raise-cli 3.1.2__tar.gz → 3.1.4__tar.gz

{raise_cli-3.1.2 → raise_cli-3.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: raise-cli
-Version: 3.1.2
+Version: 3.1.4
 Summary: RaiSE CLI - Reliable AI Software Engineering governance framework
 Project-URL: Homepage, https://raiseframework.ai
 Project-URL: Documentation, https://docs.raiseframework.ai
@@ -33,7 +33,7 @@ Requires-Dist: pydantic>=2.6.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: pyyaml>=6.0.1
 Requires-Dist: qrcode>=8.2
-Requires-Dist: raise-core==3.1.2
+Requires-Dist: raise-core==3.1.4
 Requires-Dist: rich>=13.7.0
 Requires-Dist: ruamel-yaml>=0.18
 Requires-Dist: textual>=0.89.0

{raise_cli-3.1.2 → raise_cli-3.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "raise-cli"
-version = "3.1.2"
+version = "3.1.4"
 description = "RaiSE CLI - Reliable AI Software Engineering governance framework"
 authors = [
     {name = "Emilio Osorio", email = "emilio@humansys.ai"}
@@ -21,7 +21,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "raise-core==3.1.2",
+    "raise-core==3.1.4",
     "typer>=0.12.0",
     "rich>=13.7.0",
     "pydantic>=2.6.0",
@@ -150,6 +150,7 @@ governance-trail-ci = "raise_cli.gates.governance.governance_trail_ci_gate:Gover
 gate-public-mirror-push = "raise_cli.gates.governance.public_mirror_push_gate:PublicMirrorPushGate"
 domain-model-ratified = "raise_cli.gates.ddd.domain_model_ratified_gate:DomainModelRatifiedGate"
 ddd-tactical-drift = "raise_cli.gates.ddd.tactical_drift_gate:TacticalDriftGate"
+gate-revert-scope = "raise_cli.gates.governance.revert_scope_gate:RevertScopeGate"
 
 [project.entry-points."rai.doctor.checks"]
 environment = "raise_cli.doctor.checks.environment:EnvironmentCheck"
@@ -172,6 +173,8 @@ stash-hygiene = "raise_cli.doctor.checks.stash_hygiene:StashHygieneCheck"
 legacy-install = "raise_cli.doctor.checks.legacy_install:LegacyInstallCheck"
 legacy-residues = "raise_cli.doctor.checks.legacy_residues:LegacyResiduesCheck"
 legacy-work-items = "raise_cli.doctor.checks.legacy_work_items:LegacyWorkItemsCheck"
+graph-annotation-always-null-column = "raise_cli.doctor.checks.graph_annotations:GraphAnnotationAlwaysNullColumnCheck"
+graph-annotation-scoping-drift = "raise_cli.doctor.checks.graph_annotations:GraphAnnotationScopingDriftCheck"
 update = "raise_cli.doctor.checks.update:UpdateCheck"
 worktrees = "raise_cli.doctor.checks.worktrees:WorktreesCheck"
 session-index = "raise_cli.doctor.checks.session_index:SessionIndexCheck"

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/__main__.py

@@ -9,11 +9,31 @@ from raise_cli.cli.main import app
 from raise_cli.exceptions import RaiError
 
 
+def _handle_unexpected_error(error: Exception) -> None:
+    """Print unexpected exception safely — no frame locals, no traceback by default.
+
+    Frame locals are suppressed to prevent leaking API keys and tokens that may
+    be in scope when the exception occurs (RAISE-18038). Set RAI_DEBUG=1 to
+    include the full traceback for debugging.
+    """
+    import traceback
+
+    error_type = type(error).__name__
+    print(f"Unexpected error ({error_type}): {error}", file=sys.stderr)
+
+    if os.environ.get("RAI_DEBUG") == "1":
+        traceback.print_exc()
+    else:
+        print("Set RAI_DEBUG=1 for full traceback.", file=sys.stderr)
+
+
 def main() -> None:
     """Run the CLI application with error handling.
 
     Catches RaiError exceptions and displays them with proper formatting,
-    then exits with the appropriate exit code.
+    then exits with the appropriate exit code. Any other unhandled exception
+    is caught and displayed safely (without frame locals) to prevent leaking
+    API keys and tokens to the terminal and CI logs (RAISE-18038).
     """
     if os.environ.get("RAISE_TEST_BLOCK_GRAPH_BUILD") == "1" and sys.argv[1:3] == [
         "graph",
@@ -32,6 +52,9 @@ def main() -> None:
         output_format = get_output_format()
         exit_code = handle_error(error, output_format=output_format)
         sys.exit(exit_code)
+    except Exception as error:  # noqa: BLE001
+        _handle_unexpected_error(error)
+        sys.exit(1)
 
 
 if __name__ == "__main__":

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/backlog_config.py

@@ -293,6 +293,22 @@ def derive_state_machine(  # noqa: C901
     if not state_map:
         return _empty()
 
+    # RAISE-17917: register status_mapping role-key aliases pointing at the
+    # same StateSpec as the state they resolve to. Pipeline YAMLs declare
+    # target_status using the canonical role key (e.g. "committed"), which
+    # only coincidentally matches slugify(display_name) — a real Jira typo
+    # ("Commited", one 't') otherwise makes the role key unresolvable.
+    # WorkflowStateMachine.resolve() returns the aliased StateSpec's own
+    # .slug, so alias and real-name resolution agree.
+    id_to_slug = {
+        spec.native_id: slug for slug, spec in state_map.items() if spec.native_id
+    }
+    for wf_config in sections.values():
+        for role, status_id in wf_config.status_mapping.items():
+            target_slug = id_to_slug.get(status_id)
+            if target_slug and role not in state_map:
+                state_map[role] = state_map[target_slug]
+
     # Full transition mesh — fail-open (C-2 mesh rule)
     all_slugs = frozenset(state_map.keys())
     transitions: dict[str, frozenset[str]] = {

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/composite_pm.py

@@ -14,7 +14,6 @@ from __future__ import annotations
 
 import contextlib
 import logging
-import re
 from collections.abc import Callable
 from datetime import UTC, datetime
 from pathlib import Path
@@ -25,6 +24,7 @@ from pydantic import ValidationError
 
 from raise_cli.adapters.errors import AdapterSyncError
 from raise_cli.adapters.filesystem_models import BacklogItem
+from raise_cli.adapters.id_utils import DEFAULT_ID_PATTERN, work_id_re
 from raise_cli.adapters.models import (
     AdapterHealth,
     AttachmentDetail,
@@ -55,8 +55,6 @@ _RemoteAction = Callable[[Any, str], None]
 
 MAX_RETRIES = 5
 
-_JIRA_KEY_RE = re.compile(r"^[A-Z][A-Z0-9]*-\d+$")
-
 
 class RemoteWriteOutcome(NamedTuple):
     """Return contract for ``_write_to_remotes_keyed`` (RAISE-12598).
@@ -91,12 +89,14 @@ class CompositeBacklogAdapter:
         pending: PendingOpsLog,
         *,
         server_first: bool = False,
+        id_pattern: str = DEFAULT_ID_PATTERN,
     ) -> None:
         self._local = adapters[0]
         self._remotes = adapters[1:]
         self._wi_store = wi_store
         self._pending = pending
         self._server_first = server_first
+        self._id_re = work_id_re(id_pattern)
 
     @property
     def remotes(self) -> list[Any]:
@@ -1104,7 +1104,7 @@ class CompositeBacklogAdapter:
         remote_key = self._wi_store.get_jira_key(local_key)
         if remote_key is None:
             if self._local_has_key(local_key):
-                if _JIRA_KEY_RE.match(local_key):
+                if self._id_re.match(local_key):
                     # Auto-heal: local key IS a remote key (migrated/imported
                     # item with NULL jira_key). Self-map and pass through.
                     remote_key = local_key

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/filesystem.py

@@ -137,7 +137,7 @@ class FilesystemPMAdapter:
         """Resolve path for key; raises KeyError if not found."""
         path = self._resolve_item_path(key)
         if path is None:
-            raise KeyError(key)
+            raise KeyError(f"Issue {key} not found")
         return path
 
     def _load_item(self, key: str) -> BacklogItem:
@@ -508,7 +508,7 @@ class FilesystemPMAdapter:
         """
         old_path = self._resolve_item_path(old_key)
         if old_path is None:
-            raise KeyError(old_key)
+            raise KeyError(f"Issue {old_key} not found")
 
         # Load, update key field, determine new path
         raw = yaml.safe_load(old_path.read_text(encoding="utf-8"))

raise_cli-3.1.4/src/raise_cli/adapters/id_utils.py

@@ -0,0 +1,41 @@
+r"""Utility for configurable work-item ID regex — RAISE-18508.
+
+Centralizes the pattern used to validate work-item keys across gates,
+pipeline modules, and adapters.  Callers compile the regex once via
+``work_id_re`` and should NOT hardcode ``[A-Z][A-Z0-9]*-\\d+`` directly.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+DEFAULT_ID_PATTERN: str = r"[A-Z][A-Z0-9]*-\d+"
+
+
+def work_id_re(pattern: str) -> re.Pattern[str]:
+    """Return a compiled regex for the given work-item ID pattern."""
+    return re.compile(pattern)
+
+
+def load_id_pattern(project_root: Path) -> str:
+    """Read ``id_pattern`` from ``.raise/backlog.yaml``.
+
+    Returns ``DEFAULT_ID_PATTERN`` on any error (missing file, invalid YAML,
+    adapter not found) so callers never need to handle the failure.
+    """
+    try:
+        from raise_cli.adapters.backlog_config import (
+            get_configured_adapters,
+            load_backlog_config,
+        )
+
+        adapters = get_configured_adapters(project_root)
+        if not adapters:
+            return DEFAULT_ID_PATTERN
+        adapter_name = next(iter(adapters))
+        cfg = load_backlog_config(project_root, adapter_name)
+        re.compile(cfg.id_pattern)  # validate — re.error falls through to except
+        return cfg.id_pattern
+    except Exception:  # noqa: BLE001 — fail-open: always return a usable pattern
+        return DEFAULT_ID_PATTERN

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/jira_config_gen.py

@@ -189,6 +189,16 @@ _CONFIG_HEADER = """\
 # organizations.<name>.url: tool endpoint domain
 # projects.<key>.org: which organization owns this project
 #
+# id_pattern: optional regex for work-item IDs (default: Jira format [A-Z][A-Z0-9]*-\\d+)
+# Override when your project uses non-Jira IDs (e.g. E14, S1.1, BUG-ALR-01).
+# Example patterns:
+#   Jira (default): '[A-Z][A-Z0-9]*-\\d+'
+#   Epics only:     'E\\d+'
+#   Stories only:   'S\\d+\\.\\d+'
+#   Multi-segment:  '[A-Z]+-[A-Z]+-\\d+'
+# Uncomment and set under the adapter section (e.g. under jira:):
+#   # id_pattern: 'E\\d+'
+#
 """
 
 

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/key_gen.py

@@ -45,7 +45,17 @@ def issue_type_to_work_item_type(issue_type: str) -> str:
     stores it in ``custom_fields["source_issue_type"]``).
     """
     lower = issue_type.lower()
-    valid = {"theme", "initiative", "epic", "story", "task", "bug"}
+    valid = {
+        "theme",
+        "initiative",
+        "epic",
+        "story",
+        "task",
+        "bug",
+        "spike",
+        "sub-task",
+        "research",
+    }
     if lower in valid:
         return lower
     return "story"  # default fallback

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/models/pm.py

@@ -530,6 +530,14 @@ class BacklogAdapterConfig(BaseModel, frozen=True):
         default_factory=dict,
         description="Issue type → key prefix (e.g. Epic → e, Story → s). Populated by issue-types discover.",
     )
+    id_pattern: str = Field(
+        default=r"[A-Z][A-Z0-9]*-\d+",
+        description=(
+            "Regex pattern for work-item ID validation (RAISE-18508). "
+            "Default matches Jira-style keys (e.g. RAISE-123). "
+            "Override for non-Jira systems: e.g. 'E\\d+' for InterWare."
+        ),
+    )
 
     @model_validator(mode="before")
     @classmethod

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/resolve.py

@@ -245,8 +245,14 @@ def _compose_pm_adapters(
     # Consulta env vars + ~/.rai/server.json (vía get_server_credentials).
     # El código anterior solo leía env vars, ignorando rai connect → server.json.
     server_first = get_server_credentials() is not None
+    from raise_cli.adapters.id_utils import load_id_pattern
+
     return CompositeBacklogAdapter(
-        instances, wi_store, pending, server_first=server_first
+        instances,
+        wi_store,
+        pending,
+        server_first=server_first,
+        id_pattern=load_id_pattern(root),
     )
 
 

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/adapters/sqlite_pm.py

@@ -77,6 +77,14 @@ _UPDATABLE_FIELDS: frozenset[str] = frozenset(
     }
 )
 
+# List[str]-typed fields (mirrors WorkItemStore._FIELD_VALIDATORS' list-shaped
+# entries). The dedicated CLI flags (--fix-version) already wrap their value
+# in a list before it reaches the adapter; the generic `-F fixVersions=...`
+# escape hatch does not, so a bare string here would otherwise blow past
+# WorkItemStore.update_fields' TypeAdapter(list[str]) with
+# "expected list, got str" (RAISE-17094).
+_LIST_TYPED_FIELDS: frozenset[str] = frozenset({"fix_versions", "labels"})
+
 
 def _capitalize_type(type_str: str) -> str:
     """Capitalize the first letter of a work item type for display."""
@@ -148,7 +156,7 @@ class SQLitePMAdapter:
         if wi is None:
             wi = self._store.get_by_jira_key(key)
         if wi is None:
-            raise KeyError(key)
+            raise KeyError(f"Issue {key} not found")
         return wi
 
     # -- Key generation helpers -----------------------------------------------
@@ -326,6 +334,8 @@ class SQLitePMAdapter:
             # Map to updatable field names
             if canonical == "parent":
                 canonical = "parent_local_key"
+            if canonical in _LIST_TYPED_FIELDS and isinstance(value, str):
+                value = [value] if value else []
             if canonical in _UPDATABLE_FIELDS:
                 old_value = getattr(wi, canonical, None)
                 if isinstance(old_value, list):
@@ -457,7 +467,7 @@ class SQLitePMAdapter:
         """
         wi = self._store.get_by_local_key(old_key)
         if wi is None:
-            raise KeyError(old_key)
+            raise KeyError(f"Issue {old_key} not found")
 
         conn = self._store._conn  # pyright: ignore[reportPrivateUsage] — D-S3.7: direct SQL for identity columns excluded from update_fields
         with conn:

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/agents/claude_plugin.py

@@ -14,7 +14,6 @@ context injection per agent).
 from __future__ import annotations
 
 import json
-import sys
 from pathlib import Path
 from typing import Any
 
@@ -26,11 +25,10 @@ _HOOK_COMMAND_POSIX = (
     "rai hook user-prompt-submit || exit 0"
 )
 
-_HOOK_COMMAND_WINDOWS = (
-    'set REPO_ROOT="$(dirname "$(git rev-parse --git-common-dir)")" && '
-    "cd %REPO_ROOT% && "
-    "rai hook user-prompt-submit"
-)
+# Claude Code executes hooks via bash on all platforms (Git Bash on Windows),
+# so the POSIX command works everywhere. CMD syntax (%REPO_ROOT%) caused
+# 'cd: %REPO_ROOT%: No such file or directory' in Git Bash (RAISE-18085).
+_HOOK_COMMAND_WINDOWS = _HOOK_COMMAND_POSIX
 
 SETTINGS_USER_PROMPT_SUBMIT_BLOCK: dict[str, Any] = {
     "hooks": [
@@ -80,9 +78,7 @@ class ClaudePlugin:
         Returns:
             List of relative file paths created/updated.
         """
-        command = (
-            _HOOK_COMMAND_WINDOWS if sys.platform == "win32" else _HOOK_COMMAND_POSIX
-        )
+        command = _HOOK_COMMAND_POSIX
         hook_block: dict[str, Any] = {
             "hooks": [{"type": "command", "command": command}]
         }

raise_cli-3.1.4/src/raise_cli/artifacts/html_to_md.py

@@ -0,0 +1,115 @@
+"""Derive a Markdown companion from a self-contained HTML artifact.
+
+RAISE-16870 introduced HTML as a first-class artifact format for governance
+documents (self-contained reports published to the RaiSE platform target).
+Downstream tooling (artifact-validation gates, grep/diff/git-blame,
+search) still expects a paired ``.md`` file next to the ``.html`` one --
+this module is the single place that derives it, so every publish path
+(MCP tool, CLI) can share it instead of hand-rolling a conversion on
+demand (RAISE-17804).
+
+The conversion is intentionally lossy and dependency-free (stdlib
+``html.parser`` only, no markdownify/html2text): headings, paragraphs,
+lists, bold/italic and links degrade to Markdown syntax; everything else
+degrades to plain text. ``<script>``/``<style>`` content is dropped
+entirely. It exists to keep the companion readable and searchable, not to
+round-trip the original HTML.
+"""
+
+from __future__ import annotations
+
+import re
+from html import unescape
+from html.parser import HTMLParser
+
+_SKIPPED_TAGS = {"script", "style"}
+_BLOCK_TAGS = {"p", "div", "section", "article", "header", "footer", "tr", "table"}
+_HEADING_LEVELS = {f"h{n}": n for n in range(1, 7)}
+
+
+class _HtmlToMdParser(HTMLParser):
+    """Minimal streaming HTML -> Markdown-ish text converter (stdlib only)."""
+
+    def __init__(self) -> None:
+        super().__init__(convert_charrefs=True)
+        self._out: list[str] = []
+        self._skip_depth = 0
+        self._link_href: str | None = None
+
+    def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        if tag in _SKIPPED_TAGS:
+            self._skip_depth += 1
+            return
+        if self._skip_depth:
+            return
+        if tag in _HEADING_LEVELS or tag in _BLOCK_TAGS or tag in ("br", "li"):
+            self._start_structural(tag)
+        else:
+            self._start_inline(tag, attrs)
+
+    def _start_structural(self, tag: str) -> None:
+        """Headings, block containers, line breaks, and list items."""
+        if tag in _HEADING_LEVELS:
+            self._out.append("\n\n" + "#" * _HEADING_LEVELS[tag] + " ")
+        elif tag == "br":
+            self._out.append("\n")
+        elif tag == "li":
+            self._out.append("\n- ")
+        else:  # block tag
+            self._out.append("\n\n")
+
+    def _start_inline(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        """Links and inline emphasis markers."""
+        if tag == "a":
+            href = dict(attrs).get("href")
+            self._link_href = href
+            if href:
+                self._out.append("[")
+        elif tag in ("strong", "b"):
+            self._out.append("**")
+        elif tag in ("em", "i"):
+            self._out.append("_")
+
+    def handle_endtag(self, tag: str) -> None:
+        if tag in _SKIPPED_TAGS:
+            self._skip_depth = max(0, self._skip_depth - 1)
+            return
+        if self._skip_depth:
+            return
+        if tag == "a" and self._link_href:
+            self._out.append(f"]({self._link_href})")
+            self._link_href = None
+        elif tag in ("strong", "b"):
+            self._out.append("**")
+        elif tag in ("em", "i"):
+            self._out.append("_")
+        elif tag in (*_HEADING_LEVELS, *_BLOCK_TAGS, "li", "ul", "ol"):
+            self._out.append("\n")
+
+    def handle_data(self, data: str) -> None:
+        if self._skip_depth:
+            return
+        self._out.append(data)
+
+    def get_markdown(self) -> str:
+        text = "".join(self._out)
+        text = unescape(text)
+        text = re.sub(r"[ \t]+", " ", text)
+        text = re.sub(r"[ \t]*\n[ \t]*", "\n", text)
+        text = re.sub(r"\n{3,}", "\n\n", text)
+        stripped = text.strip()
+        return f"{stripped}\n" if stripped else ""
+
+
+def html_to_md(html_content: str) -> str:
+    """Convert self-contained HTML content into a readable Markdown companion.
+
+    Best-effort, dependency-free conversion: headings, paragraphs, lists,
+    bold/italic and links are preserved as Markdown; everything else
+    degrades to plain text. ``<script>``/``<style>`` content is dropped
+    entirely so generated CSS/JS never leaks into the companion.
+    """
+    parser = _HtmlToMdParser()
+    parser.feed(html_content)
+    parser.close()
+    return parser.get_markdown()

{raise_cli-3.1.2 → raise_cli-3.1.4}/src/raise_cli/backlog/migrate.py

@@ -22,13 +22,14 @@ from pydantic import BaseModel
 
 from raise_cli.adapters.filesystem import FilesystemPMAdapter
 from raise_cli.adapters.filesystem_models import BacklogItem
+from raise_cli.adapters.id_utils import DEFAULT_ID_PATTERN, work_id_re
 from raise_cli.adapters.key_gen import issue_type_to_work_item_type
 from raise_cli.storage.work_items import WorkItem, WorkItemStore
 
 # D5: strict wire-key shape. Excludes local-only keys (E1, S1.1) and
 # hex-suffixed staged keys (TMP-7D983BB0) that `_save_item`'s looser
-# `not key.startswith("e")` heuristic would mis-tag as Jira keys.
-_WIRE_KEY_RE = re.compile(r"[A-Z][A-Z0-9]*-\d+")
+# `not key.startswith("e")` heuristic would mis-tag as remote keys.
+_WIRE_KEY_RE = work_id_re(DEFAULT_ID_PATTERN)
 
 # D11: work_items columns eligible for the fill-only-empty update rule,
 # in a fixed order so `MigrationAction.fields` is deterministic.
@@ -45,9 +46,9 @@ _FILL_ONLY_EMPTY_FIELDS: tuple[str, ...] = (
 )
 
 
-def _wire_key(key: str | None) -> str | None:
+def _wire_key(key: str | None, *, id_re: re.Pattern[str] = _WIRE_KEY_RE) -> str | None:
     """Return *key* iff it strictly matches the wire-key shape (D5), else None."""
-    if key and _WIRE_KEY_RE.fullmatch(key):
+    if key and id_re.fullmatch(key):
         return key
     return None