forgexa-cli 1.86.0__tar.gz → 1.86.2__tar.gz

{forgexa_cli-1.86.0 → forgexa_cli-1.86.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.86.0
+Version: 1.86.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.86.0 → forgexa_cli-1.86.2}/forgexa_cli/__init__.py

@@ -1,2 +1,2 @@
 """forgexa-cli — Forgexa command-line client."""
-__version__ = "1.86.0"
+__version__ = "1.86.2"

{forgexa_cli-1.86.0 → forgexa_cli-1.86.2}/forgexa_cli/agent_core.py

@@ -747,6 +747,83 @@ def task_failure_domain(
     return "execution"
 
 
+def lock_provenance_projection(path: str, source: str) -> str | None:
+    if path != "composer.lock" or len(source.encode()) > 10_000_000:
+        return None
+    try:
+        lock = json.loads(source)
+    except (ValueError, TypeError):
+        return None
+    if not isinstance(lock, dict) or not isinstance(lock.get("packages"), list):
+        return None
+    if not isinstance(lock.get("packages-dev", []), list):
+        return None
+    packages = []
+    for package in [*lock["packages"], *(lock.get("packages-dev") or [])]:
+        if not isinstance(package, dict) or not isinstance(package.get("name"), str) or not isinstance(package.get("version"), str):
+            return None
+        item = {"name": package["name"][:200], "version": package["version"][:100]}
+        for field in ("source", "dist"):
+            reference = (package.get(field) or {}).get("reference") if isinstance(package.get(field), dict) else None
+            if isinstance(reference, str) and re.fullmatch(r"[0-9a-fA-F]{7,64}", reference):
+                item[field + "_reference"] = reference
+        packages.append(item)
+    return json.dumps({"representation": "dependency_provenance_projection", "source_path": path,
+        "source_sha256": hashlib.sha256(source.encode()).hexdigest(), "source_bytes": len(source.encode()),
+        "limitation": "Parsed dependency identities only; not full lock source or implementation semantics", "packages": packages,
+    }, ensure_ascii=True, sort_keys=True, separators=(",", ":"))
+
+
+def task_review_policy(node_type: str, task_input: dict, *, changed_files: list[str] | None = None, policy_supported: bool = True) -> dict:
+    baseline = task_input.get("approved_plan_baseline")
+    reasons = []
+    if policy_supported is not True:
+        reasons.append("runtime_policy_upgrade_required")
+    fingerprint = None
+    if isinstance(baseline, dict):
+        expected = {key: value for key, value in baseline.items() if key != "fingerprint"}
+        fingerprint = hashlib.sha256(json.dumps(expected, sort_keys=True, ensure_ascii=True, separators=(",", ":")).encode()).hexdigest()
+        if type(baseline.get("version")) is not int or baseline["version"] != 1 or baseline.get("fingerprint") != fingerprint:
+            reasons.append("baseline_invalid")
+    else:
+        reasons.append("baseline_unavailable")
+    planned = (baseline or {}).get("task") if isinstance(baseline, dict) else None
+    planned = planned if isinstance(planned, dict) else {}
+    files = missing_planned_task_files({"files": planned.get("files") or [], "items": planned.get("items") or []}, [])
+    files = sorted(set(files) | {path for path in changed_files or [] if isinstance(path, str)})
+    audit = task_input.get("implementation_audit_contract") or {}
+    if node_type not in {"coding", "fix", "testing"} or planned.get("type") not in {"coding", "fix", "testing"}:
+        reasons.append("review_stage")
+    if isinstance(audit, dict) and audit.get("final_verification") is True or task_input.get("verification_work_item"):
+        reasons.append("final_verification")
+    if not files:
+        reasons.append("scope_unknown")
+    patterns = {
+        "sensitive_configuration": r"(?:^|/)(?:config|system|di|acl|webapi|db_schema)\.xml$|(?:^|/)(?:\.github|deploy|infrastructure)/|(?:^|/)(?:dockerfile|compose[^/]*)$",
+        "payment_or_crypto": r"payment|checkout|encrypt|decrypt|crypto|secret|credential|webhook|idempot|refund|compensat",
+        "data_migration": r"migrat|alembic|(?:^|/)setup/|db_schema|(?:^|/)(?:composer\.lock|package-lock\.json|yarn\.lock|cargo\.lock)$",
+        "authorization": r"(?:^|/)(?:auth[^/]*|permission[^/]*|acl|security|tenant[^/]*)[/.]",
+    }
+    for reason, pattern in patterns.items():
+        if any(re.search(pattern, path, re.IGNORECASE) for path in files):
+            reasons.append(reason)
+    if node_type in {"coding", "fix"} and files and all(path.startswith("docs/") for path in files):
+        reasons.append("scope_unknown")
+    decision = {"version": 1, "mode": "required" if reasons else "advisory", "reasons": sorted(set(reasons))}
+    decision["fingerprint"] = hashlib.sha256(json.dumps({
+        **decision, "baseline_fingerprint": fingerprint,
+        "qa_policy": str(task_input.get("qa_test_level_policy_fingerprint") or ""),
+        "change_scope": str(task_input.get("change_scope") or ""),
+    }, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
+    return decision
+
+
+def review_blocks_completion(policy: dict, assessment: dict) -> bool:
+    return not assessment.get("node_complete", assessment.get("status") == "conformant") and (
+        policy.get("mode") != "advisory" or assessment.get("status") == "deviation"
+    )
+
+
 _WORKSPACE_INSTRUCTION_PATHS = (
     "AGENTS.md",
     "CLAUDE.md",

{forgexa_cli-1.86.0 → forgexa_cli-1.86.2}/forgexa_cli/daemon.py

@@ -1234,7 +1234,7 @@ except (ImportError, ModuleNotFoundError):
 # DAEMON_VERSION is the protocol/logic version of the daemon code.
 # Kept in sync with pyproject.toml version via bump-version.sh.
 # CLIENT_TYPE identifies which packaging/distribution this daemon runs in.
-DAEMON_VERSION = "1.86.0"
+DAEMON_VERSION = "1.86.2"
 
 
 def _detect_client_type() -> str:
@@ -10219,6 +10219,8 @@ class ServerConnection:
                 },
                 "implementation_audit": {"protocol_version": agent_core.IMPLEMENTATION_AUDIT_PROTOCOL_VERSION},
                 "task_delivery": {"protocol_version": 1},
+                "verification_recovery": {"protocol_version": 1},
+                "task_review_policy": {"protocol_version": 1},
                 "recording_suggestions": {"protocol_version": 1, "isolated_workspace": True},
                 "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True, "image_agents": ["claude"]},
             },
@@ -10645,6 +10647,8 @@ class ServerConnection:
                     },
                     "implementation_audit": {"protocol_version": agent_core.IMPLEMENTATION_AUDIT_PROTOCOL_VERSION},
                     "task_delivery": {"protocol_version": 1},
+                    "verification_recovery": {"protocol_version": 1},
+                    "task_review_policy": {"protocol_version": 1},
                     "recording_suggestions": {"protocol_version": 1, "isolated_workspace": True},
                     "local_evidence": {"protocol_version": 1, "structured_summary": True},
                     "task_attachment_staging": {"protocol_version": 1, "runtime_proxy": True, "image_agents": ["claude"]},
@@ -13120,6 +13124,11 @@ class RuntimeDaemon:
                     "This indicates a git clone or worktree setup failure (check SSH/network)."
                 )
             logger.info("Workspace ready: %s", workspace_path)
+            recovery = (task.input_data or {}).get("verification_recovery")
+            if isinstance(recovery, dict) and recovery.get("version") == 1 and recovery.get("mode") == "review_only":
+                result = await self._execute_review_only(task, agent, workspace_path)
+                await report_task_complete(result)
+                return
             self._ensure_task_output_dir(workspace_path, task)
 
             try:
@@ -13937,7 +13946,9 @@ class RuntimeDaemon:
                         before_sha=node_before_sha,
                     )
 
-            if result.status == "success" and task.critic_review_required:
+            review_policy = agent_core.task_review_policy(task.node_type, task.input_data or {}, changed_files=result.files_changed)
+            result.metrics["task_review_policy"] = review_policy
+            if result.status == "success" and (task.critic_review_required or review_policy["mode"] == "required" and isinstance((task.input_data or {}).get("approved_plan_baseline"), dict)):
                 await self._collect_task_delivery_git(
                     task, workspace_path, result, attempt_before_sha=node_before_sha,
                 )
@@ -13990,6 +14001,25 @@ class RuntimeDaemon:
             project_lock.release()
             _release_local_workspace_file_lock(local_bind_file_lock)
 
+    async def _execute_review_only(self, task, agent, workspace_path) -> TaskResult:
+        recovery = (task.input_data or {})["verification_recovery"]
+        snapshot = recovery.get("snapshot") or {}
+        expected = recovery.get("commit_sha")
+        head = (await self.workspace_manager._git("rev-parse", "HEAD", cwd=workspace_path, timeout=10)).strip()
+        if not isinstance(expected, str) or not re.fullmatch(r"[0-9a-f]{40}", expected) or head != expected:
+            return TaskResult(status="failed", exit_code=-1, stdout="", stderr="", failure_code="approved_plan_baseline_modified",
+                              error="Read-only review source changed; preserve the checkout and refresh recovery evidence")
+        result = TaskResult(status="success", exit_code=0, stdout="", stderr="",
+            metrics=dict(snapshot.get("metrics") or {}), git=dict(snapshot.get("git") or {}),
+            artifacts=list(snapshot.get("artifacts") or []), observations=list(snapshot.get("observations") or []),
+            evidence_summary=snapshot.get("evidence_summary"), files_changed=list((snapshot.get("git") or {}).get("files_changed") or []))
+        for key in ("token_input", "token_output", "token_total", "input_tokens", "output_tokens", "cost_usd", "num_turns", "duration_ms"):
+            result.metrics.pop(key, None)
+        result.critic_review = await self._run_runtime_critic_review(task, agent, workspace_path, result,
+            before_sha=str(result.git.get("before_sha") or expected))
+        result.metrics["verification_recovery_mode"] = "review_only"
+        return result
+
     async def _collect_runtime_critic_diff(
         self,
         workspace_path: Path,
@@ -14061,8 +14091,10 @@ class RuntimeDaemon:
 
         after_sha = str((result.git or {}).get("commit_sha") or before_sha or "").strip()
         committed_sources: dict[str, str] = {}
+        projected_provenance = set()
         unavailable_sources: list[dict[str, str]] = []
         source_bytes = 0
+        assigned_paths = []
         coverage = {
             "candidate_files": 0, "full_source_files": 0, "unreadable_files": 0,
             "skipped_paths": 0, "omitted_files": 0, "prompt_excerpt_truncated": False,
@@ -14266,6 +14298,15 @@ class RuntimeDaemon:
                     unavailable_sources.append({"path": path, "reason": reason})
                     continue
                 encoded_size = len(source.encode("utf-8"))
+                if source_bytes + encoded_size > _RUNTIME_CRITIC_SOURCE_MAX_BYTES:
+                    projection = agent_core.lock_provenance_projection(path, source)
+                    if projection is not None and source_bytes + len(projection.encode()) <= _RUNTIME_CRITIC_SOURCE_MAX_BYTES:
+                        committed_sources[path + ".provenance.json"] = projection
+                        projected_provenance.add(path)
+                        source_bytes += len(projection.encode())
+                        source_context.append("\n## Parsed dependency provenance (not complete source or semantic proof)\n" + projection[:max(remaining, 0)])
+                        remaining -= len(projection)
+                        continue
                 if source_bytes + encoded_size <= _RUNTIME_CRITIC_SOURCE_MAX_BYTES:
                     committed_sources[path] = source
                     source_bytes += encoded_size
@@ -14279,14 +14320,23 @@ class RuntimeDaemon:
                     changed_files.append(path)
             if source_context:
                 diff = (diff or "No new changes; review committed delivery instead.") + "".join(source_context)
-        coverage["full_source_files"] = len(committed_sources)
-        coverage["omitted_files"] = coverage["candidate_files"] - coverage["full_source_files"]
+        coverage["full_source_files"] = len(committed_sources) - len(projected_provenance)
+        coverage["projected_provenance_files"] = len(projected_provenance)
+        coverage["omitted_files"] = coverage["candidate_files"] - len(committed_sources)
         coverage["capsule_incomplete"] = (
             coverage["omitted_files"] > 0 or coverage.get("reference_inventory_unavailable", False)
             or coverage.get("verification_inventory_unavailable", False)
             or coverage.get("design_reference_documents_unavailable", False)
         )
         result.metrics["runtime_critic_coverage"] = coverage
+        required_sources = set(assigned_paths) | set((result.git or {}).get("files_changed") or result.files_changed)
+        required_sources = {path for path in required_sources if isinstance(path, str)}
+        coverage["required_source_files"] = len(required_sources)
+        coverage["missing_required_source_files"] = len(required_sources - set(committed_sources) - projected_provenance)
+        if required_sources and coverage["missing_required_source_files"]:
+            if not is_local_bind:
+                result.metrics["runtime_critic_evidence"] = {"reviewed_commit_sha": after_sha, "unavailable_sources": unavailable_sources}
+            return {"collection_status": "unavailable", "failure_code": "runtime_critic_evidence_incomplete", **metadata}
         if not diff:
             return {
                 "collection_status": "unavailable",

{forgexa_cli-1.86.0 → forgexa_cli-1.86.2}/forgexa_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: forgexa-cli
-Version: 1.86.0
+Version: 1.86.2
 Summary: Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform
 Author-email: Jason Sun <dev.winds@gmail.com>
 License-Expression: MIT

{forgexa_cli-1.86.0 → forgexa_cli-1.86.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "forgexa-cli"
-version = "1.86.0"
+version = "1.86.2"
 description = "Forgexa CLI — command-line client and AI agent runtime for the Forgexa platform"
 requires-python = ">=3.9"
 license = "MIT"