refactorai-cli 0.2.20__tar.gz → 0.2.22__tar.gz

{refactorai_cli-0.2.20 → refactorai_cli-0.2.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.20
+Version: 0.2.22
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -53,6 +53,6 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.12-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.22-py3-none-any.whl
 refactor --version
 ```

{refactorai_cli-0.2.20 → refactorai_cli-0.2.22}/README.md

@@ -42,6 +42,6 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.12-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.22-py3-none-any.whl
 refactor --version
 ```

{refactorai_cli-0.2.20 → refactorai_cli-0.2.22}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.2.20"
+version = "0.2.22"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"

{refactorai_cli-0.2.20 → refactorai_cli-0.2.22}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.2.20"
+__version__ = "0.2.22"

{refactorai_cli-0.2.20 → refactorai_cli-0.2.22}/refactorai_cli/commands/run_cmds.py

@@ -72,6 +72,9 @@ from refactor_core.models import Finding, GeneratedTest, PatchGroup, RunArtifact
 from refactor_core.pipeline import build_refactor_prompt, build_review_prompt
 from refactor_core.providers import get_provider, resolve_provider_name, supported_providers
 from refactor_core.rules import annotate_documents_with_rules, filter_documents_by_rules
+from refactor_core.security import merge_refactor_findings, suppress_findings_for_rr
+from refactor_core.security.semgrep_runner import EMBEDDED_SEMGREP_SENTINEL
+from refactor_core.security.suppression import SecuritySuppression
 from refactor_core.sandbox_runtime import (
     DEFAULT_IMAGE as SANDBOX_DEFAULT_IMAGE,
     DEFAULT_SHELL as SANDBOX_DEFAULT_SHELL,
@@ -110,6 +113,7 @@ from refactor_core.testcmd import resolve_test_command
 
 from refactorai_cli.auth import AuthError, ensure_authenticated
 from refactorai_cli.local_engine_runtime import DEFAULT_ENGINE_PORT, read_engine_state
+from refactorai_cli.runtime_manager import runtime_status, runtime_version_dir
 from refactorai_cli.settings import platform_url
 from refactorai_cli.setup_flow import (
     BACKEND_BYOK,
@@ -689,6 +693,82 @@ def _warn_raw_key(constitution, config) -> None:
         )
 
 
+def _resolve_runtime_semgrep_binary() -> str:
+    try:
+        status = runtime_status()
+    except Exception:
+        return ""
+    active = str(status.get("active_version") or "").strip()
+    if not active:
+        return ""
+    try:
+        base = runtime_version_dir(active)
+    except Exception:
+        return ""
+    candidates = (
+        base / "semgrep",
+        base / "semgrep.bin",
+        base / "bin" / "semgrep",
+        base / "tools" / "semgrep",
+    )
+    for path in candidates:
+        if path.is_file():
+            return str(path)
+    return ""
+
+
+def _active_runtime_version() -> str:
+    try:
+        status = runtime_status()
+    except Exception:
+        return ""
+    return str(status.get("active_version") or "").strip()
+
+
+def _inject_runtime_scanner_settings(constitution) -> None:
+    settings = dict(getattr(constitution, "settings", {}) or {})
+    if not bool(settings.get("security_scanner_enabled", False)):
+        constitution.settings = settings
+        return
+    active_version = _active_runtime_version()
+    scanner_path = _resolve_runtime_semgrep_binary()
+    settings["security_scan_require_runtime_binary"] = True
+    if scanner_path:
+        settings["security_scan_binary"] = scanner_path
+    elif active_version:
+        # Runtime artifact can include semgrep as an embedded python module.
+        settings["security_scan_binary"] = EMBEDDED_SEMGREP_SENTINEL
+    else:
+        settings["security_scan_binary"] = ""
+    constitution.settings = settings
+
+
+def _report_runtime_scanner_status() -> None:
+    scanner_path = _resolve_runtime_semgrep_binary()
+    try:
+        status = runtime_status()
+    except Exception as exc:
+        console.print(f"[yellow]security scanner[/yellow]: status unavailable ({exc})")
+        return
+    active = str(status.get("active_version") or "").strip()
+    if scanner_path:
+        console.print(
+            f"[green]security scanner[/green]: ready "
+            f"[dim](runtime={active or 'unknown'}, path={scanner_path})[/dim]"
+        )
+        return
+    if active:
+        console.print(
+            "[green]security scanner[/green]: ready "
+            f"[dim](runtime={active}, embedded in runtime artifact)[/dim]"
+        )
+        return
+    console.print(
+        "[yellow]security scanner[/yellow]: unavailable "
+        "[dim](no active runtime; run `refactor runtime update`)[/dim]"
+    )
+
+
 def _resolve_compliance_context(
     *,
     project_config,
@@ -1562,6 +1642,7 @@ def review(
     """Run review (findings only) and store the result. Requires a valid key."""
     _require_auth()
     project_root, constitution, project_config = _load_project()
+    _inject_runtime_scanner_settings(constitution)
     try:
         (
             compliance_frameworks,
@@ -1665,13 +1746,16 @@ def review(
     run_store = create_run(project_root, run_id=artifact.run_id)
     run_store.write_artifact(artifact, target=target, status="completed")
 
-    _print_findings(artifact.findings)
+    rr_findings, security_suppressions = _prepare_rr_findings(artifact)
+    _print_findings(rr_findings)
+    _report_security_suppressions(security_suppressions, artifact=artifact)
+    _print_security_overview(artifact)
 
     # A fresh review supersedes prior refactor requests: replace them with one
     # RR per actionable finding (central-only; nothing is written into project tree).
     requests = _replace_requests_with_framework_guardrails(
         project_root=project_root,
-        findings=artifact.findings,
+        findings=rr_findings,
         run_id=artifact.run_id,
         compliance_frameworks=compliance_frameworks,
         compliance_level=resolved_compliance_level,
@@ -1781,6 +1865,7 @@ def code(
     """
     _require_auth()
     project_root, constitution, project_config = _load_project()
+    _inject_runtime_scanner_settings(constitution)
     try:
         (
             compliance_frameworks,
@@ -1870,10 +1955,13 @@ def code(
                     )
             review_store = create_run(project_root, run_id=review_artifact.run_id)
             review_store.write_artifact(review_artifact, target=target, status="completed")
-            _print_findings(review_artifact.findings)
+            rr_findings, security_suppressions = _prepare_rr_findings(review_artifact)
+            _print_findings(rr_findings)
+            _report_security_suppressions(security_suppressions, artifact=review_artifact)
+            _print_security_overview(review_artifact)
             requests = _replace_requests_with_framework_guardrails(
                 project_root=project_root,
-                findings=review_artifact.findings,
+                findings=rr_findings,
                 run_id=review_artifact.run_id,
                 compliance_frameworks=compliance_frameworks,
                 compliance_level=resolved_compliance_level,
@@ -2294,6 +2382,37 @@ def _format_operation_scope(rr) -> str:
     return "-"
 
 
+def _security_findings_from_artifact(artifact: RunArtifact) -> list[Finding]:
+    summary = dict(getattr(artifact, "security_summary", {}) or {})
+    raw = summary.get("normalized_findings", [])
+    if not isinstance(raw, list):
+        return []
+    out: list[Finding] = []
+    for item in raw:
+        try:
+            out.append(Finding.model_validate(item))
+        except Exception:
+            continue
+    return out
+
+
+def _prepare_rr_findings(artifact: RunArtifact) -> tuple[list[Finding], list[SecuritySuppression]]:
+    scanner_findings = _security_findings_from_artifact(artifact)
+    merged, _stats = merge_refactor_findings(list(artifact.findings or []), scanner_findings)
+    actionable, suppressed = suppress_findings_for_rr(merged)
+    summary = dict(getattr(artifact, "security_summary", {}) or {})
+    summary["rr_prefilter_input_count"] = len(merged)
+    summary["rr_prefilter_actionable_count"] = len(actionable)
+    summary["rr_prefilter_suppressed_count"] = len(suppressed)
+    reasons: dict[str, int] = {}
+    for item in suppressed:
+        code = str(item.reason_code or "unknown")
+        reasons[code] = int(reasons.get(code, 0) or 0) + 1
+    summary["rr_prefilter_reason_counts"] = reasons
+    artifact.security_summary = summary
+    return actionable, suppressed
+
+
 def _replace_requests_with_framework_guardrails(
     *,
     project_root: Path,
@@ -2348,6 +2467,46 @@ def _replace_requests_with_framework_guardrails(
     return requests
 
 
+def _report_security_suppressions(
+    suppressions: list[SecuritySuppression], *, artifact: RunArtifact | None = None
+) -> None:
+    if not suppressions:
+        return
+    console.print(
+        f"[yellow]warning:[/yellow] suppressed {len(suppressions)} finding(s) "
+        "before RR creation (security prefilter)."
+    )
+    for item in suppressions:
+        console.print(f"[yellow]-[/yellow] {item.location}: {item.message} [dim]({item.reason_code})[/dim]")
+        if artifact is not None:
+            artifact.notes.append(item.note())
+
+
+def _print_security_overview(artifact: RunArtifact) -> None:
+    summary = dict(getattr(artifact, "security_summary", {}) or {})
+    if not summary:
+        return
+    enabled = bool(summary.get("enabled", False))
+    status = str(summary.get("status", "unknown") or "unknown")
+    raw_count = int(summary.get("raw_count", 0) or 0)
+    normalized = int(summary.get("normalized_count", 0) or 0)
+    actionable = int(summary.get("rr_prefilter_actionable_count", len(getattr(artifact, "findings", []) or [])) or 0)
+    suppressed = int(summary.get("rr_prefilter_suppressed_count", 0) or 0)
+    duplicates = int(summary.get("duplicates_with_base", 0) or 0)
+    scanner_version = str(summary.get("scanner_version", "") or "")
+    version_note = f" v{scanner_version}" if scanner_version else ""
+    enabled_note = "enabled" if enabled else "disabled"
+    console.print(
+        "[dim]security baseline: "
+        f"{enabled_note} status={status}{version_note} raw={raw_count} "
+        f"normalized={normalized} duplicates={duplicates} "
+        f"actionable={actionable} suppressed={suppressed}[/dim]"
+    )
+    errors = summary.get("errors", [])
+    if isinstance(errors, list) and errors:
+        console.print("[dim]security notes:[/dim] " + ", ".join(str(item) for item in errors))
+
+
 def _apply_compliance_gate_to_artifact(artifact: RunArtifact) -> None:
     """Promote compliance blocking decisions into gate outcome (R18 Phase 7)."""
     summary = dict(getattr(artifact, "compliance_summary", {}) or {})
@@ -2801,6 +2960,7 @@ def doctor(
         console.print(f"[green]developer key[/green]: OK account={auth_ctx.account_id}{cache_note}")
     except AuthError as exc:
         console.print(f"[yellow]developer key[/yellow]: {exc}")
+    _report_runtime_scanner_status()
 
     missing = _missing_requirements(provider_name)
     if missing:

{refactorai_cli-0.2.20 → refactorai_cli-0.2.22}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.20
+Version: 0.2.22
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -53,6 +53,6 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.12-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.22-py3-none-any.whl
 refactor --version
 ```