refactorai-cli 0.3.2__tar.gz → 0.3.4__tar.gz

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.2
+Version: 0.3.4
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.2
+Requires-Dist: refactorai-core>=3.0.4
 
 # refactorai-cli
 
@@ -54,7 +54,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.2-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.4-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/README.md

@@ -42,7 +42,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.2-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.4-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.3.2"
+version = "0.3.4"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.0.2",
+  "refactorai-core>=3.0.4",
 ]
 
 [project.scripts]

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.3.2"
+__version__ = "0.3.4"

refactorai_cli-0.3.4/refactorai_cli/cloud_rr.py

@@ -0,0 +1,730 @@
+"""Client-side orchestrator for the cloud server-run per-RR loop (R23; doc 35).
+
+This module is the thin "hand" in the Cursor-style split: the proprietary
+per-RR decision loop runs on the platform (see ``backend/app/api/v1/rr_session``),
+and this client executes only generic primitives and reports results:
+
+- open a session with the pending RRs' context,
+- write the server-generated characterization test and run it (baseline),
+- render the server proposal and collect approval (per RR, mid-run),
+- apply the approved diff, run the test again, report the result,
+- honor the server verdict (applied / retry+revert / denied / deferred / stop),
+- persist RR status + build the run summary.
+
+IMPORTANT (IP + packaging boundary): this module MUST import only client-safe
+``refactor_core`` modules (``apply``, ``refactor_requests``, ``models``,
+``constitution``, ``store``, ``testcmd``). It MUST NOT import any engine-only
+subpackage (``execution``, ``codeintel``, ``enginecore``, ``providers``); doing
+so would both leak proprietary code to pip-only installs and re-introduce the
+``ModuleNotFoundError: No module named 'refactor_core.execution'`` crash that
+this design fixes. ``tests/test_cloud_rr_client_boundary.py`` enforces this.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+import shlex
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Callable
+
+import httpx
+
+# Client-safe core modules only (see module docstring).
+from refactor_core.apply import (
+    apply_changes,
+    compute_file_changes,
+    revert_from_backup,
+    validate_diff,
+)
+from refactor_core.models import GateResult, RunArtifact
+from refactor_core.refactor_requests import (
+    APPLIED,
+    DEFERRED,
+    DENIED,
+    FAILED,
+    IN_PROGRESS,
+    pending_requests,
+    rr_test_dir,
+    save_request,
+)
+from refactor_core.store import create_run
+from refactor_core.testcmd import _SKIP_DIRS, discover_test_command, resolve_test_command
+
+from refactorai_cli.auth import ensure_authenticated
+from refactorai_cli.settings import platform_url
+
+_ENV_ASSIGN_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=.*$")
+
+# Manifest/config files that reveal how a project runs its tests. Sent (truncated)
+# to the server for agentic test-command discovery when deterministic detection
+# finds nothing.
+_MANIFEST_NAMES = (
+    "package.json",
+    "pyproject.toml",
+    "setup.cfg",
+    "setup.py",
+    "pytest.ini",
+    "tox.ini",
+    "noxfile.py",
+    "requirements.txt",
+    "Makefile",
+    "makefile",
+    "go.mod",
+    "Cargo.toml",
+    "build.gradle",
+    "pom.xml",
+)
+
+
+class CloudRRError(RuntimeError):
+    """Raised when the cloud RR session cannot proceed."""
+
+
+def _read_source(project_root: Path, rel: str) -> str:
+    path = project_root / rel
+    if not path.is_file():
+        return ""
+    try:
+        return path.read_text(encoding="utf-8")
+    except OSError:
+        return ""
+
+
+def _run_test(project_root: Path, test_command: str | None) -> tuple[bool, str]:
+    """Run the configured test command on the host; (passed, detail).
+
+    Cloud runs execute tests client-side because the developer's code + deps live
+    here. Behavior preservation (FR3/FR3a) requires a runnable test: if NO test
+    command is configured we return ``(False, ...)`` so the server defers the RR
+    rather than applying an unverifiable change. This differs from local's
+    permissive skip on purpose -- cloud never applies an unverified change.
+    """
+    if not test_command or not str(test_command).strip():
+        return False, "no test command configured; cannot verify behavior preservation"
+    command = str(test_command).strip()
+    if command == "npm test":
+        command = "CI=true npm test -- --watch=false"
+    try:
+        proc = subprocess.run(
+            command,
+            shell=True,
+            cwd=str(project_root),
+            capture_output=True,
+            text=True,
+            timeout=600,
+        )
+    except (subprocess.SubprocessError, OSError) as exc:
+        return False, f"test command error: {exc}"
+    if proc.returncode == 0:
+        return True, "tests passed"
+    return False, (proc.stdout or proc.stderr or "")[-500:]
+
+
+def _client_preflight_command(project_root: Path, command: str | None) -> bool:
+    """Return True when ``command`` looks runnable on this host.
+
+    Composite/shell commands (``&&``, subshells, pipes) run under ``shell=True``
+    and can't be reduced to one binary, so we trust them and let the real exit
+    code gate. Simple commands are validated by checking the leading binary is on
+    PATH — this guards against running (and charging for) a server-suggested
+    command whose toolchain isn't installed.
+    """
+    if not command or not str(command).strip():
+        return False
+    if any(op in command for op in ("&&", "||", ";", "|", "(", ")")):
+        return True
+    try:
+        tokens = shlex.split(command, posix=True)
+    except ValueError:
+        return False
+    while tokens and _ENV_ASSIGN_RE.match(tokens[0]):
+        tokens.pop(0)
+    if not tokens:
+        return False
+    binary = tokens[0]
+    if "/" in binary:
+        return Path(binary).expanduser().exists()
+    return shutil.which(binary) is not None
+
+
+def _collect_test_manifests(
+    project_root: Path, *, max_files: int = 24, max_bytes: int = 4000
+) -> list[dict]:
+    """Gather manifest snippets (repo root + immediate subdirs) for discovery."""
+    root = Path(project_root)
+    docs: list[dict] = []
+    dirs: list[Path] = [root]
+    try:
+        for child in sorted(root.iterdir(), key=lambda p: p.name):
+            if child.is_dir() and child.name not in _SKIP_DIRS and not child.name.startswith("."):
+                dirs.append(child)
+    except OSError:
+        return docs
+
+    for directory in dirs:
+        for name in _MANIFEST_NAMES:
+            path = directory / name
+            if not path.is_file():
+                continue
+            try:
+                content = path.read_text(encoding="utf-8", errors="replace")[:max_bytes]
+            except OSError:
+                continue
+            rel = path.relative_to(root)
+            docs.append({"path": str(rel), "content": content})
+            if len(docs) >= max_files:
+                return docs
+        tests_dir = directory / "tests"
+        if tests_dir.is_dir():
+            try:
+                names = sorted(p.name for p in tests_dir.iterdir() if p.is_file())[:40]
+            except OSError:
+                names = []
+            rel = tests_dir.relative_to(root)
+            docs.append({"path": f"{rel}/ (listing)", "content": "\n".join(names)})
+            if len(docs) >= max_files:
+                return docs
+    return docs
+
+
+def _discover_test_command_via_cloud(
+    *,
+    project_root: Path,
+    constitution,
+    execution_mode: str,
+    auth_ctx,
+    model_hint: str | None,
+    apply_byok_payload: Callable[[dict, object], None] | None,
+) -> str:
+    """Ask the server to infer a test command from the project's manifests.
+
+    Best-effort: any transport/parse/auth issue returns ``""`` so the caller
+    falls back to the existing defer-when-unverifiable behavior.
+    """
+    documents = _collect_test_manifests(project_root)
+    if not documents:
+        return ""
+    payload = {
+        "stage": "rr_discover_testcmd",
+        "constitution_hash": constitution.content_hash,
+        "constitution_body": getattr(constitution, "body", "") or "",
+        "model_hint": model_hint,
+        "documents": documents,
+        "execution_mode": execution_mode,
+    }
+    if execution_mode == "cloud_byok" and apply_byok_payload is not None:
+        apply_byok_payload(payload, constitution)
+    idem = hashlib.sha256(
+        "|".join(
+            [auth_ctx.account_id, execution_mode, constitution.content_hash, "rr_discover_testcmd"]
+        ).encode("utf-8")
+    ).hexdigest()
+    try:
+        resp = httpx.post(
+            f"{platform_url()}/v1/inference/refactor",
+            headers={
+                "Authorization": f"Bearer {auth_ctx.key.key}",
+                "Content-Type": "application/json",
+                "Idempotency-Key": idem,
+            },
+            json=payload,
+            timeout=45.0,
+        )
+    except httpx.HTTPError:
+        return ""
+    if resp.status_code != 200:
+        return ""
+    try:
+        data = resp.json() if resp.content else {}
+    except ValueError:
+        return ""
+    return str((data or {}).get("test_command", "") or "").strip()
+
+
+def _resolve_cloud_test_command(
+    *,
+    project_root: Path,
+    config: dict,
+    constitution,
+    execution_mode: str,
+    auth_ctx,
+    model_hint: str | None,
+    apply_byok_payload: Callable[[dict, object], None] | None,
+) -> tuple[str | None, str]:
+    """Resolve a test command for a cloud run; return ``(command, note)``.
+
+    Layered resolution so the developer usually needs no config:
+    1. configured ``verification.tests.command`` or root-marker detection,
+    2. deterministic monorepo discovery (subproject test setups),
+    3. agentic discovery (server infers from manifests), preflight-validated.
+    """
+    configured = resolve_test_command(project_root, config)
+    if configured:
+        return configured, ""
+
+    discovered = discover_test_command(project_root)
+    if discovered:
+        return discovered, f"auto-detected test command: {discovered}"
+
+    suggested = _discover_test_command_via_cloud(
+        project_root=project_root,
+        constitution=constitution,
+        execution_mode=execution_mode,
+        auth_ctx=auth_ctx,
+        model_hint=model_hint,
+        apply_byok_payload=apply_byok_payload,
+    )
+    if suggested and _client_preflight_command(project_root, suggested):
+        return suggested, f"server-suggested test command: {suggested}"
+    if suggested:
+        return None, (
+            f"server suggested test command '{suggested}' but its toolchain was not "
+            "found on PATH; skipped."
+        )
+    return None, ""
+
+
+class _Session:
+    """Transport for the RR session endpoints with status-code error mapping."""
+
+    def __init__(self, *, auth_ctx, execution_mode: str, constitution_hash: str) -> None:
+        self._auth = auth_ctx
+        self._mode = execution_mode
+        self._consti = constitution_hash
+        self._base = f"{platform_url()}/v1/rr"
+
+    def _idempotency_key(self, path: str, payload: dict) -> str:
+        """Deterministic key per (account, mode, consti, rr, step, attempt).
+
+        Makes a step POST safe to retry without duplicating work or double
+        charging (FR6). Distinct RRs/attempts/steps get distinct keys so unrelated
+        attempts never collapse into one replayed result.
+        """
+        seed = "|".join(
+            [
+                self._auth.account_id,
+                self._mode,
+                self._consti,
+                path,
+                str(payload.get("rr_id", "")),
+                str(payload.get("step", "")),
+                str(payload.get("attempt", "")),
+            ]
+        )
+        return hashlib.sha256(seed.encode("utf-8")).hexdigest()
+
+    def _post(self, path: str, payload: dict) -> dict:
+        try:
+            resp = httpx.post(
+                f"{self._base}{path}",
+                headers={
+                    "Authorization": f"Bearer {self._auth.key.key}",
+                    "Content-Type": "application/json",
+                    "Idempotency-Key": self._idempotency_key(path, payload),
+                },
+                json=payload,
+                timeout=45.0,
+            )
+        except httpx.HTTPError as exc:
+            raise CloudRRError(f"Could not reach cloud RR service: {exc}") from exc
+
+        if resp.status_code == 401:
+            raise CloudRRError("Cloud RR unauthorized (developer key invalid or revoked).")
+        if resp.status_code == 402:
+            if self._mode == "cloud_byok":
+                raise CloudRRError(
+                    "Cloud BYOK is not enabled for this account (missing `run:byok`). "
+                    "Contact your admin to enable BYOK cloud execution."
+                )
+            raise CloudRRError("Cloud RR requires paid tier (`mode: cloud_managed`).")
+        if resp.status_code == 404 and self._mode == "cloud_byok":
+            raise CloudRRError(
+                "BYOK credential not found or not owned by this account. "
+                "Check `refactor cloud credentials list` and your `credential_ref`."
+            )
+        if resp.status_code in (400, 403, 409):
+            detail = ""
+            try:
+                detail = str((resp.json() or {}).get("detail", ""))
+            except Exception:
+                detail = resp.text[:300]
+            raise CloudRRError(detail or f"Cloud RR error ({resp.status_code}).")
+        if resp.status_code == 429:
+            raise CloudRRError("Cloud RR quota exhausted or rate-limited.")
+        if resp.status_code >= 400:
+            raise CloudRRError(f"Cloud RR failed ({resp.status_code}): {resp.text[:300]}")
+        return resp.json() if resp.content else {}
+
+    def open(self, payload: dict) -> dict:
+        return self._post("/session", payload)
+
+    def step(self, payload: dict) -> dict:
+        return self._post("/session/step", payload)
+
+
+def run_cloud_refactor_requests(
+    *,
+    project_root: Path,
+    constitution,
+    config: dict,
+    requests=None,
+    model_hint: str | None = None,
+    progress_cb: Callable[[dict], None] | None = None,
+    approval_cb: Callable[[dict], bool] | None = None,
+    apply_byok_payload: Callable[[dict, object], None] | None = None,
+) -> RunArtifact:
+    """Drive pending RRs through the cloud server-run loop and return a summary.
+
+    ``progress_cb`` / ``approval_cb`` are the SAME callbacks local uses
+    (``_rr_progress_logger`` / ``_rr_approval_prompt``), so the run streams the
+    same events and prompts per RR mid-run (FR8). ``apply_byok_payload`` is the
+    shared BYOK resolver injected by the caller to avoid a circular import.
+    """
+    project_root = Path(project_root)
+    progress_cb = progress_cb or (lambda e: None)
+    approval_cb = approval_cb or (lambda r: False)
+
+    execution_mode = str(constitution.get_setting("mode", "cloud_managed") or "cloud_managed")
+    auth_ctx = ensure_authenticated(project_root)
+    test_command, testcmd_note = _resolve_cloud_test_command(
+        project_root=project_root,
+        config=config,
+        constitution=constitution,
+        execution_mode=execution_mode,
+        auth_ctx=auth_ctx,
+        model_hint=model_hint,
+        apply_byok_payload=apply_byok_payload,
+    )
+
+    if requests is None:
+        requests = pending_requests(project_root)
+
+    run_store = create_run(project_root)
+    run_id = run_store.run_id
+    resolved_model = model_hint or str(
+        constitution.get_setting("model_id", "managed-default") or "managed-default"
+    )
+
+    _emit(progress_cb, phase="rr", event="run_start", total_requests=len(requests),
+          test_command=test_command or "", execution_env="cloud")
+
+    outcomes: list[dict] = []
+    counts = {"applied": 0, "denied": 0, "failed": 0, "deferred": 0}
+    notes: list[str] = []
+    if testcmd_note:
+        notes.append(testcmd_note)
+    stopped = False
+    stop_reason = ""
+    model_id = resolved_model
+
+    if not requests:
+        return _build_artifact(
+            run_store, run_id, constitution, model_id, outcomes, counts,
+            notes, stopped=False, stop_reason="", test_command=test_command,
+        )
+
+    session = _Session(
+        auth_ctx=auth_ctx,
+        execution_mode=execution_mode,
+        constitution_hash=constitution.content_hash,
+    )
+
+    # --- open the session ---------------------------------------------------
+    open_payload = {
+        "execution_mode": execution_mode,
+        "constitution_hash": constitution.content_hash,
+        "constitution_body": getattr(constitution, "body", "") or "",
+        "model_hint": resolved_model,
+        "rrs": [
+            {
+                "rr_id": rr.rr_id,
+                "rr_context": {
+                    "location": rr.location,
+                    "file_path": rr.file_path,
+                    "category": rr.category,
+                    "severity": rr.severity,
+                    "recommendation": rr.recommendation,
+                    "operation_type": rr.operation_type,
+                },
+            }
+            for rr in requests
+        ],
+    }
+    if execution_mode == "cloud_byok" and apply_byok_payload is not None:
+        apply_byok_payload(open_payload, constitution)
+
+    action = session.open(open_payload)
+    token = action.get("session_token", "")
+
+    # Map rr_id -> RefactorRequest for status updates.
+    by_id = {rr.rr_id: rr for rr in requests}
+    attempts_by_id: dict[str, int] = {}
+    started: set[str] = set()
+
+    def _start_rr(rr_id: str):
+        """Emit rr_start (once) and send the `start` step for ``rr_id``."""
+        rr = by_id.get(rr_id)
+        if rr is not None and rr_id not in started:
+            started.add(rr_id)
+            rr.status = IN_PROGRESS
+            rr.resolved_in_run = run_id
+            save_request(project_root, rr)
+            _emit(progress_cb, phase="rr", event="rr_start", rr_id=rr_id, location=rr.location)
+        return session.step(_step_payload(token, rr_id, "start", by_id, project_root))
+
+    # --- drive the loop -----------------------------------------------------
+    # Uniform contract: the server returns the next action; the client executes a
+    # primitive and posts the result. Terminal per-RR verdicts carry `next_rr_id`
+    # (empty => finished). We always send the current file source so the server
+    # can (re)build prompts. A generous iteration cap guards against runaway.
+    current_rr_id = action.get("rr_id", "")
+    if str(action.get("action", "")) == "next_rr" and current_rr_id:
+        action = _start_rr(current_rr_id)
+        token = action.get("session_token", token)
+
+    guard = 0
+    max_iters = max(50, len(requests) * 25)
+    while guard < max_iters:
+        guard += 1
+        act = str(action.get("action", ""))
+        model_id = action.get("model_id", model_id) or model_id
+
+        if act == "done":
+            break
+
+        if act == "run_baseline_test":
+            current_rr_id = action.get("rr_id", "") or current_rr_id
+            _emit(progress_cb, phase="rr", event="test_generating", rr_id=current_rr_id)
+            _write_generated_test(project_root, current_rr_id, action, by_id)
+            passed, detail = _run_test(project_root, test_command)
+            _emit(progress_cb, phase="rr", event="baseline_test", rr_id=current_rr_id,
+                  passed=passed, detail=detail, execution_env="host")
+            action = session.step(
+                _step_payload(token, current_rr_id, "baseline_result", by_id, project_root,
+                              baseline_passed=passed, baseline_detail=detail)
+            )
+            token = action.get("session_token", token)
+            continue
+
+        if act == "show_proposal":
+            current_rr_id = action.get("rr_id", "") or current_rr_id
+            rr = by_id.get(current_rr_id)
+            diff_text = str(action.get("diff_text", "") or "")
+            attempt = int(action.get("attempt", 1) or 1)
+            attempts_by_id[current_rr_id] = attempt
+            ok, why = validate_diff(project_root, diff_text)
+            if not ok:
+                _emit(progress_cb, phase="rr", event="proposal_invalid", attempt=attempt, reason=why)
+                action = session.step(
+                    _step_payload(token, current_rr_id, "verify_result", by_id, project_root,
+                                  attempt=attempt,
+                                  verify_passed=False, verify_detail=f"invalid diff: {why}")
+                )
+                token = action.get("session_token", token)
+                continue
+            _emit(progress_cb, phase="rr", event="approval_requested", rr_id=current_rr_id)
+            approved = bool(approval_cb({
+                "rr_id": current_rr_id,
+                "location": getattr(rr, "location", current_rr_id),
+                "attempt": attempt,
+                "summary": action.get("summary", ""),
+                "risk": action.get("risk", "medium"),
+                "diff_text": diff_text,
+            }))
+            _emit(progress_cb, phase="rr", event="approval_decision", rr_id=current_rr_id, approved=approved)
+            _PENDING_DIFF[current_rr_id] = diff_text
+            action = session.step(
+                _step_payload(token, current_rr_id, "approval", by_id, project_root,
+                              attempt=attempt, approved=approved)
+            )
+            token = action.get("session_token", token)
+            continue
+
+        if act in ("apply_result", "deferred"):
+            verdict = str(action.get("verdict", "") or "")
+            if verdict == "":
+                # Server approved: client applies + verifies, then posts result.
+                current_rr_id = action.get("rr_id", "") or current_rr_id
+                diff_text = _PENDING_DIFF.get(current_rr_id, "")
+                passed, detail, files = _apply_and_verify(
+                    project_root, run_store.run_dir, diff_text, test_command
+                )
+                if passed:
+                    _emit(progress_cb, phase="rr", event="rr_applied", rr_id=current_rr_id, files=files)
+                else:
+                    _emit(progress_cb, phase="rr", event="rr_reverted", rr_id=current_rr_id,
+                          attempt=attempts_by_id.get(current_rr_id, 1), detail=detail)
+                action = session.step(
+                    _step_payload(token, current_rr_id, "verify_result", by_id, project_root,
+                                  attempt=attempts_by_id.get(current_rr_id, 1),
+                                  verify_passed=passed, verify_detail=detail)
+                )
+                token = action.get("session_token", token)
+                continue
+            # Terminal verdict for the completed RR.
+            completed_id = action.get("rr_id", "") or current_rr_id
+            _record_outcome(
+                project_root, by_id, completed_id, verdict, action.get("message", ""),
+                attempts_by_id.get(completed_id, 0 if verdict == "deferred" else 1),
+                outcomes, counts, progress_cb,
+            )
+            if verdict == "failed":
+                stopped = True
+                stop_reason = str(action.get("message", "") or "refactor request failed")
+                _emit(progress_cb, phase="rr", event="run_stopped", rr_id=completed_id, reason=stop_reason)
+                break
+            next_id = str(action.get("next_rr_id", "") or "")
+            if not next_id:
+                break
+            current_rr_id = next_id
+            action = _start_rr(next_id)
+            token = action.get("session_token", token)
+            continue
+
+        notes.append(f"unexpected cloud action '{act}'")
+        break
+
+    return _build_artifact(
+        run_store, run_id, constitution, model_id, outcomes, counts,
+        notes, stopped=stopped, stop_reason=stop_reason, test_command=test_command,
+    )
+
+
+# Diffs approved but not yet applied, keyed by rr_id (client-local, per run).
+_PENDING_DIFF: dict[str, str] = {}
+
+
+def _step_payload(token, rr_id, step, by_id, project_root, *, attempt: int = 0, **kw) -> dict:
+    rr = by_id.get(rr_id) if rr_id else None
+    source = _read_source(project_root, rr.file_path) if rr is not None else ""
+    payload = {
+        "session_token": token,
+        "rr_id": rr_id,
+        "step": step,
+        "source": source,
+        "attempt": int(attempt),
+    }
+    payload.update(kw)
+    return payload
+
+
+def _write_generated_test(project_root: Path, rr_id: str, action: dict, by_id: dict) -> None:
+    content = str(action.get("test_content", "") or "")
+    if not content:
+        return
+    test_path = str(action.get("test_path", "") or "")
+    name = Path(test_path).name if test_path else f"{rr_id}.test.txt"
+    test_dir = rr_test_dir(project_root, rr_id)
+    (test_dir / name).write_text(content, encoding="utf-8")
+    rr = by_id.get(rr_id)
+    if rr is not None:
+        rr.rrtest_path = str(test_dir / name)
+        save_request(project_root, rr)
+
+
+def _apply_and_verify(
+    project_root: Path, run_dir: Path, diff_text: str, test_command
+) -> tuple[bool, str, list[str]]:
+    """Apply the diff (with backup), run the test; revert on red.
+
+    Returns ``(passed, detail, changed_files)``. ``changed_files`` is computed
+    from the diff BEFORE applying (the tree is mutated in place afterward, so it
+    cannot be recomputed against the modified files).
+    """
+    if not diff_text:
+        return False, "empty diff", []
+    try:
+        changes = compute_file_changes(project_root, [diff_text])
+    except Exception as exc:
+        return False, f"could not compute changes: {exc}", []
+    if not changes:
+        return False, "diff produced no file changes", []
+    changed_files = list(changes.keys())
+    try:
+        apply_changes(project_root, run_dir, changes)
+    except Exception as exc:
+        return False, f"apply failed: {exc}", changed_files
+    passed, detail = _run_test(project_root, test_command)
+    if not passed:
+        try:
+            revert_from_backup(project_root, run_dir)
+        except Exception as exc:  # keep going; report both
+            detail = f"{detail}; revert error: {exc}"
+    return passed, detail, changed_files
+
+
+def _record_outcome(project_root, by_id, rr_id, verdict, message, attempts,
+                    outcomes: list, counts: dict, progress_cb) -> None:
+    status_map = {
+        "applied": APPLIED,
+        "denied": DENIED,
+        "failed": FAILED,
+        "deferred": DEFERRED,
+    }
+    rr = by_id.get(rr_id)
+    if rr is not None:
+        rr.status = status_map.get(verdict, rr.status)
+        rr.attempt_count = max(int(getattr(rr, "attempt_count", 0) or 0), int(attempts or 0))
+        save_request(project_root, rr)
+    outcomes.append({
+        "location": getattr(rr, "location", rr_id) if rr is not None else rr_id,
+        "operation_type": getattr(rr, "operation_type", "content_patch") if rr is not None else "content_patch",
+        "outcome": verdict,
+        "attempts": int(attempts or 0),
+    })
+    if verdict in counts:
+        counts[verdict] += 1
+    ev = {
+        "applied": "rr_applied",
+        "denied": None,
+        "failed": "rr_failed",
+        "deferred": "rr_deferred",
+    }.get(verdict)
+    if ev == "rr_deferred":
+        _emit(progress_cb, phase="rr", event="rr_deferred", rr_id=rr_id, reason=message)
+    elif ev == "rr_failed":
+        _emit(progress_cb, phase="rr", event="rr_failed", rr_id=rr_id, reason=message)
+
+
+def _build_artifact(run_store, run_id, constitution, model_id, outcomes, counts,
+                    notes, *, stopped, stop_reason, test_command) -> RunArtifact:
+    gate = GateResult(status="blocked" if stopped else "passed")
+    applied = counts["applied"]
+    summary = (
+        f"Cloud refactor requests: applied={applied} denied={counts['denied']} "
+        f"failed={counts['failed']} deferred={counts['deferred']}"
+    )
+    artifact = RunArtifact(
+        run_id=run_id,
+        findings=[],
+        patches=[],
+        generated_tests=[],
+        gate=gate,
+        summary=summary,
+        constitution_hash=constitution.content_hash,
+        model_id=model_id,
+        notes=notes,
+        execution_mode="rr_cloud",
+        context_stats={"mode": "rr_cloud", "test_command": test_command or ""},
+        agent_trace_summary={
+            "outcomes": outcomes,
+            "applied": counts["applied"],
+            "denied": counts["denied"],
+            "failed": counts["failed"],
+            "deferred": counts["deferred"],
+            "stopped": stopped,
+            "stop_reason": stop_reason,
+        },
+    )
+    run_store.write_artifact(artifact, target=".", status="completed")
+    return artifact
+
+
+def _emit(progress_cb, **event) -> None:
+    try:
+        progress_cb(event)
+    except Exception:
+        pass

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/refactorai_cli/commands/run_cmds.py

@@ -772,155 +772,6 @@ def _apply_byok_payload(payload: dict, constitution) -> None:
         )
 
 
-def _post_cloud_inference(*, payload: dict, idempotency_key: str, auth_ctx, execution_mode: str) -> dict:
-    """POST a cloud inference request and return the parsed JSON body.
-
-    Centralizes transport + status-code error mapping so the per-RR proposal
-    path surfaces the same remediation messages as review/refactor.
-    """
-    try:
-        response = httpx.post(
-            f"{platform_url()}/v1/inference/refactor",
-            headers={
-                "Authorization": f"Bearer {auth_ctx.key.key}",
-                "Content-Type": "application/json",
-                "Idempotency-Key": idempotency_key,
-            },
-            json=payload,
-            timeout=45.0,
-        )
-    except httpx.HTTPError as exc:
-        raise RuntimeError(f"Could not reach cloud inference service: {exc}") from exc
-
-    if response.status_code == 401:
-        raise RuntimeError("Cloud inference unauthorized (developer key invalid or revoked).")
-    if response.status_code == 402:
-        if execution_mode == "cloud_byok":
-            raise RuntimeError(
-                "Cloud BYOK is not enabled for this account (missing `run:byok`). "
-                "Contact your admin to enable BYOK cloud execution."
-            )
-        raise RuntimeError("Cloud inference requires paid tier (`mode: cloud_managed`).")
-    if response.status_code == 404 and execution_mode == "cloud_byok":
-        raise RuntimeError(
-            "BYOK credential not found or not owned by this account. "
-            "Check `refactor cloud credentials list` and your `credential_ref`."
-        )
-    if response.status_code == 429:
-        raise RuntimeError("Cloud inference quota exhausted or rate-limited.")
-    if response.status_code >= 400:
-        raise RuntimeError(f"Cloud inference failed ({response.status_code}): {response.text[:500]}")
-
-    return response.json() if response.content else {}
-
-
-class _CloudRRProvider:
-    """Lightweight provider stub for cloud RR execution (R22).
-
-    The executor reads ``provider.model_id`` for the artifact and would call
-    ``provider.complete(...)`` for proposals/tests. In cloud mode the proposal
-    and test-gen hooks are supplied, so ``complete`` is never invoked; it raises
-    to make any accidental local-prompt path explicit rather than silent.
-    """
-
-    def __init__(self, *, model_id: str) -> None:
-        self.model_id = model_id
-        self.provider_name = "cloud"
-        self.supports_refactor = True
-
-    def complete(self, system: str, user: str) -> str:  # pragma: no cover - guard
-        raise RuntimeError(
-            "cloud RR execution must use server-side proposal hooks; "
-            "provider.complete should not be called."
-        )
-
-
-def _cloud_rr_hooks(
-    *,
-    project_root: Path,
-    constitution,
-    model_hint: str | None,
-) -> tuple[Callable, Callable, str]:
-    """Build (propose_fn, gen_test_fn, model_id) for cloud per-RR execution (R22).
-
-    The returned callables match the executor's hook contract. They send the
-    single RR's context + current source to the platform, which builds the
-    proprietary prompts server-side and returns a proposal / characterization
-    test. Idempotency keys include the RR id and attempt so retries of distinct
-    RRs/attempts never collapse into a replayed result.
-    """
-    execution_mode = _cloud_execution_mode(constitution) or "cloud_managed"
-    auth_ctx = ensure_authenticated(project_root)
-    constitution_body = getattr(constitution, "body", "") or ""
-    resolved_model = model_hint or str(
-        constitution.get_setting("model_id", "managed-default") or "managed-default"
-    )
-
-    def _rr_context(rr) -> dict:
-        return {
-            "location": getattr(rr, "location", ""),
-            "file_path": getattr(rr, "file_path", ""),
-            "category": getattr(rr, "category", ""),
-            "severity": getattr(rr, "severity", ""),
-            "recommendation": getattr(rr, "recommendation", ""),
-        }
-
-    def _base_payload(stage: str, rr, source: str) -> dict:
-        payload = {
-            "stage": stage,
-            "execution_mode": execution_mode,
-            "constitution_hash": constitution.content_hash,
-            "constitution_body": constitution_body,
-            "rr_context": _rr_context(rr),
-            "source": source,
-            "max_alerts": int(constitution.get_setting("max_alerts_per_run", 5) or 5),
-            "model_hint": resolved_model,
-        }
-        if execution_mode == "cloud_byok":
-            _apply_byok_payload(payload, constitution)
-        return payload
-
-    def _idempotency(stage: str, rr, attempt: int) -> str:
-        seed = "|".join(
-            [
-                auth_ctx.account_id,
-                execution_mode,
-                stage,
-                constitution.content_hash,
-                str(getattr(rr, "rr_id", "")),
-                str(int(attempt)),
-            ]
-        )
-        return hashlib.sha256(seed.encode("utf-8")).hexdigest()
-
-    def propose_fn(rr, source: str, prior_failures: list[str]) -> dict:
-        # Attempt number is derived from prior failures so each retry gets a
-        # distinct idempotency key (1-based).
-        attempt = len(prior_failures or []) + 1
-        payload = _base_payload("rr_propose", rr, source)
-        payload["prior_failures"] = list(prior_failures or [])
-        data = _post_cloud_inference(
-            payload=payload,
-            idempotency_key=_idempotency("rr_propose", rr, attempt),
-            auth_ctx=auth_ctx,
-            execution_mode=execution_mode,
-        )
-        proposal = data.get("proposal") or {}
-        if not isinstance(proposal, dict):
-            return {}
-        return proposal
-
-    def gen_test_fn(rr, source: str) -> dict:
-        # Server-side characterization-test generation is not part of Phase 1.
-        # Returning no test makes the executor fall back to the configured test
-        # command for behavioral verification (parity with a local run that has
-        # no generated test). This keeps cloud RR execution safe today and lets
-        # a future phase add a dedicated server test-gen stage.
-        return {}
-
-    return propose_fn, gen_test_fn, resolved_model
-
-
 def _load_project() -> tuple[Path, object, object]:
     files = find_project_files()
     if not files:
@@ -2105,7 +1956,7 @@ def code(
         help="Skip interactive issue approvals in agentic code mode.",
     ),
     on_rr_failure: str = typer.Option(
-        "stop",
+        "continue",
         "--on-rr-failure",
         help="RR failure behavior: stop | continue | defer.",
     ),
@@ -2292,43 +2143,49 @@ def code(
             console.print("[green]No issues to refactor.[/green]")
             return
 
-        from refactor_core.execution.rr_executor import run_refactor_requests
+        rr_config = (
+            dict(getattr(project_config, "settings", {}) or {})
+            | ({"sandbox": {"enabled": True}} if sandbox_on else {})
+            | ({"_sandbox_context": sandbox_ctx} if sandbox_ctx else {})
+        ) or dict(getattr(constitution, "settings", {}) or {})
 
-        # Cloud and local both drive the SAME per-RR interactive loop (R22 cloud
-        # RR parity). The only difference is where proposals come from: cloud
-        # passes server-side proposal hooks; local uses the local provider and
-        # client-side prompt builders. This guarantees identical UX (proposal
-        # diff + approval prompt), status transitions, and outcomes table.
-        cloud_propose_fn = None
-        cloud_gen_test_fn = None
-        rr_provider = selected_provider
         if cloud:
-            cloud_propose_fn, cloud_gen_test_fn, cloud_model_id = _cloud_rr_hooks(
-                project_root=project_root,
-                constitution=constitution,
-                model_hint=provider,
-            )
-            rr_provider = _CloudRRProvider(model_id=cloud_model_id)
-
-        with console.status("[cyan]code[/cyan] running...", spinner="dots") as status:
-            rr_config = (
-                dict(getattr(project_config, "settings", {}) or {})
-                | ({"sandbox": {"enabled": True}} if sandbox_on else {})
-                | ({"_sandbox_context": sandbox_ctx} if sandbox_ctx else {})
-            ) or dict(getattr(constitution, "settings", {}) or {})
-            artifact = run_refactor_requests(
-                project_root=project_root,
-                constitution=constitution,
-                provider=rr_provider,
-                requests=requests,
-                config=rr_config,
-                progress_cb=_rr_progress_logger(status=status),
-                approval_cb=_rr_approval_prompt(auto_approve=auto_approve),
-                on_rr_failure=on_rr_failure,
-                equivalence_mode=equivalence,
-                propose_fn=cloud_propose_fn,
-                gen_test_fn=cloud_gen_test_fn,
-            )
+            # Cloud modes: the proprietary per-RR loop runs SERVER-SIDE (R23; doc
+            # 35). The client is a thin executor speaking the RR session protocol
+            # and uses ONLY client-safe modules — it never imports the engine-only
+            # ``rr_executor``. It reuses the SAME progress logger + approval prompt
+            # as local so the run streams events and asks for approval per RR,
+            # mid-run (identical UX), with tests guarding every change.
+            from refactorai_cli.cloud_rr import run_cloud_refactor_requests
+
+            with console.status("[cyan]code[/cyan] running (cloud)...", spinner="dots") as status:
+                artifact = run_cloud_refactor_requests(
+                    project_root=project_root,
+                    constitution=constitution,
+                    config=rr_config,
+                    requests=requests,
+                    model_hint=provider,
+                    progress_cb=_rr_progress_logger(status=status),
+                    approval_cb=_rr_approval_prompt(auto_approve=auto_approve),
+                    apply_byok_payload=_apply_byok_payload,
+                )
+        else:
+            # Local mode is unchanged: dispatch to the local executor with the
+            # local provider and no cloud hooks.
+            from refactor_core.execution.rr_executor import run_refactor_requests
+
+            with console.status("[cyan]code[/cyan] running...", spinner="dots") as status:
+                artifact = run_refactor_requests(
+                    project_root=project_root,
+                    constitution=constitution,
+                    provider=selected_provider,
+                    requests=requests,
+                    config=rr_config,
+                    progress_cb=_rr_progress_logger(status=status),
+                    approval_cb=_rr_approval_prompt(auto_approve=auto_approve),
+                    on_rr_failure=on_rr_failure,
+                    equivalence_mode=equivalence,
+                )
     except typer.Exit:
         # Intentional exits (e.g. gate-blocked apply) keep their own code/message.
         raise
@@ -2370,7 +2227,7 @@ def requests(
         help="Auto-approve retry-deferred proposals.",
     ),
     on_rr_failure: str = typer.Option(
-        "stop",
+        "continue",
         "--on-rr-failure",
         help="RR failure behavior for retry: stop | continue | defer.",
     ),
@@ -3627,7 +3484,7 @@ def _report_structural_readiness(project_root: Path, config) -> None:
     if not isinstance(structural, dict):
         structural = {}
     eq_mode = str(structural.get("equivalence_mode", "strict") or "strict")
-    rr_policy = str(structural.get("on_rr_failure", "stop") or "stop")
+    rr_policy = str(structural.get("on_rr_failure", "continue") or "continue")
     rewrite_mode = str(structural.get("reference_rewrite", "auto") or "auto")
     langs = structural.get("languages", [])
     rollout = str(structural.get("rollout", "default") or "default")

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.2
+Version: 0.3.4
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.2
+Requires-Dist: refactorai-core>=3.0.4
 
 # refactorai-cli
 
@@ -54,7 +54,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.2-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.4-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/refactorai_cli.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ pyproject.toml
 refactorai_cli/__init__.py
 refactorai_cli/auth.py
 refactorai_cli/client.py
+refactorai_cli/cloud_rr.py
 refactorai_cli/control_plane.py
 refactorai_cli/credentials.py
 refactorai_cli/local_constitution.py

{refactorai_cli-0.3.2 → refactorai_cli-0.3.4}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.0.2
+refactorai-core>=3.0.4