refactorai-cli 0.2.15__tar.gz → 0.2.17__tar.gz

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.15
+Version: 0.2.17
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.2.15"
+version = "0.2.17"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.2.15"
+__version__ = "0.2.17"

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/commands/run_cmds.py

@@ -35,6 +35,10 @@ from refactor_core.constitution import (
     raw_secret_matches,
     raw_secret_matches_config,
 )
+from refactor_core.compliance_settings import resolve_compliance_selection
+from refactor_core.compliance.loader import CompliancePackError, resolve_compliance_packs
+from refactor_core.compliance.models import CompliancePackResolution
+from refactor_core.compliance.evidence import build_compliance_evidence_bundle, evaluate_compliance_gate
 from refactor_core.apply import (
     ApplyError,
     apply_changes,
@@ -50,6 +54,8 @@ from refactor_core.execution.structural_ops import structural_compatibility_matr
 from refactor_core.gate import evaluate_gate
 from refactor_core.refactor_requests import (
     DEFERRED,
+    RequestSuppression,
+    RequestWarning,
     clear_requests,
     create_requests,
     list_requests,
@@ -659,6 +665,35 @@ def _warn_raw_key(constitution, config) -> None:
         )
 
 
+def _resolve_compliance_context(
+    *,
+    project_config,
+    cli_frameworks: list[str] | None = None,
+    cli_level: str | None = None,
+    cli_rollout: str | None = None,
+    cli_canary_percent: int | None = None,
+) -> tuple[tuple[str, ...], str, CompliancePackResolution, str, int]:
+    """Resolve compliance selection + managed pack set for this run."""
+    selection = resolve_compliance_selection(
+        dict(getattr(project_config, "settings", {}) or {}),
+        cli_frameworks=cli_frameworks,
+        cli_level=cli_level,
+        cli_rollout=cli_rollout,
+        cli_canary_percent=cli_canary_percent,
+    )
+    resolution = resolve_compliance_packs(
+        selection.frameworks,
+        level=selection.level,
+    )
+    return (
+        selection.frameworks,
+        selection.level,
+        resolution,
+        selection.rollout,
+        selection.canary_percent,
+    )
+
+
 def init(
     force: bool = typer.Option(
         False,
@@ -1479,10 +1514,61 @@ def review(
         "--force",
         help="Run review even if unapplied patches exist from a prior code run.",
     ),
+    compliance_framework: list[str] | None = typer.Option(
+        None,
+        "--compliance-framework",
+        help="Compliance framework to enable for this run. Repeat for multiple values.",
+    ),
+    compliance_level: str | None = typer.Option(
+        None,
+        "--compliance-level",
+        help="Compliance level override: off | advisory | standard | strict.",
+    ),
+    compliance_rollout: str | None = typer.Option(
+        None,
+        "--compliance-rollout",
+        help="Compliance rollout mode: default | staged | canary | off | ga.",
+    ),
+    compliance_canary_percent: int | None = typer.Option(
+        None,
+        "--compliance-canary-percent",
+        help="Compliance canary percentage (0-100) when rollout=canary.",
+    ),
 ) -> None:
     """Run review (findings only) and store the result. Requires a valid key."""
     _require_auth()
     project_root, constitution, project_config = _load_project()
+    try:
+        (
+            compliance_frameworks,
+            resolved_compliance_level,
+            compliance_resolution,
+            compliance_rollout_mode,
+            compliance_canary_pct,
+        ) = (
+            _resolve_compliance_context(
+                project_config=project_config,
+                cli_frameworks=compliance_framework,
+                cli_level=compliance_level,
+                cli_rollout=compliance_rollout,
+                cli_canary_percent=compliance_canary_percent,
+            )
+        )
+    except CompliancePackError as exc:
+        console.print(f"[red]review: compliance pack resolution failed:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    if compliance_frameworks:
+        pack_label = ", ".join(
+            f"{pack.pack_id}@{pack.version}" for pack in compliance_resolution.packs
+        ) or "(none loaded)"
+        console.print(
+            "[dim]review: compliance selection "
+            f"frameworks={list(compliance_frameworks)} level={resolved_compliance_level} "
+            f"rollout={compliance_rollout_mode} canary_percent={compliance_canary_pct} "
+            f"packs={pack_label}[/dim]"
+        )
+    for warning in compliance_resolution.warnings:
+        console.print(f"[yellow]review: compliance warning:[/yellow] {warning}")
     register_project(project_root, constitution_hash=constitution.content_hash)
     _maybe_build_graph(project_root, project_config)
     sandbox_ctx = None
@@ -1555,9 +1641,39 @@ def review(
     _print_findings(artifact.findings)
 
     # A fresh review supersedes prior refactor requests: replace them with one
-    # RR per finding (central-only; nothing is written into the project tree).
-    clear_requests(project_root)
-    requests = create_requests(project_root, artifact.findings, run_id=artifact.run_id)
+    # RR per actionable finding (central-only; nothing is written into project tree).
+    requests = _replace_requests_with_framework_guardrails(
+        project_root=project_root,
+        findings=artifact.findings,
+        run_id=artifact.run_id,
+        compliance_frameworks=compliance_frameworks,
+        compliance_level=resolved_compliance_level,
+        compliance_rollout=compliance_rollout_mode,
+        compliance_canary_percent=compliance_canary_pct,
+        compliance_resolution=compliance_resolution,
+        artifact=artifact,
+    )
+    _apply_compliance_gate_to_artifact(artifact)
+    run_store.write_artifact(artifact, target=target, status="completed")
+    if compliance_frameworks:
+        artifact.notes.append(
+            "Compliance selection: frameworks="
+            + ",".join(compliance_frameworks)
+            + (
+                f" level={resolved_compliance_level} rollout={compliance_rollout_mode} "
+                f"canary_percent={compliance_canary_pct}"
+            )
+        )
+        if compliance_resolution.packs:
+            artifact.notes.append(
+                "Compliance packs: "
+                + ", ".join(
+                    f"{pack.pack_id}@{pack.version}"
+                    for pack in compliance_resolution.packs
+                )
+            )
+        for warning in compliance_resolution.warnings:
+            artifact.notes.append(f"Compliance pack warning: {warning}")
     if requests:
         console.print(
             f"\n[bold]Created {len(requests)} refactor request(s).[/bold] "
@@ -1602,6 +1718,26 @@ def code(
         "--equivalence",
         help="Equivalence policy: strict | balanced.",
     ),
+    compliance_framework: list[str] | None = typer.Option(
+        None,
+        "--compliance-framework",
+        help="Compliance framework to enable for this run. Repeat for multiple values.",
+    ),
+    compliance_level: str | None = typer.Option(
+        None,
+        "--compliance-level",
+        help="Compliance level override: off | advisory | standard | strict.",
+    ),
+    compliance_rollout: str | None = typer.Option(
+        None,
+        "--compliance-rollout",
+        help="Compliance rollout mode: default | staged | canary | off | ga.",
+    ),
+    compliance_canary_percent: int | None = typer.Option(
+        None,
+        "--compliance-canary-percent",
+        help="Compliance canary percentage (0-100) when rollout=canary.",
+    ),
 ) -> None:
     """Work through refactor requests one by one, applying & verifying each.
 
@@ -1610,6 +1746,37 @@ def code(
     """
     _require_auth()
     project_root, constitution, project_config = _load_project()
+    try:
+        (
+            compliance_frameworks,
+            resolved_compliance_level,
+            compliance_resolution,
+            compliance_rollout_mode,
+            compliance_canary_pct,
+        ) = (
+            _resolve_compliance_context(
+                project_config=project_config,
+                cli_frameworks=compliance_framework,
+                cli_level=compliance_level,
+                cli_rollout=compliance_rollout,
+                cli_canary_percent=compliance_canary_percent,
+            )
+        )
+    except CompliancePackError as exc:
+        console.print(f"[red]code: compliance pack resolution failed:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    if compliance_frameworks:
+        pack_label = ", ".join(
+            f"{pack.pack_id}@{pack.version}" for pack in compliance_resolution.packs
+        ) or "(none loaded)"
+        console.print(
+            "[dim]code: compliance selection "
+            f"frameworks={list(compliance_frameworks)} level={resolved_compliance_level} "
+            f"rollout={compliance_rollout_mode} canary_percent={compliance_canary_pct} "
+            f"packs={pack_label}[/dim]"
+        )
+    for warning in compliance_resolution.warnings:
+        console.print(f"[yellow]code: compliance warning:[/yellow] {warning}")
     register_project(project_root, constitution_hash=constitution.content_hash)
     _maybe_build_graph(project_root, project_config)
     sandbox_ctx = None
@@ -1666,10 +1833,38 @@ def code(
             review_store = create_run(project_root, run_id=review_artifact.run_id)
             review_store.write_artifact(review_artifact, target=target, status="completed")
             _print_findings(review_artifact.findings)
-            clear_requests(project_root)
-            requests = create_requests(
-                project_root, review_artifact.findings, run_id=review_artifact.run_id
+            requests = _replace_requests_with_framework_guardrails(
+                project_root=project_root,
+                findings=review_artifact.findings,
+                run_id=review_artifact.run_id,
+                compliance_frameworks=compliance_frameworks,
+                compliance_level=resolved_compliance_level,
+                compliance_rollout=compliance_rollout_mode,
+                compliance_canary_percent=compliance_canary_pct,
+                compliance_resolution=compliance_resolution,
+                artifact=review_artifact,
             )
+            _apply_compliance_gate_to_artifact(review_artifact)
+            if compliance_frameworks:
+                review_artifact.notes.append(
+                    "Compliance selection: frameworks="
+                    + ",".join(compliance_frameworks)
+                    + (
+                        f" level={resolved_compliance_level} rollout={compliance_rollout_mode} "
+                        f"canary_percent={compliance_canary_pct}"
+                    )
+                )
+                if compliance_resolution.packs:
+                    review_artifact.notes.append(
+                        "Compliance packs: "
+                        + ", ".join(
+                            f"{pack.pack_id}@{pack.version}"
+                            for pack in compliance_resolution.packs
+                        )
+                    )
+                for warning in compliance_resolution.warnings:
+                    review_artifact.notes.append(f"Compliance pack warning: {warning}")
+            review_store.write_artifact(review_artifact, target=target, status="completed")
             console.print(f"[bold]Created {len(requests)} refactor request(s).[/bold]")
 
         if not requests:
@@ -1818,6 +2013,204 @@ def requests(
     console.print(table)
 
 
+def compliance(
+    action: str = typer.Argument(
+        "show",
+        help="Compliance view action: status | show | coverage | explain | export",
+    ),
+    subject: str = typer.Argument(
+        "",
+        help="Rule ID when action=explain.",
+    ),
+    compliance_framework: list[str] | None = typer.Option(
+        None,
+        "--compliance-framework",
+        help="Compliance framework selection override. Repeat for multiple values.",
+    ),
+    compliance_level: str | None = typer.Option(
+        None,
+        "--compliance-level",
+        help="Compliance level override: off | advisory | standard | strict.",
+    ),
+    compliance_rollout: str | None = typer.Option(
+        None,
+        "--compliance-rollout",
+        help="Compliance rollout mode override: default | staged | canary | off | ga.",
+    ),
+    compliance_canary_percent: int | None = typer.Option(
+        None,
+        "--compliance-canary-percent",
+        help="Compliance canary percentage override when rollout=canary.",
+    ),
+    output: str = typer.Option(
+        "",
+        "--output",
+        help="Output file path for action=export (defaults to latest run directory).",
+    ),
+) -> None:
+    """Show/export compliance packs, coverage, and rule details."""
+    _require_auth()
+    _project_root, _constitution, project_config = _load_project()
+    frameworks, level, resolution, rollout_mode, canary_percent = _resolve_compliance_context(
+        project_config=project_config,
+        cli_frameworks=compliance_framework,
+        cli_level=compliance_level,
+        cli_rollout=compliance_rollout,
+        cli_canary_percent=compliance_canary_percent,
+    )
+    mode = str(action or "show").strip().lower()
+    if mode not in {"status", "show", "coverage", "explain", "export"}:
+        console.print(f"[red]Unknown compliance action:[/red] {action}")
+        raise typer.Exit(code=2)
+    if not frameworks:
+        console.print(
+            "[dim]No compliance frameworks selected. "
+            "Set `compliance.frameworks` in refactor.config or pass --compliance-framework.[/dim]"
+        )
+        return
+
+    if mode == "status":
+        run_dir = head_run_dir(_project_root)
+        report = read_report(run_dir) if run_dir else {}
+        summary = (
+            dict((report or {}).get("compliance_summary", {}) or {})
+            if isinstance(report, dict)
+            else {}
+        )
+        gate = dict((report or {}).get("gate", {}) or {}) if isinstance(report, dict) else {}
+        console.print("[bold]Compliance status[/bold]")
+        console.print(
+            f"  selection: frameworks={list(frameworks)} level={level} "
+            f"rollout={rollout_mode} canary_percent={canary_percent}"
+        )
+        table = Table(title="Compliance packs", show_lines=False)
+        table.add_column("pack_id", no_wrap=True)
+        table.add_column("framework", no_wrap=True)
+        table.add_column("version", no_wrap=True)
+        table.add_column("rules", no_wrap=True)
+        for pack in resolution.packs:
+            table.add_row(pack.pack_id, pack.framework, pack.version, str(len(pack.rules)))
+        console.print(table)
+        if not run_dir:
+            console.print(
+                "[yellow]No runs yet.[/yellow] Run `refactor review` to produce compliance evidence."
+            )
+            return
+        run_id = str((report or {}).get("run_id", run_dir.name))
+        created = str((report or {}).get("created_at", ""))
+        gate_status = str(gate.get("status", "unknown"))
+        projected = int(summary.get("projected_count", 0) or 0)
+        blocked = int(summary.get("blocked_count", 0) or 0)
+        warned = int(summary.get("warned_count", 0) or 0)
+        gate_color = "green" if gate_status == "passed" else "red"
+        console.print(
+            f"  latest_run: {run_id}" + (f" ({created})" if created else "")
+        )
+        console.print(
+            f"  gate: [{gate_color}]{gate_status}[/{gate_color}] "
+            f"projected={projected} blocked={blocked} warned={warned}"
+        )
+        if blocked > 0 and level in {"standard", "strict"}:
+            console.print(
+                "[yellow]next step:[/yellow] resolve blocked controls or run with "
+                "`--compliance-rollout staged` during pilot."
+            )
+        elif projected == 0:
+            console.print(
+                "[dim]No compliance-projected controls were triggered in the latest run.[/dim]"
+            )
+        return
+
+    if mode == "show":
+        console.print(
+            "[bold]Compliance selection[/bold]: "
+            f"frameworks={list(frameworks)} level={level} "
+            f"rollout={rollout_mode} canary_percent={canary_percent}"
+        )
+        table = Table(title="Compliance packs", show_lines=False)
+        table.add_column("pack_id", no_wrap=True)
+        table.add_column("framework", no_wrap=True)
+        table.add_column("version", no_wrap=True)
+        table.add_column("rules", no_wrap=True)
+        table.add_column("depends_on")
+        for pack in resolution.packs:
+            table.add_row(
+                pack.pack_id,
+                pack.framework,
+                pack.version,
+                str(len(pack.rules)),
+                ", ".join(pack.depends_on) if pack.depends_on else "-",
+            )
+        console.print(table)
+        for warning in resolution.warnings:
+            console.print(f"[yellow]warning:[/yellow] {warning}")
+        return
+
+    if mode == "export":
+        run_dir = head_run_dir(_project_root)
+        if not run_dir:
+            console.print("[yellow]No runs available to export compliance evidence.[/yellow]")
+            raise typer.Exit(code=1)
+        report = read_report(run_dir) or {}
+        payload = build_compliance_evidence_bundle(report)
+        destination = Path(output).expanduser() if output.strip() else (run_dir / "compliance-evidence.json")
+        try:
+            destination.parent.mkdir(parents=True, exist_ok=True)
+            destination.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+        except OSError as exc:
+            console.print(f"[red]Failed to write compliance evidence:[/red] {exc}")
+            raise typer.Exit(code=1) from exc
+        console.print(f"[green]Compliance evidence exported:[/green] {destination}")
+        return
+
+    if mode == "coverage":
+        table = Table(title="Compliance coverage", show_lines=False)
+        table.add_column("framework", no_wrap=True)
+        table.add_column("control", no_wrap=True)
+        table.add_column("classification", no_wrap=True)
+        rows = 0
+        for pack in resolution.packs:
+            if not pack.coverage:
+                table.add_row(pack.framework, "-", "unknown")
+                rows += 1
+                continue
+            for control, classification in sorted(pack.coverage.items()):
+                table.add_row(pack.framework, control, classification)
+                rows += 1
+        if rows == 0:
+            console.print("[dim]No coverage metadata available in selected packs.[/dim]")
+            return
+        console.print(table)
+        return
+
+    # explain
+    rule_id = (subject or "").strip()
+    if not rule_id:
+        console.print("[red]Rule id is required for `refactor compliance explain`.[/red]")
+        raise typer.Exit(code=2)
+    needle = rule_id.lower()
+    matches = []
+    for pack in resolution.packs:
+        for rule in pack.rules:
+            if rule.rule_id.lower() == needle or needle in rule.rule_id.lower():
+                matches.append((pack, rule))
+    if not matches:
+        console.print(f"[yellow]No compliance rule found:[/yellow] {rule_id}")
+        raise typer.Exit(code=1)
+    for pack, rule in matches:
+        console.print(
+            f"[bold]{rule.rule_id}[/bold] "
+            f"[dim](pack={pack.pack_id}@{pack.version}, framework={pack.framework})[/dim]"
+        )
+        if rule.source_standard:
+            console.print(f"  standard: {rule.source_standard}")
+        if rule.control_objective:
+            console.print(f"  objective: {rule.control_objective}")
+        console.print(f"  operation_intent: {rule.operation_intent}")
+        console.print(f"  base_severity: {rule.base_severity}")
+        console.print(f"  priority: {rule.priority}")
+
+
 def _format_operation_scope(rr) -> str:
     scope = getattr(rr, "scope", None)
     if scope is None:
@@ -1848,6 +2241,131 @@ def _format_operation_scope(rr) -> str:
     return "-"
 
 
+def _replace_requests_with_framework_guardrails(
+    *,
+    project_root: Path,
+    findings: list[Finding],
+    run_id: str,
+    compliance_frameworks: tuple[str, ...] = (),
+    compliance_level: str = "standard",
+    compliance_rollout: str = "default",
+    compliance_canary_percent: int = 20,
+    compliance_resolution: CompliancePackResolution | None = None,
+    artifact: RunArtifact | None = None,
+) -> list:
+    clear_requests(project_root)
+    requests, suppressions, warnings = create_requests(
+        project_root,
+        findings,
+        run_id=run_id,
+        compliance_frameworks=compliance_frameworks,
+        compliance_level=compliance_level,
+        compliance_rollout=compliance_rollout,
+        compliance_canary_percent=compliance_canary_percent,
+        return_diagnostics=True,
+    )
+    _report_framework_suppressions(suppressions, artifact=artifact)
+    _report_framework_warnings(warnings, artifact=artifact)
+    if artifact is not None and compliance_frameworks:
+        compliance_suppressed = [
+            item for item in suppressions if str(item.reason_code).startswith("RR_COMPLIANCE_")
+        ]
+        compliance_warnings = [
+            item for item in warnings if str(item.reason_code).startswith("RR_COMPLIANCE_")
+        ]
+        artifact.compliance_summary = {
+            "level": compliance_level,
+            "frameworks": list(compliance_frameworks),
+            "rollout": compliance_rollout,
+            "canary_percent": int(compliance_canary_percent),
+            "pack_versions": (
+                compliance_resolution.pack_versions if compliance_resolution is not None else {}
+            ),
+            "projected_count": len(compliance_suppressed) + len(compliance_warnings),
+            "blocked_count": len(compliance_suppressed),
+            "warned_count": len(compliance_warnings),
+            "rules_triggered": sorted(
+                {
+                    item.rule_id
+                    for item in [*compliance_suppressed, *compliance_warnings]
+                    if str(item.rule_id).strip()
+                }
+            ),
+        }
+    return requests
+
+
+def _apply_compliance_gate_to_artifact(artifact: RunArtifact) -> None:
+    """Promote compliance blocking decisions into gate outcome (R18 Phase 7)."""
+    summary = dict(getattr(artifact, "compliance_summary", {}) or {})
+    decision = evaluate_compliance_gate(
+        summary,
+        base_gate_status=str(getattr(artifact.gate, "status", "unknown") or "unknown"),
+    )
+    if decision.status == "blocked":
+        artifact.gate.status = "blocked"
+    reasons = list((artifact.gate.blocking_reasons or {}).get("reasons", []))
+    for reason in decision.reasons:
+        if reason not in reasons:
+            reasons.append(reason)
+    artifact.gate.blocking_reasons["reasons"] = reasons
+
+
+def _report_framework_suppressions(
+    suppressions: list[RequestSuppression], *, artifact: RunArtifact | None = None
+) -> None:
+    if not suppressions:
+        return
+    feasibility = sum(1 for s in suppressions if s.rule_id == "operation_feasibility")
+    compliance = sum(
+        1 for s in suppressions if s.reason_code.startswith("RR_COMPLIANCE_")
+    )
+    framework = len(suppressions) - feasibility - compliance
+    parts: list[str] = []
+    if framework:
+        parts.append(f"{framework} due to framework invariants")
+    if compliance:
+        parts.append(f"{compliance} due to compliance controls")
+    if feasibility:
+        parts.append(f"{feasibility} not executable as written")
+    detail = "; ".join(parts) if parts else "review-stage checks"
+    console.print(
+        f"[yellow]warning:[/yellow] suppressed {len(suppressions)} finding(s) ({detail})."
+    )
+    for item in suppressions:
+        console.print(
+            f"[yellow]-[/yellow] {item.location}: {item.message} "
+            f"[dim](framework={item.framework or 'unknown'}, rule={item.rule_id or 'unspecified'})[/dim]"
+        )
+        if artifact is not None:
+            artifact.notes.append(item.note())
+
+
+def _report_framework_warnings(
+    warnings: list[RequestWarning], *, artifact: RunArtifact | None = None
+) -> None:
+    if not warnings:
+        return
+    compliance = sum(1 for item in warnings if item.reason_code.startswith("RR_COMPLIANCE_"))
+    framework = len(warnings) - compliance
+    detail_parts: list[str] = []
+    if framework:
+        detail_parts.append(f"{framework} framework")
+    if compliance:
+        detail_parts.append(f"{compliance} compliance")
+    detail = ", ".join(detail_parts) if detail_parts else "review"
+    console.print(
+        f"[yellow]warning:[/yellow] flagged {len(warnings)} finding(s) with caution ({detail})."
+    )
+    for item in warnings:
+        console.print(
+            f"[yellow]-[/yellow] {item.location}: {item.message} "
+            f"[dim](framework={item.framework or 'unknown'}, rule={item.rule_id or 'unspecified'})[/dim]"
+        )
+        if artifact is not None:
+            artifact.notes.append(item.note())
+
+
 def apply(
     force: bool = typer.Option(False, "--force", help="Apply even if the quality gate blocks."),
 ) -> None:
@@ -2105,6 +2623,11 @@ def gc(
 
 def check(
     strict: bool = typer.Option(False, "--strict", help="Exit non-zero if issues are found (for CI)."),
+    compliance_gate: bool = typer.Option(
+        False,
+        "--compliance-gate",
+        help="Also enforce latest run compliance gate status (for CI/PR pipelines).",
+    ),
 ) -> None:
     """Check the constitution for committed secrets (developer/provider keys)."""
     files = find_project_files()
@@ -2115,6 +2638,25 @@ def check(
     constitution = load_constitution(consti_path)
     config = load_config(config_path)
     findings = raw_secret_matches(constitution) + raw_secret_matches_config(config)
+    compliance_failed = False
+    if compliance_gate:
+        run_dir = head_run_dir(consti_path.parent)
+        if run_dir is None:
+            console.print("[yellow]Compliance gate check skipped:[/yellow] no runs yet.")
+        else:
+            report = read_report(run_dir) or {}
+            decision = evaluate_compliance_gate(
+                report.get("compliance_summary", {}),
+                base_gate_status=str((report.get("gate") or {}).get("status", "unknown")),
+            )
+            if decision.status == "blocked":
+                compliance_failed = True
+                console.print(
+                    "[red]Compliance gate blocked[/red]: "
+                    + ", ".join(decision.reasons or ("compliance_controls_blocked",))
+                )
+            else:
+                console.print("[green]Compliance gate[/green]: passed")
     if findings:
         kinds = ", ".join(sorted({kind for kind, _ in findings}))
         console.print(
@@ -2122,6 +2664,8 @@ def check(
             f"{consti_path} or {config_path}. Replace secrets with `${{ENV_VAR}}` references."
         )
         raise typer.Exit(code=1 if strict else 0)
+    if compliance_failed:
+        raise typer.Exit(code=1 if strict else 0)
     console.print("[green]OK[/green]: no committed secret-like literals detected.")
 
 

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/commands/runtime_cmds.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import typer
 from rich.console import Console
+from rich.progress import BarColumn, DownloadColumn, Progress, TaskID, TextColumn, TimeRemainingColumn, TransferSpeedColumn
 
 from refactorai_cli.auth import AuthError, ensure_authenticated
 from refactorai_cli.control_plane import ensure_lease, heartbeat, read_cached_lease, resolve_policy
@@ -62,7 +63,23 @@ def update(
             f"[bold]resolved manifest[/bold]: version={manifest.runtime_version} "
             f"channel={channel}"
         )
-        artifact = download_artifact(manifest.artifact_url)
+        progress_columns = (
+            TextColumn("[progress.description]{task.description}"),
+            BarColumn(),
+            DownloadColumn(),
+            TransferSpeedColumn(),
+            TimeRemainingColumn(),
+        )
+        with Progress(*progress_columns, console=console, transient=True) as progress:
+            task_id: TaskID = progress.add_task("Downloading runtime artifact", total=None)
+
+            def _on_progress(downloaded: int, total: int | None) -> None:
+                update_kwargs = {"completed": int(max(downloaded, 0))}
+                if total is not None and total > 0:
+                    update_kwargs["total"] = total
+                progress.update(task_id, **update_kwargs)
+
+            artifact = download_artifact(manifest.artifact_url, progress_cb=_on_progress)
         console.print(f"[bold]downloaded artifact[/bold]: {len(artifact)} bytes")
         if dry_run:
             # Verification happens in activate_runtime; dry-run still checks

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/commands/runtime_proxy_cmds.py

@@ -136,3 +136,8 @@ def doctor(ctx: typer.Context) -> None:
 def config(ctx: typer.Context) -> None:
     """Manage config via proprietary runtime."""
     _exec_runtime("config", list(ctx.args))
+
+
+def compliance(ctx: typer.Context) -> None:
+    """Inspect compliance packs/coverage via proprietary runtime."""
+    _exec_runtime("compliance", list(ctx.args))

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/main.py

@@ -56,6 +56,7 @@ app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.gc)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.check)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.doctor)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.config)
+app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.compliance)
 
 app.command()(setup_cmds.setup)
 

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/runtime_manager.py

@@ -14,6 +14,7 @@ import platform
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
+from typing import Callable
 from urllib.parse import urlparse
 
 import httpx
@@ -153,17 +154,49 @@ def resolve_runtime_manifest(*, channel: str = "stable", timeout: float = 20.0)
     return manifest
 
 
-def download_artifact(url: str, *, timeout: float = 60.0) -> bytes:
+def download_artifact(
+    url: str,
+    *,
+    timeout: float = 60.0,
+    progress_cb: Callable[[int, int | None], None] | None = None,
+) -> bytes:
     headers: dict[str, str] = {}
     if _should_send_runtime_auth(url):
         headers["Authorization"] = _runtime_auth_header()
+    resolved_timeout = max(float(timeout), 300.0)
+    if progress_cb is None:
+        try:
+            response = httpx.get(url, headers=headers, timeout=resolved_timeout)
+        except httpx.HTTPError as exc:
+            raise RuntimeError(f"Could not download runtime artifact: {exc}") from exc
+        if response.status_code >= 400:
+            raise RuntimeError(f"Runtime artifact download failed ({response.status_code})")
+        return response.content
     try:
-        response = httpx.get(url, headers=headers, timeout=max(float(timeout), 300.0))
+        with httpx.stream("GET", url, headers=headers, timeout=resolved_timeout) as response:
+            if response.status_code >= 400:
+                raise RuntimeError(f"Runtime artifact download failed ({response.status_code})")
+            total: int | None = None
+            total_header = str(response.headers.get("Content-Length") or "").strip()
+            if total_header:
+                try:
+                    parsed_total = int(total_header)
+                except ValueError:
+                    parsed_total = -1
+                if parsed_total > 0:
+                    total = parsed_total
+            downloaded = 0
+            chunks: list[bytes] = []
+            progress_cb(downloaded, total)
+            for chunk in response.iter_bytes(chunk_size=64 * 1024):
+                if not chunk:
+                    continue
+                chunks.append(chunk)
+                downloaded += len(chunk)
+                progress_cb(downloaded, total)
     except httpx.HTTPError as exc:
         raise RuntimeError(f"Could not download runtime artifact: {exc}") from exc
-    if response.status_code >= 400:
-        raise RuntimeError(f"Runtime artifact download failed ({response.status_code})")
-    return response.content
+    return b"".join(chunks)
 
 
 def _should_send_runtime_auth(url: str) -> bool:

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli/setup_flow.py

@@ -10,6 +10,9 @@ from pathlib import Path
 from inspect import signature
 from typing import Callable
 
+from rich.console import Console
+from rich.progress import BarColumn, DownloadColumn, Progress, TaskID, TextColumn, TimeRemainingColumn, TransferSpeedColumn
+
 from refactorai_cli.local_engine_runtime import (
     DEFAULT_ENGINE_CONTAINER,
     DEFAULT_ENGINE_IMAGE,
@@ -39,6 +42,7 @@ STAGE_NAMES = {
     "S5": "backend_bootstrap",
     "S6": "validate",
 }
+_setup_console = Console()
 
 
 class SetupError(RuntimeError):
@@ -180,7 +184,23 @@ def _stage_s3_runtime(ask_approval: Callable[[str], bool], emit: Callable[[str],
         raise SetupError("Runtime installation was not approved.")
     if emit:
         emit(f"Downloading runtime artifact {manifest.runtime_version}...")
-    artifact = download_artifact(manifest.artifact_url)
+    progress_columns = (
+        TextColumn("[progress.description]{task.description}"),
+        BarColumn(),
+        DownloadColumn(),
+        TransferSpeedColumn(),
+        TimeRemainingColumn(),
+    )
+    with Progress(*progress_columns, console=_setup_console, transient=True) as progress:
+        task_id: TaskID = progress.add_task("Downloading runtime artifact", total=None)
+
+        def _on_progress(downloaded: int, total: int | None) -> None:
+            update_kwargs = {"completed": int(max(downloaded, 0))}
+            if total is not None and total > 0:
+                update_kwargs["total"] = total
+            progress.update(task_id, **update_kwargs)
+
+        artifact = download_artifact(manifest.artifact_url, progress_cb=_on_progress)
     if emit:
         emit("Verifying and activating runtime artifact...")
     path = activate_runtime(manifest, artifact, channel="stable")

{refactorai_cli-0.2.15 → refactorai_cli-0.2.17}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.15
+Version: 0.2.17
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown