redeploy 0.2.61__tar.gz → 0.2.63__tar.gz

{redeploy-0.2.61 → redeploy-0.2.63}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: redeploy
-Version: 0.2.61
+Version: 0.2.63
 Summary: Infrastructure migration toolkit: detect → plan → apply
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -32,17 +32,17 @@ Requires-Dist: mcp>=1.0; extra == "mcp"
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.61-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-29.1h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.63-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-31.8h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $7.5000 (81 commits)
-- 👤 **Human dev:** ~$2911 (29.1h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $7.5000 (83 commits)
+- 👤 **Human dev:** ~$3183 (31.8h @ $100/h, 30min dedup)
 
-Generated on 2026-04-21 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
+Generated on 2026-04-23 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.61-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.63-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 

{redeploy-0.2.61 → redeploy-0.2.63}/README.md

@@ -3,17 +3,17 @@
 
 ## AI Cost Tracking
 
-![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.61-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
-![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-29.1h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
+![PyPI](https://img.shields.io/badge/pypi-costs-blue) ![Version](https://img.shields.io/badge/version-0.2.63-blue) ![Python](https://img.shields.io/badge/python-3.9+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![AI Cost](https://img.shields.io/badge/AI%20Cost-$7.50-orange) ![Human Time](https://img.shields.io/badge/Human%20Time-31.8h-blue) ![Model](https://img.shields.io/badge/Model-openrouter%2Fqwen%2Fqwen3--coder--next-lightgrey)
 
-- 🤖 **LLM usage:** $7.5000 (81 commits)
-- 👤 **Human dev:** ~$2911 (29.1h @ $100/h, 30min dedup)
+- 🤖 **LLM usage:** $7.5000 (83 commits)
+- 👤 **Human dev:** ~$3183 (31.8h @ $100/h, 30min dedup)
 
-Generated on 2026-04-21 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
+Generated on 2026-04-23 using [openrouter/qwen/qwen3-coder-next](https://openrouter.ai/qwen/qwen3-coder-next)
 
 ---
 
-![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.61-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
+![PyPI](https://img.shields.io/badge/pypi-redeploy-blue) ![Version](https://img.shields.io/badge/version-0.2.63-blue) ![Python](https://img.shields.io/badge/python-3.10+-blue) ![License](https://img.shields.io/badge/license-Apache--2.0-green)
 
 Infrastructure migration and device deploy toolkit — VPS, Raspberry Pi kiosk, Podman Quadlet, k3s.
 

{redeploy-0.2.61 → redeploy-0.2.63}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "redeploy"
-version = "0.2.61"
+version = "0.2.63"
 description = "Infrastructure migration toolkit: detect → plan → apply"
 readme = "README.md"
 requires-python = ">=3.11"

{redeploy-0.2.61 → redeploy-0.2.63}/redeploy/__init__.py

@@ -7,7 +7,7 @@ Public API (stable from 0.2.0, semver guaranteed)::
 
 Everything not listed in ``__all__`` is internal and may change without notice.
 """
-__version__ = "0.2.61"
+__version__ = "0.2.63"
 
 # ── Core models ───────────────────────────────────────────────────────────────
 from .models import (  # noqa: F401

redeploy-0.2.63/redeploy/analyze/__init__.py

@@ -0,0 +1,6 @@
+"""Static analysis for migration specs — pre-flight checks before plan/apply."""
+from __future__ import annotations
+
+from .spec_analyzer import SpecAnalyzer, AnalysisResult, IssueSeverity
+
+__all__ = ["SpecAnalyzer", "AnalysisResult", "IssueSeverity"]

redeploy-0.2.63/redeploy/analyze/checkers/__init__.py

@@ -0,0 +1 @@
+"""Built-in static checkers for redeploy specs."""

redeploy-0.2.63/redeploy/analyze/spec_analyzer.py

@@ -0,0 +1,383 @@
+"""Static analysis engine for migration specs.
+
+Scans compiled MigrationSpec + raw markpact blocks for:
+- missing local files/paths referenced in steps (src, dst, command, config_file)
+- broken command_ref / insert_before references
+- docker-compose.yml inconsistencies (missing files, volume paths, build contexts)
+- hardcoded absolute paths to external dependencies in commands
+- .env / config file references
+"""
+from __future__ import annotations
+
+import re
+import subprocess
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from ..markpact.models import MarkpactDocument
+from ..models.plan import MigrationStep
+from ..models.spec import MigrationSpec
+
+
+class IssueSeverity(str, Enum):
+    ERROR = "error"
+    WARNING = "warning"
+    INFO = "info"
+
+
+@dataclass
+class Issue:
+    severity: IssueSeverity
+    category: str
+    step_id: str | None
+    message: str
+    suggestion: str | None = None
+    line: int | None = None
+
+
+@dataclass
+class AnalysisResult:
+    issues: list[Issue] = field(default_factory=list)
+    passed: bool = True
+
+    def add(self, severity: IssueSeverity, category: str, message: str,
+            step_id: str | None = None, suggestion: str | None = None, line: int | None = None) -> None:
+        self.issues.append(Issue(severity, category, step_id, message, suggestion, line))
+        if severity == IssueSeverity.ERROR:
+            self.passed = False
+
+    def errors(self) -> list[Issue]:
+        return [i for i in self.issues if i.severity == IssueSeverity.ERROR]
+
+    def warnings(self) -> list[Issue]:
+        return [i for i in self.issues if i.severity == IssueSeverity.WARNING]
+
+
+class _Checker:
+    def check(self, spec: MigrationSpec, document: MarkpactDocument | None,
+              base_dir: Path, result: AnalysisResult) -> None:
+        raise NotImplementedError
+
+
+class _PathChecker(_Checker):
+    """Validate local file paths referenced by steps."""
+
+    def check(self, spec, document, base_dir, result):
+        for step in spec.extra_steps:
+            self._check_field(step, "src", base_dir, result)
+            self._check_field(step, "dst", base_dir, result)
+            self._check_field(step, "config_file", base_dir, result)
+            self._check_env_file(step, base_dir, result)
+
+    def _check_field(self, step: dict, field_name: str, base_dir: Path, result: AnalysisResult):
+        val = step.get(field_name)
+        if not val:
+            return
+        # Only check local (non-ssh) paths; remote paths often start with ~ or user@host:...
+        if re.search(r"^[\w.-]+@", str(val)):
+            return
+        # dst pointing to remote home (~/) is not a local path to verify
+        if field_name == "dst" and str(val).startswith("~/"):
+            return
+        path = self._resolve(val, base_dir)
+        if path and not path.exists():
+            result.add(
+                IssueSeverity.ERROR, "paths",
+                f"Step '{step.get('id')}' references missing {field_name}: {val}",
+                step.get("id"),
+                suggestion=f"Create file/dir or correct path: {path}"
+            )
+
+    def _check_env_file(self, step: dict, base_dir: Path, result: AnalysisResult):
+        # Some steps may compose env_file indirectly; we also scan raw commands for .env
+        pass
+
+    @staticmethod
+    def _resolve(val: str, base_dir: Path) -> Path | None:
+        val = val.strip()
+        if val.startswith("~/"):
+            return Path.home() / val[2:]
+        if val.startswith("/"):
+            return Path(val)
+        # relative -> resolve against base_dir
+        return base_dir / val
+
+
+class _CommandPathChecker(_Checker):
+    """Scan command strings for hardcoded absolute paths outside the project."""
+
+    EXTERNAL_RE = re.compile(
+        r"(?:^|\s)(/home/\w+/[^\s'\"]+|~/[^\s'\"]+)"
+    )
+
+    def check(self, spec, document, base_dir, result):
+        for step in spec.extra_steps:
+            cmd = step.get("command") or ""
+            for match in self.EXTERNAL_RE.finditer(cmd):
+                path_str = match.group(1)
+                # Skip remote target paths (ssh_cmd / inline_script running remotely)
+                if path_str.startswith("~/"):
+                    continue
+                # Ignore paths inside the project tree
+                resolved = self._resolve(path_str, base_dir)
+                if resolved and self._is_inside(resolved, base_dir):
+                    continue
+                # Check if exists locally
+                if resolved and not resolved.exists():
+                    result.add(
+                        IssueSeverity.ERROR, "commands",
+                        f"Step '{step.get('id')}' command references missing external path: {path_str}",
+                        step.get("id"),
+                        suggestion="Add rsync/scp step to sync this dependency, or correct the path."
+                    )
+                else:
+                    result.add(
+                        IssueSeverity.WARNING, "commands",
+                        f"Step '{step.get('id')}' command references external path: {path_str}",
+                        step.get("id"),
+                        suggestion="Consider adding an explicit sync step for this dependency."
+                    )
+
+    @staticmethod
+    def _resolve(val: str, base_dir: Path) -> Path | None:
+        val = val.strip().rstrip("/")
+        if val.startswith("~/"):
+            return Path.home() / val[2:]
+        if val.startswith("/"):
+            return Path(val)
+        return base_dir / val
+
+    @staticmethod
+    def _is_inside(path: Path, base: Path) -> bool:
+        try:
+            path.resolve().relative_to(base.resolve())
+            return True
+        except ValueError:
+            return False
+
+
+class _ReferenceChecker(_Checker):
+    """Ensure command_ref and insert_before point to existing things."""
+
+    def check(self, spec, document, base_dir, result):
+        from redeploy.steps import StepLibrary
+        step_ids = {s.get("id") for s in spec.extra_steps if s.get("id")}
+        step_ids |= set(StepLibrary.list())
+        ref_ids = set()
+        if document:
+            for block in document.blocks:
+                if block.kind == "ref" and block.ref_id:
+                    ref_ids.add(block.ref_id)
+
+        for step in spec.extra_steps:
+            sid = step.get("id")
+            cref = step.get("command_ref")
+            if cref and cref not in ref_ids:
+                result.add(
+                    IssueSeverity.ERROR, "references",
+                    f"Step '{sid}' references unknown command_ref '{cref}'",
+                    sid,
+                    suggestion=f"Define a ```bash markpact:ref {cref} block or remove command_ref."
+                )
+            ib = step.get("insert_before")
+            if ib and ib not in step_ids:
+                result.add(
+                    IssueSeverity.WARNING, "references",
+                    f"Step '{sid}' insert_before points to unknown step '{ib}'",
+                    sid,
+                    suggestion="This may be a runtime-generated step; verify the generated plan."
+                )
+
+
+class _ComposeChecker(_Checker):
+    """Validate docker-compose files declared in spec or found in project."""
+
+    def check(self, spec, document, base_dir, result):
+        compose_files = list(spec.target.compose_files or [])
+        # Also try to discover common names if none explicitly declared
+        if not compose_files:
+            for candidate in ("docker-compose.yml", "docker-compose.yaml", "compose.yml", "compose.yaml"):
+                if (base_dir / candidate).exists():
+                    compose_files.append(candidate)
+                    break
+
+        for cf in compose_files:
+            path = base_dir / cf
+            if not path.exists():
+                result.add(
+                    IssueSeverity.ERROR, "compose",
+                    f"Declared compose file not found: {cf}",
+                    suggestion=f"Create {path} or remove from target.compose_files."
+                )
+                continue
+            self._scan_compose(path, base_dir, result)
+
+    def _scan_compose(self, path: Path, base_dir: Path, result: AnalysisResult):
+        try:
+            data = yaml.safe_load(path.read_text()) or {}
+        except Exception as exc:
+            result.add(IssueSeverity.ERROR, "compose", f"Cannot parse {path}: {exc}")
+            return
+
+        services = data.get("services", {})
+        for svc_name, svc in services.items():
+            if not isinstance(svc, dict):
+                continue
+            # build.context
+            build = svc.get("build")
+            if isinstance(build, dict):
+                ctx = build.get("context", ".")
+                ctx_path = base_dir / ctx if not ctx.startswith("/") else Path(ctx)
+                if not ctx_path.exists():
+                    result.add(
+                        IssueSeverity.ERROR, "compose",
+                        f"Service '{svc_name}' build.context missing: {ctx}",
+                        suggestion=f"Create directory {ctx_path} or fix context."
+                    )
+                dockerfile = build.get("dockerfile")
+                if dockerfile:
+                    df_path = ctx_path / dockerfile
+                    if not df_path.exists():
+                        result.add(
+                            IssueSeverity.ERROR, "compose",
+                            f"Service '{svc_name}' Dockerfile missing: {df_path}",
+                            suggestion=f"Create {df_path} or correct dockerfile path."
+                        )
+            # env_file
+            env_files = svc.get("env_file", [])
+            if isinstance(env_files, str):
+                env_files = [env_files]
+            for ef in env_files:
+                ef_path = base_dir / ef if not str(ef).startswith("/") else Path(ef)
+                if not ef_path.exists():
+                    result.add(
+                        IssueSeverity.WARNING, "compose",
+                        f"Service '{svc_name}' env_file missing: {ef}",
+                        suggestion=f"Create {ef_path} or remove env_file entry."
+                    )
+            # volumes
+            for vol in svc.get("volumes", []):
+                if isinstance(vol, str):
+                    if ":" in vol:
+                        host_part = vol.split(":", 1)[0]
+                        # Skip named volumes and relative paths that exist
+                        if host_part.startswith("/"):
+                            if not Path(host_part).exists():
+                                result.add(
+                                    IssueSeverity.WARNING, "compose",
+                                    f"Service '{svc_name}' volume host path missing: {host_part}",
+                                    suggestion=f"Ensure host path exists before deployment."
+                                )
+                        elif host_part != "." and "/" in host_part:
+                            hp = base_dir / host_part
+                            if not hp.exists():
+                                result.add(
+                                    IssueSeverity.WARNING, "compose",
+                                    f"Service '{svc_name}' relative volume path missing: {hp}",
+                                    suggestion=f"Create {hp} or mount as named volume."
+                                )
+
+
+class _EnvFileChecker(_Checker):
+    """Check that .env referenced by target.env_file exists."""
+
+    def check(self, spec, document, base_dir, result):
+        ef = spec.target.env_file or spec.source.env_file
+        if ef:
+            path = base_dir / ef if not ef.startswith("/") else Path(ef)
+            if not path.exists():
+                result.add(
+                    IssueSeverity.ERROR, "env",
+                    f"env_file not found: {ef}",
+                    suggestion=f"Create {path} or correct env_file path."
+                )
+
+
+class _BinaryChecker(_Checker):
+    """Warn if commands reference binaries not available locally (best-effort)."""
+
+    def check(self, spec, document, base_dir, result):
+        for step in spec.extra_steps:
+            cmd = step.get("command") or ""
+            for word in cmd.split():
+                word = word.strip(";|&`'\"()")
+                if "/" in word or word in ("if", "then", "else", "fi", "for", "do", "done", "echo", "true", "false"):
+                    continue
+                if not self._which(word):
+                    # Only warn for likely commands (simple words, not variable names)
+                    if re.match(r"^[a-zA-Z][a-zA-Z0-9_-]+$", word):
+                        result.add(
+                            IssueSeverity.WARNING, "binaries",
+                            f"Step '{step.get('id')}' command uses binary not found locally: '{word}'",
+                            step.get("id"),
+                            suggestion=f"Install '{word}' or ensure it exists on target host."
+                        )
+
+    @staticmethod
+    def _which(cmd: str) -> bool:
+        try:
+            subprocess.run(["which", cmd], capture_output=True, check=True)
+            return True
+        except Exception:
+            return False
+
+
+class SpecAnalyzer:
+    """Run static checks against a compiled MigrationSpec (and optional raw MarkpactDocument)."""
+
+    DEFAULT_CHECKERS: list[_Checker] = [
+        _PathChecker(),
+        _CommandPathChecker(),
+        _ReferenceChecker(),
+        _ComposeChecker(),
+        _EnvFileChecker(),
+        _BinaryChecker(),
+    ]
+
+    def __init__(self, base_dir: Path | None = None,
+                 checkers: list[_Checker] | None = None):
+        self.base_dir = base_dir or Path.cwd()
+        self.checkers = checkers or list(self.DEFAULT_CHECKERS)
+
+    def analyze(self, spec: MigrationSpec,
+                document: MarkpactDocument | None = None) -> AnalysisResult:
+        result = AnalysisResult()
+        for checker in self.checkers:
+            checker.check(spec, document, self.base_dir, result)
+        return result
+
+    def analyze_file(self, spec_path: Path) -> tuple[MigrationSpec | None, AnalysisResult]:
+        """Load spec from file (YAML or markpact) and analyze."""
+        from ..markpact.parser import parse_markpact_file
+        from ..markpact.compiler import compile_markpact_document, MarkpactCompileError
+        from ..models.spec import MigrationSpec as MS
+
+        document = None
+        spec = None
+        result = AnalysisResult()
+
+        # Try markpact first
+        if spec_path.suffix == ".md":
+            try:
+                document = parse_markpact_file(spec_path)
+                spec = compile_markpact_document(document)
+            except MarkpactCompileError as exc:
+                result.add(IssueSeverity.ERROR, "compile", str(exc))
+                return None, result
+            except Exception as exc:
+                result.add(IssueSeverity.ERROR, "compile", f"Failed to parse markpact: {exc}")
+                return None, result
+        else:
+            try:
+                spec = MS.from_file(spec_path)
+            except Exception as exc:
+                result.add(IssueSeverity.ERROR, "load", f"Failed to load spec: {exc}")
+                return None, result
+
+        if spec:
+            result = self.analyze(spec, document)
+        return spec, result

{redeploy-0.2.61 → redeploy-0.2.63}/redeploy/apply/handlers.py

@@ -112,7 +112,7 @@ def run_docker_health_wait(
             status_str = ", ".join(f"{n}:{s}" for n, s in statuses)
 
             if status_str != last_status:
-                logger.debug(f"    [{elapsed}s] containers: {status_str}")
+                logger.info(f"    [{elapsed}s] containers: {status_str}")
                 last_status = status_str
 
             if _all_containers_healthy(statuses):

{redeploy-0.2.61 → redeploy-0.2.63}/redeploy/cli/__init__.py

@@ -57,10 +57,12 @@ from .commands.status import status
 from .commands.bump_fix import bump_cmd, fix_cmd
 from .commands.prompt_cmd import prompt_cmd
 from .commands.mcp_cmd import mcp_cmd
+from .commands.lint import lint
 
 # Register commands
 cli.add_command(audit)
 cli.add_command(detect)
+cli.add_command(lint)
 cli.add_command(devices)
 cli.add_command(scan)
 cli.add_command(device_add)

redeploy-0.2.63/redeploy/cli/commands/lint.py

@@ -0,0 +1,86 @@
+"""lint command — static analysis of migration specs before deployment."""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import click
+from rich.console import Console
+from rich.table import Table
+
+from ...analyze import SpecAnalyzer
+
+
+@click.command()
+@click.argument("spec_file", default=None, required=False, type=click.Path(), metavar="SPEC")
+@click.option("--env", "env_name", default="", help="Named environment from redeploy.yaml")
+@click.option("--json", "as_json", is_flag=True, help="Output raw JSON")
+@click.option("--exit-zero", is_flag=True, help="Exit 0 even if errors found")
+@click.pass_context
+def lint(ctx, spec_file, env_name, as_json, exit_zero):
+    """Static analysis of a migration spec (YAML or markpact .md).
+
+    Detects missing files, broken references, missing command_ref blocks,
+    docker-compose inconsistencies, and hardcoded external paths.
+    """
+    console = Console()
+    from ...cli.core import load_spec_or_exit
+    from ...models import ProjectManifest
+
+    manifest = ProjectManifest.find_and_load(Path.cwd())
+    resolved = spec_file or (manifest.spec if manifest else "migration.yaml")
+
+    if not Path(resolved).exists():
+        console.print(f"[red]✗ spec file not found: {resolved}[/red]")
+        sys.exit(1)
+
+    spec = load_spec_or_exit(console, resolved)
+
+    if manifest and env_name:
+        if env_name not in manifest.environments:
+            console.print(f"[yellow]⚠ env '{env_name}' not in redeploy.yaml[/yellow]")
+        manifest.apply_to_spec(spec, env_name=env_name)
+
+    analyzer = SpecAnalyzer(base_dir=Path.cwd())
+    _, result = analyzer.analyze_file(Path(resolved))
+
+    if as_json:
+        import json
+        out = {
+            "passed": result.passed,
+            "errors": len(result.errors()),
+            "warnings": len(result.warnings()),
+            "issues": [
+                {
+                    "severity": i.severity.value,
+                    "category": i.category,
+                    "step_id": i.step_id,
+                    "message": i.message,
+                    "suggestion": i.suggestion,
+                }
+                for i in result.issues
+            ],
+        }
+        console.print(json.dumps(out, indent=2))
+    else:
+        if result.passed and not result.issues:
+            console.print("[green]✓ No issues found[/green]")
+        else:
+            if result.errors():
+                console.print(f"[red]✗ {len(result.errors())} error(s)[/red]")
+            if result.warnings():
+                console.print(f"[yellow]⚠ {len(result.warnings())} warning(s)[/yellow]")
+
+            t = Table(show_header=True, box=None, padding=(0, 2))
+            t.add_column("Severity", width=8)
+            t.add_column("Category", width=12)
+            t.add_column("Step", width=20)
+            t.add_column("Message")
+            t.add_column("Suggestion", style="dim")
+            for i in result.issues:
+                sev = f"[red]{i.severity.value}[/red]" if i.severity.value == "error" else f"[yellow]{i.severity.value}[/yellow]"
+                t.add_row(sev, i.category, i.step_id or "—", i.message, i.suggestion or "")
+            console.print(t)
+
+    if not exit_zero and not result.passed:
+        sys.exit(1)

{redeploy-0.2.61 → redeploy-0.2.63}/redeploy/cli/commands/plan_apply.py

@@ -264,10 +264,14 @@ def migrate(ctx, host, app, domain, target, strategy, target_version,
     "--max-heal-retries", default=3, show_default=True,
     help="Maximum number of LLM self-healing attempts."
 )
+@click.option(
+    "--lint/--no-lint", default=True, show_default=True,
+    help="Run static analysis before deployment to catch missing files, broken references, and external path issues."
+)
 @click.pass_context
 def run(ctx, spec_file, dry_run, plan_only, do_detect, plan_out, output,
         env_name, progress_yaml, resume, from_step, state_file, no_state,
-        heal, fix_hint, max_heal_retries):
+        heal, fix_hint, max_heal_retries, lint):
     """Execute migration from a single YAML spec (source + target in one file).
 
     SPEC defaults to migration.yaml (or value from redeploy.yaml manifest).
@@ -305,6 +309,28 @@ def run(ctx, spec_file, dry_run, plan_only, do_detect, plan_out, output,
     _apply_manifest_to_spec(console, manifest, spec, env_name)
     _print_spec_summary(console, spec)
 
+    # Static analysis (lint)
+    if lint:
+        from ...analyze import SpecAnalyzer, IssueSeverity
+        analyzer = SpecAnalyzer(base_dir=Path.cwd())
+        _, lint_result = analyzer.analyze_file(Path(resolved_spec))
+        if lint_result.issues:
+            console.print(f"\n[bold]lint[/bold]")
+            for i in lint_result.issues:
+                color = "red" if i.severity == IssueSeverity.ERROR else "yellow"
+                prefix = f"[{color}]{i.severity.value}[/{color}]"
+                step = f" ({i.step_id})" if i.step_id else ""
+                console.print(f"  {prefix}{step} {i.category}: {i.message}")
+                if i.suggestion:
+                    console.print(f"      [dim]→ {i.suggestion}[/dim]")
+            if not lint_result.passed:
+                console.print("\n[red]✗ lint failed — fix errors above or use --no-lint to skip.[/red]")
+                sys.exit(1)
+            else:
+                console.print(f"[yellow]⚠ lint passed with {len(lint_result.warnings())} warning(s)[/yellow]")
+        else:
+            console.print("[green]  ✓ lint passed[/green]")
+
     # Optional live detect
     if do_detect:
         planner = _perform_live_detect(console, spec)

{redeploy-0.2.61 → redeploy-0.2.63}/redeploy/tests/test_cli.py

@@ -163,7 +163,7 @@ class TestRunPlanOnly:
         spec = tmp_path / "migration.md"
         spec.write_text(_migration_markdown_supported(), encoding="utf-8")
 
-        result = _runner().invoke(cli, ["run", str(spec), "--plan-only"])
+        result = _runner().invoke(cli, ["run", str(spec), "--plan-only", "--no-lint"])
 
         assert result.exit_code == 0, result.output
         assert "markdown migration" in result.output