refactorai-cli 0.2.29__tar.gz → 0.2.30__tar.gz

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.29
+Version: 0.2.30
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -53,28 +53,34 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.29-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.30-py3-none-any.whl
 refactor --version
 ```
 
 ## Cloud BYOK setup (bring your own provider key)
 
 Run cloud inference with your own provider credentials (no local runtime
-required). The secret is read from your environment and encrypted server-side;
-it is never written to disk or printed.
+required). Preferred path is env-key in project config (`provider_key:
+${ENV_VAR}`). Platform-stored credentials (`credential_ref`) are optional
+fallback.
 
 ```bash
 # 1. Authenticate (developer key with the run:byok entitlement).
 refactor login
 
-# 2. Register your provider secret from an env var.
+# 2A. Preferred: set BYOK directly from project env in refactor.config:
+#
+# mode: cloud_byok
+# provider: openai
+# model_id: gpt-4.1-mini
+# provider_key: ${OPENAI_API_KEY}
+#
+# 2B. Optional fallback: register a platform-stored credential from env.
 export OPENAI_API_KEY=sk-...
 refactor cloud credentials set --provider openai --from-env OPENAI_API_KEY --label "my key"
 # -> prints a credential_ref, e.g. cred_01J...
 
-# 3. Point your project at cloud_byok in refactor.config:
-#    mode: cloud_byok
-#    provider: openai
+# 3. If you use platform-stored fallback, set credential_ref in config:
 #    credential_ref: cred_01J...
 
 # 4. Verify readiness, then run.

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/README.md

@@ -42,28 +42,34 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.29-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.30-py3-none-any.whl
 refactor --version
 ```
 
 ## Cloud BYOK setup (bring your own provider key)
 
 Run cloud inference with your own provider credentials (no local runtime
-required). The secret is read from your environment and encrypted server-side;
-it is never written to disk or printed.
+required). Preferred path is env-key in project config (`provider_key:
+${ENV_VAR}`). Platform-stored credentials (`credential_ref`) are optional
+fallback.
 
 ```bash
 # 1. Authenticate (developer key with the run:byok entitlement).
 refactor login
 
-# 2. Register your provider secret from an env var.
+# 2A. Preferred: set BYOK directly from project env in refactor.config:
+#
+# mode: cloud_byok
+# provider: openai
+# model_id: gpt-4.1-mini
+# provider_key: ${OPENAI_API_KEY}
+#
+# 2B. Optional fallback: register a platform-stored credential from env.
 export OPENAI_API_KEY=sk-...
 refactor cloud credentials set --provider openai --from-env OPENAI_API_KEY --label "my key"
 # -> prints a credential_ref, e.g. cred_01J...
 
-# 3. Point your project at cloud_byok in refactor.config:
-#    mode: cloud_byok
-#    provider: openai
+# 3. If you use platform-stored fallback, set credential_ref in config:
 #    credential_ref: cred_01J...
 
 # 4. Verify readiness, then run.

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.2.29"
+version = "0.2.30"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.2.29"
+__version__ = "0.2.30"

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/refactorai_cli/commands/cloud_cmds.py

@@ -114,7 +114,8 @@ def credentials_set(
         f"[green]Credential registered[/green] for provider [bold]{data.get('provider', provider)}[/bold].\n"
         f"  credential_ref: [bold]{data.get('credential_ref', '?')}[/bold]\n"
         f"  masked_secret: {data.get('masked_secret', '****')}\n"
-        "Add the credential_ref to refactor.config under `credential_ref:` to use cloud_byok."
+        "Use this as an optional cloud_byok fallback (`credential_ref:`). "
+        "Preferred path is env-key in project config (`provider_key: ${ENV_VAR}`)."
     )
 
 

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/refactorai_cli/commands/run_cmds.py

@@ -167,7 +167,14 @@ def _default_config_for_init() -> tuple[str, str]:
         )
         return config_text, "local_server"
     if backend == BACKEND_BYOK:
-        return DEFAULT_CONFIG, "byok"
+        config_text = DEFAULT_CONFIG.replace("mode: local", "mode: cloud_byok", 1)
+        config_text = config_text.replace("provider: heuristic", "provider: openai", 1)
+        config_text = config_text.replace(
+            "model_id: heuristic-local-v1",
+            "model_id: gpt-4.1-mini\nprovider_key: ${OPENAI_API_KEY}\n# credential_ref: cred_01J...",
+            1,
+        )
+        return config_text, "byok"
     return DEFAULT_CONFIG, "default"
 
 _SEVERITY_STYLE = {
@@ -653,16 +660,29 @@ def _cloud_inference(
     }
 
     if execution_mode == "cloud_byok":
-        credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
         provider_name = str(constitution.get_setting("provider", "") or "").strip()
-        if not credential_ref:
+        provider_key = str(constitution.get_setting("provider_key", "") or "").strip()
+        credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
+
+        # Env-key-first BYOK path: when provider_key is configured (typically via
+        # ${ENV_VAR} interpolation), prefer it over credential_ref.
+        if provider_key:
+            if not provider_name or provider_name.lower() == "cloud":
+                raise RuntimeError(
+                    "cloud_byok with provider_key requires an explicit provider "
+                    "(e.g. provider: openai)."
+                )
+            payload["provider_key"] = provider_key
+            payload["provider"] = provider_name
+        elif credential_ref:
+            payload["credential_ref"] = credential_ref
+            if provider_name and provider_name.lower() != "cloud":
+                payload["provider"] = provider_name
+        else:
             raise RuntimeError(
-                "cloud_byok requires a `credential_ref` in refactor.config. "
-                "Register one with `refactor cloud credentials set` and copy its ref."
+                "cloud_byok requires either `provider_key` (preferred env-key path) "
+                "or `credential_ref` (platform-stored credential path) in refactor.config."
             )
-        payload["credential_ref"] = credential_ref
-        if provider_name and provider_name.lower() != "cloud":
-            payload["provider"] = provider_name
 
     idempotency_key = _stable_idempotency_key(
         account_id=auth_ctx.account_id,
@@ -911,7 +931,7 @@ def init(
     elif config_profile == "byok":
         console.print(
             "[green]Configured[/green] refactor.config for BYOK setup "
-            "(provider=heuristic; uncomment a provider block to use your key)."
+            "(mode=cloud_byok, env-key-first via provider_key; credential_ref is optional fallback)."
         )
     console.print(
         f"[green]Registered[/green] project in central store: {project_store_dir(project_root)}"
@@ -3065,60 +3085,123 @@ def _cloud_doctor(
         console.print("[dim]Run `refactor login` or set REFACTOR_API_KEY.[/dim]")
         raise typer.Exit(code=1) from exc
 
-    # BYOK requires a credential_ref in config plus a matching server-side
-    # credential owned by this account.
+    # BYOK supports two secret sources:
+    # 1) provider_key (preferred env-key path), or
+    # 2) credential_ref (platform-stored secret fallback).
     credential_ref = ""
+    provider_key = ""
+    provider_name = ""
     if execution_mode == "cloud_byok":
+        provider_name = str(constitution.get_setting("provider", "") or "").strip()
+        provider_key = str(constitution.get_setting("provider_key", "") or "").strip()
         credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
-        if not credential_ref:
+        if not provider_name or provider_name.lower() == "cloud":
             console.print(
-                "[red]cloud_byok[/red]: no `credential_ref` in refactor.config. "
-                "Register one with `refactor cloud credentials set` and add its ref."
+                "[red]cloud_byok[/red]: set an explicit `provider` "
+                "(for example `provider: openai`)."
+            )
+            raise typer.Exit(code=1)
+        console.print(f"[bold]provider[/bold]: {provider_name}")
+        if provider_key:
+            console.print(
+                "[green]provider_key[/green]: set via config/env interpolation "
+                "(preferred BYOK path)."
+            )
+        elif credential_ref:
+            console.print(f"[green]credential_ref[/green]: {credential_ref}")
+        else:
+            console.print(
+                "[red]cloud_byok[/red]: set either `provider_key` (preferred) "
+                "or `credential_ref` in refactor.config."
             )
             raise typer.Exit(code=1)
-        console.print(f"[green]credential_ref[/green]: {credential_ref}")
-        provider_name = str(constitution.get_setting("provider", "") or "").strip()
-        if provider_name and provider_name.lower() != "cloud":
-            console.print(f"[bold]provider[/bold]: {provider_name}")
 
     if skip_ping:
         console.print("[dim]Skipping cloud endpoint reachability check (--skip-ping).[/dim]")
         return
 
-    # Verify the BYOK credential exists and is owned by this account, and that
-    # the credential endpoint is reachable.
+    # Verify BYOK readiness and endpoint reachability.
     if execution_mode == "cloud_byok":
-        try:
-            response = httpx.get(
-                f"{platform_url()}/v1/inference/credentials",
-                headers={"Authorization": f"Bearer {auth_ctx.key.key}"},
-                timeout=20.0,
-            )
-        except httpx.HTTPError as exc:
-            console.print(f"[red]cloud endpoint[/red]: unreachable ({exc}).")
-            raise typer.Exit(code=1) from exc
-        if response.status_code == 402:
-            console.print(
-                "[red]entitlement[/red]: BYOK not enabled for this account (missing `run:byok`). "
-                "Contact your admin to enable BYOK cloud execution."
-            )
-            raise typer.Exit(code=1)
-        if response.status_code == 401:
-            console.print("[red]developer key[/red]: unauthorized (invalid or revoked). Run `refactor login`.")
-            raise typer.Exit(code=1)
-        if response.status_code >= 400:
-            console.print(f"[red]cloud endpoint[/red]: credential check failed ({response.status_code}).")
-            raise typer.Exit(code=1)
-        data = response.json() if response.content else {}
-        refs = {str(row.get("credential_ref", "")) for row in (data.get("credentials", []) or [])}
-        if credential_ref not in refs:
-            console.print(
-                f"[red]credential[/red]: `{credential_ref}` not found for this account. "
-                "Check `refactor cloud credentials list`."
-            )
-            raise typer.Exit(code=1)
-        console.print("[green]credential[/green]: found and owned by this account.")
-        console.print("[green]cloud endpoint[/green]: reachable.")
+        if provider_key:
+            # Env-key path: perform a lightweight inference ping so entitlement +
+            # provider auth are validated together.
+            try:
+                response = httpx.post(
+                    f"{platform_url()}/v1/inference/refactor",
+                    headers={
+                        "Authorization": f"Bearer {auth_ctx.key.key}",
+                        "Content-Type": "application/json",
+                        "Idempotency-Key": f"doctor-cloud-byok-{uuid.uuid4().hex}",
+                    },
+                    json={
+                        "stage": "review",
+                        "execution_mode": "cloud_byok",
+                        "provider": provider_name,
+                        "provider_key": provider_key,
+                        "constitution_hash": "doctor",
+                        "system_prompt": "doctor ping",
+                        "user_prompt": "doctor ping",
+                        "max_alerts": 1,
+                    },
+                    timeout=20.0,
+                )
+            except httpx.HTTPError as exc:
+                console.print(f"[red]cloud endpoint[/red]: unreachable ({exc}).")
+                raise typer.Exit(code=1) from exc
+            if response.status_code == 402:
+                console.print(
+                    "[red]entitlement[/red]: BYOK not enabled for this account (missing `run:byok`). "
+                    "Contact your admin to enable BYOK cloud execution."
+                )
+                raise typer.Exit(code=1)
+            if response.status_code == 401:
+                console.print("[red]developer key[/red]: unauthorized (invalid or revoked). Run `refactor login`.")
+                raise typer.Exit(code=1)
+            if response.status_code >= 400:
+                detail = ""
+                try:
+                    detail = str((response.json() or {}).get("detail", ""))
+                except Exception:
+                    detail = response.text[:200]
+                console.print(
+                    f"[red]cloud BYOK ping failed[/red] ({response.status_code})"
+                    + (f": {detail}" if detail else ".")
+                )
+                raise typer.Exit(code=1)
+            console.print("[green]cloud endpoint[/green]: reachable.")
+            console.print("[green]BYOK provider auth[/green]: OK")
+        else:
+            try:
+                response = httpx.get(
+                    f"{platform_url()}/v1/inference/credentials",
+                    headers={"Authorization": f"Bearer {auth_ctx.key.key}"},
+                    timeout=20.0,
+                )
+            except httpx.HTTPError as exc:
+                console.print(f"[red]cloud endpoint[/red]: unreachable ({exc}).")
+                raise typer.Exit(code=1) from exc
+            if response.status_code == 402:
+                console.print(
+                    "[red]entitlement[/red]: BYOK not enabled for this account (missing `run:byok`). "
+                    "Contact your admin to enable BYOK cloud execution."
+                )
+                raise typer.Exit(code=1)
+            if response.status_code == 401:
+                console.print("[red]developer key[/red]: unauthorized (invalid or revoked). Run `refactor login`.")
+                raise typer.Exit(code=1)
+            if response.status_code >= 400:
+                console.print(f"[red]cloud endpoint[/red]: credential check failed ({response.status_code}).")
+                raise typer.Exit(code=1)
+            data = response.json() if response.content else {}
+            refs = {str(row.get("credential_ref", "")) for row in (data.get("credentials", []) or [])}
+            if credential_ref not in refs:
+                console.print(
+                    f"[red]credential[/red]: `{credential_ref}` not found for this account. "
+                    "Check `refactor cloud credentials list`."
+                )
+                raise typer.Exit(code=1)
+            console.print("[green]credential[/green]: found and owned by this account.")
+            console.print("[green]cloud endpoint[/green]: reachable.")
     else:
         console.print(
             "[dim]cloud_managed uses platform-managed provider credentials; "

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/refactorai_cli/commands/runtime_proxy_cmds.py

@@ -142,8 +142,8 @@ def _exec_runtime(command_name: str, passthrough_args: list[str]) -> None:
 
 
 def init(ctx: typer.Context) -> None:
-    """Initialize project state via proprietary runtime."""
-    _exec_runtime("init", list(ctx.args))
+    """Initialize project config locally (no runtime required)."""
+    _delegate_to_run_cmds("init", list(ctx.args))
 
 
 def start(ctx: typer.Context) -> None:

{refactorai_cli-0.2.29 → refactorai_cli-0.2.30}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.2.29
+Version: 0.2.30
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -53,28 +53,34 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.29-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.2.30-py3-none-any.whl
 refactor --version
 ```
 
 ## Cloud BYOK setup (bring your own provider key)
 
 Run cloud inference with your own provider credentials (no local runtime
-required). The secret is read from your environment and encrypted server-side;
-it is never written to disk or printed.
+required). Preferred path is env-key in project config (`provider_key:
+${ENV_VAR}`). Platform-stored credentials (`credential_ref`) are optional
+fallback.
 
 ```bash
 # 1. Authenticate (developer key with the run:byok entitlement).
 refactor login
 
-# 2. Register your provider secret from an env var.
+# 2A. Preferred: set BYOK directly from project env in refactor.config:
+#
+# mode: cloud_byok
+# provider: openai
+# model_id: gpt-4.1-mini
+# provider_key: ${OPENAI_API_KEY}
+#
+# 2B. Optional fallback: register a platform-stored credential from env.
 export OPENAI_API_KEY=sk-...
 refactor cloud credentials set --provider openai --from-env OPENAI_API_KEY --label "my key"
 # -> prints a credential_ref, e.g. cred_01J...
 
-# 3. Point your project at cloud_byok in refactor.config:
-#    mode: cloud_byok
-#    provider: openai
+# 3. If you use platform-stored fallback, set credential_ref in config:
 #    credential_ref: cred_01J...
 
 # 4. Verify readiness, then run.