forgexa-cli 1.68.0__tar.gz → 1.68.2__tar.gz

{forgexa_cli-1.68.0 → forgexa_cli-1.68.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.68.0
+Version: 1.68.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.68.0 → forgexa_cli-1.68.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.68.0"
+__version__ = "1.68.2"

{forgexa_cli-1.68.0 → forgexa_cli-1.68.2}/forgexa_cli/daemon.py

@@ -1234,7 +1234,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.68.0"
+DAEMON_VERSION = "1.68.2"
 
 
 def _detect_client_type() -> str:
@@ -1624,6 +1624,7 @@ class TaskInfo:
     runtime_evidence_plan: dict | None = None
     local_evidence_upload: bool = False
     critic_review_required: bool = False
+    local_untracked_paths: set[str] = field(default_factory=set, repr=False)
 
 
 @dataclass
@@ -2612,6 +2613,8 @@ def _read_local_bind_shared_output_snapshot(task_id: str) -> dict | None:
             start = max(total_bytes - _LOCAL_BIND_SHARED_OUTPUT_MAX_BYTES, 0)
             output_file.seek(start)
             raw = output_file.read()
+    except FileNotFoundError:
+        return None
     except OSError as exc:
         logger.warning("Failed to read local-bind output log for task %s: %s", task_id, exc)
         return None
@@ -3650,8 +3653,11 @@ class WorkspaceManager:
         """Resolve the workspace path for a workspace_resolution="local_bind" task.
 
         Validates the daemon-private mapping entry (binding_id -> local_path),
-        the directory's git remote identity, and its branch/cleanliness
-        state. Ordinary local-bind tasks perform NO destructive git operation
+        the directory's git remote identity, branch, and tracked changes.
+        Pre-existing untracked and ignored files remain user-owned and local.
+        Uncommitted task-owned requirement artifacts are backed up locally
+        before restoring their committed baseline. User code is never reset.
+        Ordinary local-bind tasks perform NO destructive git operation
         (no reset --hard, clean, branch deletion, or implicit branch switch)
         on the user's real directory. The only exception is an explicitly
         authorized fresh-analysis reset, which has its own server marker,
@@ -3739,16 +3745,30 @@ class WorkspaceManager:
                 "will never switch branches in your real working directory automatically."
             )
 
-        status_output = await self._git("status", "--porcelain", cwd=local_path)
-        if status_output.strip():
-            dirty_paths = [line[3:] for line in status_output.splitlines() if line.strip()]
-            shown = ", ".join(dirty_paths[:20])
-            more = f" (+{len(dirty_paths) - 20} more)" if len(dirty_paths) > 20 else ""
+        status_output = await self._git(
+            "status", "--porcelain=v1", "--untracked-files=no", "-z", cwd=local_path,
+        )
+        dirty_paths = _git_status_paths(status_output)
+        recoverable_paths = self._local_requirement_artifact_paths(task, local_path)
+        user_dirty_paths = [
+            path for path in dirty_paths
+            if path not in recoverable_paths or not path.startswith("docs/requirements/")
+        ]
+        if user_dirty_paths:
+            shown = ", ".join(user_dirty_paths[:20])
+            more = f" (+{len(user_dirty_paths) - 20} more)" if len(user_dirty_paths) > 20 else ""
             raise RuntimeError(
-                "local_binding_unavailable: local directory has uncommitted changes, refusing "
-                f"to run: {shown}{more}"
+                "local_binding_unavailable: local directory has uncommitted tracked changes, "
+                f"refusing to overwrite user work: {shown}{more}. Commit or stash these "
+                "changes, then retry; unrelated untracked files do not need to be deleted."
             )
 
+        task.local_untracked_paths = {
+            path for path in (await self._git(
+                "ls-files", "--others", "-z", cwd=local_path,
+            )).split("\0") if path
+        }
+
         try:
             remote_branch = await self._git(
                 "ls-remote", "--heads", "origin", f"refs/heads/{target_branch}",
@@ -3783,9 +3803,14 @@ class WorkspaceManager:
             remote_head = (
                 await self._git("rev-parse", f"origin/{target_branch}", cwd=local_path)
             ).strip()
+            await self._recover_local_requirement_artifacts(local_path, task, recoverable_paths)
             if local_head != remote_head:
+                await self._check_local_untracked_overwrites(local_path, remote_head)
                 try:
-                    await self._git("merge", "--ff-only", f"origin/{target_branch}", cwd=local_path)
+                    await self._git(
+                        "merge", "--ff-only", "--no-overwrite-ignore",
+                        f"origin/{target_branch}", cwd=local_path,
+                    )
                 except RuntimeError as exc:
                     raise RuntimeError(
                         f"local_binding_unavailable: local branch '{target_branch}' cannot "
@@ -3824,6 +3849,7 @@ class WorkspaceManager:
                     f"local branch is not at origin/{default_branch}; refusing to bootstrap from "
                     "unpushed or stale history"
                 )
+            await self._recover_local_requirement_artifacts(local_path, task, recoverable_paths)
 
         if (
             task.node_type == "analysis"
@@ -3864,8 +3890,153 @@ class WorkspaceManager:
                     f"HEAD after fetch — cross-phase handoff incomplete: {', '.join(missing_shas)}"
                 )
 
+        task.local_untracked_paths = {
+            path for path in (await self._git(
+                "ls-files", "--others", "-z", cwd=local_path,
+            )).split("\0") if path
+        }
         return local_path
 
+    @staticmethod
+    def _local_requirement_artifact_paths(task: TaskInfo, local_path: Path | None = None) -> set[str]:
+        key = str(task.requirement_key or "")
+        if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._-]*", key):
+            return set()
+        prefix = f"docs/requirements/{key}/"
+        data = task.input_data or {}
+        context = data.get("context") or {}
+        names = {
+            name for outputs in _ANALYSIS_OUTPUTS_BY_TYPE.values() for name in outputs
+        } | {
+            "design.md", "test-cases.json", "coverage-matrix.json",
+            "test-evidence.json", "test-report.md", "release-note.md",
+        }
+        names.update(
+            _get_design_output_for_type(requirement_type)
+            for requirement_type in _ANALYSIS_OUTPUTS_BY_TYPE
+        )
+        paths: set[str] = set()
+        for values in (data, context):
+            for field_name in ("analysis_output_dir", "output_dir"):
+                directory = str(values.get(field_name) or "").replace("\\", "/").rstrip("/")
+                if (
+                    directory.startswith(prefix)
+                    and not any(part in ("", ".", "..") for part in directory.split("/"))
+                ):
+                    paths.update(f"{directory}/{name}" for name in names)
+        if local_path is not None:
+            for manifest_path in sorted(paths):
+                if not manifest_path.endswith("/test-cases.json"):
+                    continue
+                manifest_file = local_path / manifest_path
+                if not manifest_file.resolve().is_relative_to(local_path.resolve()):
+                    continue
+                try:
+                    manifest = json.loads(manifest_file.read_text(encoding="utf-8"))
+                except (OSError, ValueError, UnicodeError):
+                    continue
+                cases = manifest.get("test_cases") if isinstance(manifest, dict) else None
+                if not isinstance(cases, list):
+                    continue
+                for case in cases:
+                    if not isinstance(case, dict):
+                        continue
+                    case_id = str(case.get("id") or "")
+                    script_path = str(case.get("script_path") or "").replace("\\", "/")
+                    parts = script_path.split("/")
+                    if (
+                        re.fullmatch(r"TC-\d+", case_id)
+                        and len(parts) == 3
+                        and parts[0] == "tests"
+                        and parts[1] in ("e2e", "unit", "integration")
+                        and parts[2].startswith((case_id + "-", case_id + "."))
+                        and parts[2].endswith((".spec.ts", ".spec.js", ".test.ts", ".test.js", ".py"))
+                    ):
+                        paths.add(script_path)
+        return paths
+
+    async def _recover_local_requirement_artifacts(
+        self, local_path: Path, task: TaskInfo, recoverable_paths: set[str],
+    ) -> None:
+        if not recoverable_paths:
+            return
+        git = self._git
+        status_output = await git(
+            "status", "--porcelain=v1", "--untracked-files=all", "-z", cwd=local_path,
+        )
+        paths = sorted({
+            path for status, path in _git_status_entries(status_output)
+            if path in recoverable_paths
+            and (status == "??" or path.startswith("docs/requirements/"))
+        })
+        if not paths:
+            return
+        workspace_root = local_path.resolve()
+        if any(not (local_path / path).resolve().is_relative_to(workspace_root) for path in paths):
+            raise RuntimeError(
+                "local_binding_unavailable: requirement artifact resolves outside the local "
+                "workspace; refusing to recover files through an external symbolic link"
+            )
+        recovery_ref = f"refs/forgexa/local-artifact-recovery/{task.task_id}/{time.time_ns()}"
+        await git("check-ref-format", recovery_ref, cwd=local_path)
+        name, email = _resolve_git_author(task.project)
+        try:
+            await git(
+                "-c", f"user.name={name}", "-c", f"user.email={email}",
+                "stash", "push", "--include-untracked", "--message",
+                f"Forgexa requirement artifact recovery for {task.task_id}", "--",
+                *(f":(literal){path}" for path in paths), cwd=local_path,
+            )
+            recovery_sha = (await git("rev-parse", "refs/stash", cwd=local_path)).strip()
+            await git("update-ref", recovery_ref, recovery_sha, cwd=local_path)
+        except RuntimeError as exc:
+            raise RuntimeError(
+                "local_binding_unavailable: could not preserve uncommitted requirement "
+                "artifacts; any created backup remains in the local Git stash. "
+                "No user code was discarded."
+            ) from exc
+        _append_local_bind_output_log(task.task_id, [
+            f"[daemon] Preserved {len(paths)} unfinished requirement artifact(s) in "
+            f"{recovery_ref}; restored their committed baseline for this task. "
+            f"Recover with git stash apply --index {recovery_ref}.",
+        ])
+        logger.info("Preserved local requirement artifacts for task %s in %s", task.task_id, recovery_ref)
+        remaining_status = await git(
+            "status", "--porcelain=v1", "--untracked-files=no", "-z", cwd=local_path,
+        )
+        if _git_status_paths(remaining_status):
+            raise RuntimeError(
+                "local_binding_unavailable: tracked changes remain after requirement artifact "
+                f"recovery; no task was started. Preserved artifacts are in {recovery_ref}."
+            )
+
+    async def _check_local_untracked_overwrites(self, local_path: Path, revision: str) -> None:
+        untracked_paths = {
+            path for path in (await self._git(
+                "ls-files", "--others", "-z", cwd=local_path,
+            )).split("\0") if path
+        }
+        if not untracked_paths:
+            return
+        target_paths = {
+            path for path in (await self._git(
+                "ls-tree", "-r", "--name-only", "-z", revision, cwd=local_path,
+            )).split("\0") if path
+        }
+        conflicts = {
+            path for path in target_paths if _is_preserved_local_path(path, untracked_paths)
+        }
+        conflicts.update(
+            path.rstrip("/") for path in untracked_paths
+            if _is_preserved_local_path(path.rstrip("/"), target_paths)
+        )
+        if conflicts:
+            raise RuntimeError(
+                "local_binding_unavailable: branch update would overwrite untracked or "
+                "ignored local files; no branch was updated. Preserve the conflicting "
+                f"files, then retry: {', '.join(sorted(conflicts)[:20])}"
+            )
+
     async def _reset_authorized_local_fresh_branch(
         self,
         local_path: Path,
@@ -3903,6 +4074,18 @@ class WorkspaceManager:
             )
             return
 
+        await self._check_local_untracked_overwrites(local_path, default_sha)
+        try:
+            await git(
+                "read-tree", "--dry-run", "-m", "-u", "HEAD", default_sha,
+                cwd=local_path,
+            )
+        except RuntimeError as exc:
+            raise RuntimeError(
+                "local_binding_unavailable: local fresh branch reset would overwrite local "
+                f"files; no branch was reset. Preserve the conflicting files, then retry: {exc}"
+            ) from exc
+
         backup_tag = f"forgexa/fresh-analysis-backup/{task_id}"
         await git("check-ref-format", f"refs/tags/{backup_tag}", cwd=local_path)
         remote_tag = await git(
@@ -3948,7 +4131,8 @@ class WorkspaceManager:
             ) from exc
 
         try:
-            await git("reset", "--hard", default_sha, cwd=local_path)
+            await self._check_local_untracked_overwrites(local_path, default_sha)
+            await git("reset", "--keep", default_sha, cwd=local_path)
         except RuntimeError as exc:
             try:
                 await git(
@@ -6563,6 +6747,18 @@ class ProcessManager:
                     "Fix ALL listed issues. Focus on the specific problems above."
                 )
 
+        if task.workspace_resolution == "local_bind":
+            prompt += (
+                "\n\n## Local Workspace Safety\n"
+                "This is the user's real working directory. Pre-existing untracked and "
+                "ignored files are user-owned, not task output. Preserve them: do not delete, "
+                "overwrite, stage, or commit them. Modify only tracked task files or create "
+                "new task files. If the task requires changing a pre-existing untracked "
+                "file, report the conflict instead of overwriting it. Never run git clean, "
+                "git reset --hard, force-push, or blanket staging such as git add -A. "
+                "Leave committing and pushing task changes to Forgexa."
+            )
+
         if workspace_path is not None:
             return agent_core.with_workspace_environment_guidance(
                 prompt, workspace_path,
@@ -10412,9 +10608,9 @@ def _testing_intents_have_e2e(workspace_path: Path, input_data: dict[str, Any])
 _QA_TEST_LEVELS = frozenset({"unit", "integration", "e2e"})
 
 
-def _git_status_paths(status_output: str) -> list[str]:
-    """Extract changed paths from porcelain-v1 `-z` output."""
-    paths: list[str] = []
+def _git_status_entries(status_output: str) -> list[tuple[str, str]]:
+    """Extract status/path pairs from porcelain-v1 `-z` output."""
+    entries: list[tuple[str, str]] = []
     records = status_output.split("\0")
     index = 0
     while index < len(records):
@@ -10422,12 +10618,35 @@ def _git_status_paths(status_output: str) -> list[str]:
         index += 1
         if len(record) < 4 or record[2] != " ":
             continue
-        paths.append(record[3:])
+        entries.append((record[:2], record[3:]))
         if "R" in record[:2] or "C" in record[:2]:
             if index < len(records) and records[index]:
-                paths.append(records[index])
+                entries.append((record[:2], records[index]))
             index += 1
-    return paths
+    return entries
+
+
+def _git_status_paths(status_output: str) -> list[str]:
+    """Extract changed paths from porcelain-v1 `-z` output."""
+    return [path for _status, path in _git_status_entries(status_output)]
+
+
+def _is_preserved_local_path(path: str, preserved_paths: set[str]) -> bool:
+    if path in preserved_paths or path + "/" in preserved_paths:
+        return True
+    prefix = ""
+    for component in path.split("/")[:-1]:
+        prefix += component + "/"
+        if prefix in preserved_paths or prefix[:-1] in preserved_paths:
+            return True
+    return False
+
+
+def _local_bind_changed_paths(status_output: str, preserved_paths: set[str]) -> list[str]:
+    return [
+        path for status, path in _git_status_entries(status_output)
+        if status != "??" or not _is_preserved_local_path(path, preserved_paths)
+    ]
 
 
 def _qa_test_level_from_source_path(path: object) -> str | None:
@@ -12258,6 +12477,8 @@ class RuntimeDaemon:
         is_local_bind = task.workspace_resolution == "local_bind"
         async def report_task_complete(result: TaskResult) -> None:
             if is_local_bind:
+                if result.error:
+                    _append_local_bind_output_log(task.task_id, [f"[daemon] {result.error}"])
                 _prepare_local_bind_completion(task, result)
             if self.managed_policy is not None and not await self.managed_policy.finish_task():
                 result.status = "failed"
@@ -13217,6 +13438,9 @@ class RuntimeDaemon:
             logger.info("Task %s completed: %s (agent=%s)", task.task_id, result.status, agent.agent_id)
 
         except Exception as e:
+            failure_code = str(getattr(e, "code", "") or "")
+            if is_local_bind and str(e).startswith("local_binding_unavailable:"):
+                failure_code = "local_binding_unavailable"
             if self.managed_policy is not None:
                 _append_local_bind_output_log(task.task_id, [str(e)])
                 logger.warning("Managed local task failed: %s", getattr(e, "code", "local_task_failed"))
@@ -13225,6 +13449,7 @@ class RuntimeDaemon:
             await report_task_complete(TaskResult(
                 status="failed", exit_code=-1, stdout="", stderr="",
                 error=str(e),
+                failure_code=failure_code,
                 execution_attempt_id=task.execution_attempt_id,
             ))
         finally:
@@ -15416,12 +15641,18 @@ class RuntimeDaemon:
         require_source_inventory = _qa_source_test_validation_required(
             (task.input_data or {}).get("qa_test_level_policy_snapshot")
         )
+        preserved_paths = (
+            getattr(task, "local_untracked_paths", None)
+            if getattr(task, "workspace_resolution", None) == "local_bind"
+            else None
+        )
         for attempt in range(max_retries):
             inventory_issues = await self._refresh_validation_changed_paths(
                 workspace_path,
                 result,
                 default_branch=default_branch,
                 before_sha=before_sha,
+                preserved_paths=preserved_paths,
             )
             issues = self._validate_outputs(workspace_path, task, result)
             if require_source_inventory:
@@ -15545,6 +15776,7 @@ class RuntimeDaemon:
             result,
             default_branch=default_branch,
             before_sha=before_sha,
+            preserved_paths=preserved_paths,
         )
         remaining = self._validate_outputs(workspace_path, task, result)
         if require_source_inventory:
@@ -15639,6 +15871,7 @@ class RuntimeDaemon:
         *,
         default_branch: str,
         before_sha: str,
+        preserved_paths: set[str] | None = None,
     ) -> list[str]:
         """Merge reported, working-tree, and already-committed task paths."""
         reported_paths = ProcessManager._normalize_repo_paths(result.files_changed)
@@ -15654,7 +15887,7 @@ class RuntimeDaemon:
                 cwd=workspace_path,
             )
             paths.update(ProcessManager._normalize_repo_paths(
-                _git_status_paths(status_output)
+                _local_bind_changed_paths(status_output, preserved_paths or set())
             ))
             collected_paths = True
         except Exception:
@@ -16007,6 +16240,8 @@ class RuntimeDaemon:
     async def _discard_transient_untracked_runtime_files(
         self,
         workspace_path: Path,
+        *,
+        preserved_paths: set[str] | None = None,
     ) -> list[str]:
         """Discard known untracked test-run metadata before automatic staging."""
         git = self.workspace_manager._git
@@ -16026,6 +16261,8 @@ class RuntimeDaemon:
             if not line.startswith("?? "):
                 continue
             relative_path = line[3:].replace("\\", "/").lstrip("./")
+            if _is_preserved_local_path(relative_path, preserved_paths or set()):
+                continue
             if relative_path not in _TRANSIENT_UNTRACKED_RUNTIME_PATHS:
                 continue
             candidate = workspace_path / relative_path
@@ -16126,12 +16363,12 @@ class RuntimeDaemon:
           before staging and again before pushing: if the user switched
           branches while the agent ran, the task fails closed instead of
           committing/pushing the changes onto the wrong branch
-        - refuses to commit if any changed path (staged, or already
-          committed by the agent itself since before_sha) looks like a
-          secret (.env, private keys, etc.) — fails the task closed rather
-          than silently excluding just those files, since a partial commit
-          would leave the directory dirty and block future local_bind tasks
-          on this binding (which requires a clean working tree)
+                - preserves the startup inventory of user-owned untracked/ignored
+                    files and excludes it from staging and convergence checks; if the
+                    agent stages or commits those files, refuses to push
+                - refuses to commit/push task paths that look like secrets (.env,
+                    private keys, etc.), including paths committed by the agent itself
+                    since before_sha; untouched pre-existing private files stay local
         - never rebases, merges, resets, or force-pushes; a non-fast-forward
           push failure just fails the task closed, no automatic recovery
         Returns a dict with commit/push status info (empty dict on success),
@@ -16173,9 +16410,26 @@ class RuntimeDaemon:
                         "from HEAD. Review the branch history yourself before retrying."
                     )}
 
-            await self._discard_transient_untracked_runtime_files(workspace_path)
-            status_output = await git("status", "--porcelain", cwd=workspace_path)
-            dirty_paths = [line[3:] for line in status_output.splitlines() if line.strip()]
+            if task.local_untracked_paths and not before_sha:
+                return {"commit_error": "Refusing to commit: the local task baseline is unavailable"}
+
+            await self._discard_transient_untracked_runtime_files(
+                workspace_path, preserved_paths=task.local_untracked_paths,
+            )
+            status_output = await git(
+                "status", "--porcelain=v1", "--untracked-files=all", "-z", cwd=workspace_path,
+            )
+            dirty_paths = _local_bind_changed_paths(status_output, task.local_untracked_paths)
+            preserved_dirty = [
+                path for path in dirty_paths
+                if _is_preserved_local_path(path, task.local_untracked_paths)
+            ]
+            if preserved_dirty:
+                return {"commit_error": (
+                    "Refusing to commit: pre-existing user-owned local files were staged ("
+                    + ", ".join(preserved_dirty[:20])
+                    + "). Not pushed; unstage these files and review the task changes."
+                )}
 
             sensitive_dirty = [p for p in dirty_paths if _is_sensitive_local_path(p)]
             if sensitive_dirty:
@@ -16186,7 +16440,19 @@ class RuntimeDaemon:
                 )}
 
             if dirty_paths:
-                await git("add", "-A", cwd=workspace_path)
+                await git("add", "-u", cwd=workspace_path)
+                new_paths = [
+                    path for status, path in _git_status_entries(status_output)
+                    if status == "??" and not _is_preserved_local_path(
+                        path, task.local_untracked_paths,
+                    )
+                ]
+                for offset in range(0, len(new_paths), 100):
+                    await git(
+                        "add", "--",
+                        *(f":(literal){path}" for path in new_paths[offset:offset + 100]),
+                        cwd=workspace_path,
+                    )
 
                 mode_change_error = await self._pure_file_mode_change_error(
                     workspace_path, "--cached"
@@ -16254,15 +16520,27 @@ class RuntimeDaemon:
             # every path touched since before_sha for sensitive content too,
             # not just what we just staged ourselves.
             if before_sha:
-                try:
+                committed_paths: set[str] = set()
+                commits = await git("rev-list", f"{before_sha}..HEAD", cwd=workspace_path)
+                for commit_sha in commits.splitlines():
                     changed_since_before = await git(
-                        "diff", "--name-only", f"{before_sha}..HEAD", cwd=workspace_path,
+                        "diff-tree", "--no-commit-id", "--name-only", "--no-renames",
+                        "-r", "-m", "-z", commit_sha, cwd=workspace_path,
                     )
-                except RuntimeError:
-                    changed_since_before = ""
+                    committed_paths.update(path for path in changed_since_before.split("\0") if path)
+                preserved_committed = sorted(
+                    path for path in committed_paths
+                    if _is_preserved_local_path(path, task.local_untracked_paths)
+                )
+                if preserved_committed:
+                    return {"commit_error": (
+                        "Refusing to push: commit(s) made during this task include pre-existing "
+                        "user-owned local files ("
+                        + ", ".join(preserved_committed[:20])
+                        + "). Not pushed; inspect and fix the commit(s) yourself."
+                    )}
                 agent_sensitive = [
-                    p for p in changed_since_before.splitlines()
-                    if p.strip() and _is_sensitive_local_path(p)
+                    path for path in sorted(committed_paths) if _is_sensitive_local_path(path)
                 ]
                 if agent_sensitive:
                     return {"commit_error": (
@@ -16272,8 +16550,10 @@ class RuntimeDaemon:
                         + "). Not pushed — inspect and fix the commit(s) yourself."
                     )}
 
-            post_commit_status = await git("status", "--porcelain", cwd=workspace_path)
-            if post_commit_status.strip():
+            post_commit_status = await git(
+                "status", "--porcelain=v1", "--untracked-files=all", "-z", cwd=workspace_path,
+            )
+            if _local_bind_changed_paths(post_commit_status, task.local_untracked_paths):
                 if _post_commit_sync_attempts_remaining > 0:
                     logger.warning(
                         "local_bind: workspace changed after commit in %s; "
@@ -16328,8 +16608,10 @@ class RuntimeDaemon:
                     "yourself (e.g. pull/merge), then retry."
                 )}
 
-            post_push_status = await git("status", "--porcelain", cwd=workspace_path)
-            if not post_push_status.strip():
+            post_push_status = await git(
+                "status", "--porcelain=v1", "--untracked-files=all", "-z", cwd=workspace_path,
+            )
+            if not _local_bind_changed_paths(post_push_status, task.local_untracked_paths):
                 return {}
 
             if _post_commit_sync_attempts_remaining > 0:

{forgexa_cli-1.68.0 → forgexa_cli-1.68.2}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.68.0
+Version: 1.68.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.68.0 → forgexa_cli-1.68.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.68.0"
+version = "1.68.2"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"