+    selection = evidence.get("selection")
+    if not isinstance(selection, dict) or selection.get("scope_mode") not in ("common", "market"):
+        raise EvidenceError("aws_evidence_invalid_selection")
+    if selection["scope_mode"] == "common" and "country_codes" in selection:
+        raise EvidenceError("aws_evidence_invalid_selection")
+    summary = {
+        **evidence,
+        "metrics": [
+            {key: value for key, value in metric.items() if key != "datapoints"}
+            for metric in metrics
+        ],
+    }
+    try:
+        summary_json = canonical_json(summary)
+    except (ValueError, TypeError):
+        raise EvidenceError("aws_evidence_invalid_payload") from None
+    if len(summary_json.encode("utf-8")) > SUMMARY_MAX_BYTES:
+        raise EvidenceError("aws_evidence_size_limit")
+    if digest(summary) != reference["summary_sha256"]:
+        raise EvidenceError("aws_evidence_integrity_failed")
+    return {
+        "reference": reference,
+        "summary": summary,
+        "summary_json": summary_json,
+        "data_policy": dict(policy),
+        "expires_at": metadata["expires_at"],
+        "model_provider": model_provider,
+    }

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/forgexa_cli/daemon.py

@@ -1231,7 +1231,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.63.1"
+DAEMON_VERSION = "1.64.1"
 
 
 def _detect_client_type() -> str:
@@ -18681,10 +18681,37 @@ class RuntimeDaemon:
             self._shutdown_event.set()
 
 
+def _start_desktop_parent_monitor(daemon, loop):
+    """Stop only an explicitly Desktop-owned daemon when its parent pipe closes."""
+    if sys.platform != "win32" or os.environ.pop("FORGEXA_DESKTOP_PARENT_PIPE", None) != "1":
+        return None
+    stream = sys.stdin
+    if stream is None:
+        raise RuntimeError("Desktop parent pipe is unavailable")
+    import threading
+
+    def monitor():
+        try:
+            while stream.read(1):
+                pass
+        except (OSError, ValueError):
+            pass
+        try:
+            # Capture the running loop here, not in this background thread.
+            loop.call_soon_threadsafe(daemon.handle_signal, signal.SIGTERM)
+        except RuntimeError:
+            pass  # The daemon has already closed its loop.
+
+    thread = threading.Thread(target=monitor, name="desktop-parent-pipe", daemon=True)
+    thread.start()
+    return thread
+
+
 async def main():
     daemon = RuntimeDaemon()
 
     loop = asyncio.get_event_loop()
+    _start_desktop_parent_monitor(daemon, loop)
     if sys.platform != "win32":
         for sig in (signal.SIGINT, signal.SIGTERM):
             loop.add_signal_handler(sig, daemon.handle_signal, sig)

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.63.1
+Version: 1.64.1
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/forgexa_cli.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ forgexa_cli/_build_config.py
 forgexa_cli/_local_bind.py
 forgexa_cli/agent_core.py
 forgexa_cli/autoupgrade.py
+forgexa_cli/aws_evidence.py
 forgexa_cli/daemon.py
 forgexa_cli/main.py
 forgexa_cli/py.typed

{forgexa_cli-1.63.1 → forgexa_cli-1.64.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.63.1"
+version = "1.64.1"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"