forgexa-cli 1.8.3__tar.gz → 1.8.5__tar.gz

{forgexa_cli-1.8.3 → forgexa_cli-1.8.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.8.3
+Version: 1.8.5
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Build Tools
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.9

{forgexa_cli-1.8.3 → forgexa_cli-1.8.5}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.8.3"
+__version__ = "1.8.5"

{forgexa_cli-1.8.3 → forgexa_cli-1.8.5}/forgexa_cli/daemon.py

@@ -15,11 +15,14 @@ import sys
 # ── Python version gate — must run before any other imports ──────────────────
 # Emit a machine-readable DAEMON_ERROR so the desktop app shows a clear
 # message instead of a cryptic traceback.
+# Minimum: 3.9 (macOS ships 3.9; CLI/daemon run on end-user machines).
+# from __future__ import annotations (line 11) makes all X|Y union hints
+# lazy strings on 3.9/3.10, so no runtime SyntaxError on those versions.
 if sys.version_info < (3, 9):
     _ver = f"{sys.version_info.major}.{sys.version_info.minor}"
     print(
-        f"DAEMON_ERROR: Python {_ver} is too old. Forgexa Daemon requires Python 3.9 or "
-        f"newer. Please upgrade Python from https://www.python.org/downloads/",
+        f"DAEMON_ERROR: Python {_ver} is too old. Forgexa Daemon requires Python "
+        f"3.9 or newer. Please upgrade Python from https://www.python.org/downloads/",
         file=sys.stderr,
     )
     sys.exit(1)
@@ -82,24 +85,27 @@ def _try_install_httpx(deps_dir: str) -> tuple[bool, str]:
 
     # Try pip --target first (most universally compatible).
     # Falls back to --user, then --break-system-packages as last resort.
-    # We explicitly list httpcore alongside httpx because pip --target may
-    # skip transitive deps it finds in system site-packages, even though
-    # they won't be importable from the isolated deps directory.
+    # We explicitly list httpcore and certifi alongside httpx because pip
+    # --target may skip transitive deps it finds in system site-packages,
+    # even though they won't be importable from the isolated deps directory.
+    # certifi must be included so that its cacert.pem bundle is copied into
+    # the deps dir; without it httpx raises FileNotFoundError when building
+    # the default SSL context (observed on Python 3.14 standalone / Windows).
     strategies: list[tuple[str, list[str]]] = [
         (
             "pip install --target (isolated deps)",
             [python, "-m", "pip", "install", "--target", deps_dir,
-             "--quiet", "--upgrade", "httpx>=0.24", "httpcore"],
+             "--quiet", "--upgrade", "httpx>=0.24", "httpcore", "certifi"],
         ),
         (
             "pip install --user",
             [python, "-m", "pip", "install", "--user", "--quiet",
-             "httpx>=0.24", "httpcore"],
+             "httpx>=0.24", "httpcore", "certifi"],
         ),
         (
             "pip install --break-system-packages",
             [python, "-m", "pip", "install", "--quiet",
-             "--break-system-packages", "httpx>=0.24", "httpcore"],
+             "--break-system-packages", "httpx>=0.24", "httpcore", "certifi"],
         ),
     ]
 
@@ -190,19 +196,33 @@ def _die_missing_httpx(detail: str) -> None:
 def _validate_httpx_imports() -> tuple[bool, str]:
     """Validate that httpx and its critical transitive deps are importable.
 
-    A bare ``import httpx`` can succeed even when httpcore is missing,
-    because httpx lazily imports its transport layer.  We eagerly check
-    the full chain so the daemon fails fast with a clear message instead
-    of crashing mid-operation when ``httpx.AsyncClient()`` tries to load
-    the transport.
+    A bare ``import httpx`` can succeed even when httpcore or certifi is
+    missing, because httpx lazily imports its transport and SSL layers.
+    We eagerly check the full chain so the daemon fails fast with a clear
+    message instead of crashing mid-operation.
 
-    Returns (ok, missing_module_name).
+    Also verifies that certifi's CA bundle file actually exists on disk.
+    A ``pip install --target`` run may install certifi's Python package but
+    omit the package-data file (cacert.pem) when pip detects certifi in
+    the system site-packages and skips re-copying it.  Without the bundle,
+    httpx raises FileNotFoundError when building the default SSL context
+    (observed on Python 3.14 standalone builds on Windows).
+
+    Returns (ok, missing_module_name).  'certifi:bundle' means certifi is
+    importable but its CA bundle file is absent.
     """
-    for mod_name in ("httpx", "httpcore"):
+    for mod_name in ("httpx", "httpcore", "certifi"):
         try:
             __import__(mod_name)
         except ImportError:
             return False, mod_name
+    # Verify the certifi CA bundle file actually exists on disk
+    try:
+        import certifi as _certifi_check
+        if not os.path.isfile(_certifi_check.where()):
+            return False, "certifi:bundle"
+    except Exception:
+        return False, "certifi"
     return True, ""
 
 
@@ -223,8 +243,8 @@ if not _httpx_ok:
     if _httpx_missing != "httpx":
         shutil.rmtree(_HTTPX_DEPS_DIR, ignore_errors=True)
         for _mod_key in list(sys.modules):
-            if _mod_key in ("httpx", "httpcore") or \
-               _mod_key.startswith(("httpx.", "httpcore.")):
+            if _mod_key in ("httpx", "httpcore", "certifi") or \
+               _mod_key.startswith(("httpx.", "httpcore.", "certifi.")):
                 del sys.modules[_mod_key]
 
     # Attempt auto-install to user-writable deps directory
@@ -245,6 +265,46 @@ import httpx  # noqa: E402  — guaranteed available after validation above
 
 del _httpx_ok, _httpx_missing
 
+
+def _make_httpx_ssl_context():
+    """Build an SSL context resilient to missing or mislocated certifi bundles.
+
+    On Windows 10/11 with Python 3.13+ / 3.14+, ``ssl.create_default_context()``
+    can use the built-in Windows certificate store directly and does NOT need
+    an external CA bundle file.  However, older httpx versions call
+    ``certifi.where()`` and pass the resulting path to
+    ``ssl.create_default_context(cafile=...)``.  When running from an
+    isolated deps directory, the certifi package may be importable (found
+    in system site-packages via sys.path) but its ``cacert.pem`` bundle may
+    not exist at the expected path, causing a ``FileNotFoundError``.
+
+    Strategy (in order):
+      1. Explicit certifi bundle — portable; pinned root CAs.
+      2. System truststore — works on Windows 11 (cert store), macOS
+         (Keychain), and Linux (/etc/ssl).  No external file needed.
+      3. httpx default (verify=True) — last resort; httpx makes its own
+         SSL choice.
+
+    Returns a value suitable for ``httpx.AsyncClient(verify=...)``.
+    """
+    import ssl as _ssl
+    # Strategy 1: explicit certifi bundle (most portable)
+    try:
+        import certifi as _certifi
+        cafile = _certifi.where()
+        if os.path.isfile(cafile):
+            return _ssl.create_default_context(cafile=cafile)
+    except Exception:
+        pass
+    # Strategy 2: system truststore (no external file needed)
+    try:
+        return _ssl.create_default_context()
+    except Exception:
+        pass
+    # Strategy 3: let httpx use its own SSL handling
+    return True
+
+
 # ── Settings: graceful fallback when running standalone (outside backend package) ──
 try:
     from app.config import settings
@@ -332,7 +392,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.8.3"
+DAEMON_VERSION = "1.8.5"
 
 
 def _detect_client_type() -> str:
@@ -651,7 +711,8 @@ class AgentDiscovery:
         },
         "copilot": {
             "commands": ["copilot"],
-            "detect": "copilot --version",
+            "detect": "copilot version",
+            "detect_alt": "copilot --version",
             "invoke_modes": ["cli"],
             "env_path_override": "FACTORY_COPILOT_PATH",
             "compatibility_level": "L3",
@@ -679,12 +740,30 @@ class AgentDiscovery:
             localappdata = Path(os.environ.get("LOCALAPPDATA", home / "AppData" / "Local"))
             extra_dirs += [
                 appdata / "npm",                         # npm -g installs
-                localappdata / "Programs" / "Python" / "Scripts",
                 home / ".opencode" / "bin",
                 home / ".cargo" / "bin",
                 home / ".bun" / "bin",
                 home / "scoop" / "shims",                # scoop package manager
             ]
+            # Python 3.x on Windows installs Scripts to a versioned subdirectory:
+            # %LOCALAPPDATA%\Programs\Python\Python312\Scripts (etc.).
+            # Glob all Python3* dirs so we catch whichever version is installed.
+            py_base = localappdata / "Programs" / "Python"
+            if py_base.is_dir():
+                for py_dir in sorted(py_base.glob("Python3*/"), reverse=True):
+                    scripts = py_dir / "Scripts"
+                    if scripts.is_dir():
+                        extra_dirs.append(scripts)
+            # Flat path kept for compatibility with non-standard Python installers.
+            extra_dirs.append(py_base / "Scripts")
+            # GitHub Copilot CLI — VS Code extension installs the binary into
+            # AppData\Roaming\Code\User\globalStorage\github.copilot-chat\copilotCli\
+            # This dir is NOT in system PATH so the daemon must add it explicitly.
+            for vs_variant in ("Code", "Code - Insiders", "VSCodium"):
+                extra_dirs.append(
+                    appdata / vs_variant / "User" / "globalStorage"
+                    / "github.copilot-chat" / "copilotCli"
+                )
             # nvm-windows stores versions differently
             nvm_home = os.environ.get("NVM_HOME", "")
             if nvm_home:
@@ -756,6 +835,19 @@ class AgentDiscovery:
             resolved = shutil.which(cmd)
             if resolved:
                 version = await self._get_version(spec["detect"])
+                if version is None and "detect_alt" in spec:
+                    # Primary detect command failed; try the alternative.
+                    # Example: new GitHub Copilot CLI 1.0.x uses `copilot version`
+                    # as a subcommand while older releases used `copilot --version`.
+                    version = await self._get_version(spec["detect_alt"])
+                if version is None:
+                    # Binary found but version check failed — it is a stub or
+                    # not properly installed (e.g. copilot prompts to install).
+                    logger.warning(
+                        "Agent %s found at %s but version check failed — skipping",
+                        agent_id, resolved,
+                    )
+                    continue
                 available.append(DiscoveredAgent(
                     agent_id=agent_id,
                     command=resolved,
@@ -766,18 +858,58 @@ class AgentDiscovery:
                 logger.info("Discovered agent: %s v%s (%s)", agent_id, version, resolved)
         return available
 
-    async def _get_version(self, detect_cmd: str) -> str:
+    async def _get_version(self, detect_cmd: str) -> str | None:
+        """Run <detect_cmd> and return the first line of output as a version string.
+
+        Returns ``None`` if the command exits with a non-zero code, times out,
+        or produces output that doesn't look like a version number (e.g. an
+        interactive install prompt).  Callers should treat ``None`` as
+        "binary found but not functional".
+        """
+        import re
         try:
             parts = detect_cmd.split()
+            # On Windows, agent CLIs installed via npm create .cmd wrapper scripts
+            # (e.g. %APPDATA%\npm\copilot.cmd). Python's asyncio.create_subprocess_exec
+            # calls CreateProcess which cannot execute .cmd/.bat files directly —
+            # they need cmd.exe as the interpreter. Detect and wrap automatically.
+            if sys.platform == "win32":
+                resolved = shutil.which(parts[0])
+                if resolved:
+                    ext = Path(resolved).suffix.lower()
+                    if ext in ('.cmd', '.bat'):
+                        parts = ['cmd', '/c', resolved] + parts[1:]
+                    elif ext == '.ps1':
+                        parts = [
+                            'powershell', '-NoProfile', '-NonInteractive',
+                            '-Command', resolved,
+                        ] + parts[1:]
             proc = await asyncio.create_subprocess_exec(
                 *parts,
+                stdin=asyncio.subprocess.DEVNULL,
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
             )
-            stdout, _ = await asyncio.wait_for(proc.communicate(), timeout=10)
-            return stdout.decode().strip().split("\n")[0][:100]
+            stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=10)
+            if proc.returncode != 0:
+                return None
+            output = stdout.decode().strip().split("\n")[0][:100]
+            if not output:
+                # Some tools write their version to stderr (e.g. some Node CLIs)
+                output = stderr.decode().strip().split("\n")[0][:100]
+            # Reject non-version output such as interactive install prompts.
+            # A valid version string contains a digit sequence like 1.2.3 or v1.2.
+            # Use re.search so we match versions embedded in text like:
+            #   'Kimi Code 1.0.0', '@openai/codex 0.1.x', 'GitHub Copilot 1.2.3'
+            if not re.search(r'v?\d+[.\d]', output):
+                logger.warning(
+                    "Version check for %r returned unexpected output: %r — treating as not available",
+                    detect_cmd, output,
+                )
+                return None
+            return output
         except Exception:
-            return "unknown"
+            return None
 
     @staticmethod
     async def _probe_bwrap_support() -> None:
@@ -3415,6 +3547,7 @@ class ServerConnection:
         self.runtime_id: str | None = None
         self.client = httpx.AsyncClient(
             headers={"Authorization": f"Bearer {api_token}"} if api_token else {},
+            verify=_make_httpx_ssl_context(),
         )
         self.heartbeat: HeartbeatService | None = None
         self.poller: TaskPoller | None = None
@@ -4647,9 +4780,12 @@ class RuntimeDaemon:
                 timeout=10,
             )
 
-            # 1. Select agent — normalize legacy aliases to canonical IDs
+            # 1. Select agent — normalize legacy aliases to canonical IDs.
+            # When no agent_override is specified (empty/None), pass an empty
+            # string so _select_agent falls through to its "any available L3
+            # agent" logic instead of hard-failing on the 'claude' default.
             _AGENT_ALIASES = {"claude": "claude", "kimi": "kimi"}
-            agent_type = _AGENT_ALIASES.get(agent_override or "", agent_override or "claude")
+            agent_type = _AGENT_ALIASES.get(agent_override or "", agent_override or "")
             agent = self._select_agent(agent_type, [])
             if not agent:
                 _INSTALL_HINTS = {
@@ -4679,7 +4815,11 @@ class RuntimeDaemon:
             full_prompt = f"{system_prompt}\n\n{user_prompt}" if system_prompt else user_prompt
             fake_task = TaskInfo(
                 task_id=job_id,
-                graph_id="",
+                # Use job_id as graph_id so workspace_key is non-empty.
+                # If graph_id="" then workspace_key="" and ws_path == project_dir
+                # (Python: Path("x") / "" == Path("x")), causing git clone to
+                # fail with "destination path already exists" on the second run.
+                graph_id=job_id,
                 node_type="ai_job",
                 agent_type=agent_type,
                 input_prompt=full_prompt,
@@ -4704,40 +4844,86 @@ class RuntimeDaemon:
                 timeout=10,
             )
 
-            # 3. Run agent with prompt
+            # 3. Run agent with prompt — stream output lines back to server in
+            # real-time so the UI black box shows agent activity instead of
+            # staying empty for the entire (potentially long) run.
             _line_buffer: list[str] = []
+            _chunk_state = {"sent_count": 0, "last_flush": time.monotonic()}
+
+            async def _flush_output_to_server():
+                pending = _line_buffer[_chunk_state["sent_count"]:]
+                if not pending:
+                    return
+                try:
+                    await conn.client.post(
+                        f"{reporter_url}/progress",
+                        json={"output_lines": pending, "agent_id": agent.agent_id},
+                        timeout=5,
+                    )
+                except Exception:
+                    pass  # never let streaming errors affect agent execution
+                _chunk_state["sent_count"] += len(pending)
+                _chunk_state["last_flush"] = time.monotonic()
 
             async def on_chunk(lines: list[str]):
                 _line_buffer.extend(lines)
+                now = time.monotonic()
+                pending_count = len(_line_buffer) - _chunk_state["sent_count"]
+                # Flush every 10 new lines or every 8 seconds, whichever first
+                if pending_count >= 10 or (now - _chunk_state["last_flush"]) >= 8.0:
+                    await _flush_output_to_server()
 
             result = await self.process_manager.run_agent(
                 agent, fake_task, workspace_path, on_chunk=on_chunk,
             )
+            # Flush any remaining buffered lines after agent finishes
+            await _flush_output_to_server()
 
             # 4. Auto-commit if successful
+            input_ctx = aj.get("input_context", {})
             git_info = {}
             if result.status == "success" and result.files_changed:
                 git_info = await self._auto_commit(workspace_path, fake_task)
 
             # 5. Report completion
-            output_content = result.stdout[-20000:] if result.stdout else ""
+            # For deliverables: allow up to 200K chars (full document); others: last 20K
+            max_content = 200000 if task_type == "deliverable_generate" else 20000
+            output_content = (result.stdout or "")[-max_content:] if result.stdout else ""
             scripts: dict = {}
 
-            # Try to extract per-scenario scripts from output
-            scenario_ids = aj.get("input_context", {}).get("scenario_ids", [])
+            scenario_ids = input_ctx.get("scenario_ids", [])
             if scenario_ids and output_content:
-                # Simple heuristic: if output is a single script, map it to first scenario
-                # Daemon-generated scripts may be multiple files in workspace
+                # Primary: extract scripts using structured SCRIPT_START/END markers
+                # inserted by poll_ai_jobs into the multi-scenario prompt.
+                import re as _re
                 for sid in scenario_ids:
-                    # Check if daemon wrote test files to workspace
-                    import glob
-                    test_files = glob.glob(str(workspace_path / "tests" / "**" / f"*{sid[:8]}*"), recursive=True)
-                    if test_files:
-                        try:
-                            with open(test_files[0], "r") as f:
-                                scripts[sid] = f.read()
-                        except Exception:
-                            pass
+                    pattern = (
+                        r"##\s*SCRIPT_START::" + _re.escape(sid)
+                        + r"\s*\n(.*?)\n##\s*SCRIPT_END::" + _re.escape(sid)
+                    )
+                    m = _re.search(pattern, output_content, _re.DOTALL)
+                    if m:
+                        scripts[sid] = m.group(1).strip()
+
+                # Fallback: if no markers found but only one scenario, treat
+                # the entire output as that scenario's script.
+                if not scripts and len(scenario_ids) == 1:
+                    scripts[scenario_ids[0]] = output_content.strip()
+
+                # Fallback: check workspace for test files named after scenario
+                if not scripts:
+                    import glob as _glob
+                    for sid in scenario_ids:
+                        test_files = _glob.glob(
+                            str(workspace_path / "tests" / "**" / f"*{sid[:8]}*"),
+                            recursive=True,
+                        )
+                        if test_files:
+                            try:
+                                with open(test_files[0], "r") as f:
+                                    scripts[sid] = f.read()
+                            except Exception:
+                                pass
 
             complete_payload = {
                 "status": "success" if result.status == "success" else "failed",
@@ -5349,12 +5535,18 @@ class RuntimeDaemon:
         self, workspace_path: Path, default_branch: str, task: TaskInfo,
         project_key: str = "default",
     ):
-        """Rebase the current branch onto ``origin/{default_branch}``.
-
-        Strategy (3-tier):
-          1. ``git rebase origin/{default_branch}`` — cleanest; linear history.
-          2. If rebase conflicts → abort, try ``git merge`` instead.
-          3. If merge conflicts → use the AI agent to auto-resolve.
+        """Integrate the current branch with ``origin/{default_branch}``.
+
+        Strategy:
+          - If the current branch already exists on remote (was previously pushed):
+            Skip rebase entirely and use merge only.  Rebase rewrites commit
+            SHAs of already-published commits, which creates divergence and
+            requires a force-push.  Many servers (e.g. Bitbucket Server with
+            branch protection) forbid force-push, so we must preserve the
+            existing remote history by using merge instead.
+          - If the branch is new (first push): try rebase first for a clean
+            linear history; fall back to merge on conflicts.
+          - 3-tier merge fallback: merge → AI-assisted conflict resolution.
         """
         git = self.workspace_manager._git
         target = f"origin/{default_branch}"
@@ -5363,10 +5555,10 @@ class RuntimeDaemon:
         try:
             await git("fetch", "origin", cwd=workspace_path, timeout=300, project_key=project_key)
         except RuntimeError as exc:
-            logger.warning("Pre-push fetch failed: %s — skipping rebase", exc)
+            logger.warning("Pre-push fetch failed: %s — skipping integration", exc)
             return
 
-        # Check if rebase is needed (any commits on origin/default ahead of us?)
+        # Check if integration is needed (any commits on origin/default ahead of us?)
         try:
             behind = await git(
                 "rev-list", "--count", f"HEAD..{target}", cwd=workspace_path,
@@ -5374,27 +5566,56 @@ class RuntimeDaemon:
             if behind.strip() == "0":
                 logger.info("Branch is already up-to-date with %s", target)
                 return
-            logger.info("Branch is %s commit(s) behind %s — rebasing", behind.strip(), target)
+            logger.info("Branch is %s commit(s) behind %s — integrating", behind.strip(), target)
         except RuntimeError:
-            # Can't determine — proceed with rebase anyway
+            # Can't determine — proceed anyway
             pass
 
-        # ── Tier 1: rebase ──
+        # Determine if the current branch already exists on remote.
+        # If it does, a rebase would rewrite the SHAs of already-pushed commits,
+        # causing divergence that requires a force-push (often blocked by server
+        # branch-protection rules).  Use merge-only in that case.
+        current_branch = ""
+        remote_branch_exists = False
         try:
-            await git(
-                "-c", "user.name=Forgexa Agent",
-                "-c", "user.email=agent@forgexa.net",
-                "rebase", target,
-                cwd=workspace_path, timeout=120,
-            )
-            logger.info("Rebase onto %s succeeded", target)
-            return  # done — clean linear history
+            current_branch = (await git(
+                "rev-parse", "--abbrev-ref", "HEAD", cwd=workspace_path,
+            )).strip()
         except RuntimeError:
-            logger.info("Rebase onto %s had conflicts — aborting rebase", target)
+            pass
+        if current_branch and current_branch != "HEAD":
             try:
-                await git("rebase", "--abort", cwd=workspace_path)
+                await git(
+                    "rev-parse", "--verify", f"origin/{current_branch}",
+                    cwd=workspace_path,
+                )
+                remote_branch_exists = True
+            except RuntimeError:
+                remote_branch_exists = False
+
+        if not remote_branch_exists:
+            # ── Tier 1: rebase (safe — branch not yet on remote) ──
+            try:
+                await git(
+                    "-c", "user.name=Forgexa Agent",
+                    "-c", "user.email=agent@forgexa.net",
+                    "rebase", target,
+                    cwd=workspace_path, timeout=120,
+                )
+                logger.info("Rebase onto %s succeeded", target)
+                return  # done — clean linear history
             except RuntimeError:
-                pass  # already aborted or not in rebase state
+                logger.info("Rebase onto %s had conflicts — aborting rebase", target)
+                try:
+                    await git("rebase", "--abort", cwd=workspace_path)
+                except RuntimeError:
+                    pass  # already aborted or not in rebase state
+        else:
+            logger.info(
+                "Branch %s already exists on remote — skipping rebase to preserve "
+                "published commit SHAs (force-push not required)",
+                current_branch,
+            )
 
         # ── Tier 2: merge ──
         try:
@@ -5628,19 +5849,132 @@ class RuntimeDaemon:
                                 return None
                             except RuntimeError as exc:
                                 logger.error("Force-push (with lease) failed for %s: %s", branch, exc)
+                                exc_str = str(exc).lower()
+                                # Detect permanent server-side force-push prohibition
+                                # (e.g. Bitbucket Server branch-protection pre-receive hook).
+                                # In this case we must NOT retry with force — instead, recover
+                                # by resetting to the remote HEAD and cherry-picking only the
+                                # truly new commits, then doing a regular (non-force) push.
+                                force_push_blocked = (
+                                    "force-pushing" in exc_str
+                                    or "force pushing" in exc_str
+                                    or "pre-receive hook declined" in exc_str
+                                )
+                                if force_push_blocked:
+                                    logger.warning(
+                                        "Remote has force-push disabled for branch %s — "
+                                        "attempting cherry-pick recovery to avoid force-push",
+                                        branch,
+                                    )
+                                    try:
+                                        # Identify commits that are genuinely new (not
+                                        # equivalent to any remote commit).  git-cherry
+                                        # lines prefixed with '+' are truly missing from
+                                        # origin; '-' lines are already incorporated (same
+                                        # patch, different SHA — result of prior rebase).
+                                        cherry_out = (await git(
+                                            "cherry", "HEAD", f"origin/{branch}",
+                                            cwd=workspace_path,
+                                        )).strip()
+                                        new_shas = [
+                                            line.split()[1]
+                                            for line in cherry_out.splitlines()
+                                            if line.startswith("+ ")
+                                        ]
+                                        if not new_shas:
+                                            # Nothing genuinely new — remote is already
+                                            # up-to-date, treat as success.
+                                            logger.info(
+                                                "Recovery: no truly new commits on %s — "
+                                                "remote already has equivalent content",
+                                                branch,
+                                            )
+                                            return None
+                                        # Reset local branch to match remote exactly,
+                                        # then replay only the new commits on top.
+                                        await git(
+                                            "reset", "--hard", f"origin/{branch}",
+                                            cwd=workspace_path,
+                                        )
+                                        await git(
+                                            "-c", "user.name=Forgexa Agent",
+                                            "-c", "user.email=agent@forgexa.net",
+                                            "cherry-pick", *new_shas,
+                                            cwd=workspace_path,
+                                        )
+                                        # Now a regular push should succeed.
+                                        await git(
+                                            "push", "-u", "origin", branch,
+                                            cwd=workspace_path, project_key=project_key,
+                                        )
+                                        logger.info(
+                                            "Recovery push succeeded for branch %s "
+                                            "(%d new commit(s) cherry-picked)",
+                                            branch, len(new_shas),
+                                        )
+                                        return None
+                                    except RuntimeError as recovery_exc:
+                                        logger.error(
+                                            "Cherry-pick recovery also failed for %s: %s",
+                                            branch, recovery_exc,
+                                        )
+                                        return (
+                                            f"Push failed: remote has force-push disabled "
+                                            f"and cherry-pick recovery failed: {recovery_exc}"
+                                        )
                                 return f"Push failed: {exc}"
                         else:
-                            logger.error(
-                                "SAFETY: Refusing to push %s — remote has %d commit(s) "
-                                "not in local branch. This would destroy prior work. "
-                                "Remote-only commits:\n%s",
-                                branch, remote_count, remote_ahead,
-                            )
-                            return (
-                                f"Push refused: remote branch '{branch}' has {remote_count} "
-                                f"commit(s) not in local history. Force-pushing would "
-                                f"destroy prior implementation work."
+                            # Remote has genuinely new commits not in local history.
+                            # Before refusing, attempt fetch + rebase: if the local
+                            # commits are documentation-only (analysis) or purely
+                            # additive they will rebase cleanly onto the remote HEAD.
+                            logger.warning(
+                                "Branch %s: remote has %d commit(s) not in local history — "
+                                "attempting fetch+rebase recovery before refusing push",
+                                branch, remote_count,
                             )
+                            try:
+                                # 1. Fetch the specific remote branch
+                                await git(
+                                    "fetch", "origin", branch,
+                                    cwd=workspace_path,
+                                )
+                                # 2. Rebase local commits onto the updated remote HEAD
+                                await git(
+                                    "-c", "user.name=Forgexa Agent",
+                                    "-c", "user.email=agent@forgexa.net",
+                                    "rebase", f"origin/{branch}",
+                                    cwd=workspace_path,
+                                )
+                                # 3. Push normally (no force needed — we're ahead of origin now)
+                                await git(
+                                    "push", "-u", "origin", branch,
+                                    cwd=workspace_path, project_key=project_key,
+                                )
+                                logger.info(
+                                    "Fetch+rebase recovery succeeded for branch %s "
+                                    "(%d remote commit(s) incorporated)",
+                                    branch, remote_count,
+                                )
+                                return None
+                            except RuntimeError as rebase_exc:
+                                rebase_exc_str = str(rebase_exc)
+                                # Abort any in-progress rebase to leave workspace clean
+                                try:
+                                    await git("rebase", "--abort", cwd=workspace_path)
+                                except RuntimeError:
+                                    pass
+                                logger.error(
+                                    "Fetch+rebase recovery failed for branch %s: %s — "
+                                    "refusing push to protect remote work",
+                                    branch, rebase_exc_str,
+                                )
+                                return (
+                                    f"Push refused: remote branch '{branch}' has {remote_count} "
+                                    f"commit(s) not in local history, and automatic rebase failed "
+                                    f"(likely a merge conflict). Manual resolution required. "
+                                    f"Details: {rebase_exc_str[:300]}"
+                                )
 
                     logger.info("Found unpushed commits on %s, pushing...", branch)
                     last_push_exc: Exception | None = None

{forgexa_cli-1.8.3 → forgexa_cli-1.8.5}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.8.3
+Version: 1.8.5
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License: MIT
@@ -20,6 +20,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development :: Build Tools
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.9

{forgexa_cli-1.8.3 → forgexa_cli-1.8.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.8.3"
+version = "1.8.5"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = { text = "MIT" }
@@ -21,6 +21,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Software Development :: Build Tools",
     "Topic :: Software Development :: Quality Assurance",
 ]