refactorai-cli 0.2.16__tar.gz → 0.2.19__tar.gz

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.16
+Version: 0.2.19
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.2.16"
+version = "0.2.19"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.2.16"
+__version__ = "0.2.19"

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/refactorai_cli/commands/run_cmds.py

@@ -35,6 +35,13 @@ from refactor_core.constitution import (
     raw_secret_matches,
     raw_secret_matches_config,
 )
+from refactor_core.compliance_settings import (
+    ComplianceSelectionError,
+    resolve_compliance_selection,
+)
+from refactor_core.compliance.loader import CompliancePackError, resolve_compliance_packs
+from refactor_core.compliance.models import CompliancePackResolution
+from refactor_core.compliance.evidence import build_compliance_evidence_bundle, evaluate_compliance_gate
 from refactor_core.apply import (
     ApplyError,
     apply_changes,
@@ -180,6 +187,25 @@ _REQUIRED_ENV_BY_PROVIDER: dict[str, list[object]] = {
 }
 
 
+def _sanitize_runtime_error_message(message: object) -> str:
+    """Normalize provider/runtime errors to runtime-artifact-friendly guidance."""
+    text = str(message or "").strip()
+    if not text:
+        return "unknown"
+    install_hint = re.search(
+        r"Install with:\s*pip install ['\"]refactor-core(?:\[[^'\"]+\])?['\"]",
+        text,
+        flags=re.IGNORECASE,
+    )
+    if install_hint:
+        return (
+            "Bedrock credentials are not configured for runtime execution. "
+            "Set AWS_BEARER_TOKEN_BEDROCK (for example: `set -a; source .env; set +a`) "
+            "or run with AWS SDK credentials in an environment that includes boto3."
+        )
+    return text
+
+
 def _agent_progress_logger(
     stage: str, *, status=None, verbose_steps: bool = True
 ) -> Callable[[dict], None]:
@@ -298,16 +324,18 @@ def _agent_progress_logger(
                     f"[dim]{stage}: step {event.get('step', '?')} result -> {summary}[/dim]"
                 )
         elif kind == "tool_error":
+            error_text = _sanitize_runtime_error_message(event.get("error", "unknown"))
             console.print(
                 f"[yellow]{stage}: step {event.get('step', '?')} tool `{event.get('tool', '?')}` "
-                f"error: {event.get('error', 'unknown')}[/yellow]"
+                f"error: {error_text}[/yellow]"
             )
         elif kind == "invalid_response":
             console.print(f"[yellow]{stage}: step {event.get('step', '?')} returned invalid JSON tool call.[/yellow]")
         elif kind == "transport_error":
+            error_text = _sanitize_runtime_error_message(event.get("error", "unknown"))
             console.print(
                 f"[yellow]{stage}: model transport error at step {event.get('step', '?')}: "
-                f"{event.get('error', 'unknown')}[/yellow]"
+                f"{error_text}[/yellow]"
             )
         elif kind == "finish":
             _set_status(
@@ -661,6 +689,35 @@ def _warn_raw_key(constitution, config) -> None:
         )
 
 
+def _resolve_compliance_context(
+    *,
+    project_config,
+    cli_frameworks: list[str] | None = None,
+    cli_level: str | None = None,
+    cli_rollout: str | None = None,
+    cli_canary_percent: int | None = None,
+) -> tuple[tuple[str, ...], str, CompliancePackResolution, str, int]:
+    """Resolve compliance selection + managed pack set for this run."""
+    selection = resolve_compliance_selection(
+        dict(getattr(project_config, "settings", {}) or {}),
+        cli_frameworks=cli_frameworks,
+        cli_level=cli_level,
+        cli_rollout=cli_rollout,
+        cli_canary_percent=cli_canary_percent,
+    )
+    resolution = resolve_compliance_packs(
+        selection.frameworks,
+        level=selection.level,
+    )
+    return (
+        selection.frameworks,
+        selection.level,
+        resolution,
+        selection.rollout,
+        selection.canary_percent,
+    )
+
+
 def init(
     force: bool = typer.Option(
         False,
@@ -1481,10 +1538,64 @@ def review(
         "--force",
         help="Run review even if unapplied patches exist from a prior code run.",
     ),
+    compliance_framework: list[str] | None = typer.Option(
+        None,
+        "--compliance-framework",
+        help="Compliance framework to enable for this run. Repeat for multiple values.",
+    ),
+    compliance_level: str | None = typer.Option(
+        None,
+        "--compliance-level",
+        help="Compliance level override: off | advisory | standard | strict.",
+    ),
+    compliance_rollout: str | None = typer.Option(
+        None,
+        "--compliance-rollout",
+        help="Compliance rollout mode: default | staged | canary | off | ga.",
+    ),
+    compliance_canary_percent: int | None = typer.Option(
+        None,
+        "--compliance-canary-percent",
+        help="Compliance canary percentage (0-100) when rollout=canary.",
+    ),
 ) -> None:
     """Run review (findings only) and store the result. Requires a valid key."""
     _require_auth()
     project_root, constitution, project_config = _load_project()
+    try:
+        (
+            compliance_frameworks,
+            resolved_compliance_level,
+            compliance_resolution,
+            compliance_rollout_mode,
+            compliance_canary_pct,
+        ) = (
+            _resolve_compliance_context(
+                project_config=project_config,
+                cli_frameworks=compliance_framework,
+                cli_level=compliance_level,
+                cli_rollout=compliance_rollout,
+                cli_canary_percent=compliance_canary_percent,
+            )
+        )
+    except ComplianceSelectionError as exc:
+        console.print(f"[red]review: invalid compliance selection:[/red] {exc}")
+        raise typer.Exit(code=2) from exc
+    except CompliancePackError as exc:
+        console.print(f"[red]review: compliance pack resolution failed:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    if compliance_frameworks:
+        pack_label = ", ".join(
+            f"{pack.pack_id}@{pack.version}" for pack in compliance_resolution.packs
+        ) or "(none loaded)"
+        console.print(
+            "[dim]review: compliance selection "
+            f"frameworks={list(compliance_frameworks)} level={resolved_compliance_level} "
+            f"rollout={compliance_rollout_mode} canary_percent={compliance_canary_pct} "
+            f"packs={pack_label}[/dim]"
+        )
+    for warning in compliance_resolution.warnings:
+        console.print(f"[yellow]review: compliance warning:[/yellow] {warning}")
     register_project(project_root, constitution_hash=constitution.content_hash)
     _maybe_build_graph(project_root, project_config)
     sandbox_ctx = None
@@ -1546,7 +1657,7 @@ def review(
                 "Review continued; address sandbox install/toolchain incompatibilities for best results."
             )
     except Exception as exc:  # provider/transport errors should not crash the CLI
-        console.print(f"[red]Review failed:[/red] {exc}")
+        console.print(f"[red]Review failed:[/red] {_sanitize_runtime_error_message(exc)}")
         raise typer.Exit(code=1) from exc
     finally:
         _teardown_sandbox_context(project_root, sandbox_ctx)
@@ -1562,8 +1673,34 @@ def review(
         project_root=project_root,
         findings=artifact.findings,
         run_id=artifact.run_id,
+        compliance_frameworks=compliance_frameworks,
+        compliance_level=resolved_compliance_level,
+        compliance_rollout=compliance_rollout_mode,
+        compliance_canary_percent=compliance_canary_pct,
+        compliance_resolution=compliance_resolution,
         artifact=artifact,
     )
+    _apply_compliance_gate_to_artifact(artifact)
+    run_store.write_artifact(artifact, target=target, status="completed")
+    if compliance_frameworks:
+        artifact.notes.append(
+            "Compliance selection: frameworks="
+            + ",".join(compliance_frameworks)
+            + (
+                f" level={resolved_compliance_level} rollout={compliance_rollout_mode} "
+                f"canary_percent={compliance_canary_pct}"
+            )
+        )
+        if compliance_resolution.packs:
+            artifact.notes.append(
+                "Compliance packs: "
+                + ", ".join(
+                    f"{pack.pack_id}@{pack.version}"
+                    for pack in compliance_resolution.packs
+                )
+            )
+        for warning in compliance_resolution.warnings:
+            artifact.notes.append(f"Compliance pack warning: {warning}")
     if requests:
         console.print(
             f"\n[bold]Created {len(requests)} refactor request(s).[/bold] "
@@ -1608,6 +1745,26 @@ def code(
         "--equivalence",
         help="Equivalence policy: strict | balanced.",
     ),
+    compliance_framework: list[str] | None = typer.Option(
+        None,
+        "--compliance-framework",
+        help="Compliance framework to enable for this run. Repeat for multiple values.",
+    ),
+    compliance_level: str | None = typer.Option(
+        None,
+        "--compliance-level",
+        help="Compliance level override: off | advisory | standard | strict.",
+    ),
+    compliance_rollout: str | None = typer.Option(
+        None,
+        "--compliance-rollout",
+        help="Compliance rollout mode: default | staged | canary | off | ga.",
+    ),
+    compliance_canary_percent: int | None = typer.Option(
+        None,
+        "--compliance-canary-percent",
+        help="Compliance canary percentage (0-100) when rollout=canary.",
+    ),
 ) -> None:
     """Work through refactor requests one by one, applying & verifying each.
 
@@ -1616,6 +1773,40 @@ def code(
     """
     _require_auth()
     project_root, constitution, project_config = _load_project()
+    try:
+        (
+            compliance_frameworks,
+            resolved_compliance_level,
+            compliance_resolution,
+            compliance_rollout_mode,
+            compliance_canary_pct,
+        ) = (
+            _resolve_compliance_context(
+                project_config=project_config,
+                cli_frameworks=compliance_framework,
+                cli_level=compliance_level,
+                cli_rollout=compliance_rollout,
+                cli_canary_percent=compliance_canary_percent,
+            )
+        )
+    except ComplianceSelectionError as exc:
+        console.print(f"[red]code: invalid compliance selection:[/red] {exc}")
+        raise typer.Exit(code=2) from exc
+    except CompliancePackError as exc:
+        console.print(f"[red]code: compliance pack resolution failed:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    if compliance_frameworks:
+        pack_label = ", ".join(
+            f"{pack.pack_id}@{pack.version}" for pack in compliance_resolution.packs
+        ) or "(none loaded)"
+        console.print(
+            "[dim]code: compliance selection "
+            f"frameworks={list(compliance_frameworks)} level={resolved_compliance_level} "
+            f"rollout={compliance_rollout_mode} canary_percent={compliance_canary_pct} "
+            f"packs={pack_label}[/dim]"
+        )
+    for warning in compliance_resolution.warnings:
+        console.print(f"[yellow]code: compliance warning:[/yellow] {warning}")
     register_project(project_root, constitution_hash=constitution.content_hash)
     _maybe_build_graph(project_root, project_config)
     sandbox_ctx = None
@@ -1676,8 +1867,34 @@ def code(
                 project_root=project_root,
                 findings=review_artifact.findings,
                 run_id=review_artifact.run_id,
+                compliance_frameworks=compliance_frameworks,
+                compliance_level=resolved_compliance_level,
+                compliance_rollout=compliance_rollout_mode,
+                compliance_canary_percent=compliance_canary_pct,
+                compliance_resolution=compliance_resolution,
                 artifact=review_artifact,
             )
+            _apply_compliance_gate_to_artifact(review_artifact)
+            if compliance_frameworks:
+                review_artifact.notes.append(
+                    "Compliance selection: frameworks="
+                    + ",".join(compliance_frameworks)
+                    + (
+                        f" level={resolved_compliance_level} rollout={compliance_rollout_mode} "
+                        f"canary_percent={compliance_canary_pct}"
+                    )
+                )
+                if compliance_resolution.packs:
+                    review_artifact.notes.append(
+                        "Compliance packs: "
+                        + ", ".join(
+                            f"{pack.pack_id}@{pack.version}"
+                            for pack in compliance_resolution.packs
+                        )
+                    )
+                for warning in compliance_resolution.warnings:
+                    review_artifact.notes.append(f"Compliance pack warning: {warning}")
+            review_store.write_artifact(review_artifact, target=target, status="completed")
             console.print(f"[bold]Created {len(requests)} refactor request(s).[/bold]")
 
         if not requests:
@@ -1710,7 +1927,7 @@ def code(
                 equivalence_mode=equivalence,
             )
     except Exception as exc:
-        console.print(f"[red]Refactor failed:[/red] {exc}")
+        console.print(f"[red]Refactor failed:[/red] {_sanitize_runtime_error_message(exc)}")
         raise typer.Exit(code=1) from exc
     finally:
         _teardown_sandbox_context(project_root, sandbox_ctx)
@@ -1826,6 +2043,211 @@ def requests(
     console.print(table)
 
 
+def compliance(
+    action: str = typer.Argument(
+        "show",
+        help="Compliance view action: status | show | coverage | explain | export",
+    ),
+    subject: str = typer.Argument(
+        "",
+        help="Rule ID when action=explain.",
+    ),
+    compliance_framework: list[str] | None = typer.Option(
+        None,
+        "--compliance-framework",
+        help="Compliance framework selection override. Repeat for multiple values.",
+    ),
+    compliance_level: str | None = typer.Option(
+        None,
+        "--compliance-level",
+        help="Compliance level override: off | advisory | standard | strict.",
+    ),
+    compliance_rollout: str | None = typer.Option(
+        None,
+        "--compliance-rollout",
+        help="Compliance rollout mode override: default | staged | canary | off | ga.",
+    ),
+    compliance_canary_percent: int | None = typer.Option(
+        None,
+        "--compliance-canary-percent",
+        help="Compliance canary percentage override when rollout=canary.",
+    ),
+    output: str = typer.Option(
+        "",
+        "--output",
+        help="Output file path for action=export (defaults to latest run directory).",
+    ),
+) -> None:
+    """Show/export compliance packs, coverage, and rule details."""
+    _require_auth()
+    _project_root, _constitution, project_config = _load_project()
+    try:
+        frameworks, level, resolution, rollout_mode, canary_percent = _resolve_compliance_context(
+            project_config=project_config,
+            cli_frameworks=compliance_framework,
+            cli_level=compliance_level,
+            cli_rollout=compliance_rollout,
+            cli_canary_percent=compliance_canary_percent,
+        )
+    except ComplianceSelectionError as exc:
+        console.print(f"[red]compliance: invalid selection:[/red] {exc}")
+        raise typer.Exit(code=2) from exc
+    except CompliancePackError as exc:
+        console.print(f"[red]compliance: pack resolution failed:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    mode = str(action or "show").strip().lower()
+    if mode not in {"status", "show", "coverage", "explain", "export"}:
+        console.print(f"[red]Unknown compliance action:[/red] {action}")
+        raise typer.Exit(code=2)
+    if not frameworks:
+        console.print(
+            "[dim]No compliance frameworks selected. "
+            "Set `compliance.frameworks` in refactor.config or pass --compliance-framework.[/dim]"
+        )
+        return
+
+    if mode == "status":
+        run_dir = head_run_dir(_project_root)
+        report = read_report(run_dir) if run_dir else {}
+        summary = (
+            dict((report or {}).get("compliance_summary", {}) or {})
+            if isinstance(report, dict)
+            else {}
+        )
+        gate = dict((report or {}).get("gate", {}) or {}) if isinstance(report, dict) else {}
+        console.print("[bold]Compliance status[/bold]")
+        console.print(
+            f"  selection: frameworks={list(frameworks)} level={level} "
+            f"rollout={rollout_mode} canary_percent={canary_percent}"
+        )
+        table = Table(title="Compliance packs", show_lines=False)
+        table.add_column("pack_id", no_wrap=True)
+        table.add_column("framework", no_wrap=True)
+        table.add_column("version", no_wrap=True)
+        table.add_column("rules", no_wrap=True)
+        for pack in resolution.packs:
+            table.add_row(pack.pack_id, pack.framework, pack.version, str(len(pack.rules)))
+        console.print(table)
+        if not run_dir:
+            console.print(
+                "[yellow]No runs yet.[/yellow] Run `refactor review` to produce compliance evidence."
+            )
+            return
+        run_id = str((report or {}).get("run_id", run_dir.name))
+        created = str((report or {}).get("created_at", ""))
+        gate_status = str(gate.get("status", "unknown"))
+        projected = int(summary.get("projected_count", 0) or 0)
+        blocked = int(summary.get("blocked_count", 0) or 0)
+        warned = int(summary.get("warned_count", 0) or 0)
+        gate_color = "green" if gate_status == "passed" else "red"
+        console.print(
+            f"  latest_run: {run_id}" + (f" ({created})" if created else "")
+        )
+        console.print(
+            f"  gate: [{gate_color}]{gate_status}[/{gate_color}] "
+            f"projected={projected} blocked={blocked} warned={warned}"
+        )
+        if blocked > 0 and level in {"standard", "strict"}:
+            console.print(
+                "[yellow]next step:[/yellow] resolve blocked controls or run with "
+                "`--compliance-rollout staged` during pilot."
+            )
+        elif projected == 0:
+            console.print(
+                "[dim]No compliance-projected controls were triggered in the latest run.[/dim]"
+            )
+        return
+
+    if mode == "show":
+        console.print(
+            "[bold]Compliance selection[/bold]: "
+            f"frameworks={list(frameworks)} level={level} "
+            f"rollout={rollout_mode} canary_percent={canary_percent}"
+        )
+        table = Table(title="Compliance packs", show_lines=False)
+        table.add_column("pack_id", no_wrap=True)
+        table.add_column("framework", no_wrap=True)
+        table.add_column("version", no_wrap=True)
+        table.add_column("rules", no_wrap=True)
+        table.add_column("depends_on")
+        for pack in resolution.packs:
+            table.add_row(
+                pack.pack_id,
+                pack.framework,
+                pack.version,
+                str(len(pack.rules)),
+                ", ".join(pack.depends_on) if pack.depends_on else "-",
+            )
+        console.print(table)
+        for warning in resolution.warnings:
+            console.print(f"[yellow]warning:[/yellow] {warning}")
+        return
+
+    if mode == "export":
+        run_dir = head_run_dir(_project_root)
+        if not run_dir:
+            console.print("[yellow]No runs available to export compliance evidence.[/yellow]")
+            raise typer.Exit(code=1)
+        report = read_report(run_dir) or {}
+        payload = build_compliance_evidence_bundle(report)
+        destination = Path(output).expanduser() if output.strip() else (run_dir / "compliance-evidence.json")
+        try:
+            destination.parent.mkdir(parents=True, exist_ok=True)
+            destination.write_text(json.dumps(payload, indent=2, sort_keys=True), encoding="utf-8")
+        except OSError as exc:
+            console.print(f"[red]Failed to write compliance evidence:[/red] {exc}")
+            raise typer.Exit(code=1) from exc
+        console.print(f"[green]Compliance evidence exported:[/green] {destination}")
+        return
+
+    if mode == "coverage":
+        table = Table(title="Compliance coverage", show_lines=False)
+        table.add_column("framework", no_wrap=True)
+        table.add_column("control", no_wrap=True)
+        table.add_column("classification", no_wrap=True)
+        rows = 0
+        for pack in resolution.packs:
+            if not pack.coverage:
+                table.add_row(pack.framework, "-", "unknown")
+                rows += 1
+                continue
+            for control, classification in sorted(pack.coverage.items()):
+                table.add_row(pack.framework, control, classification)
+                rows += 1
+        if rows == 0:
+            console.print("[dim]No coverage metadata available in selected packs.[/dim]")
+            return
+        console.print(table)
+        return
+
+    # explain
+    rule_id = (subject or "").strip()
+    if not rule_id:
+        console.print("[red]Rule id is required for `refactor compliance explain`.[/red]")
+        raise typer.Exit(code=2)
+    needle = rule_id.lower()
+    matches = []
+    for pack in resolution.packs:
+        for rule in pack.rules:
+            if rule.rule_id.lower() == needle or needle in rule.rule_id.lower():
+                matches.append((pack, rule))
+    if not matches:
+        console.print(f"[yellow]No compliance rule found:[/yellow] {rule_id}")
+        raise typer.Exit(code=1)
+    for pack, rule in matches:
+        console.print(
+            f"[bold]{rule.rule_id}[/bold] "
+            f"[dim](pack={pack.pack_id}@{pack.version}, framework={pack.framework})[/dim]"
+        )
+        if rule.source_standard:
+            console.print(f"  standard: {rule.source_standard}")
+        if rule.control_objective:
+            console.print(f"  objective: {rule.control_objective}")
+        console.print(f"  operation_intent: {rule.operation_intent}")
+        console.print(f"  base_severity: {rule.base_severity}")
+        console.print(f"  priority: {rule.priority}")
+
+
 def _format_operation_scope(rr) -> str:
     scope = getattr(rr, "scope", None)
     if scope is None:
@@ -1861,6 +2283,11 @@ def _replace_requests_with_framework_guardrails(
     project_root: Path,
     findings: list[Finding],
     run_id: str,
+    compliance_frameworks: tuple[str, ...] = (),
+    compliance_level: str = "standard",
+    compliance_rollout: str = "default",
+    compliance_canary_percent: int = 20,
+    compliance_resolution: CompliancePackResolution | None = None,
     artifact: RunArtifact | None = None,
 ) -> list:
     clear_requests(project_root)
@@ -1868,20 +2295,79 @@ def _replace_requests_with_framework_guardrails(
         project_root,
         findings,
         run_id=run_id,
+        compliance_frameworks=compliance_frameworks,
+        compliance_level=compliance_level,
+        compliance_rollout=compliance_rollout,
+        compliance_canary_percent=compliance_canary_percent,
         return_diagnostics=True,
     )
     _report_framework_suppressions(suppressions, artifact=artifact)
     _report_framework_warnings(warnings, artifact=artifact)
+    if artifact is not None and compliance_frameworks:
+        compliance_suppressed = [
+            item for item in suppressions if str(item.reason_code).startswith("RR_COMPLIANCE_")
+        ]
+        compliance_warnings = [
+            item for item in warnings if str(item.reason_code).startswith("RR_COMPLIANCE_")
+        ]
+        artifact.compliance_summary = {
+            "level": compliance_level,
+            "frameworks": list(compliance_frameworks),
+            "rollout": compliance_rollout,
+            "canary_percent": int(compliance_canary_percent),
+            "pack_versions": (
+                compliance_resolution.pack_versions if compliance_resolution is not None else {}
+            ),
+            "projected_count": len(compliance_suppressed) + len(compliance_warnings),
+            "blocked_count": len(compliance_suppressed),
+            "warned_count": len(compliance_warnings),
+            "rules_triggered": sorted(
+                {
+                    item.rule_id
+                    for item in [*compliance_suppressed, *compliance_warnings]
+                    if str(item.rule_id).strip()
+                }
+            ),
+        }
     return requests
 
 
+def _apply_compliance_gate_to_artifact(artifact: RunArtifact) -> None:
+    """Promote compliance blocking decisions into gate outcome (R18 Phase 7)."""
+    summary = dict(getattr(artifact, "compliance_summary", {}) or {})
+    decision = evaluate_compliance_gate(
+        summary,
+        base_gate_status=str(getattr(artifact.gate, "status", "unknown") or "unknown"),
+    )
+    if decision.status == "blocked":
+        artifact.gate.status = "blocked"
+    reasons = list((artifact.gate.blocking_reasons or {}).get("reasons", []))
+    for reason in decision.reasons:
+        if reason not in reasons:
+            reasons.append(reason)
+    artifact.gate.blocking_reasons["reasons"] = reasons
+
+
 def _report_framework_suppressions(
     suppressions: list[RequestSuppression], *, artifact: RunArtifact | None = None
 ) -> None:
     if not suppressions:
         return
+    feasibility = sum(1 for s in suppressions if s.rule_id == "operation_feasibility")
+    compliance = sum(
+        1 for s in suppressions if s.reason_code.startswith("RR_COMPLIANCE_")
+    )
+    framework = len(suppressions) - feasibility - compliance
+    parts: list[str] = []
+    if framework:
+        parts.append(f"{framework} due to framework invariants")
+    if compliance:
+        parts.append(f"{compliance} due to compliance controls")
+    if feasibility:
+        parts.append(f"{feasibility} not executable as written")
+    detail = "; ".join(parts) if parts else "review-stage checks"
     console.print(
-        f"[yellow]warning:[/yellow] suppressed {len(suppressions)} finding(s) due to framework invariants."
+        f"[yellow]warning:[/yellow] suppressed {len(suppressions)} finding(s) ({detail})."
     )
     for item in suppressions:
         console.print(
@@ -1897,8 +2383,16 @@ def _report_framework_warnings(
 ) -> None:
     if not warnings:
         return
+    compliance = sum(1 for item in warnings if item.reason_code.startswith("RR_COMPLIANCE_"))
+    framework = len(warnings) - compliance
+    detail_parts: list[str] = []
+    if framework:
+        detail_parts.append(f"{framework} framework")
+    if compliance:
+        detail_parts.append(f"{compliance} compliance")
+    detail = ", ".join(detail_parts) if detail_parts else "review"
     console.print(
-        f"[yellow]warning:[/yellow] flagged {len(warnings)} finding(s) with framework caution."
+        f"[yellow]warning:[/yellow] flagged {len(warnings)} finding(s) with caution ({detail})."
     )
     for item in warnings:
         console.print(
@@ -2166,6 +2660,11 @@ def gc(
 
 def check(
     strict: bool = typer.Option(False, "--strict", help="Exit non-zero if issues are found (for CI)."),
+    compliance_gate: bool = typer.Option(
+        False,
+        "--compliance-gate",
+        help="Also enforce latest run compliance gate status (for CI/PR pipelines).",
+    ),
 ) -> None:
     """Check the constitution for committed secrets (developer/provider keys)."""
     files = find_project_files()
@@ -2176,6 +2675,25 @@ def check(
     constitution = load_constitution(consti_path)
     config = load_config(config_path)
     findings = raw_secret_matches(constitution) + raw_secret_matches_config(config)
+    compliance_failed = False
+    if compliance_gate:
+        run_dir = head_run_dir(consti_path.parent)
+        if run_dir is None:
+            console.print("[yellow]Compliance gate check skipped:[/yellow] no runs yet.")
+        else:
+            report = read_report(run_dir) or {}
+            decision = evaluate_compliance_gate(
+                report.get("compliance_summary", {}),
+                base_gate_status=str((report.get("gate") or {}).get("status", "unknown")),
+            )
+            if decision.status == "blocked":
+                compliance_failed = True
+                console.print(
+                    "[red]Compliance gate blocked[/red]: "
+                    + ", ".join(decision.reasons or ("compliance_controls_blocked",))
+                )
+            else:
+                console.print("[green]Compliance gate[/green]: passed")
     if findings:
         kinds = ", ".join(sorted({kind for kind, _ in findings}))
         console.print(
@@ -2183,6 +2701,8 @@ def check(
             f"{consti_path} or {config_path}. Replace secrets with `${{ENV_VAR}}` references."
         )
         raise typer.Exit(code=1 if strict else 0)
+    if compliance_failed:
+        raise typer.Exit(code=1 if strict else 0)
     console.print("[green]OK[/green]: no committed secret-like literals detected.")
 
 

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/refactorai_cli/commands/runtime_proxy_cmds.py

@@ -136,3 +136,8 @@ def doctor(ctx: typer.Context) -> None:
 def config(ctx: typer.Context) -> None:
     """Manage config via proprietary runtime."""
     _exec_runtime("config", list(ctx.args))
+
+
+def compliance(ctx: typer.Context) -> None:
+    """Inspect compliance packs/coverage via proprietary runtime."""
+    _exec_runtime("compliance", list(ctx.args))

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/refactorai_cli/main.py

@@ -56,6 +56,7 @@ app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.gc)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.check)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.doctor)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.config)
+app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.compliance)
 
 app.command()(setup_cmds.setup)
 

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/refactorai_cli/setup_flow.py

@@ -10,6 +10,9 @@ from pathlib import Path
 from inspect import signature
 from typing import Callable
 
+from rich.console import Console
+from rich.progress import BarColumn, DownloadColumn, Progress, TaskID, TextColumn, TimeRemainingColumn, TransferSpeedColumn
+
 from refactorai_cli.local_engine_runtime import (
     DEFAULT_ENGINE_CONTAINER,
     DEFAULT_ENGINE_IMAGE,
@@ -39,6 +42,7 @@ STAGE_NAMES = {
     "S5": "backend_bootstrap",
     "S6": "validate",
 }
+_setup_console = Console()
 
 
 class SetupError(RuntimeError):
@@ -180,7 +184,23 @@ def _stage_s3_runtime(ask_approval: Callable[[str], bool], emit: Callable[[str],
         raise SetupError("Runtime installation was not approved.")
     if emit:
         emit(f"Downloading runtime artifact {manifest.runtime_version}...")
-    artifact = download_artifact(manifest.artifact_url)
+    progress_columns = (
+        TextColumn("[progress.description]{task.description}"),
+        BarColumn(),
+        DownloadColumn(),
+        TransferSpeedColumn(),
+        TimeRemainingColumn(),
+    )
+    with Progress(*progress_columns, console=_setup_console, transient=True) as progress:
+        task_id: TaskID = progress.add_task("Downloading runtime artifact", total=None)
+
+        def _on_progress(downloaded: int, total: int | None) -> None:
+            update_kwargs = {"completed": int(max(downloaded, 0))}
+            if total is not None and total > 0:
+                update_kwargs["total"] = total
+            progress.update(task_id, **update_kwargs)
+
+        artifact = download_artifact(manifest.artifact_url, progress_cb=_on_progress)
     if emit:
         emit("Verifying and activating runtime artifact...")
     path = activate_runtime(manifest, artifact, channel="stable")

{refactorai_cli-0.2.16 → refactorai_cli-0.2.19}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.16
+Version: 0.2.19
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown