forgexa-cli 1.66.3__tar.gz → 1.67.0__tar.gz

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.66.3
+Version: 1.67.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.66.3"
+__version__ = "1.67.0"

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/forgexa_cli/aws_evidence.py

@@ -155,6 +155,12 @@ def model_destination(driver_id: str, environment: dict) -> dict:
 
 
 def validate_reference(reference: Any) -> dict:
+    if isinstance(reference, dict) and reference.get("evidence_type") == "aws_logs":
+        try:
+            from app import aws_logs_evidence
+        except ImportError:
+            import aws_logs_evidence
+        return aws_logs_evidence.validate_reference(reference)
     if not isinstance(reference, dict) or set(reference) != REFERENCE_FIELDS:
         raise EvidenceError("aws_evidence_invalid_reference")
     for field in ("workspace_id", "project_id", "user_id", "snapshot_id"):
@@ -206,6 +212,12 @@ def agent_transfer_allowed(policy: Any, model_provider: str | None = None) -> bo
 
 
 def validate_payload(reference: Any, metadata: Any, payload: Any, model_provider: str | None = None) -> dict:
+    if isinstance(reference, dict) and reference.get("evidence_type") == "aws_logs":
+        try:
+            from app import aws_logs_evidence
+        except ImportError:
+            import aws_logs_evidence
+        return aws_logs_evidence.validate_payload(reference, metadata, payload)
     reference = validate_reference(reference)
     if not isinstance(payload, str) or len(payload.encode("utf-8")) > PAYLOAD_MAX_BYTES:
         raise EvidenceError("aws_evidence_size_limit")

forgexa_cli-1.67.0/forgexa_cli/aws_logs_evidence.py

@@ -0,0 +1,136 @@
+"""Portable contracts for frozen CloudWatch log evidence."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import re
+from datetime import datetime, timezone
+from uuid import UUID
+
+LOGS_PROTOCOL = 1
+PAYLOAD_LIMIT = 10 * 1024 * 1024
+ATTACHMENT_LIMIT = 32 * 1024
+REFERENCE_FIELDS = {"issuer", "workspace_id", "project_id", "user_id", "snapshot_id",
+    "payload_sha256", "summary_sha256", "evidence_type", "attachment_id"}
+
+
+def canonical(value):
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True, allow_nan=False)
+
+
+def digest(value):
+    return hashlib.sha256(canonical(value).encode("utf-8")).hexdigest()
+
+
+def overview(evidence):
+    return {key: value for key, value in evidence.items() if key != "events"}
+
+
+def select_attachment(evidence, event_ids, ranges, attachment_id):
+    available = {event["event_ref"]: event for event in evidence["events"]}
+    if len(event_ids) != len(set(event_ids)) or set(event_ids) - available.keys() or set(ranges) - set(event_ids):
+        raise ValueError("aws_logs_selection_invalid")
+    if not event_ids and evidence["events"]:
+        raise ValueError("aws_logs_selection_required")
+    selected = []
+    for event_id in event_ids:
+        event = dict(available[event_id])
+        if event_id in ranges:
+            start, end = ranges[event_id]
+            if not isinstance(start, int) or not isinstance(end, int) or not 0 <= start < end <= len(event["message"]):
+                raise ValueError("aws_logs_selection_invalid")
+            event["message"] = event["message"][start:end]
+            event["selection_range"] = [start, end]
+            event["selection_truncated"] = True
+        selected.append(event)
+    packet = {**evidence, "attachment_id": attachment_id, "parent_payload_sha256": digest(evidence), "events": selected,
+        "attachment_selection": {"returned_events": len(evidence["events"]), "selected_events": len(selected),
+            "selection_truncated": len(selected) < len(evidence["events"]) or bool(ranges)}}
+    if len(canonical(packet).encode("utf-8")) > ATTACHMENT_LIMIT:
+        raise ValueError("aws_logs_attachment_budget")
+    return packet
+
+
+def validate_reference(reference):
+    if not isinstance(reference, dict) or set(reference) != REFERENCE_FIELDS or reference.get("evidence_type") != "aws_logs":
+        raise ValueError("aws_evidence_invalid_reference")
+    for field in ("workspace_id", "project_id", "user_id", "snapshot_id", "attachment_id"):
+        value = reference.get(field)
+        try:
+            if not isinstance(value, str) or str(UUID(value)) != value:
+                raise ValueError
+        except (ValueError, TypeError):
+            raise ValueError("aws_evidence_invalid_reference") from None
+    for field in ("payload_sha256", "summary_sha256"):
+        if not isinstance(reference[field], str) or not re.fullmatch(r"[a-f0-9]{64}", reference[field]):
+            raise ValueError("aws_evidence_invalid_reference")
+    if not isinstance(reference["issuer"], str) or not reference["issuer"].startswith(("https://", "http://")) or len(reference["issuer"]) > 2048:
+        raise ValueError("aws_evidence_invalid_reference")
+    return dict(reference)
+
+
+def validate_payload(reference, metadata, payload):
+    reference = validate_reference(reference)
+    if not isinstance(payload, str) or len(payload.encode("utf-8")) > ATTACHMENT_LIMIT:
+        raise ValueError("aws_logs_attachment_budget")
+    if hashlib.sha256(payload.encode("utf-8")).hexdigest() != reference["payload_sha256"]:
+        raise ValueError("aws_evidence_integrity_failed")
+    if not isinstance(metadata, dict) or metadata.get("aws_logs_evidence") != LOGS_PROTOCOL or metadata.get("status") not in {"ready", "partial"}:
+        raise ValueError("aws_evidence_protocol_unsupported")
+    if any(metadata.get(field) != reference[field] for field in REFERENCE_FIELDS - {"issuer"}):
+        raise ValueError("aws_evidence_identity_mismatch")
+    policy = metadata.get("data_policy", {})
+    if policy.get("approval_mode") != "user_consent" or policy.get("allow_agent_transfer") is not True or policy.get("allow_logs_agent_transfer") is not True or type(policy.get("policy_version")) is not int or policy["policy_version"] < 1:
+        raise ValueError("aws_evidence_policy_denied")
+    try:
+        expiration = datetime.fromisoformat(metadata["expires_at"].replace("Z", "+00:00"))
+        if expiration.tzinfo is None or expiration <= datetime.now(timezone.utc):
+            raise ValueError
+    except (ValueError, TypeError, KeyError):
+        raise ValueError("aws_evidence_expired") from None
+
+    def object_pairs(pairs):
+        result = {}
+        for key, value in pairs:
+            if key in result:
+                raise ValueError("aws_evidence_invalid_payload")
+            result[key] = value
+        return result
+
+    try:
+        evidence = json.loads(payload, object_pairs_hook=object_pairs)
+    except (ValueError, TypeError, RecursionError):
+        raise ValueError("aws_evidence_invalid_payload") from None
+    if not isinstance(evidence, dict) or evidence.get("schema_version") != 1 or evidence.get("provider") != "aws_logs":
+        raise ValueError("aws_evidence_invalid_payload")
+    if evidence.get("snapshot_id") != reference["snapshot_id"] or evidence.get("attachment_id") != reference["attachment_id"]:
+        raise ValueError("aws_evidence_identity_mismatch")
+    origin = evidence.get("origin", {})
+    for field, key in (("issuer", "issuer"), ("workspace_id", "workspace_id"), ("project_id", "project_id"), ("user_id", "created_by_user_id")):
+        if origin.get(key) != reference[field]:
+            raise ValueError("aws_evidence_identity_mismatch")
+    sources = evidence.get("sources")
+    events = evidence.get("events")
+    if not isinstance(sources, list) or not 1 <= len(sources) <= 4 or not isinstance(events, list) or len(events) > 1000:
+        raise ValueError("aws_evidence_size_limit")
+    identities = set()
+    for source in sources:
+        if not isinstance(source, dict) or source.get("source_ref") in identities or not re.fullmatch(r"AWS-L1-S\d+", str(source.get("source_ref", ""))):
+            raise ValueError("aws_logs_source_mismatch")
+        if not re.fullmatch(r"\d{12}", str(source.get("account_id", ""))) or source.get("partition") not in {"aws", "aws-cn", "aws-us-gov"}:
+            raise ValueError("aws_logs_source_mismatch")
+        identities.add(source["source_ref"])
+    references = set()
+    for event in events:
+        if not isinstance(event, dict) or event.get("source_ref") not in identities or event.get("event_ref") in references or not re.fullmatch(r"AWS-L1-E\d+", str(event.get("event_ref", ""))):
+            raise ValueError("aws_logs_source_mismatch")
+        if not isinstance(event.get("message"), str) or not isinstance(event.get("timestamp"), str) or any(key.startswith("_") for key in event):
+            raise ValueError("aws_evidence_invalid_payload")
+        references.add(event["event_ref"])
+    summary = canonical(evidence)
+    if hashlib.sha256(summary.encode("utf-8")).hexdigest() != reference["summary_sha256"]:
+        raise ValueError("aws_evidence_integrity_failed")
+    return {"reference": reference, "summary": evidence, "summary_json": summary,
+        "data_policy": dict(policy), "expires_at": metadata["expires_at"], "model_provider": None,
+        "data_category": "aws_logs"}

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/forgexa_cli/daemon.py

@@ -1234,7 +1234,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.66.3"
+DAEMON_VERSION = "1.67.0"
 
 
 def _detect_client_type() -> str:
@@ -9113,8 +9113,11 @@ class HeartbeatService:
         self._agents = [dict(agent) for agent in agents]
 
     async def _sync_local_workspace_bindings(self) -> None:
-        if _MANAGED_WSL_POLICY is not None and _MANAGED_WSL_POLICY.task is not None:
-            return  # The task already retains mapping admission and the physical lock.
+        if _MANAGED_WSL_POLICY is not None:
+            if _MANAGED_WSL_POLICY.task is None:
+                await asyncio.wait_for(_MANAGED_WSL_POLICY.refresh_binding(self),
+                                       timeout=_LOCAL_BINDING_VERIFICATION_TIMEOUT_SECONDS)
+            return  # One exact Linux binding; a task already holds its admission/physical locks.
         try:
             response = await asyncio.wait_for(self.client.get(
                 f"{self.server_url}/api/v1/runtimes/{self.runtime_id}/local-workspace-bindings/verification",
@@ -9137,8 +9140,7 @@ class HeartbeatService:
                 (binding for binding in bindings if isinstance(binding, dict) and binding.get("id")),
                 key=lambda binding: binding.get("status") != "pending",
             )
-            limit = 1 if _MANAGED_WSL_POLICY is not None else _LOCAL_BINDING_VERIFICATION_CONCURRENCY
-            semaphore = asyncio.Semaphore(limit)
+            semaphore = asyncio.Semaphore(_LOCAL_BINDING_VERIFICATION_CONCURRENCY)
 
             async def verify_one(binding):
                 async with semaphore:

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.66.3
+Version: 1.67.0
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/forgexa_cli.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ forgexa_cli/_local_bind.py
 forgexa_cli/agent_core.py
 forgexa_cli/autoupgrade.py
 forgexa_cli/aws_evidence.py
+forgexa_cli/aws_logs_evidence.py
 forgexa_cli/daemon.py
 forgexa_cli/main.py
 forgexa_cli/py.typed

{forgexa_cli-1.66.3 → forgexa_cli-1.67.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.66.3"
+version = "1.67.0"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"