refactorai-cli 0.3.1__tar.gz → 0.3.3__tar.gz

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.1
+Version: 0.3.3
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.1
+Requires-Dist: refactorai-core>=3.0.3
 
 # refactorai-cli
 
@@ -54,7 +54,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.1-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.3-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/README.md

@@ -42,7 +42,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.1-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.3-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.3.1"
+version = "0.3.3"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.0.1",
+  "refactorai-core>=3.0.3",
 ]
 
 [project.scripts]

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.3.1"
+__version__ = "0.3.3"

refactorai_cli-0.3.3/refactorai_cli/cloud_rr.py

@@ -0,0 +1,531 @@
+"""Client-side orchestrator for the cloud server-run per-RR loop (R23; doc 35).
+
+This module is the thin "hand" in the Cursor-style split: the proprietary
+per-RR decision loop runs on the platform (see ``backend/app/api/v1/rr_session``),
+and this client executes only generic primitives and reports results:
+
+- open a session with the pending RRs' context,
+- write the server-generated characterization test and run it (baseline),
+- render the server proposal and collect approval (per RR, mid-run),
+- apply the approved diff, run the test again, report the result,
+- honor the server verdict (applied / retry+revert / denied / deferred / stop),
+- persist RR status + build the run summary.
+
+IMPORTANT (IP + packaging boundary): this module MUST import only client-safe
+``refactor_core`` modules (``apply``, ``refactor_requests``, ``models``,
+``constitution``, ``store``, ``testcmd``). It MUST NOT import any engine-only
+subpackage (``execution``, ``codeintel``, ``enginecore``, ``providers``); doing
+so would both leak proprietary code to pip-only installs and re-introduce the
+``ModuleNotFoundError: No module named 'refactor_core.execution'`` crash that
+this design fixes. ``tests/test_cloud_rr_client_boundary.py`` enforces this.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import subprocess
+from pathlib import Path
+from typing import Callable
+
+import httpx
+
+# Client-safe core modules only (see module docstring).
+from refactor_core.apply import (
+    apply_changes,
+    compute_file_changes,
+    revert_from_backup,
+    validate_diff,
+)
+from refactor_core.models import GateResult, RunArtifact
+from refactor_core.refactor_requests import (
+    APPLIED,
+    DEFERRED,
+    DENIED,
+    FAILED,
+    IN_PROGRESS,
+    pending_requests,
+    rr_test_dir,
+    save_request,
+)
+from refactor_core.store import create_run
+from refactor_core.testcmd import resolve_test_command
+
+from refactorai_cli.auth import ensure_authenticated
+from refactorai_cli.settings import platform_url
+
+
+class CloudRRError(RuntimeError):
+    """Raised when the cloud RR session cannot proceed."""
+
+
+def _read_source(project_root: Path, rel: str) -> str:
+    path = project_root / rel
+    if not path.is_file():
+        return ""
+    try:
+        return path.read_text(encoding="utf-8")
+    except OSError:
+        return ""
+
+
+def _run_test(project_root: Path, test_command: str | None) -> tuple[bool, str]:
+    """Run the configured test command on the host; (passed, detail).
+
+    Cloud runs execute tests client-side because the developer's code + deps live
+    here. Behavior preservation (FR3/FR3a) requires a runnable test: if NO test
+    command is configured we return ``(False, ...)`` so the server defers the RR
+    rather than applying an unverifiable change. This differs from local's
+    permissive skip on purpose -- cloud never applies an unverified change.
+    """
+    if not test_command or not str(test_command).strip():
+        return False, "no test command configured; cannot verify behavior preservation"
+    command = str(test_command).strip()
+    if command == "npm test":
+        command = "CI=true npm test -- --watch=false"
+    try:
+        proc = subprocess.run(
+            command,
+            shell=True,
+            cwd=str(project_root),
+            capture_output=True,
+            text=True,
+            timeout=600,
+        )
+    except (subprocess.SubprocessError, OSError) as exc:
+        return False, f"test command error: {exc}"
+    if proc.returncode == 0:
+        return True, "tests passed"
+    return False, (proc.stdout or proc.stderr or "")[-500:]
+
+
+class _Session:
+    """Transport for the RR session endpoints with status-code error mapping."""
+
+    def __init__(self, *, auth_ctx, execution_mode: str, constitution_hash: str) -> None:
+        self._auth = auth_ctx
+        self._mode = execution_mode
+        self._consti = constitution_hash
+        self._base = f"{platform_url()}/v1/rr"
+
+    def _idempotency_key(self, path: str, payload: dict) -> str:
+        """Deterministic key per (account, mode, consti, rr, step, attempt).
+
+        Makes a step POST safe to retry without duplicating work or double
+        charging (FR6). Distinct RRs/attempts/steps get distinct keys so unrelated
+        attempts never collapse into one replayed result.
+        """
+        seed = "|".join(
+            [
+                self._auth.account_id,
+                self._mode,
+                self._consti,
+                path,
+                str(payload.get("rr_id", "")),
+                str(payload.get("step", "")),
+                str(payload.get("attempt", "")),
+            ]
+        )
+        return hashlib.sha256(seed.encode("utf-8")).hexdigest()
+
+    def _post(self, path: str, payload: dict) -> dict:
+        try:
+            resp = httpx.post(
+                f"{self._base}{path}",
+                headers={
+                    "Authorization": f"Bearer {self._auth.key.key}",
+                    "Content-Type": "application/json",
+                    "Idempotency-Key": self._idempotency_key(path, payload),
+                },
+                json=payload,
+                timeout=45.0,
+            )
+        except httpx.HTTPError as exc:
+            raise CloudRRError(f"Could not reach cloud RR service: {exc}") from exc
+
+        if resp.status_code == 401:
+            raise CloudRRError("Cloud RR unauthorized (developer key invalid or revoked).")
+        if resp.status_code == 402:
+            if self._mode == "cloud_byok":
+                raise CloudRRError(
+                    "Cloud BYOK is not enabled for this account (missing `run:byok`). "
+                    "Contact your admin to enable BYOK cloud execution."
+                )
+            raise CloudRRError("Cloud RR requires paid tier (`mode: cloud_managed`).")
+        if resp.status_code == 404 and self._mode == "cloud_byok":
+            raise CloudRRError(
+                "BYOK credential not found or not owned by this account. "
+                "Check `refactor cloud credentials list` and your `credential_ref`."
+            )
+        if resp.status_code in (400, 403, 409):
+            detail = ""
+            try:
+                detail = str((resp.json() or {}).get("detail", ""))
+            except Exception:
+                detail = resp.text[:300]
+            raise CloudRRError(detail or f"Cloud RR error ({resp.status_code}).")
+        if resp.status_code == 429:
+            raise CloudRRError("Cloud RR quota exhausted or rate-limited.")
+        if resp.status_code >= 400:
+            raise CloudRRError(f"Cloud RR failed ({resp.status_code}): {resp.text[:300]}")
+        return resp.json() if resp.content else {}
+
+    def open(self, payload: dict) -> dict:
+        return self._post("/session", payload)
+
+    def step(self, payload: dict) -> dict:
+        return self._post("/session/step", payload)
+
+
+def run_cloud_refactor_requests(
+    *,
+    project_root: Path,
+    constitution,
+    config: dict,
+    requests=None,
+    model_hint: str | None = None,
+    progress_cb: Callable[[dict], None] | None = None,
+    approval_cb: Callable[[dict], bool] | None = None,
+    apply_byok_payload: Callable[[dict, object], None] | None = None,
+) -> RunArtifact:
+    """Drive pending RRs through the cloud server-run loop and return a summary.
+
+    ``progress_cb`` / ``approval_cb`` are the SAME callbacks local uses
+    (``_rr_progress_logger`` / ``_rr_approval_prompt``), so the run streams the
+    same events and prompts per RR mid-run (FR8). ``apply_byok_payload`` is the
+    shared BYOK resolver injected by the caller to avoid a circular import.
+    """
+    project_root = Path(project_root)
+    progress_cb = progress_cb or (lambda e: None)
+    approval_cb = approval_cb or (lambda r: False)
+
+    execution_mode = str(constitution.get_setting("mode", "cloud_managed") or "cloud_managed")
+    auth_ctx = ensure_authenticated(project_root)
+    test_command = resolve_test_command(project_root, config)
+
+    if requests is None:
+        requests = pending_requests(project_root)
+
+    run_store = create_run(project_root)
+    run_id = run_store.run_id
+    resolved_model = model_hint or str(
+        constitution.get_setting("model_id", "managed-default") or "managed-default"
+    )
+
+    _emit(progress_cb, phase="rr", event="run_start", total_requests=len(requests),
+          test_command=test_command or "", execution_env="cloud")
+
+    outcomes: list[dict] = []
+    counts = {"applied": 0, "denied": 0, "failed": 0, "deferred": 0}
+    notes: list[str] = []
+    stopped = False
+    stop_reason = ""
+    model_id = resolved_model
+
+    if not requests:
+        return _build_artifact(
+            run_store, run_id, constitution, model_id, outcomes, counts,
+            notes, stopped=False, stop_reason="", test_command=test_command,
+        )
+
+    session = _Session(
+        auth_ctx=auth_ctx,
+        execution_mode=execution_mode,
+        constitution_hash=constitution.content_hash,
+    )
+
+    # --- open the session ---------------------------------------------------
+    open_payload = {
+        "execution_mode": execution_mode,
+        "constitution_hash": constitution.content_hash,
+        "constitution_body": getattr(constitution, "body", "") or "",
+        "model_hint": resolved_model,
+        "rrs": [
+            {
+                "rr_id": rr.rr_id,
+                "rr_context": {
+                    "location": rr.location,
+                    "file_path": rr.file_path,
+                    "category": rr.category,
+                    "severity": rr.severity,
+                    "recommendation": rr.recommendation,
+                    "operation_type": rr.operation_type,
+                },
+            }
+            for rr in requests
+        ],
+    }
+    if execution_mode == "cloud_byok" and apply_byok_payload is not None:
+        apply_byok_payload(open_payload, constitution)
+
+    action = session.open(open_payload)
+    token = action.get("session_token", "")
+
+    # Map rr_id -> RefactorRequest for status updates.
+    by_id = {rr.rr_id: rr for rr in requests}
+    attempts_by_id: dict[str, int] = {}
+    started: set[str] = set()
+
+    def _start_rr(rr_id: str):
+        """Emit rr_start (once) and send the `start` step for ``rr_id``."""
+        rr = by_id.get(rr_id)
+        if rr is not None and rr_id not in started:
+            started.add(rr_id)
+            rr.status = IN_PROGRESS
+            rr.resolved_in_run = run_id
+            save_request(project_root, rr)
+            _emit(progress_cb, phase="rr", event="rr_start", rr_id=rr_id, location=rr.location)
+        return session.step(_step_payload(token, rr_id, "start", by_id, project_root))
+
+    # --- drive the loop -----------------------------------------------------
+    # Uniform contract: the server returns the next action; the client executes a
+    # primitive and posts the result. Terminal per-RR verdicts carry `next_rr_id`
+    # (empty => finished). We always send the current file source so the server
+    # can (re)build prompts. A generous iteration cap guards against runaway.
+    current_rr_id = action.get("rr_id", "")
+    if str(action.get("action", "")) == "next_rr" and current_rr_id:
+        action = _start_rr(current_rr_id)
+        token = action.get("session_token", token)
+
+    guard = 0
+    max_iters = max(50, len(requests) * 25)
+    while guard < max_iters:
+        guard += 1
+        act = str(action.get("action", ""))
+        model_id = action.get("model_id", model_id) or model_id
+
+        if act == "done":
+            break
+
+        if act == "run_baseline_test":
+            current_rr_id = action.get("rr_id", "") or current_rr_id
+            _emit(progress_cb, phase="rr", event="test_generating", rr_id=current_rr_id)
+            _write_generated_test(project_root, current_rr_id, action, by_id)
+            passed, detail = _run_test(project_root, test_command)
+            _emit(progress_cb, phase="rr", event="baseline_test", rr_id=current_rr_id,
+                  passed=passed, detail=detail, execution_env="host")
+            action = session.step(
+                _step_payload(token, current_rr_id, "baseline_result", by_id, project_root,
+                              baseline_passed=passed, baseline_detail=detail)
+            )
+            token = action.get("session_token", token)
+            continue
+
+        if act == "show_proposal":
+            current_rr_id = action.get("rr_id", "") or current_rr_id
+            rr = by_id.get(current_rr_id)
+            diff_text = str(action.get("diff_text", "") or "")
+            attempt = int(action.get("attempt", 1) or 1)
+            attempts_by_id[current_rr_id] = attempt
+            ok, why = validate_diff(project_root, diff_text)
+            if not ok:
+                _emit(progress_cb, phase="rr", event="proposal_invalid", attempt=attempt, reason=why)
+                action = session.step(
+                    _step_payload(token, current_rr_id, "verify_result", by_id, project_root,
+                                  attempt=attempt,
+                                  verify_passed=False, verify_detail=f"invalid diff: {why}")
+                )
+                token = action.get("session_token", token)
+                continue
+            _emit(progress_cb, phase="rr", event="approval_requested", rr_id=current_rr_id)
+            approved = bool(approval_cb({
+                "rr_id": current_rr_id,
+                "location": getattr(rr, "location", current_rr_id),
+                "attempt": attempt,
+                "summary": action.get("summary", ""),
+                "risk": action.get("risk", "medium"),
+                "diff_text": diff_text,
+            }))
+            _emit(progress_cb, phase="rr", event="approval_decision", rr_id=current_rr_id, approved=approved)
+            _PENDING_DIFF[current_rr_id] = diff_text
+            action = session.step(
+                _step_payload(token, current_rr_id, "approval", by_id, project_root,
+                              attempt=attempt, approved=approved)
+            )
+            token = action.get("session_token", token)
+            continue
+
+        if act in ("apply_result", "deferred"):
+            verdict = str(action.get("verdict", "") or "")
+            if verdict == "":
+                # Server approved: client applies + verifies, then posts result.
+                current_rr_id = action.get("rr_id", "") or current_rr_id
+                diff_text = _PENDING_DIFF.get(current_rr_id, "")
+                passed, detail, files = _apply_and_verify(
+                    project_root, run_store.run_dir, diff_text, test_command
+                )
+                if passed:
+                    _emit(progress_cb, phase="rr", event="rr_applied", rr_id=current_rr_id, files=files)
+                else:
+                    _emit(progress_cb, phase="rr", event="rr_reverted", rr_id=current_rr_id,
+                          attempt=attempts_by_id.get(current_rr_id, 1), detail=detail)
+                action = session.step(
+                    _step_payload(token, current_rr_id, "verify_result", by_id, project_root,
+                                  attempt=attempts_by_id.get(current_rr_id, 1),
+                                  verify_passed=passed, verify_detail=detail)
+                )
+                token = action.get("session_token", token)
+                continue
+            # Terminal verdict for the completed RR.
+            completed_id = action.get("rr_id", "") or current_rr_id
+            _record_outcome(
+                project_root, by_id, completed_id, verdict, action.get("message", ""),
+                attempts_by_id.get(completed_id, 0 if verdict == "deferred" else 1),
+                outcomes, counts, progress_cb,
+            )
+            if verdict == "failed":
+                stopped = True
+                stop_reason = str(action.get("message", "") or "refactor request failed")
+                _emit(progress_cb, phase="rr", event="run_stopped", rr_id=completed_id, reason=stop_reason)
+                break
+            next_id = str(action.get("next_rr_id", "") or "")
+            if not next_id:
+                break
+            current_rr_id = next_id
+            action = _start_rr(next_id)
+            token = action.get("session_token", token)
+            continue
+
+        notes.append(f"unexpected cloud action '{act}'")
+        break
+
+    return _build_artifact(
+        run_store, run_id, constitution, model_id, outcomes, counts,
+        notes, stopped=stopped, stop_reason=stop_reason, test_command=test_command,
+    )
+
+
+# Diffs approved but not yet applied, keyed by rr_id (client-local, per run).
+_PENDING_DIFF: dict[str, str] = {}
+
+
+def _step_payload(token, rr_id, step, by_id, project_root, *, attempt: int = 0, **kw) -> dict:
+    rr = by_id.get(rr_id) if rr_id else None
+    source = _read_source(project_root, rr.file_path) if rr is not None else ""
+    payload = {
+        "session_token": token,
+        "rr_id": rr_id,
+        "step": step,
+        "source": source,
+        "attempt": int(attempt),
+    }
+    payload.update(kw)
+    return payload
+
+
+def _write_generated_test(project_root: Path, rr_id: str, action: dict, by_id: dict) -> None:
+    content = str(action.get("test_content", "") or "")
+    if not content:
+        return
+    test_path = str(action.get("test_path", "") or "")
+    name = Path(test_path).name if test_path else f"{rr_id}.test.txt"
+    test_dir = rr_test_dir(project_root, rr_id)
+    (test_dir / name).write_text(content, encoding="utf-8")
+    rr = by_id.get(rr_id)
+    if rr is not None:
+        rr.rrtest_path = str(test_dir / name)
+        save_request(project_root, rr)
+
+
+def _apply_and_verify(
+    project_root: Path, run_dir: Path, diff_text: str, test_command
+) -> tuple[bool, str, list[str]]:
+    """Apply the diff (with backup), run the test; revert on red.
+
+    Returns ``(passed, detail, changed_files)``. ``changed_files`` is computed
+    from the diff BEFORE applying (the tree is mutated in place afterward, so it
+    cannot be recomputed against the modified files).
+    """
+    if not diff_text:
+        return False, "empty diff", []
+    try:
+        changes = compute_file_changes(project_root, [diff_text])
+    except Exception as exc:
+        return False, f"could not compute changes: {exc}", []
+    if not changes:
+        return False, "diff produced no file changes", []
+    changed_files = list(changes.keys())
+    try:
+        apply_changes(project_root, run_dir, changes)
+    except Exception as exc:
+        return False, f"apply failed: {exc}", changed_files
+    passed, detail = _run_test(project_root, test_command)
+    if not passed:
+        try:
+            revert_from_backup(project_root, run_dir)
+        except Exception as exc:  # keep going; report both
+            detail = f"{detail}; revert error: {exc}"
+    return passed, detail, changed_files
+
+
+def _record_outcome(project_root, by_id, rr_id, verdict, message, attempts,
+                    outcomes: list, counts: dict, progress_cb) -> None:
+    status_map = {
+        "applied": APPLIED,
+        "denied": DENIED,
+        "failed": FAILED,
+        "deferred": DEFERRED,
+    }
+    rr = by_id.get(rr_id)
+    if rr is not None:
+        rr.status = status_map.get(verdict, rr.status)
+        rr.attempt_count = max(int(getattr(rr, "attempt_count", 0) or 0), int(attempts or 0))
+        save_request(project_root, rr)
+    outcomes.append({
+        "location": getattr(rr, "location", rr_id) if rr is not None else rr_id,
+        "operation_type": getattr(rr, "operation_type", "content_patch") if rr is not None else "content_patch",
+        "outcome": verdict,
+        "attempts": int(attempts or 0),
+    })
+    if verdict in counts:
+        counts[verdict] += 1
+    ev = {
+        "applied": "rr_applied",
+        "denied": None,
+        "failed": "rr_failed",
+        "deferred": "rr_deferred",
+    }.get(verdict)
+    if ev == "rr_deferred":
+        _emit(progress_cb, phase="rr", event="rr_deferred", rr_id=rr_id, reason=message)
+    elif ev == "rr_failed":
+        _emit(progress_cb, phase="rr", event="rr_failed", rr_id=rr_id, reason=message)
+
+
+def _build_artifact(run_store, run_id, constitution, model_id, outcomes, counts,
+                    notes, *, stopped, stop_reason, test_command) -> RunArtifact:
+    gate = GateResult(status="blocked" if stopped else "passed")
+    applied = counts["applied"]
+    summary = (
+        f"Cloud refactor requests: applied={applied} denied={counts['denied']} "
+        f"failed={counts['failed']} deferred={counts['deferred']}"
+    )
+    artifact = RunArtifact(
+        run_id=run_id,
+        findings=[],
+        patches=[],
+        generated_tests=[],
+        gate=gate,
+        summary=summary,
+        constitution_hash=constitution.content_hash,
+        model_id=model_id,
+        notes=notes,
+        execution_mode="rr_cloud",
+        context_stats={"mode": "rr_cloud", "test_command": test_command or ""},
+        agent_trace_summary={
+            "outcomes": outcomes,
+            "applied": counts["applied"],
+            "denied": counts["denied"],
+            "failed": counts["failed"],
+            "deferred": counts["deferred"],
+            "stopped": stopped,
+            "stop_reason": stop_reason,
+        },
+    )
+    run_store.write_artifact(artifact, target=".", status="completed")
+    return artifact
+
+
+def _emit(progress_cb, **event) -> None:
+    try:
+        progress_cb(event)
+    except Exception:
+        pass

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/refactorai_cli/commands/run_cmds.py

@@ -665,29 +665,7 @@ def _cloud_inference(
     }
 
     if execution_mode == "cloud_byok":
-        provider_name = str(constitution.get_setting("provider", "") or "").strip()
-        provider_key = str(constitution.get_setting("provider_key", "") or "").strip()
-        credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
-
-        # Env-key-first BYOK path: when provider_key is configured (typically via
-        # ${ENV_VAR} interpolation), prefer it over credential_ref.
-        if provider_key:
-            if not provider_name or provider_name.lower() == "cloud":
-                raise RuntimeError(
-                    "cloud_byok with provider_key requires an explicit provider "
-                    "(e.g. provider: openai)."
-                )
-            payload["provider_key"] = provider_key
-            payload["provider"] = provider_name
-        elif credential_ref:
-            payload["credential_ref"] = credential_ref
-            if provider_name and provider_name.lower() != "cloud":
-                payload["provider"] = provider_name
-        else:
-            raise RuntimeError(
-                "cloud_byok requires either `provider_key` (preferred env-key path) "
-                "or `credential_ref` (platform-stored credential path) in refactor.config."
-            )
+        _apply_byok_payload(payload, constitution)
 
     idempotency_key = _stable_idempotency_key(
         account_id=auth_ctx.account_id,
@@ -764,6 +742,36 @@ def _cloud_inference(
     )
 
 
+def _apply_byok_payload(payload: dict, constitution) -> None:
+    """Populate BYOK provider fields on a cloud inference ``payload`` in place.
+
+    Env-key-first: prefer ``provider_key`` (typically ``${ENV_VAR}``) over a
+    platform-stored ``credential_ref``. Shared by the review/refactor path and
+    the per-RR proposal path so BYOK resolution stays consistent.
+    """
+    provider_name = str(constitution.get_setting("provider", "") or "").strip()
+    provider_key = str(constitution.get_setting("provider_key", "") or "").strip()
+    credential_ref = str(constitution.get_setting("credential_ref", "") or "").strip()
+
+    if provider_key:
+        if not provider_name or provider_name.lower() == "cloud":
+            raise RuntimeError(
+                "cloud_byok with provider_key requires an explicit provider "
+                "(e.g. provider: openai)."
+            )
+        payload["provider_key"] = provider_key
+        payload["provider"] = provider_name
+    elif credential_ref:
+        payload["credential_ref"] = credential_ref
+        if provider_name and provider_name.lower() != "cloud":
+            payload["provider"] = provider_name
+    else:
+        raise RuntimeError(
+            "cloud_byok requires either `provider_key` (preferred env-key path) "
+            "or `credential_ref` (platform-stored credential path) in refactor.config."
+        )
+
+
 def _load_project() -> tuple[Path, object, object]:
     files = find_project_files()
     if not files:
@@ -1802,7 +1810,8 @@ def review(
         if _sandbox_enabled(project_config):
             if cloud:
                 console.print(
-                    "[dim]review: sandbox.enabled is ignored in cloud_managed mode.[/dim]"
+                    f"[dim]review: sandbox.enabled is ignored in "
+                    f"{_cloud_execution_mode(constitution)} mode.[/dim]"
                 )
             else:
                 sandbox_ctx = _ensure_sandbox_ready(
@@ -2029,7 +2038,8 @@ def code(
         if _sandbox_enabled(project_config):
             if cloud:
                 console.print(
-                    "[dim]code: sandbox.enabled is ignored in cloud_managed mode.[/dim]"
+                    f"[dim]code: sandbox.enabled is ignored in "
+                    f"{_cloud_execution_mode(constitution)} mode.[/dim]"
                 )
             else:
                 sandbox_ctx = _ensure_sandbox_ready(
@@ -2133,82 +2143,49 @@ def code(
             console.print("[green]No issues to refactor.[/green]")
             return
 
+        rr_config = (
+            dict(getattr(project_config, "settings", {}) or {})
+            | ({"sandbox": {"enabled": True}} if sandbox_on else {})
+            | ({"_sandbox_context": sandbox_ctx} if sandbox_ctx else {})
+        ) or dict(getattr(constitution, "settings", {}) or {})
+
         if cloud:
-            # Cloud modes generate patches via the platform inference API rather
-            # than the local RR interactive loop. Reuse prior review findings as
-            # prompt context; fall back to the latest stored review findings when
-            # requests were carried over from an earlier run.
-            if not cloud_review_findings:
-                existing_dir = head_run_dir(project_root)
-                if existing_dir is not None:
-                    try:
-                        cloud_review_findings = [
-                            Finding.model_validate(item) for item in (read_findings(existing_dir) or [])
-                        ]
-                    except Exception:
-                        cloud_review_findings = []
-            with console.status("[cyan]code[/cyan] generating patches (cloud)...", spinner="dots"):
-                artifact = _cloud_inference(
-                    stage="refactor",
+            # Cloud modes: the proprietary per-RR loop runs SERVER-SIDE (R23; doc
+            # 35). The client is a thin executor speaking the RR session protocol
+            # and uses ONLY client-safe modules — it never imports the engine-only
+            # ``rr_executor``. It reuses the SAME progress logger + approval prompt
+            # as local so the run streams events and asks for approval per RR,
+            # mid-run (identical UX), with tests guarding every change.
+            from refactorai_cli.cloud_rr import run_cloud_refactor_requests
+
+            with console.status("[cyan]code[/cyan] running (cloud)...", spinner="dots") as status:
+                artifact = run_cloud_refactor_requests(
                     project_root=project_root,
                     constitution=constitution,
-                    target=target,
+                    config=rr_config,
+                    requests=requests,
                     model_hint=provider,
-                    findings=cloud_review_findings,
+                    progress_cb=_rr_progress_logger(status=status),
+                    approval_cb=_rr_approval_prompt(auto_approve=auto_approve),
+                    apply_byok_payload=_apply_byok_payload,
                 )
-            cloud_store = create_run(project_root, run_id=artifact.run_id)
-            cloud_store.write_artifact(artifact, target=target, status="completed")
-
-            _print_rr_summary(artifact)
-            _print_patches(artifact.patches)
-            gate_color = "green" if artifact.gate.status == "passed" else "red"
-            console.print(
-                f"\n[bold]result[/bold]: [{gate_color}]{artifact.gate.status}[/{gate_color}]  "
-                f"[dim]model={artifact.model_id} mode={_cloud_execution_mode(constitution)} "
-                f"run={artifact.run_id}[/dim]"
-            )
+        else:
+            # Local mode is unchanged: dispatch to the local executor with the
+            # local provider and no cloud hooks.
+            from refactor_core.execution.rr_executor import run_refactor_requests
 
-            if apply:
-                gate_mode = str(constitution.get_setting("gate_mode", "strict") or "strict")
-                diffs = [p.diff_text for p in (artifact.patches or [])]
-                if not diffs:
-                    console.print("[dim]No patches to apply.[/dim]")
-                else:
-                    _apply_diffs(
-                        project_root,
-                        cloud_store.run_dir,
-                        diffs,
-                        artifact.gate.status,
-                        gate_mode,
-                        force,
-                        project_config,
-                    )
-            elif artifact.patches:
-                console.print(
-                    "[dim]Review patches with `refactor diff`, then apply with "
-                    "`refactor code --apply` or `refactor apply`.[/dim]"
+            with console.status("[cyan]code[/cyan] running...", spinner="dots") as status:
+                artifact = run_refactor_requests(
+                    project_root=project_root,
+                    constitution=constitution,
+                    provider=selected_provider,
+                    requests=requests,
+                    config=rr_config,
+                    progress_cb=_rr_progress_logger(status=status),
+                    approval_cb=_rr_approval_prompt(auto_approve=auto_approve),
+                    on_rr_failure=on_rr_failure,
+                    equivalence_mode=equivalence,
                 )
-            return
-
-        from refactor_core.execution.rr_executor import run_refactor_requests
-
-        with console.status("[cyan]code[/cyan] running...", spinner="dots") as status:
-            rr_config = (
-                dict(getattr(project_config, "settings", {}) or {})
-                | ({"sandbox": {"enabled": True}} if sandbox_on else {})
-                | ({"_sandbox_context": sandbox_ctx} if sandbox_ctx else {})
-            ) or dict(getattr(constitution, "settings", {}) or {})
-            artifact = run_refactor_requests(
-                project_root=project_root,
-                constitution=constitution,
-                provider=selected_provider,
-                requests=requests,
-                config=rr_config,
-                progress_cb=_rr_progress_logger(status=status),
-                approval_cb=_rr_approval_prompt(auto_approve=auto_approve),
-                on_rr_failure=on_rr_failure,
-                equivalence_mode=equivalence,
-            )
     except typer.Exit:
         # Intentional exits (e.g. gate-blocked apply) keep their own code/message.
         raise

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.1
+Version: 0.3.3
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.1
+Requires-Dist: refactorai-core>=3.0.3
 
 # refactorai-cli
 
@@ -54,7 +54,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.1-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.3-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/refactorai_cli.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ pyproject.toml
 refactorai_cli/__init__.py
 refactorai_cli/auth.py
 refactorai_cli/client.py
+refactorai_cli/cloud_rr.py
 refactorai_cli/control_plane.py
 refactorai_cli/credentials.py
 refactorai_cli/local_constitution.py

{refactorai_cli-0.3.1 → refactorai_cli-0.3.3}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.0.1
+refactorai-core>=3.0.3