pdd-cli 0.0.238__tar.gz → 0.0.239__tar.gz

{pdd_cli-0.0.238 → pdd_cli-0.0.239}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pdd-cli
-Version: 0.0.238
+Version: 0.0.239
 Summary: PDD (Prompt-Driven Development) Command Line Interface
 Author: Greg Tanaka
 Author-email: glt@alumni.caltech.edu
@@ -65,7 +65,7 @@ Requires-Dist: twine; extra == "dev"
 Requires-Dist: httpx==0.28.1; extra == "dev"
 Dynamic: license-file
 
-.. image:: https://img.shields.io/badge/pdd--cli-v0.0.238-blue
+.. image:: https://img.shields.io/badge/pdd--cli-v0.0.239-blue
    :alt: PDD-CLI Version
 
 .. image:: https://img.shields.io/badge/Discord-join%20chat-7289DA.svg?logo=discord&logoColor=white&link=https://discord.gg/Yp4RTh8bG7
@@ -142,7 +142,7 @@ After installation, verify:
 
    pdd --version
 
-You'll see the current PDD version (e.g., 0.0.238).
+You'll see the current PDD version (e.g., 0.0.239).
 
 Getting Started with Examples
 -----------------------------

{pdd_cli-0.0.238 → pdd_cli-0.0.239}/README.md

@@ -1,6 +1,6 @@
 # PDD (Prompt-Driven Development) Command Line Interface
 
-![PDD-CLI Version](https://img.shields.io/badge/pdd--cli-v0.0.238-blue) [![Discord](https://img.shields.io/badge/Discord-join%20chat-7289DA.svg?logo=discord&logoColor=white)](https://discord.gg/Yp4RTh8bG7)
+![PDD-CLI Version](https://img.shields.io/badge/pdd--cli-v0.0.239-blue) [![Discord](https://img.shields.io/badge/Discord-join%20chat-7289DA.svg?logo=discord&logoColor=white)](https://discord.gg/Yp4RTh8bG7)
 
 ## Introduction
 
@@ -362,7 +362,7 @@ For proper model identifiers to use in your custom configuration, refer to the [
 
 ## Version
 
-Current version: 0.0.238
+Current version: 0.0.239
 
 To check your installed version, run:
 ```
@@ -864,7 +864,7 @@ Options:
 - `--skip-verify`: Skip the functional verification step
 - `--skip-tests`: Skip unit test generation and fixing
 - `--target-coverage FLOAT`: Desired code coverage percentage (default is 90.0)
-- `--dry-run`: Display real-time sync analysis instead of running sync operations. For no-argument project-wide sync, this prints the dependency-ordered module list and estimated cost without executing any module syncs. For single-module sync, it performs the same state analysis as a normal sync run but without acquiring exclusive locks or executing operations.
+- `--dry-run`: Display real-time sync analysis instead of running sync operations. For no-argument project-wide sync, this prints the dependency-ordered module list and estimated cost without executing any module syncs, plus a single compact roll-up of modules outside the Tier 1 (`generate` / `auto-deps`) scope — bucketed by reason (e.g. `Out of Tier 1 scope: 42 example, 31 test, 18 verify, 12 update, 74 no-prompt fixture`) instead of one warning line per skipped entry. When zero modules are stale, the `0 stale module(s)` fragment is rendered in green so the success signal is visually unambiguous. Actionable architecture-graph warnings (ambiguous or unresolved cross-arch dependencies) are still printed individually in yellow. For single-module sync, it performs the same state analysis as a normal sync run but without acquiring exclusive locks or executing operations. Passing the top-level `pdd --verbose` flag (see above) restores the legacy per-module enumeration after the compact roll-up — one yellow warning line per module outside the Tier 1 scope — for debugging.
 - `--one-session / --no-one-session`: Run sync in a single agentic session instead of separate sessions for each step. Cannot be combined with `--skip-tests` or `--skip-verify`.
 - `--no-steer`: Disable interactive steering of sync operations.
 - `--steer-timeout FLOAT`: Timeout in seconds for steering prompts (default: 8.0).
@@ -2745,8 +2745,9 @@ Options:
 - `--fixer ROLE`: Fixer role for `--review-loop` (for example, `claude`). The fixer must be different from the reviewer unless `--review-only` is used.
 - `--reviewers ROLES`: Legacy comma-separated review-loop role order, interpreted as `reviewer,fixer` (default: `codex,claude`).
 - `--reviewer-fallback ROLE`: Optional secondary reviewer role to invoke once if the primary reviewer cannot complete (for example, because of auth, network, sandbox, or CLI failures). The fallback must resolve to a role different from the reviewer and fixer; if it succeeds, it becomes the active reviewer for the remaining loop and the superseded primary's row in the final report is annotated `(optional, superseded by <fallback>)` so downstream verdict adapters drop the failed primary from the required-reviewer set and resolve to `ship_degraded` instead of `unknown`.
+- `--fixer-fallback ROLE`: Optional secondary fixer role to invoke once if the primary fixer cannot complete (for example, Claude Code subscription-tier `credential-limit` failures). Role aliases are normalized so `claude` and `anthropic` resolve to the same identity; the fallback must resolve to a role different from the active fixer, the active reviewer, AND the originally configured reviewer (so `--reviewer codex --reviewer-fallback gemini --fixer-fallback codex` is skipped even after gemini takes over reviewing). Before the fallback runs the worktree is reset so the primary fixer's partial edits do not leak; on success the fallback takes over as the active fixer for the remaining rounds.
 - `--max-review-rounds INT`: Maximum primary-reviewer/fixer rounds (default: 5).
-- `--max-review-cost FLOAT`: Maximum review-loop LLM cost in USD (default: 10.0).
+- `--max-review-cost FLOAT`: Maximum review-loop LLM cost in USD (default: 50.0).
 - `--max-review-minutes FLOAT`: Maximum review-loop wall-clock minutes (default: 90.0).
 - `--blocking-severities LIST`: Comma-separated severity names used for review-loop reporting and prompt guidance (default: `blocker,critical,medium`). The fixer still receives every valid reviewer finding.
 - `--continue-on-reviewer-limit`: Report provider, rate, context-window, timeout, auth, network, sandbox, permission, and non-zero-exit reviewer failures as `degraded` instead of `failed`. Degraded reviewers are still not clean unless a configured fallback reviewer completes successfully and takes over as the active reviewer.
@@ -3512,7 +3513,7 @@ PDD can be integrated into various development workflows. Here are the conceptua
 4. Stage and commit healed files with a descriptive message — partial metadata state (any stage reporting `failed`) blocks the commit/checkpoint in PR mode. `skipped` is permitted for legitimate cases (no `architecture.json`, unregistered modules, LLM-first tag generation pending #870) and does not block.
 5. Push changes to the current branch
 
-**Metadata Finalization**: The CI auto-heal `update` branch and the preflight drift-heal path both call the same `run_metadata_sync` orchestrator that `pdd update --sync-metadata` uses, so all three workflows share one finalization surface. The orchestrator runs in a fixed order — prompt → tags → architecture → run-report cleanup → fingerprint last. **Within `run_metadata_sync`** a `failed` upstream stage gates every later write-bearing stage (architecture, run_report, fingerprint), so a tags failure cannot drag architecture or fingerprint state out of sync. `skipped` upstream (no `architecture.json`, unregistered modules, LLM-first tag refresh pending #870) is acceptable and does not gate later stages. **The orchestrator is not transactional across stages**: if e.g. tags + architecture succeed and fingerprint then fails, the prompt and `architecture.json` writes have already landed on disk and `run_metadata_sync` itself does not roll them back. End-to-end rollback for a failing module is handled by the CI auto-heal layer — on a sync failure, `pdd.ci_drift_heal` calls `_revert_prompt_file` and the module-scoped `_snapshot_metadata_state_for(drift)` / `_restore_metadata_state_for(snapshot)` pair (which captures this module's `architecture.json` bytes + `.pdd/meta/<basename>_<language>.json` pre-sync and writes them back on failure, never touching other modules' state). A repo-scoped `git restore -- .pdd` / `git restore -- architecture.json` is explicitly NOT used because in a multi-module push-to-main heal it would wipe earlier successful modules' writes from the same run; the legacy `_cleanup_metadata_artifacts` symbol is kept only as a no-op import shim. The combined invariant: `git add -A` on push-to-main cannot publish a failed module's partial metadata alongside another module's successful heal. The combined invariant: auto-heal never commits a half-synced state, and preflight never leaves stale fingerprints after a successful update.
+**Metadata Finalization**: The CI auto-heal `update` branch and the preflight drift-heal path both call the same `run_metadata_sync` orchestrator that `pdd update --sync-metadata` uses, so all three workflows share one finalization surface. The orchestrator runs in a fixed order — prompt → tags → architecture → run-report cleanup → fingerprint last. **Within `run_metadata_sync`** a `failed` upstream stage gates every later write-bearing stage (architecture, run_report, fingerprint), so a tags failure cannot drag architecture or fingerprint state out of sync. `skipped` upstream (no `architecture.json`, unregistered modules, LLM-first tag refresh pending #870) is acceptable and does not gate later stages. **The orchestrator is not transactional across stages**: if e.g. tags + architecture succeed and fingerprint then fails, the prompt and `architecture.json` writes have already landed on disk and `run_metadata_sync` itself does not roll them back. End-to-end rollback for a failing module is handled by the CI auto-heal layer — on a sync failure, `pdd.ci_drift_heal` calls `_revert_prompt_file` and the module-scoped `_snapshot_metadata_state_for(drift)` / `_restore_metadata_state_for(snapshot)` pair (which captures this module's `architecture.json` bytes + `.pdd/meta/<basename>_<language>.json` pre-sync and writes them back on failure, never touching other modules' state). A repo-scoped `git restore -- .pdd` / `git restore -- architecture.json` is explicitly NOT used because in a multi-module push-to-main heal it would wipe earlier successful modules' writes from the same run; the legacy `_cleanup_metadata_artifacts` symbol is kept only as a no-op import shim. **Staging is scoped, not blanket** — `commit_and_push` runs `git add -u` for tracked updates plus explicit per-module pathspecs (computed from each `DriftInfo`'s `prompt_path`/`code_path`/`example_path`/`test_path` and `_operation_log_metadata_relpaths(basename, language)`), filters out gitignored paths via `git check-ignore`, and adds `project_dependencies.csv` only when a healed module ran `auto-deps`; `git add -A` is explicitly rejected because it sweeps unrelated `.pdd/meta/*.json` fingerprints from out-of-scope modules into the heal commit (issue #1021) and could publish a failed module's partial metadata alongside another module's successful heal. The combined invariant: auto-heal never commits a half-synced state, and preflight never leaves stale fingerprints after a successful update.
 
 **Usage:**
 ```bash

{pdd_cli-0.0.238 → pdd_cli-0.0.239}/pdd/agentic_checkup.py

@@ -321,8 +321,9 @@ def run_agentic_checkup(
     reviewer: Optional[str] = None,
     fixer: Optional[str] = None,
     reviewer_fallback: Optional[str] = None,
+    fixer_fallback: Optional[str] = None,
     max_review_rounds: int = 5,
-    max_review_cost: float = 10.0,
+    max_review_cost: float = 50.0,
     max_review_minutes: float = 90.0,
     require_all_reviewers_clean: bool = True,
     continue_on_reviewer_limit: bool = False,
@@ -349,6 +350,10 @@ def run_agentic_checkup(
             reviewer first pass and do not invoke the fixer or push changes.
         reviewer_fallback: Optional secondary reviewer role to try once when
             the primary reviewer cannot complete.
+        fixer_fallback: Optional secondary fixer role to try once when the
+            primary fixer cannot address the reviewer's findings (e.g. a
+            subscription-tier credential is exhausted). Must differ from
+            both the primary fixer and the active reviewer.
 
     Returns:
         Tuple of (success, message, total_cost, model_used).
@@ -452,6 +457,7 @@ def run_agentic_checkup(
             reviewer=reviewer,
             fixer=fixer,
             reviewer_fallback=reviewer_fallback,
+            fixer_fallback=fixer_fallback,
             review_only=review_only,
             max_rounds=max_review_rounds,
             max_cost=max_review_cost,

{pdd_cli-0.0.238 → pdd_cli-0.0.239}/pdd/agentic_common.py

@@ -388,6 +388,26 @@ _PERMANENT_ERROR_CLASSES: Tuple[Tuple[str, Tuple[str, ...]], ...] = (
             r"model\s+not\s+found(?!\s+in\s+provider)",
         ),
     ),
+    (
+        # Issue (this PR): Claude Code subscription-tier weekly limit ("You've
+        # hit your limit · resets [TIME]"). Distinct from API-tier 429 because
+        # the reset window is hours-to-days, not seconds-to-minutes — retrying
+        # on the 60s rate-limit floor wastes minutes. Stable token
+        # `credential-limit` lets pdd_cloud's OAuth-token waterfall detect this
+        # and rotate to a different credential instead of retrying the dead one.
+        "credential-limit",
+        (
+            # Proximity + time-token guard. Requires "hit your limit" and
+            # "resets" within 40 chars (typical envelope is "... limit ·
+            # resets May 18, 11pm (UTC) ...") AND requires a time-token
+            # OR delimiter immediately after "resets" so distant prose
+            # like "if you hit your limit, nothing resets automatically"
+            # does NOT classify as credential-limit. Without the time
+            # token, any sentence stringing both phrases together would
+            # short-circuit the rate-limit retry path on benign text.
+            r"hit\s+your\s+limit[^\n]{0,40}?\bresets?\b\s*(?:[·:|\-]|in\s|at\s|on\s|\d|jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)",
+        ),
+    ),
     (
         # Issue #1072: quota exhaustion (permanent even when 429 is present)
         "quota",

{pdd_cli-0.0.238 → pdd_cli-0.0.239}/pdd/agentic_sync.py

@@ -725,9 +725,14 @@ def _analyze_global_sync_modules(
 
     if not quiet:
         skipped_count = len(modules) - len(modules_to_sync)
+        stale_count = len(modules_to_sync)
+        if stale_count == 0:
+            stale_fragment = f"[green]0 stale module(s)[/green]"
+        else:
+            stale_fragment = f"{stale_count} stale module(s)"
         console.print(
-            f"[bold]Global sync analysis:[/bold] {len(modules_to_sync)} stale "
-            f"module(s), {skipped_count} already synced or skipped."
+            f"[bold]Global sync analysis:[/bold] {stale_fragment}, "
+            f"{skipped_count} already synced or skipped."
         )
 
     return GlobalSyncAnalysis(
@@ -839,15 +844,79 @@ def _build_scoped_global_dep_graph(
     return graph, warnings
 
 
+_SKIPPED_BUCKET_ORDER: Tuple[str, ...] = (
+    "example",
+    "test",
+    "verify",
+    "update",
+    "fix",
+    "crash",
+    "no-prompt fixture",
+    "other",
+)
+_SKIPPED_OPERATION_BUCKETS: Tuple[str, ...] = (
+    "example",
+    "test",
+    "verify",
+    "update",
+    "fix",
+    "crash",
+)
+
+
+def _bucket_skipped_reasons(skipped_modules: List[str]) -> Dict[str, int]:
+    """Bucket skipped-module entries by reason for the dry-run roll-up.
+
+    Entries flagged "no syncable prompt file found" go into `no-prompt fixture`;
+    entries shaped "{key}: {language} requires {operation}; outside Tier 1 ..."
+    bucket by `operation` when it matches a known Tier-1-out-of-scope op,
+    otherwise into `other`.
+    """
+    buckets: Dict[str, int] = {name: 0 for name in _SKIPPED_BUCKET_ORDER}
+    for entry in skipped_modules:
+        lower = entry.lower()
+        if "no syncable prompt file found" in lower:
+            buckets["no-prompt fixture"] += 1
+            continue
+        matched = False
+        for op in _SKIPPED_OPERATION_BUCKETS:
+            if f"requires {op}" in lower:
+                buckets[op] += 1
+                matched = True
+                break
+        if not matched:
+            buckets["other"] += 1
+    return buckets
+
+
+def _format_skipped_bucket_summary(skipped_modules: List[str]) -> Optional[str]:
+    """Return a stable single-line roll-up of skipped buckets, or None if empty."""
+    if not skipped_modules:
+        return None
+    buckets = _bucket_skipped_reasons(skipped_modules)
+    parts = [
+        f"{count} {name}"
+        for name in _SKIPPED_BUCKET_ORDER
+        if (count := buckets.get(name, 0)) > 0
+    ]
+    if not parts:
+        return None
+    return "Out of Tier 1 scope: " + ", ".join(parts)
+
+
 def _print_global_sync_plan(
     analysis: GlobalSyncAnalysis,
     ordered_modules: List[str],
     warnings: List[str],
     budget: Optional[float] = None,
+    verbose: bool = False,
 ) -> None:
     """Render a concise global sync dry-run plan."""
     console.print("[bold]Global sync dry run:[/bold]")
-    console.print(f"  Tier 1 (prompt staleness): {len(ordered_modules)} module(s) stale")
+    if len(ordered_modules) == 0:
+        console.print("  Tier 1 (prompt staleness): [green]0 module(s) stale[/green]")
+    else:
+        console.print(f"  Tier 1 (prompt staleness): {len(ordered_modules)} module(s) stale")
     console.print(f"  Total architecture modules scanned: {len(analysis.all_modules)}")
     console.print(f"  Estimated cost: ${analysis.estimated_cost:.2f}")
     if budget is not None:
@@ -870,8 +939,13 @@ def _print_global_sync_plan(
     for warning in warnings:
         console.print(f"[yellow]Warning: {warning}[/yellow]")
 
-    for skipped in analysis.skipped_modules:
-        console.print(f"[yellow]Warning: {skipped}[/yellow]")
+    if analysis.skipped_modules:
+        summary = _format_skipped_bucket_summary(analysis.skipped_modules)
+        if summary is not None:
+            console.print(f"  [dim]{summary}[/dim]")
+        if verbose:
+            for skipped in analysis.skipped_modules:
+                console.print(f"[yellow]Warning: {skipped}[/yellow]")
 
 
 def run_global_sync(
@@ -930,7 +1004,9 @@ def run_global_sync(
 
     if dry_run:
         if not quiet:
-            _print_global_sync_plan(analysis, ordered_modules, dep_warnings, budget)
+            _print_global_sync_plan(
+                analysis, ordered_modules, dep_warnings, budget, verbose=verbose
+            )
         return (
             True,
             f"Global sync dry run: {len(ordered_modules)} module(s) would sync.",