insightfactory-cli 1.2.0__tar.gz → 1.3.0.dev37__tar.gz

{insightfactory_cli-1.2.0 → insightfactory_cli-1.3.0.dev37}/.github/workflows/claude.yml

@@ -4,7 +4,8 @@
 # Purpose: AI-powered code review and assistance, on demand only.
 #          Triggered by mentioning @claude in a PR comment, an issue
 #          comment, or an inline PR review comment (e.g. `@claude review`).
-#          There is no automatic review on PR open.
+#          @agent-review on a PR runs Claude and Codex together through the
+#          shared agent review instead. There is no automatic review on PR open.
 #
 # =======================================================
 
@@ -76,3 +77,66 @@ jobs:
         Tests:
         - `tests/` uses isolated config dirs via `INSIGHTFACTORY_CONFIG_DIR`; never smoke-test
           against `~/.insightfactory`.
+
+  agent-review:
+    # Claude and Codex review the PR together, one matrix job each. The shared
+    # workflow's request check refuses anything but a PR comment from someone with
+    # write access that names @agent-review as a whole word.
+    if: >-
+      contains(github.event.comment.body, '@agent-review')
+      && (github.event_name == 'pull_request_review_comment' || github.event.issue.pull_request)
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
+      issues: write
+      actions: read
+      checks: read
+      statuses: read
+    uses: insightfactory-ai/if_sre_github_actions/.github/workflows/if_s_agent_review.yml@main
+    secrets: inherit
+    with:
+      # A reviewer approves only an approved verdict with no P0, P1 or P2, and a
+      # person from the required team still approves every PR (the Approvers
+      # ruleset on develop, test and main).
+      allow_agent_approval: true
+      # The same instructions as the @claude job above; keep the two in step.
+      append_system_prompt: |
+        This repository (insightfactory-cli) is the production Python `if-cli`, published to public
+        PyPI. Read CLAUDE.md and README.md before reviewing; the rules below are the ones that get
+        violated most often.
+
+        Runtime and layout:
+        - Runtime code is stdlib-only. Flag any new runtime dependency in pyproject.toml or any
+          import outside the standard library.
+        - Keep one module per CLI command under `src/if_cli/commands/`.
+        - Do not suggest third-party HTTP, OAuth, or CLI frameworks; the codebase uses urllib and
+          argparse deliberately.
+
+        Security and auth:
+        - A profile's bearer token must never be sent outside that profile's factory origin. Flag
+          any code path that could forward a token to another host.
+        - OAuth uses authorization-code flow with PKCE and a loopback-only (`127.0.0.1`) callback.
+          The CLI is a public client with no client secret.
+        - Do not commit credentials, access tokens, refresh tokens, or client secrets in code,
+          tests, or fixtures. Fixtures must use neutral hostnames such as `factory.example`.
+
+        On-disk compatibility:
+        - Profiles and tokens must be written only through the atomic private-file helpers
+          (`write_private_file` in config.py): `0o600` files, `0o700` directories, atomic replace
+          via temp file.
+        - On-disk profile and token-cache paths, JSON shapes, and file permissions must stay
+          byte-compatible with the Node `@insightfactory-ai/if-cli` so users can switch
+          implementations without re-authenticating.
+
+        Programmatic API (breaking-change surface):
+        - These four symbols are a supported in-process surface documented in README.md:
+          `if_cli.config.load_config`, `if_cli.config.get_profile`, `if_cli.oauth.get_valid_token`,
+          `if_cli.runtime.CliError`.
+        - They must raise `CliError` on failure (never `SystemExit`), never write to stdout, never
+          launch a browser or block on interactive input, and use only bounded waits.
+        - Changing signatures, behaviour, or removing any of them requires a major version bump.
+
+        Tests:
+        - `tests/` uses isolated config dirs via `INSIGHTFACTORY_CONFIG_DIR`; never smoke-test
+          against `~/.insightfactory`.

{insightfactory_cli-1.2.0 → insightfactory_cli-1.3.0.dev37}/CHANGELOG.md

@@ -11,6 +11,14 @@ that: every PR into `develop` must add an entry here, and a tag whose version ha
 section fails rather than releasing an empty page. The version only moves when the
 last one has been released, so a cycle's PRs share a section.
 
+## 1.3.0
+
+### Changed
+
+- Internal only: a PR comment naming `@agent-review` runs the shared Claude and
+  Codex review, which can approve a PR that a person from the required team
+  still approves. The CLI itself is unchanged.
+
 ## 1.2.0
 
 ### Added

{insightfactory_cli-1.2.0 → insightfactory_cli-1.3.0.dev37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: insightfactory-cli
-Version: 1.2.0
+Version: 1.3.0.dev37
 Summary: Profile-based authentication CLI for the InsightFactory Interfaces API
 Project-URL: Homepage, https://insightfactory.ai
 Author-email: "insightfactory.ai Support" <support@insightfactory.ai>

{insightfactory_cli-1.2.0 → insightfactory_cli-1.3.0.dev37}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "insightfactory-cli"
-version = "1.2.0"
+version = "1.3.0.dev37"
 description = "Profile-based authentication CLI for the InsightFactory Interfaces API"
 readme = "README.md"
 requires-python = ">=3.10"

{insightfactory_cli-1.2.0 → insightfactory_cli-1.3.0.dev37}/uv.lock

@@ -305,7 +305,7 @@ wheels = [
 
 [[package]]
 name = "insightfactory-cli"
-version = "1.2.0"
+version = "1.3.0"
 source = { editable = "." }
 
 [package.optional-dependencies]