raise-cli 3.1.6__tar.gz → 3.1.7__tar.gz

{raise_cli-3.1.6 → raise_cli-3.1.7}/.gitignore

@@ -97,6 +97,8 @@ dev/output/
 .raise/rai/personal/calibration.jsonl
 .raise/rai/personal/patterns.jsonl
 .raise/rai/personal/active-session
+# Defense in depth: pipeline advance token files (RAISE-19640)
+.raise/rai/personal/*.token
 
 # RaiSE sync state (per-instance JIRA mappings, not shared)
 .raise/rai/sync/

{raise_cli-3.1.6 → raise_cli-3.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: raise-cli
-Version: 3.1.6
+Version: 3.1.7
 Summary: RaiSE CLI - Reliable AI Software Engineering governance framework
 Project-URL: Homepage, https://raiseframework.ai
 Project-URL: Documentation, https://docs.raiseframework.ai
@@ -23,7 +23,7 @@ Requires-Dist: httpx<1.0,>=0.27.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: logfire-api>=4.0
 Requires-Dist: markdown>=3.6
-Requires-Dist: mcp<2,>=1.26
+Requires-Dist: mcp<2,>=1.30.0
 Requires-Dist: networkx>=3.6.1
 Requires-Dist: numpy>=1.26.0
 Requires-Dist: onnxruntime>=1.18.0
@@ -33,7 +33,7 @@ Requires-Dist: pydantic>=2.6.0
 Requires-Dist: python-dotenv>=1.0.0
 Requires-Dist: pyyaml>=6.0.1
 Requires-Dist: qrcode>=8.2
-Requires-Dist: raise-core==3.1.6
+Requires-Dist: raise-core==3.1.7
 Requires-Dist: rich>=13.7.0
 Requires-Dist: ruamel-yaml>=0.18
 Requires-Dist: textual>=0.89.0

{raise_cli-3.1.6 → raise_cli-3.1.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "raise-cli"
-version = "3.1.6"
+version = "3.1.7"
 description = "RaiSE CLI - Reliable AI Software Engineering governance framework"
 authors = [
     {name = "Emilio Osorio", email = "emilio@humansys.ai"}
@@ -21,7 +21,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "raise-core==3.1.6",
+    "raise-core==3.1.7",
     "typer>=0.12.0",
     "rich>=13.7.0",
     "pydantic>=2.6.0",
@@ -41,7 +41,7 @@ dependencies = [
     "numpy>=1.26.0",
     "logfire-api>=4.0",
     "httpx>=0.27.0,<1.0",
-    "mcp>=1.26,<2",
+    "mcp>=1.30.0,<2",
     "markdown>=3.6",
     "atlassian-python-api>=3.41.0,<5",
     "qrcode>=8.2",

raise_cli-3.1.7/src/raise_cli/adapters/_html_shell.py

@@ -0,0 +1,26 @@
+# pyright: reportPrivateUsage=false
+"""Copper & Patina HTML shell para artefactos locales (RAISE-19213)."""
+
+from __future__ import annotations
+
+import html
+
+from raise_cli.ddd.tactical_report import _COPPER_PATINA_CSS
+
+
+def wrap_html_shell(title: str, body: str) -> str:
+    """Envolver body en un documento HTML con CSS Copper & Patina inline."""
+    return (
+        f"<!DOCTYPE html>\n"
+        f'<html lang="es">\n'
+        f"<head>\n"
+        f'  <meta charset="utf-8">\n'
+        f'  <meta name="viewport" content="width=device-width, initial-scale=1">\n'
+        f"  <title>{html.escape(title)}</title>\n"
+        f"  <style>{_COPPER_PATINA_CSS}</style>\n"
+        f"</head>\n"
+        f"<body>\n"
+        f"{body}\n"
+        f"</body>\n"
+        f"</html>"
+    )

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/composite_pm.py

@@ -25,6 +25,7 @@ from pydantic import ValidationError
 from raise_cli.adapters.errors import AdapterSyncError
 from raise_cli.adapters.filesystem_models import BacklogItem
 from raise_cli.adapters.id_utils import DEFAULT_ID_PATTERN, work_id_re
+from raise_cli.adapters.key_gen import issue_type_to_work_item_type
 from raise_cli.adapters.models import (
     AdapterHealth,
     AttachmentDetail,
@@ -159,6 +160,12 @@ class CompositeBacklogAdapter:
         if mapped:
             with contextlib.suppress(Exception):
                 self._wi_store.update_fields(wi.id, mapped)
+        retype_value = changes.get("issuetype") or changes.get("issue_type")
+        if retype_value is not None:
+            with contextlib.suppress(Exception):
+                new_type = issue_type_to_work_item_type(str(retype_value))
+                if new_type != wi.type:
+                    self._wi_store.retype(wi.id, new_type)
 
     def _write_through_to_local(
         self,
@@ -453,50 +460,123 @@ class CompositeBacklogAdapter:
         self._update_work_item_fields(key, {"status": status})
         return IssueRef(key=key, remote_synced=True)
 
+    def _rollback_local_transition(
+        self,
+        local_key: str,
+        prev_statuses: dict[str, str],
+    ) -> None:
+        """Best-effort rollback of a single local transition (RAISE-17085)."""
+        prev = prev_statuses.get(local_key)
+        if prev is not None:
+            with contextlib.suppress(Exception):
+                self._local.transition_issue(local_key, prev)
+
     def batch_transition(self, keys: list[str], status: str) -> BatchResult:
-        """Batch transition: local-canonical via filesystem, remote-native direct to remote."""
+        """Batch transition with transition_issue-grade safety (RAISE-17085).
+
+        Transitions are context-dependent and never queued for replay
+        (RAISE-4186). On remote failure, local state is rolled back.
+        """
         self._flush_pending()
         local_canonical = [k for k in keys if self._local_has_key(k)]
         remote_native = [k for k in keys if not self._local_has_key(k)]
 
-        merged: BatchResult = (
-            self._local.batch_transition(local_canonical, status)
-            if local_canonical
+        prev_statuses: dict[str, str] = {}
+        for k in local_canonical:
+            with contextlib.suppress(Exception):
+                prev_statuses[k] = self._local.get_issue(k).status
+
+        mapped_keys, unmapped_keys, remote_to_local = self._partition_by_ledger(
+            local_canonical
+        )
+
+        local_result: BatchResult = (
+            self._local.batch_transition(mapped_keys, status)
+            if mapped_keys
             else BatchResult()
         )
 
-        # remote_native: pass through as-is; local_canonical: resolve via ledger
-        remote_keys: list[str] = list(remote_native)
-        for k in local_canonical:
-            rk = self._wi_store.get_jira_key(k)
-            if rk is not None:
-                remote_keys.append(rk)
-            else:
-                self._pending.append("transition_issue", k, {"status": status})
+        succeeded: list[IssueRef] = list(local_result.succeeded)
+        failed: list[FailureDetail] = list(local_result.failed)
+        for k in unmapped_keys:
+            failed.append(FailureDetail(key=k, error="No remote mapping in ledger"))
+
+        # Only keys that transitioned locally go to remote (QR R1).
+        local_ok = [r.key for r in local_result.succeeded]
+        remote_to_local = {
+            rk: lk for rk, lk in remote_to_local.items() if lk in local_ok
+        }
+        remote_keys: list[str] = list(remote_native) + list(remote_to_local)
 
         if not remote_keys:
-            return merged
+            return BatchResult(succeeded=succeeded, failed=failed)
 
         remote_native_set = set(remote_native)
         for remote in self._remotes:
             try:
                 remote_result = remote.batch_transition(remote_keys, status)
-                merged = BatchResult(
-                    succeeded=merged.succeeded
-                    + [
-                        r for r in remote_result.succeeded if r.key in remote_native_set
-                    ],
-                    failed=merged.failed
-                    + [f for f in remote_result.failed if f.key in remote_native_set],
+                self._merge_remote_batch_result(
+                    remote_result,
+                    remote_native_set,
+                    remote_to_local,
+                    prev_statuses,
+                    succeeded,
+                    failed,
                 )
             except Exception as exc:  # noqa: BLE001 — intentional broad catch (grandfathered at BLE001 enablement, RAISE-15490)
-                self._pending.append(
-                    "batch_transition",
-                    ",".join(keys),
-                    {"status": status},
-                )
                 logger.warning("Remote batch_transition failed: %s", exc)
-        return merged
+                for lk in local_ok:
+                    self._rollback_local_transition(lk, prev_statuses)
+                    succeeded[:] = [r for r in succeeded if r.key != lk]
+                    failed.append(FailureDetail(key=lk, error=str(exc)))
+                for rk in remote_native:
+                    failed.append(FailureDetail(key=rk, error=str(exc)))
+                break
+
+        return BatchResult(succeeded=succeeded, failed=failed)
+
+    def _partition_by_ledger(
+        self, local_canonical: list[str]
+    ) -> tuple[list[str], list[str], dict[str, str]]:
+        """Split local-canonical keys into mapped/unmapped; build reverse map."""
+        mapped: list[str] = []
+        unmapped: list[str] = []
+        remote_to_local: dict[str, str] = {}
+        for k in local_canonical:
+            rk = self._wi_store.get_jira_key(k)
+            if rk is not None:
+                mapped.append(k)
+                remote_to_local[rk] = k
+            else:
+                unmapped.append(k)
+        return mapped, unmapped, remote_to_local
+
+    def _merge_remote_batch_result(
+        self,
+        remote_result: BatchResult,
+        remote_native_set: set[str],
+        remote_to_local: dict[str, str],
+        prev_statuses: dict[str, str],
+        succeeded: list[IssueRef],
+        failed: list[FailureDetail],
+    ) -> None:
+        """Merge remote BatchResult, rolling back local on per-key failures."""
+        remote_failed_keys = {f.key for f in remote_result.failed}
+
+        for r in remote_result.succeeded:
+            if r.key in remote_native_set:
+                succeeded.append(r)
+        for f in remote_result.failed:
+            if f.key in remote_native_set:
+                failed.append(f)
+
+        for rk, lk in remote_to_local.items():
+            if rk in remote_failed_keys:
+                self._rollback_local_transition(lk, prev_statuses)
+                succeeded[:] = [r for r in succeeded if r.key != lk]
+                detail = next((f for f in remote_result.failed if f.key == rk), None)
+                error = detail.error if detail else "Remote transition failed"
+                failed.append(FailureDetail(key=lk, error=error))
 
     def batch_create(self, issues: list[IssueSpec]) -> BatchResult:
         """Create multiple issues with per-item fault isolation."""
@@ -878,7 +958,7 @@ class CompositeBacklogAdapter:
                     self._reconcile_local_mirror(
                         promoted_ref.key, remote_ref.key, remote
                     )
-            except Exception as exc:  # noqa: BLE001
+            except Exception as exc:  # noqa: BLE001 — intentional broad catch (grandfathered at BLE001 enablement, RAISE-15490)
                 logger.warning(
                     "Replay create_issue %s failed on remote[%d]: %s", op.key, i, exc
                 )
@@ -934,7 +1014,7 @@ class CompositeBacklogAdapter:
             try:
                 remote.batch_transition(resolved, status)  # type: ignore[arg-type]
                 completed.append(i)
-            except Exception as exc:  # noqa: BLE001
+            except Exception as exc:  # noqa: BLE001 — intentional broad catch (grandfathered at BLE001 enablement, RAISE-15490)
                 logger.warning(
                     "Replay batch_transition %s failed on remote[%d]: %s",
                     op.key,
@@ -962,7 +1042,7 @@ class CompositeBacklogAdapter:
             try:
                 remote.link_to_parent(remote_child, remote_parent)
                 completed.append(i)
-            except Exception as exc:  # noqa: BLE001
+            except Exception as exc:  # noqa: BLE001 — intentional broad catch (grandfathered at BLE001 enablement, RAISE-15490)
                 logger.warning(
                     "Replay link_to_parent %s failed on remote[%d]: %s", op.key, i, exc
                 )
@@ -988,7 +1068,7 @@ class CompositeBacklogAdapter:
             try:
                 remote.link_issues(remote_source, remote_target, link_type)
                 completed.append(i)
-            except Exception as exc:  # noqa: BLE001
+            except Exception as exc:  # noqa: BLE001 — intentional broad catch (grandfathered at BLE001 enablement, RAISE-15490)
                 logger.warning(
                     "Replay link_issues %s failed on remote[%d]: %s", op.key, i, exc
                 )
@@ -1050,7 +1130,7 @@ class CompositeBacklogAdapter:
             try:
                 action(remote, remote_key)
                 completed.append(i)
-            except Exception as exc:  # noqa: BLE001
+            except Exception as exc:  # noqa: BLE001 — intentional broad catch (grandfathered at BLE001 enablement, RAISE-15490)
                 logger.debug(
                     "Replay %s %s failed on remote[%d]: %s", op.op, op.key, i, exc
                 )

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/confluence_client.py

@@ -708,15 +708,37 @@ class ConfluenceClient:
             parent_title=parent_title,
         )
 
+    @staticmethod
+    def _extract_status(error: Exception) -> int | None:
+        """Extract the HTTP status code from an atlassian exception.
+
+        atlassian stores the originating HTTPError as ``error.reason``; the
+        requests HTTPError carries the response on ``error.response``.  As a
+        fallback we also check ``error.response`` directly (for callers that
+        surface the raw HTTPError).
+        """
+        reason = getattr(error, "reason", None)
+        # RAISE-19457 adversarial panel F2: use ``is None`` not truthiness.
+        # A requests.Response with a 4xx/5xx status code is falsy (ok=False),
+        # so the old ``or`` check would fall through and lose the status_code.
+        response = getattr(reason, "response", None)
+        if response is None:
+            response = getattr(error, "response", None)
+        status: int | None = getattr(response, "status_code", None)
+        return status
+
     @staticmethod
     def _map_error(error: Exception, context: str) -> ConfluenceError:
         """Map atlassian exceptions to our hierarchy using isinstance."""
         from atlassian.errors import ApiError, ApiNotFoundError, ApiPermissionError
 
+        status = ConfluenceClient._extract_status(error)
         if isinstance(error, ApiPermissionError):
-            return ConfluenceAuthError(f"{context}: {error}")
+            return ConfluenceAuthError(f"{context}: {error}", status_code=status)
         if isinstance(error, ApiNotFoundError):
-            return ConfluenceNotFoundError(f"{context}: {error}")
+            return ConfluenceNotFoundError(f"{context}: {error}", status_code=status)
         if isinstance(error, ApiError):
-            return ConfluenceApiError(f"{context}: {error}")
-        return ConfluenceApiError(f"{context}: unexpected error: {error}")
+            return ConfluenceApiError(f"{context}: {error}", status_code=status)
+        return ConfluenceApiError(
+            f"{context}: unexpected error: {error}", status_code=status
+        )

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/confluence_exceptions.py

@@ -16,22 +16,25 @@ from __future__ import annotations
 class ConfluenceError(Exception):
     """Base for all Confluence client errors."""
 
-    def __init__(self, message: str) -> None:
+    def __init__(self, message: str, status_code: int | None = None) -> None:
         self.message = message
+        self.status_code = status_code
         super().__init__(message)
 
 
 class ConfluenceAuthError(ConfluenceError):
     """401/403 — invalid or missing credentials."""
 
+    def __init__(self, message: str, status_code: int | None = None) -> None:
+        super().__init__(message, status_code=status_code)
+
 
 class ConfluenceNotFoundError(ConfluenceError):
     """404 — page, space, or resource not found."""
 
+    def __init__(self, message: str, status_code: int | None = None) -> None:
+        super().__init__(message, status_code=status_code)
+
 
 class ConfluenceApiError(ConfluenceError):
     """Generic API error (incl. post-retry 429, 5xx, etc)."""
-
-    def __init__(self, message: str, status_code: int | None = None) -> None:
-        self.status_code = status_code
-        super().__init__(message)

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/filesystem_docs.py

@@ -49,7 +49,11 @@ class FilesystemDocsTarget:
         metadata: dict[str, Any],
         format: str = "markdown",
     ) -> PublishResult:
-        """Write content to local file at metadata['path']. format is unused (RAISE-16870 D5)."""
+        """Write content to local file at metadata['path'].
+
+        When format='html', wraps content in Copper & Patina HTML shell
+        (RAISE-19213). Otherwise writes verbatim (RAISE-16870 D5).
+        """
         raw_path = metadata.get("path")
         if not raw_path:
             return PublishResult(
@@ -59,6 +63,11 @@ class FilesystemDocsTarget:
         error = self._validate_frontmatter(content, doc_type)
         if error:
             return error
+        if format == "html":
+            from raise_cli.adapters._html_shell import wrap_html_shell
+
+            title = metadata.get("title", "")
+            content = wrap_html_shell(title, content)
         path = self._root / raw_path
         path.parent.mkdir(parents=True, exist_ok=True)
         path.write_text(

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/jira_adapter.py

@@ -597,6 +597,8 @@ class PythonApiJiraAdapter:
     ) -> Any:
         """Wrap value based on Jira field schema — universal dispatch (S2503.20)."""
         if field_id in self._KEY_OBJECT_FIELDS:
+            if isinstance(value, str) and value in self._UNASSIGN_SENTINELS:
+                return None
             return {"key": value} if isinstance(value, str) else value
         if field_id in self._ARRAY_NAME_OBJECT_FIELDS:
             if isinstance(value, str):

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/jira_client.py

@@ -1073,15 +1073,35 @@ class JiraClient:
 
     # ── Internal ─────────────────────────────────────────────────────
 
+    @staticmethod
+    def _extract_status(error: Exception) -> int | None:
+        """Extract the HTTP status code from an atlassian exception.
+
+        atlassian stores the originating HTTPError as ``error.reason``; the
+        requests HTTPError carries the response on ``error.response``.  As a
+        fallback we also check ``error.response`` directly (for callers that
+        surface the raw HTTPError).
+        """
+        reason = getattr(error, "reason", None)
+        # RAISE-19457 adversarial panel F2: use ``is None`` not truthiness.
+        # A requests.Response with a 4xx/5xx status code is falsy (ok=False),
+        # so the old ``or`` check would fall through and lose the status_code.
+        response = getattr(reason, "response", None)
+        if response is None:
+            response = getattr(error, "response", None)
+        status: int | None = getattr(response, "status_code", None)
+        return status
+
     @staticmethod
     def _map_error(error: Exception, context: str) -> JiraAdapterError:
         """Map atlassian exceptions to our hierarchy using isinstance."""
         from atlassian.errors import ApiError, ApiNotFoundError, ApiPermissionError
 
+        status = JiraClient._extract_status(error)
         if isinstance(error, ApiPermissionError):
-            return JiraAuthError(f"{context}: {error}")
+            return JiraAuthError(f"{context}: {error}", status_code=status)
         if isinstance(error, ApiNotFoundError):
-            return JiraNotFoundError(f"{context}: {error}")
+            return JiraNotFoundError(f"{context}: {error}", status_code=status)
         if isinstance(error, ApiError):
-            return JiraApiError(f"{context}: {error}")
-        return JiraApiError(f"{context}: unexpected error: {error}")
+            return JiraApiError(f"{context}: {error}", status_code=status)
+        return JiraApiError(f"{context}: unexpected error: {error}", status_code=status)

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/jira_exceptions.py

@@ -16,22 +16,25 @@ from __future__ import annotations
 class JiraAdapterError(Exception):
     """Base for all Jira client errors."""
 
-    def __init__(self, message: str) -> None:
+    def __init__(self, message: str, status_code: int | None = None) -> None:
         self.message = message
+        self.status_code = status_code
         super().__init__(message)
 
 
 class JiraAuthError(JiraAdapterError):
     """401/403 — invalid or missing credentials."""
 
+    def __init__(self, message: str, status_code: int | None = None) -> None:
+        super().__init__(message, status_code=status_code)
+
 
 class JiraNotFoundError(JiraAdapterError):
     """404 — issue, project, or resource not found."""
 
+    def __init__(self, message: str, status_code: int | None = None) -> None:
+        super().__init__(message, status_code=status_code)
+
 
 class JiraApiError(JiraAdapterError):
     """Generic API error (incl. post-retry 429, 5xx, etc)."""
-
-    def __init__(self, message: str, status_code: int | None = None) -> None:
-        self.status_code = status_code
-        super().__init__(message)

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/adapters/sqlite_pm.py

@@ -16,7 +16,7 @@ import re
 import uuid
 from datetime import UTC, datetime
 from pathlib import Path
-from typing import Any
+from typing import Any, cast
 
 from raise_cli.adapters.filesystem_models import BacklogItem
 from raise_cli.adapters.key_gen import (
@@ -322,6 +322,27 @@ class SQLitePMAdapter:
         self._store.create(work_item)
         return IssueRef(key=key)
 
+    def _apply_retype(self, wi: WorkItem, value: object, author: str) -> None:
+        """Apply an issue_type change via the dedicated retype path."""
+        new_type = issue_type_to_work_item_type(str(value))
+        if new_type != wi.type:
+            self._store.append_changelog(wi.id, "type", wi.type, new_type, author)
+            self._store.retype(wi.id, new_type)
+
+    @staticmethod
+    def _normalize_list_value(value: object) -> object:
+        """Coerce a list-typed field value to a list of names."""
+        if isinstance(value, str):
+            return [value] if value else []
+        # Jira's `[{"name": "3.1.6"}]` shape (assign_fix_version) → names
+        # (RAISE-18975).
+        if isinstance(value, list):
+            return [
+                v["name"] if isinstance(v, dict) and "name" in v else v
+                for v in cast("list[Any]", value)
+            ]
+        return value
+
     def update_issue(self, key: str, fields: dict[str, Any]) -> IssueRef:
         """Update fields on an existing issue. Writes changelog for each change."""
         wi = self._resolve_work_item(key)
@@ -331,18 +352,14 @@ class SQLitePMAdapter:
             canonical = _JIRA_FIELD_ALIASES.get(field_name, field_name)
             if canonical in _IMMUTABLE_FIELDS:
                 continue
+            if canonical == "issue_type":
+                self._apply_retype(wi, value, author)
+                continue
             # Map to updatable field names
             if canonical == "parent":
                 canonical = "parent_local_key"
-            if canonical in _LIST_TYPED_FIELDS and isinstance(value, str):
-                value = [value] if value else []
-            # Jira's `[{"name": "3.1.6"}]` shape (assign_fix_version) → names
-            # (RAISE-18975).
-            if canonical in _LIST_TYPED_FIELDS and isinstance(value, list):
-                value = [
-                    v["name"] if isinstance(v, dict) and "name" in v else v
-                    for v in value
-                ]
+            if canonical in _LIST_TYPED_FIELDS:
+                value = self._normalize_list_value(value)
             if canonical in _UPDATABLE_FIELDS:
                 old_value = getattr(wi, canonical, None)
                 if isinstance(old_value, list):

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/agents/codex_plugin.py

@@ -19,6 +19,8 @@ from raise_cli.mcp.workspace_config import (
     detect_mcp_pipeline_command,
     render_codex_config_toml,
 )
+from raise_cli.skills.parser import ParseError
+from raise_cli.skills.parser import parse_frontmatter as _parse_skill_frontmatter
 from raise_cli.skills.sync import skill_names as _skill_names
 
 _HOOKS_JSON: dict[str, Any] = {
@@ -211,6 +213,23 @@ exit 0
 """
 
 
+def _skill_is_public(skill_dir: Path) -> bool:
+    """Return True when the skill's raise.visibility is 'public' (default).
+
+    Reads the SKILL.md frontmatter and checks the raise.visibility key.
+    Defaults to True (public) on any read or parse failure so that skills
+    without an explicit visibility field are included — backward-compatible.
+    """
+    skill_md = skill_dir / "SKILL.md"
+    try:
+        content = skill_md.read_text(encoding="utf-8")
+        fm, _ = _parse_skill_frontmatter(content)
+        metadata = fm.get("metadata", {}) or {}
+        return metadata.get("raise.visibility", "public") == "public"
+    except (OSError, ParseError):
+        return True  # default public on read/parse failure
+
+
 class CodexPlugin:
     """Generate RaiSE governance config files for Codex CLI.
 
@@ -278,13 +297,23 @@ class CodexPlugin:
 
         source_skills_dir = project_root / ".agent" / "skills"
         if source_skills_dir.is_dir():
-            shutil.copytree(source_skills_dir, plugin_skills_dir, dirs_exist_ok=True)
-            # Remove stale skill dirs that no longer exist in source — prevents
-            # ghost entries after a rename from dirtying the tree on every sync
-            # (RAISE-18967).  Use the shared skill_names() helper so the
-            # definition of "skill directory" is consistent with SkillSyncer.
-            source_names = _skill_names(source_skills_dir)
-            for name in _skill_names(plugin_skills_dir) - source_names:
+            # Copy only public-visibility skills to the plugin — internal skills
+            # must not be distributed (RAISE-19076).  Default is public so that
+            # skills without a raise.visibility field are included.
+            plugin_skills_dir.mkdir(parents=True, exist_ok=True)
+            public_source_names: set[str] = set()
+            for name in _skill_names(source_skills_dir):
+                if _skill_is_public(source_skills_dir / name):
+                    shutil.copytree(
+                        source_skills_dir / name,
+                        plugin_skills_dir / name,
+                        dirs_exist_ok=True,
+                    )
+                    public_source_names.add(name)
+            # Remove stale skill dirs that no longer exist in source (or were
+            # demoted to internal) — prevents ghost entries after a rename or
+            # visibility change from dirtying the tree on every sync (RAISE-18967).
+            for name in _skill_names(plugin_skills_dir) - public_source_names:
                 shutil.rmtree(plugin_skills_dir / name)
         else:
             plugin_skills_dir.mkdir(parents=True, exist_ok=True)

{raise_cli-3.1.6 → raise_cli-3.1.7}/src/raise_cli/backlog/hooks.py

@@ -130,6 +130,19 @@ def pipeline_run_active() -> bool:
     return any_pipeline_run_active()
 
 
+def active_run_issue_ids() -> frozenset[str]:
+    """Return the set of issue_ids that have at least one active pipeline run.
+
+    Single store query; used by ``batch-transition`` to evaluate the
+    engine-ownership guard per-key (RAISE-19625).  Fail-open per RAISE-10966.
+    """
+    from raise_cli.pipeline.execution_context import (
+        active_run_issue_ids as _active_run_issue_ids,
+    )
+
+    return _active_run_issue_ids()
+
+
 def _current_fix_versions(project: Path, jira_key: str) -> list[str]:
     """Read the issue's current fixVersion names from the configured PM adapter."""
     from raise_cli.adapters.resolve import resolve_pm_adapter