refactorai-cli 0.2.26__tar.gz → 0.2.28__tar.gz

{refactorai_cli-0.2.26 → refactorai_cli-0.2.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.26
+Version: 0.2.28
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -53,6 +53,39 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.26-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.28-py3-none-any.whl
 refactor --version
 ```
+
+## Cloud BYOK setup (bring your own provider key)
+
+Run cloud inference with your own provider credentials (no local runtime
+required). The secret is read from your environment and encrypted server-side;
+it is never written to disk or printed.
+
+```bash
+# 1. Authenticate (developer key with the run:byok entitlement).
+refactor login
+
+# 2. Register your provider secret from an env var.
+export OPENAI_API_KEY=sk-...
+refactor cloud credentials set --provider openai --from-env OPENAI_API_KEY --label "my key"
+# -> prints a credential_ref, e.g. cred_01J...
+
+# 3. Point your project at cloud_byok in refactor.config:
+#    mode: cloud_byok
+#    provider: openai
+#    credential_ref: cred_01J...
+
+# 4. Verify readiness, then run.
+refactor doctor
+refactor review .
+refactor code . --apply
+```
+
+Manage credentials:
+
+```bash
+refactor cloud credentials list
+refactor cloud credentials remove --credential-ref cred_01J...
+```

refactorai_cli-0.2.28/README.md

@@ -0,0 +1,80 @@
+# refactorai-cli
+
+Public CLI package for Refactor.
+
+- PyPI package name: `refactorai-cli`
+- Installed command: `refactor`
+- Python module package: `refactorai_cli`
+
+By default, the CLI targets `https://api.refactorai.codes`.
+Use `REFACTOR_PLATFORM_URL` only when you need to override the control-plane URL
+(for self-hosted or local development environments).
+
+## Local development install
+
+From repository root:
+
+```bash
+pip install -e refactor_core -e refactorai-cli
+```
+
+## Build
+
+From repository root:
+
+```bash
+python -m pip install --upgrade build twine
+python -m build "./refactorai-cli"
+```
+
+Artifacts are created in:
+
+- `refactorai-cli/dist/*.whl`
+- `refactorai-cli/dist/*.tar.gz`
+
+## Publish
+
+```bash
+python -m twine check ./refactorai-cli/dist/*
+python -m twine upload ./refactorai-cli/dist/*
+```
+
+## Install test (local)
+
+```bash
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.28-py3-none-any.whl
+refactor --version
+```
+
+## Cloud BYOK setup (bring your own provider key)
+
+Run cloud inference with your own provider credentials (no local runtime
+required). The secret is read from your environment and encrypted server-side;
+it is never written to disk or printed.
+
+```bash
+# 1. Authenticate (developer key with the run:byok entitlement).
+refactor login
+
+# 2. Register your provider secret from an env var.
+export OPENAI_API_KEY=sk-...
+refactor cloud credentials set --provider openai --from-env OPENAI_API_KEY --label "my key"
+# -> prints a credential_ref, e.g. cred_01J...
+
+# 3. Point your project at cloud_byok in refactor.config:
+#    mode: cloud_byok
+#    provider: openai
+#    credential_ref: cred_01J...
+
+# 4. Verify readiness, then run.
+refactor doctor
+refactor review .
+refactor code . --apply
+```
+
+Manage credentials:
+
+```bash
+refactor cloud credentials list
+refactor cloud credentials remove --credential-ref cred_01J...
+```

{refactorai_cli-0.2.26 → refactorai_cli-0.2.28}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.2.26"
+version = "0.2.28"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"

{refactorai_cli-0.2.26 → refactorai_cli-0.2.28}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.2.26"
+__version__ = "0.2.28"

refactorai_cli-0.2.28/refactorai_cli/commands/cloud_cmds.py

@@ -0,0 +1,176 @@
+"""`refactor cloud` command group for BYOK cloud credential management (R20).
+
+Lets developers self-serve register/list/remove provider credentials used by
+``cloud_byok`` inference without hand-crafting API calls. Secrets are read from
+the environment (never passed on the command line) and are envelope-encrypted
+server-side; responses are always masked.
+"""
+
+from __future__ import annotations
+
+import os
+
+import httpx
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from refactorai_cli.auth import AuthError, ensure_authenticated
+from refactorai_cli.settings import platform_url
+
+console = Console()
+
+app = typer.Typer(
+    name="cloud",
+    help="Cloud (BYOK) credential management and helpers.",
+    no_args_is_help=True,
+    add_completion=False,
+)
+
+credentials_app = typer.Typer(
+    name="credentials",
+    help="Manage provider credentials for cloud_byok inference.",
+    no_args_is_help=True,
+    add_completion=False,
+)
+app.add_typer(credentials_app, name="credentials")
+
+_CREDENTIALS_PATH = "/v1/inference/credentials"
+_TIMEOUT = 20.0
+
+
+def _auth_header() -> tuple[str, str]:
+    """Return ``(base_url, bearer_key)`` or exit with a clear auth error."""
+    try:
+        auth_ctx = ensure_authenticated()
+    except AuthError as exc:
+        console.print(f"[red]Not authenticated:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    return platform_url(), auth_ctx.key.key
+
+
+def _handle_error_status(response: httpx.Response) -> None:
+    """Map credential API error statuses to actionable CLI messages."""
+    if response.status_code < 400:
+        return
+    if response.status_code == 401:
+        console.print("[red]Unauthorized[/red]: developer key invalid or revoked. Run `refactor login`.")
+    elif response.status_code == 402:
+        console.print(
+            "[red]BYOK not enabled[/red] for this account (missing `run:byok`). "
+            "Contact your admin to enable BYOK cloud execution."
+        )
+    elif response.status_code == 404:
+        console.print("[red]Not found[/red]: credential does not exist or is not owned by this account.")
+    else:
+        detail = ""
+        try:
+            detail = str((response.json() or {}).get("detail", ""))
+        except Exception:
+            detail = response.text[:200]
+        console.print(f"[red]Request failed[/red] ({response.status_code}): {detail}")
+    raise typer.Exit(code=1)
+
+
+@credentials_app.command("set")
+def credentials_set(
+    provider: str = typer.Option(..., "--provider", help="Provider name, e.g. openai, anthropic."),
+    from_env: str = typer.Option(
+        ...,
+        "--from-env",
+        help="Environment variable holding the provider secret (value is read from your shell).",
+    ),
+    label: str = typer.Option("", "--label", help="Optional human-readable label for this credential."),
+) -> None:
+    """Register (or replace) a provider credential from an environment variable.
+
+    The secret value is read from ``--from-env`` and sent over TLS to be
+    encrypted server-side. It is never written to disk or shown on screen.
+    """
+    secret_value = os.environ.get(from_env, "").strip()
+    if not secret_value:
+        console.print(
+            f"[red]Environment variable ${{{from_env}}} is empty or unset.[/red] "
+            "Export your provider secret first, e.g. "
+            f"`export {from_env}=sk-...` then re-run."
+        )
+        raise typer.Exit(code=1)
+
+    base_url, key = _auth_header()
+    try:
+        response = httpx.post(
+            f"{base_url}{_CREDENTIALS_PATH}",
+            headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
+            json={"provider": provider, "secret_value": secret_value, "credential_label": label},
+            timeout=_TIMEOUT,
+        )
+    except httpx.HTTPError as exc:
+        console.print(f"[red]Could not reach platform:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+
+    _handle_error_status(response)
+    data = response.json() if response.content else {}
+    console.print(
+        f"[green]Credential registered[/green] for provider [bold]{data.get('provider', provider)}[/bold].\n"
+        f"  credential_ref: [bold]{data.get('credential_ref', '?')}[/bold]\n"
+        f"  masked_secret: {data.get('masked_secret', '****')}\n"
+        "Add the credential_ref to refactor.config under `credential_ref:` to use cloud_byok."
+    )
+
+
+@credentials_app.command("list")
+def credentials_list() -> None:
+    """List the developer's active BYOK provider credentials (masked)."""
+    base_url, key = _auth_header()
+    try:
+        response = httpx.get(
+            f"{base_url}{_CREDENTIALS_PATH}",
+            headers={"Authorization": f"Bearer {key}"},
+            timeout=_TIMEOUT,
+        )
+    except httpx.HTTPError as exc:
+        console.print(f"[red]Could not reach platform:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+
+    _handle_error_status(response)
+    data = response.json() if response.content else {}
+    rows = data.get("credentials", []) if isinstance(data, dict) else []
+    if not rows:
+        console.print("[dim]No cloud credentials registered.[/dim] Use `refactor cloud credentials set`.")
+        return
+
+    table = Table(title="Cloud BYOK credentials")
+    table.add_column("provider")
+    table.add_column("credential_ref")
+    table.add_column("label")
+    table.add_column("secret")
+    table.add_column("created")
+    for row in rows:
+        table.add_row(
+            str(row.get("provider", "")),
+            str(row.get("credential_ref", "")),
+            str(row.get("credential_label", "") or ""),
+            str(row.get("masked_secret", "****")),
+            str(row.get("created_at", "") or ""),
+        )
+    console.print(table)
+
+
+@credentials_app.command("remove")
+def credentials_remove(
+    credential_ref: str = typer.Option(..., "--credential-ref", help="Credential reference to deactivate."),
+) -> None:
+    """Deactivate (remove) a BYOK provider credential by reference."""
+    base_url, key = _auth_header()
+    try:
+        response = httpx.delete(
+            f"{base_url}{_CREDENTIALS_PATH}/{credential_ref}",
+            headers={"Authorization": f"Bearer {key}"},
+            timeout=_TIMEOUT,
+        )
+    except httpx.HTTPError as exc:
+        console.print(f"[red]Could not reach platform:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+
+    _handle_error_status(response)
+    console.print(f"[green]Removed[/green] credential [bold]{credential_ref}[/bold].")

{refactorai_cli-0.2.26 → refactorai_cli-0.2.28}/refactorai_cli/commands/run_cmds.py

@@ -7,6 +7,7 @@ generation and application.
 
 from __future__ import annotations
 
+import hashlib
 import os
 import json
 import re
@@ -578,8 +579,40 @@ def _require_auth() -> None:
         raise typer.Exit(code=1) from exc
 
 
+def _cloud_execution_mode(constitution) -> str:
+    """Return the cloud execution mode for the project, or "" for local mode.
+
+    Recognizes both cloud modes (R20):
+    - ``cloud_managed``: platform-managed provider keys.
+    - ``cloud_byok``: developer-supplied provider credential (via credential_ref).
+    """
+    mode = str(constitution.get_setting("mode", "local") or "local").strip().lower()
+    return mode if mode in {"cloud_managed", "cloud_byok"} else ""
+
+
 def _is_cloud_mode(constitution) -> bool:
-    return str(constitution.get_setting("mode", "local") or "local").strip().lower() == "cloud_managed"
+    return bool(_cloud_execution_mode(constitution))
+
+
+def _stable_idempotency_key(
+    *,
+    account_id: str,
+    stage: str,
+    constitution_hash: str,
+    target: str,
+    max_alerts: int,
+    execution_mode: str,
+) -> str:
+    """Deterministic idempotency key so retries replay instead of re-charging (C10).
+
+    The key MUST change when inputs change (target/constitution/stage/mode) so
+    distinct runs are not incorrectly deduplicated, and MUST be stable across
+    retries of the same logical run so managed quota is not double-charged.
+    """
+    seed = "|".join(
+        [account_id, execution_mode, stage, constitution_hash, str(target), str(int(max_alerts))]
+    )
+    return hashlib.sha256(seed.encode("utf-8")).hexdigest()
 
 
 def _cloud_inference(
@@ -589,6 +622,7 @@ def _cloud_inference(
     constitution,
     target: str,
     model_hint: str | None = None,
+    findings: list | None = None,
 ) -> RunArtifact:
     max_alerts = int(constitution.get_setting("max_alerts_per_run", 5) or 5)
     gate_mode = str(constitution.get_setting("gate_mode", "strict") or "strict")
@@ -600,35 +634,72 @@ def _cloud_inference(
     if stage == "review":
         system_prompt, user_prompt = build_review_prompt(constitution, documents, max_alerts)
     else:
-        system_prompt, user_prompt = build_refactor_prompt(constitution, documents, [], max_alerts)
+        # Feed prior review findings into the refactor prompt so cloud `code`
+        # generates patches targeting the same issues (parity with local RR).
+        system_prompt, user_prompt = build_refactor_prompt(
+            constitution, documents, list(findings or []), max_alerts
+        )
 
+    execution_mode = _cloud_execution_mode(constitution) or "cloud_managed"
     auth_ctx = ensure_authenticated(project_root)
     payload = {
         "stage": stage,
+        "execution_mode": execution_mode,
         "constitution_hash": constitution.content_hash,
         "system_prompt": system_prompt,
         "user_prompt": user_prompt,
         "max_alerts": max_alerts,
         "model_hint": model_hint or str(constitution.get_setting("model_id", "managed-default") or "managed-default"),
     }
+
+    if execution_mode == "cloud_byok":
+        credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
+        provider_name = str(constitution.get_setting("provider", "") or "").strip()
+        if not credential_ref:
+            raise RuntimeError(
+                "cloud_byok requires a `credential_ref` in refactor.config. "
+                "Register one with `refactor cloud credentials set` and copy its ref."
+            )
+        payload["credential_ref"] = credential_ref
+        if provider_name and provider_name.lower() != "cloud":
+            payload["provider"] = provider_name
+
+    idempotency_key = _stable_idempotency_key(
+        account_id=auth_ctx.account_id,
+        stage=stage,
+        constitution_hash=constitution.content_hash,
+        target=target,
+        max_alerts=max_alerts,
+        execution_mode=execution_mode,
+    )
     try:
         response = httpx.post(
             f"{platform_url()}/v1/inference/refactor",
             headers={
                 "Authorization": f"Bearer {auth_ctx.key.key}",
                 "Content-Type": "application/json",
-                "Idempotency-Key": uuid.uuid4().hex,
+                "Idempotency-Key": idempotency_key,
             },
             json=payload,
             timeout=45.0,
         )
     except httpx.HTTPError as exc:
-        raise RuntimeError(f"Could not reach managed inference service: {exc}") from exc
+        raise RuntimeError(f"Could not reach cloud inference service: {exc}") from exc
 
     if response.status_code == 401:
         raise RuntimeError("Cloud inference unauthorized (developer key invalid or revoked).")
     if response.status_code == 402:
+        if execution_mode == "cloud_byok":
+            raise RuntimeError(
+                "Cloud BYOK is not enabled for this account (missing `run:byok`). "
+                "Contact your admin to enable BYOK cloud execution."
+            )
         raise RuntimeError("Cloud inference requires paid tier (`mode: cloud_managed`).")
+    if response.status_code == 404 and execution_mode == "cloud_byok":
+        raise RuntimeError(
+            "BYOK credential not found or not owned by this account. "
+            "Check `refactor cloud credentials list` and your `credential_ref`."
+        )
     if response.status_code == 429:
         raise RuntimeError("Cloud inference quota exhausted or rate-limited.")
     if response.status_code >= 400:
@@ -1926,6 +1997,10 @@ def code(
                 constitution, project_root=project_root, provider_name=provider
             )
 
+        # Cloud refactor generation reuses the review findings as prompt context;
+        # track them so they flow into the cloud refactor stage below (C2).
+        cloud_review_findings: list[Finding] = []
+
         # If no pending refactor requests exist, run review first to create them.
         requests = pending_requests(project_root)
         if not requests:
@@ -1938,6 +2013,7 @@ def code(
                     target=target,
                     model_hint=provider,
                 )
+                cloud_review_findings = list(review_artifact.findings or [])
             else:
                 with console.status("[cyan]review[/cyan] analyzing...", spinner="dots") as status:
                     review_progress = _agent_progress_logger(
@@ -2006,11 +2082,60 @@ def code(
             return
 
         if cloud:
+            # Cloud modes generate patches via the platform inference API rather
+            # than the local RR interactive loop. Reuse prior review findings as
+            # prompt context; fall back to the latest stored review findings when
+            # requests were carried over from an earlier run.
+            if not cloud_review_findings:
+                existing_dir = head_run_dir(project_root)
+                if existing_dir is not None:
+                    try:
+                        cloud_review_findings = [
+                            Finding.model_validate(item) for item in (read_findings(existing_dir) or [])
+                        ]
+                    except Exception:
+                        cloud_review_findings = []
+            with console.status("[cyan]code[/cyan] generating patches (cloud)...", spinner="dots"):
+                artifact = _cloud_inference(
+                    stage="refactor",
+                    project_root=project_root,
+                    constitution=constitution,
+                    target=target,
+                    model_hint=provider,
+                    findings=cloud_review_findings,
+                )
+            cloud_store = create_run(project_root, run_id=artifact.run_id)
+            cloud_store.write_artifact(artifact, target=target, status="completed")
+
+            _print_rr_summary(artifact)
+            _print_patches(artifact.patches)
+            gate_color = "green" if artifact.gate.status == "passed" else "red"
             console.print(
-                f"[yellow]Created {len(requests)} refactor request(s).[/yellow] "
-                "The interactive apply-and-verify loop runs against a local provider; "
-                "configure a local provider/key to work through them with `refactor code`."
+                f"\n[bold]result[/bold]: [{gate_color}]{artifact.gate.status}[/{gate_color}]  "
+                f"[dim]model={artifact.model_id} mode={_cloud_execution_mode(constitution)} "
+                f"run={artifact.run_id}[/dim]"
             )
+
+            if apply:
+                gate_mode = str(constitution.get_setting("gate_mode", "strict") or "strict")
+                diffs = [p.diff_text for p in (artifact.patches or [])]
+                if not diffs:
+                    console.print("[dim]No patches to apply.[/dim]")
+                else:
+                    _apply_diffs(
+                        project_root,
+                        cloud_store.run_dir,
+                        diffs,
+                        artifact.gate.status,
+                        gate_mode,
+                        force,
+                        project_config,
+                    )
+            elif artifact.patches:
+                console.print(
+                    "[dim]Review patches with `refactor diff`, then apply with "
+                    "`refactor code --apply` or `refactor apply`.[/dim]"
+                )
             return
 
         with console.status("[cyan]code[/cyan] running...", spinner="dots") as status:
@@ -2030,6 +2155,9 @@ def code(
                 on_rr_failure=on_rr_failure,
                 equivalence_mode=equivalence,
             )
+    except typer.Exit:
+        # Intentional exits (e.g. gate-blocked apply) keep their own code/message.
+        raise
     except Exception as exc:
         console.print(f"[red]Refactor failed:[/red] {_sanitize_runtime_error_message(exc)}")
         raise typer.Exit(code=1) from exc
@@ -2912,6 +3040,92 @@ def _missing_requirements(provider_name: str) -> list[str]:
     return missing
 
 
+def _cloud_doctor(
+    *,
+    project_root: Path,
+    constitution,
+    execution_mode: str,
+    skip_ping: bool,
+) -> None:
+    """Cloud-mode readiness checks (C7): auth, entitlement, endpoint, credential.
+
+    Cloud modes don't require a local provider or runtime, so this path checks
+    the control-plane identity and inference endpoint reachability instead of
+    resolving/pinging a local provider.
+    """
+    console.print(f"[bold]project[/bold]: {project_root}")
+    console.print(f"[bold]mode[/bold]: {execution_mode}")
+
+    try:
+        auth_ctx = ensure_authenticated(project_root)
+        cache_note = " (cached)" if auth_ctx.cached else ""
+        console.print(f"[green]developer key[/green]: OK account={auth_ctx.account_id}{cache_note}")
+    except AuthError as exc:
+        console.print(f"[red]developer key[/red]: {exc}")
+        console.print("[dim]Run `refactor login` or set REFACTOR_API_KEY.[/dim]")
+        raise typer.Exit(code=1) from exc
+
+    # BYOK requires a credential_ref in config plus a matching server-side
+    # credential owned by this account.
+    credential_ref = ""
+    if execution_mode == "cloud_byok":
+        credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
+        if not credential_ref:
+            console.print(
+                "[red]cloud_byok[/red]: no `credential_ref` in refactor.config. "
+                "Register one with `refactor cloud credentials set` and add its ref."
+            )
+            raise typer.Exit(code=1)
+        console.print(f"[green]credential_ref[/green]: {credential_ref}")
+        provider_name = str(constitution.get_setting("provider", "") or "").strip()
+        if provider_name and provider_name.lower() != "cloud":
+            console.print(f"[bold]provider[/bold]: {provider_name}")
+
+    if skip_ping:
+        console.print("[dim]Skipping cloud endpoint reachability check (--skip-ping).[/dim]")
+        return
+
+    # Verify the BYOK credential exists and is owned by this account, and that
+    # the credential endpoint is reachable.
+    if execution_mode == "cloud_byok":
+        try:
+            response = httpx.get(
+                f"{platform_url()}/v1/inference/credentials",
+                headers={"Authorization": f"Bearer {auth_ctx.key.key}"},
+                timeout=20.0,
+            )
+        except httpx.HTTPError as exc:
+            console.print(f"[red]cloud endpoint[/red]: unreachable ({exc}).")
+            raise typer.Exit(code=1) from exc
+        if response.status_code == 402:
+            console.print(
+                "[red]entitlement[/red]: BYOK not enabled for this account (missing `run:byok`). "
+                "Contact your admin to enable BYOK cloud execution."
+            )
+            raise typer.Exit(code=1)
+        if response.status_code == 401:
+            console.print("[red]developer key[/red]: unauthorized (invalid or revoked). Run `refactor login`.")
+            raise typer.Exit(code=1)
+        if response.status_code >= 400:
+            console.print(f"[red]cloud endpoint[/red]: credential check failed ({response.status_code}).")
+            raise typer.Exit(code=1)
+        data = response.json() if response.content else {}
+        refs = {str(row.get("credential_ref", "")) for row in (data.get("credentials", []) or [])}
+        if credential_ref not in refs:
+            console.print(
+                f"[red]credential[/red]: `{credential_ref}` not found for this account. "
+                "Check `refactor cloud credentials list`."
+            )
+            raise typer.Exit(code=1)
+        console.print("[green]credential[/green]: found and owned by this account.")
+        console.print("[green]cloud endpoint[/green]: reachable.")
+    else:
+        console.print(
+            "[dim]cloud_managed uses platform-managed provider credentials; "
+            "run `refactor review` to exercise the endpoint.[/dim]"
+        )
+
+
 def doctor(
     provider: str | None = typer.Option(
         None,
@@ -2946,6 +3160,16 @@ def doctor(
         _report_sandbox(project_root, project_config)
         return
 
+    execution_mode = _cloud_execution_mode(constitution)
+    if execution_mode:
+        _cloud_doctor(
+            project_root=project_root,
+            constitution=constitution,
+            execution_mode=execution_mode,
+            skip_ping=skip_ping,
+        )
+        return
+
     mode = str(constitution.get_setting("mode", "local") or "local")
     provider_name = resolve_provider_name(constitution, provider_name=provider)