raise-cli 3.1.4__tar.gz → 3.1.6__tar.gz

{raise_cli-3.1.4 → raise_cli-3.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: raise-cli
-Version: 3.1.4
+Version: 3.1.6
 Summary: RaiSE CLI - Reliable AI Software Engineering governance framework
 Project-URL: Homepage, https://raiseframework.ai
 Project-URL: Documentation, https://docs.raiseframework.ai
@@ -18,7 +18,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Topic :: Software Development :: Quality Assurance
 Requires-Python: >=3.12
-Requires-Dist: atlassian-python-api>=3.41.0
+Requires-Dist: atlassian-python-api<5,>=3.41.0
 Requires-Dist: httpx<1.0,>=0.27.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: logfire-api>=4.0
@@ -33,7 +33,7 @@ Requires-Dist: pydantic>=2.6.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: pyyaml>=6.0.1
 Requires-Dist: qrcode>=8.2
-Requires-Dist: raise-core==3.1.4
+Requires-Dist: raise-core==3.1.6
 Requires-Dist: rich>=13.7.0
 Requires-Dist: ruamel-yaml>=0.18
 Requires-Dist: textual>=0.89.0

{raise_cli-3.1.4 → raise_cli-3.1.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "raise-cli"
-version = "3.1.4"
+version = "3.1.6"
 description = "RaiSE CLI - Reliable AI Software Engineering governance framework"
 authors = [
     {name = "Emilio Osorio", email = "emilio@humansys.ai"}
@@ -21,7 +21,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "raise-core==3.1.4",
+    "raise-core==3.1.6",
     "typer>=0.12.0",
     "rich>=13.7.0",
     "pydantic>=2.6.0",
@@ -43,7 +43,7 @@ dependencies = [
     "httpx>=0.27.0,<1.0",
     "mcp>=1.26,<2",
     "markdown>=3.6",
-    "atlassian-python-api>=3.41.0",
+    "atlassian-python-api>=3.41.0,<5",
     "qrcode>=8.2",
     "onnxruntime>=1.18.0",
     "tokenizers>=0.19",
@@ -108,6 +108,7 @@ format = "raise_cli.gates.builtin.format:FormatGate"
 suppression-ratchet = "raise_cli.gates.builtin.suppression_ratchet:SuppressionRatchetGate"
 graph-applies-to-rc1 = "raise_cli.gates.builtin.graph_applies_to:GraphAppliesToGate"
 generated-artifact-hygiene = "raise_cli.gates.repository_hygiene:GeneratedArtifactHygieneGate"
+subprocess-stdin = "raise_cli.gates.subprocess_stdin_gate:SubprocessStdinGate"
 governance-freshness = "raise_cli.gates.governance_freshness:GovernanceFreshnessGate"
 epic-governance-freshness = "raise_cli.gates.governance_freshness:EpicGovernanceFreshnessGate"
 drift-post-refactor-orphan = "raise_cli.gates.drift.post_refactor_orphan:PostRefactorOrphanGate"
@@ -162,6 +163,7 @@ runtimes = "raise_cli.doctor.checks.runtimes:RuntimesCheck"
 bob = "raise_cli.doctor.checks.bob:BobIntegrationCheck"
 skills = "raise_cli.doctor.checks.skills:SkillCommandReferenceCheck"
 local-db = "raise_cli.doctor.checks.local_db:LocalDbCheck"
+storage-health = "raise_cli.doctor.checks.storage_health:StorageHealthCheck"
 acli = "raise_cli.doctor.checks.acli:AcliCheck"
 server-connectivity = "raise_cli.doctor.checks.onboarding:ServerConnectivityCheck"
 graph-state = "raise_cli.doctor.checks.onboarding:GraphStateCheck"

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/adapters/filesystem_docs.py

@@ -61,7 +61,9 @@ class FilesystemDocsTarget:
             return error
         path = self._root / raw_path
         path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(content)
+        path.write_text(
+            content, encoding="utf-8"
+        )  # RAISE-17565: explícito, independiente del locale del OS
         return PublishResult(
             success=True, url=str(path), message="Written to filesystem"
         )

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/adapters/jira_adapter.py

@@ -530,7 +530,17 @@ class PythonApiJiraAdapter:
             return FieldSchema.from_legacy_string(raw)
         return raw
 
-    def _wrap_user_field(self, value: str, client: JiraClient) -> dict[str, Any]:
+    # Sentinel values that mean "unassign" — map to assignee: null (RAISE-18889).
+    _UNASSIGN_SENTINELS: frozenset[str] = frozenset({"", "none"})
+
+    def _wrap_user_field(self, value: str, client: JiraClient) -> dict[str, Any] | None:
+        """Resolve a user string to a Jira accountId object.
+
+        Returns ``None`` when *value* is an unassign sentinel (``""`` or
+        ``"none"``), which serialises as ``assignee: null`` in Jira REST calls.
+        """
+        if value in self._UNASSIGN_SENTINELS:
+            return None
         users = client.search_users(value)
         if not users:
             raise JiraApiError(f"No Jira user found for '{value}'")
@@ -544,7 +554,11 @@ class PythonApiJiraAdapter:
             return values
         item_type = items.get("type", "string")
         if item_type == "user":
-            return [self._wrap_user_field(v, client) for v in values]
+            # Filter out None results — _wrap_user_field returns None for
+            # unassign sentinels; null is invalid inside a Jira array field.
+            return [
+                w for v in values if (w := self._wrap_user_field(v, client)) is not None
+            ]
         if item_type == "option":
             return [{"value": v} for v in values]
         return values
@@ -635,7 +649,12 @@ class PythonApiJiraAdapter:
     # ── CRUD ────────────────────────────────────────────────────────
 
     async def create_issue(self, project_key: str, issue: IssueSpec) -> IssueRef:
-        """Create a Jira issue via REST API."""
+        """Create a Jira issue via REST API.
+
+        Assignee is applied via a dedicated POST-creation call (RAISE-18889) because
+        Jira silently discards the ``assignee`` field in the creation payload for many
+        project/screen configurations. This mirrors the behaviour of the Jira MCP.
+        """
         client = self._client_for(project_key)
         fields: dict[str, Any] = {
             "project": {"key": project_key},
@@ -646,13 +665,45 @@ class PythonApiJiraAdapter:
             fields["description"] = markdown_to_adf(issue.description)
         if issue.labels:
             fields["labels"] = issue.labels
-        fields.update(issue.metadata or {})
+        metadata = dict(issue.metadata or {})
+
+        # Extract assignee before building the POST payload — Jira ignores the field
+        # in the creation request, so we apply it separately after create.
+        # Only extract string values; dict values (escape hatch, RAISE-1596) are left
+        # in metadata and should not be sent to Jira either, so we pop them and resolve
+        # the accountId directly.
+        assignee_raw: str | None = None
+        assignee_account_id: str | None = None
+        _assignee_requested = False
+        if "assignee" in metadata:
+            _assignee_requested = True
+            raw = metadata.pop("assignee")
+            if isinstance(raw, str):
+                assignee_raw = raw
+            elif isinstance(raw, dict):
+                # Escape hatch: caller already provided {"accountId": "..."}.
+                assignee_account_id = raw.get("accountId")
+
+        fields.update(metadata)
         if issue.parent:
             fields["parent"] = {"key": issue.parent}
 
         self._wrap_fields(fields, client)
         result = client.create_issue(fields)
         key = result.get("key", "")
+
+        if _assignee_requested:
+            if assignee_raw is not None:
+                # _wrap_user_field returns None for sentinels ("" / "none") → unassign.
+                wrapped = self._wrap_user_field(assignee_raw, client)
+                assignee_account_id = wrapped["accountId"] if wrapped else None
+            try:
+                client.assign_issue(key, assignee_account_id)
+            except Exception as exc:
+                raise JiraApiError(
+                    f"Issue {key!r} created but assignee could not be set: {exc}"
+                ) from exc
+
         return IssueRef(key=key, url=self._build_url(key))
 
     async def get_issue(self, key: str) -> IssueDetail:

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/adapters/jira_client.py

@@ -523,6 +523,20 @@ class JiraClient:
         except Exception as e:
             raise self._map_error(e, f"search_users({query!r})") from e
 
+    def assign_issue(self, key: str, account_id: str | None) -> None:
+        """Assign or unassign an issue via the dedicated assignee endpoint.
+
+        Args:
+            key: Issue key (e.g. ``RAISE-100``).
+            account_id: Jira account ID to assign to, or ``None`` to unassign.
+        """
+        try:
+            self._client.assign_issue(key, account_id)  # type: ignore[no-untyped-call]
+        except JiraAdapterError:
+            raise
+        except Exception as e:
+            raise self._map_error(e, f"assign_issue({key!r})") from e
+
     # ── Comments ─────────────────────────────────────────────────────
 
     def add_comment(self, key: str, body: str | dict[str, Any]) -> dict[str, Any]:

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/adapters/sqlite_pm.py

@@ -336,6 +336,13 @@ class SQLitePMAdapter:
                 canonical = "parent_local_key"
             if canonical in _LIST_TYPED_FIELDS and isinstance(value, str):
                 value = [value] if value else []
+            # Jira's `[{"name": "3.1.6"}]` shape (assign_fix_version) → names
+            # (RAISE-18975).
+            if canonical in _LIST_TYPED_FIELDS and isinstance(value, list):
+                value = [
+                    v["name"] if isinstance(v, dict) and "name" in v else v
+                    for v in value
+                ]
             if canonical in _UPDATABLE_FIELDS:
                 old_value = getattr(wi, canonical, None)
                 if isinstance(old_value, list):

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/agents/claude_plugin.py

@@ -43,7 +43,9 @@ SETTINGS_USER_PROMPT_SUBMIT_BLOCK: dict[str, Any] = {
 # shape purge.py compares against to detect a fully rai-owned, unmodified
 # file (D1/D2, same pattern as MCP_JSON_CONTENT in purge.py).
 SETTINGS_JSON_CONTENT: dict[str, Any] = {
-    "hooks": {"UserPromptSubmit": [SETTINGS_USER_PROMPT_SUBMIT_BLOCK]}
+    "hooks": {"UserPromptSubmit": [SETTINGS_USER_PROMPT_SUBMIT_BLOCK]},
+    # RAISE-19272: must mirror post_init so rai purge recognises a pristine file.
+    "disabledMcpjsonServers": ["rai-workspace"],
 }
 
 
@@ -102,6 +104,11 @@ class ClaudePlugin:
                     break
         else:
             ups_hooks.append(hook_block)
+        # RAISE-19272: 3.1.6 pipelines run CLI-only — keep the rai-workspace MCP
+        # server listed in .mcp.json but disabled. Opt back in by removing it.
+        disabled: list[str] = settings.setdefault("disabledMcpjsonServers", [])
+        if "rai-workspace" not in disabled:
+            disabled.append("rai-workspace")
         settings_path.write_text(json.dumps(settings, indent=2), encoding="utf-8")
 
         return [str(settings_path.relative_to(project_root))]

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/agents/codex_plugin.py

@@ -19,6 +19,7 @@ from raise_cli.mcp.workspace_config import (
     detect_mcp_pipeline_command,
     render_codex_config_toml,
 )
+from raise_cli.skills.sync import skill_names as _skill_names
 
 _HOOKS_JSON: dict[str, Any] = {
     "hooks": {
@@ -278,6 +279,13 @@ class CodexPlugin:
         source_skills_dir = project_root / ".agent" / "skills"
         if source_skills_dir.is_dir():
             shutil.copytree(source_skills_dir, plugin_skills_dir, dirs_exist_ok=True)
+            # Remove stale skill dirs that no longer exist in source — prevents
+            # ghost entries after a rename from dirtying the tree on every sync
+            # (RAISE-18967).  Use the shared skill_names() helper so the
+            # definition of "skill directory" is consistent with SkillSyncer.
+            source_names = _skill_names(source_skills_dir)
+            for name in _skill_names(plugin_skills_dir) - source_names:
+                shutil.rmtree(plugin_skills_dir / name)
         else:
             plugin_skills_dir.mkdir(parents=True, exist_ok=True)
 

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/artifacts/models.py

@@ -126,6 +126,7 @@ class ReviewArtifact(ArtifactBase):
     review_type: Literal["architecture", "quality"]
     findings: list[dict[str, Any]]
     verdict: Literal["approved", "needs_changes", "rejected"]
+    route: str = ""  # skill that produced the review (RAISE-19203)
 
 
 class RetroArtifact(ArtifactBase):

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/backlog/close_drift.py

@@ -113,6 +113,7 @@ def _run_git(project_root: Path, *args: str) -> subprocess.CompletedProcess[str]
             check=False,
             capture_output=True,
             text=True,
+            stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
         )
     except OSError:
         return None
@@ -234,6 +235,7 @@ def fetch_dev_ref(project_root: Path, dev_branch: str) -> str | None:
             check=False,
             capture_output=True,
             text=True,
+            stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
         )
     except OSError as exc:
         return str(exc)

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/backlog/hooks.py

@@ -14,6 +14,7 @@ S15036 adds:
 
 from __future__ import annotations
 
+import json
 import logging
 import subprocess
 from datetime import UTC, datetime
@@ -76,6 +77,7 @@ def apply_transition(project: Path, jira_key: str, status: str) -> str | None:
             timeout=_TRANSITION_TIMEOUT_S,
             check=False,
             cwd=project,
+            stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
         )
     except (OSError, subprocess.TimeoutExpired) as exc:
         log_transition(
@@ -128,6 +130,14 @@ def pipeline_run_active() -> bool:
     return any_pipeline_run_active()
 
 
+def _current_fix_versions(project: Path, jira_key: str) -> list[str]:
+    """Read the issue's current fixVersion names from the configured PM adapter."""
+    from raise_cli.adapters.resolve import resolve_pm_adapter
+
+    detail = resolve_pm_adapter(None, project).get_issue(jira_key)
+    return list(detail.fix_versions or ())
+
+
 def assign_fix_version(project: Path, jira_key: str, version: str) -> str | None:
     """Assign ``fixVersion`` via the ``rai backlog update`` JSON escape hatch.
 
@@ -135,11 +145,22 @@ def assign_fix_version(project: Path, jira_key: str, version: str) -> str | None
     new CLI surface is introduced. Returns an error message on failure or
     ``None`` on success (RAISE-10966).
 
+    The existing fixVersions are kept: the write sends their union with
+    ``version`` and is skipped when ``version`` is already present.
+
     Extracted from ``raise_cli.story.open_service._assign_fix_version``
     (RAISE-15033) so the engine can own fixVersion assignment and skills
     can delegate without duplicating the logic.
     """
-    payload = f'fixVersions=[{{"name": "{version}"}}]'
+    try:
+        current = _current_fix_versions(project, jira_key)
+    except Exception as exc:  # noqa: BLE001 — never write blind over an unread list
+        return f"fixVersion assign failed: could not read current fixVersions: {exc}"
+    if version in current:
+        return None
+    # Jira replaces the whole list on update — send the union (RAISE-18975 C1).
+    names = [*dict.fromkeys(current), version]
+    payload = "fixVersions=" + json.dumps([{"name": n} for n in names])
     try:
         proc = subprocess.run(
             ["rai", "backlog", "update", jira_key, "-F", payload],
@@ -148,6 +169,7 @@ def assign_fix_version(project: Path, jira_key: str, version: str) -> str | None
             timeout=_TRANSITION_TIMEOUT_S,
             check=False,
             cwd=project,
+            stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
         )
     except (OSError, subprocess.TimeoutExpired) as exc:
         return f"fixVersion assign failed: {exc}"

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/backlog/merge_gate.py

@@ -142,6 +142,7 @@ def _run_git(args: list[str], repo: Path) -> subprocess.CompletedProcess[str]:
         capture_output=True,
         text=True,
         check=False,
+        stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
     )
 
 

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/backlog/mr_classify.py

@@ -89,6 +89,7 @@ def _run_glab(
             capture_output=True,
             text=True,
             encoding="utf-8",
+            stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
         )
     except OSError:
         return None

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/backlog/seed.py

@@ -35,6 +35,7 @@ def extract_raise_keys(
         capture_output=True,
         text=True,
         check=False,
+        stdin=subprocess.DEVNULL,  # RAISE-18877: prevent Win32 handle inheritance
     )
     keys = set(_RAISE_KEY_RE.findall(result.stdout))
     return sorted(keys)

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/cli/commands/backlog.py

@@ -258,7 +258,9 @@ def _resolve_description(
 # Jira issue-type values (`Bug`, `Task`, ...) are always capitalized in this
 # codebase's convention (FIXED_PREFIXES keys are `Epic`/`Story`/`Bug`), so
 # `-t Task` (default) keeps meaning "Jira Task issue type, remote-only"
-# while `-t task` (lowercase) means the new ontology type.
+# while `-t task` (lowercase) means the new ontology type. Exception:
+# `create --local` matches case-insensitively (RAISE-19267) — there is no
+# remote path for it to fall back to.
 _ONTOLOGY_TYPES = frozenset({"theme", "initiative", "epic", "story", "task"})
 
 
@@ -503,6 +505,42 @@ def version_create(
     console.print(f"{label}: {version.name}")
 
 
+def _create_local_only(
+    *,
+    summary: str,
+    project: str,
+    issue_type: str,
+    parent: str | None,
+    description: str,
+    format: str,
+) -> None:
+    """`create --local` path: SQLite work_items only, no adapter (RAISE-19267).
+
+    Case-insensitive on the type so the Jira-style ``-t Story`` works too.
+    Localized aliases are honored best-effort: a broken or Jira-only backlog
+    config must never block a local create.
+    """
+    with contextlib.suppress(Exception):
+        issue_type = _resolve_issue_type_alias(issue_type, None)
+    issue_type = issue_type.lower()
+    if not _is_ontology_type(issue_type):
+        console.print(
+            f"[red]Error:[/red] --local requires an ontology type "
+            f"(epic, story, ...); got {issue_type!r}"
+        )
+        raise typer.Exit(1)
+    _create_work_item(
+        summary=summary,
+        project=project,
+        issue_type=cast("WorkItemType", issue_type),
+        parent=parent,
+        description=description,
+        local=True,
+        format=format,
+        pm=None,
+    )
+
+
 @backlog_app.command()
 def create(
     summary: Annotated[str, typer.Argument(help="Issue title")],
@@ -575,6 +613,20 @@ def create(
 ) -> None:
     """Create a new backlog item."""
     _validate_format(format)
+    if local:
+        # RAISE-19267: --local is local-first — never resolve the adapter or
+        # load backlog config (both validate Jira and fail without it).
+        _create_local_only(
+            summary=summary,
+            project=project,
+            issue_type=issue_type,
+            parent=parent,
+            description=_resolve_description(
+                description, description_file, description_stdin
+            ),
+            format=format,
+        )
+        return
     pm = resolve_adapter(adapter)
     # Resolve localized type alias (e.g. "Historia" → "Story") before creating.
     issue_type = _resolve_issue_type_alias(issue_type, adapter)
@@ -1840,7 +1892,7 @@ def sync(
         result = sync_backlog(
             remote_pm,
             adapter_name,
-            project_filter=project,
+            project_filter=project_key,
             output_path=output_path,
         )
     except ValueError as exc:

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/cli/commands/connect.py

@@ -77,6 +77,7 @@ def _handle_approved(server: str, poll_data: dict[str, object], api_key: str) ->
         "api_key": api_key,
         "org_id": poll_data.get("org_id"),
         "org_name": poll_data.get("org_name"),
+        "org_slug": poll_data.get("org_slug"),
         "member_id": poll_data.get("member_id"),
         "email": poll_data.get("email"),
         "role": poll_data.get("role"),
@@ -184,7 +185,76 @@ def _start_device_flow(
     return resp.json()  # type: ignore[no-any-return]
 
 
-def connect_command(
+_SELF_REVOKE_ENDPOINT = "/api/v2/api-keys/self"
+
+
+def _read_existing_connection() -> dict[str, Any] | None:
+    """Return server.json contents, or None if absent/unreadable/incomplete."""
+    path = _get_server_credentials_path()
+    if not path.is_file():
+        return None
+    try:
+        raw: Any = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return None
+    if not isinstance(raw, dict):
+        return None
+    return {str(k): v for k, v in raw.items()}  # pyright: ignore[reportUnknownVariableType,reportUnknownArgumentType]
+
+
+def _show_connection_status(conn: dict[str, Any]) -> None:
+    console.print("[green]Already connected.[/green]")
+    console.print(f"  Organization: [bold]{conn.get('org_name')}[/bold]")
+    console.print(f"  Email: {conn.get('email')}")
+    console.print(f"  Role: {conn.get('role')}")
+
+
+def _is_different_org(conn: dict[str, Any], org_slug: str | None) -> bool:
+    """True only when both slugs are known and differ (legacy files: False)."""
+    existing = conn.get("org_slug")
+    return bool(org_slug and existing and existing.lower() != org_slug.lower())
+
+
+def _revoke_existing_key(conn: dict[str, Any]) -> None:
+    """Best-effort server-side self-revoke; never raises (D6/D7)."""
+    server_url = conn.get("server_url")
+    api_key = conn.get("api_key")
+    if not server_url or not api_key:
+        return
+    try:
+        resp = httpx.delete(
+            f"{str(server_url).rstrip('/')}{_SELF_REVOKE_ENDPOINT}",
+            headers={"Authorization": f"Bearer {api_key}"},
+            timeout=10,
+        )
+    except httpx.HTTPError:
+        console.print(
+            "[yellow]Warning:[/yellow] Could not reach server -- "
+            "key may still be active remotely."
+        )
+        return
+    # 401/404 mean the key is already revoked/unknown: nothing left to revoke.
+    if resp.status_code >= 500:
+        console.print(
+            "[yellow]Warning:[/yellow] Server error during revoke -- "
+            "key may still be active remotely."
+        )
+
+
+def disconnect_command() -> None:
+    """Revoke this machine's server key (best-effort) and delete local credentials."""
+    path = _get_server_credentials_path()
+    if not path.is_file():
+        console.print("Not connected.")
+        return
+    conn = _read_existing_connection()
+    if conn is not None:
+        _revoke_existing_key(conn)
+    path.unlink(missing_ok=True)
+    console.print("[green]Disconnected.[/green] Local credentials removed.")
+
+
+def connect_command(  # noqa: C901
     org_slug: Annotated[
         str | None,
         typer.Argument(
@@ -197,9 +267,9 @@ def connect_command(
         typer.Option(
             "--server",
             "-s",
-            help="Server URL (default: https://api.raise.sh)",
+            help="Server URL (default: https://api.raise.works)",
         ),
-    ] = "https://api.raise.sh",
+    ] = "https://api.raise.works",
     no_bootstrap: Annotated[
         bool,
         typer.Option(
@@ -207,8 +277,30 @@ def connect_command(
             help="Skip team knowledge sync after connect (e.g. for CI environments).",
         ),
     ] = False,
+    force: Annotated[
+        bool,
+        typer.Option(
+            "--force",
+            help="Revoke the existing connection (best-effort) and reconnect.",
+        ),
+    ] = False,
 ) -> None:
     """Connect this machine to a RaiSE server using device authorization."""
+    if org_slug:
+        org_slug = org_slug.lower()  # slugs are canonically lowercase (RAISE-19112)
+    if (conn := _read_existing_connection()) is not None:
+        if force:
+            _revoke_existing_key(conn)
+            _get_server_credentials_path().unlink(missing_ok=True)
+        else:
+            _show_connection_status(conn)
+            if _is_different_org(conn, org_slug):
+                console.print(
+                    f"[red]Already connected to {conn.get('org_name')}.[/red] "
+                    "Run `rai disconnect` first, or `rai connect --force`."
+                )
+                raise typer.Exit(1)
+            raise typer.Exit(0)
     client = httpx.Client(base_url=server, timeout=10)
 
     if org_slug:

{raise_cli-3.1.4 → raise_cli-3.1.6}/src/raise_cli/cli/commands/gate.py

@@ -82,13 +82,13 @@ def _print_result(result: GateResult) -> None:
     the never-evaluated drift gates read as healthy for months.
     """
     if not result.passed:
-        marker = "[red]{CROSS}[/red]"
+        marker = "[red]✗[/red]"
     elif result.skipped:
-        marker = "[yellow]{SKIP}[/yellow]"
+        marker = "[yellow]~[/yellow]"
     elif result.advisory and result.details:
-        marker = "[yellow]{WARN}[/yellow]"
+        marker = "[yellow]⚠[/yellow]"
     else:
-        marker = "[green]{CHECK}[/green]"
+        marker = "[green]✓[/green]"
     console.print(f"  {marker} {escape(result.gate_id)}: {escape(result.message)}")
     for detail in result.details:
         console.print(f"    {escape(detail)}")
@@ -157,12 +157,12 @@ def check_command(
         typer.Option("--format", "-f", help="Output format: human or json"),
     ] = "human",
     scope: Annotated[
-        str | None,
+        list[str],
         typer.Option(
             "--scope",
-            help="Append a path argument to the gate command (e.g. scope tests to a subdirectory)",
+            help="Append a path argument to the gate command (repeatable: --scope a/ --scope b/)",
         ),
-    ] = None,
+    ] = [],  # noqa: B006 — Typer requires a mutable default here; it is never mutated
     strict_drift: Annotated[
         bool,
         typer.Option(
@@ -196,7 +196,7 @@ def check_command(
         $ rai gate check drift-post-refactor-orphan --strict-drift
     """
     registry = _get_registry()
-    extra_args: tuple[str, ...] = (scope,) if scope else ()
+    extra_args: tuple[str, ...] = tuple(scope)
 
     exclusive = sum([bool(gate_id), all_gates, bool(point)])
     if exclusive > 1: