refactorai-cli 0.3.3__tar.gz → 0.3.5__tar.gz

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.3
+Version: 0.3.5
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.3
+Requires-Dist: refactorai-core>=3.0.4
 
 # refactorai-cli
 
@@ -54,7 +54,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.3-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.4-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/README.md

@@ -42,7 +42,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.3-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.4-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.3.3"
+version = "0.3.5"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.0.3",
+  "refactorai-core>=3.0.4",
 ]
 
 [project.scripts]

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.3.3"
+__version__ = "0.3.5"

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/client.py

@@ -44,3 +44,21 @@ class PlatformClient:
                 f"Key validation failed ({response.status_code})", status_code=response.status_code
             )
         return response.json()
+
+    def list_key_accounts(self, developer_key: str) -> list[dict]:
+        try:
+            response = httpx.get(
+                f"{self.base_url}/v1/keys/accounts",
+                headers={"Authorization": f"Bearer {developer_key}"},
+                timeout=self.timeout,
+            )
+        except httpx.HTTPError as exc:
+            raise PlatformError(f"Could not reach platform at {self.base_url}: {exc}") from exc
+        if response.status_code == 401:
+            raise PlatformError("Developer key is invalid or revoked", status_code=401)
+        if response.status_code >= 400:
+            raise PlatformError(
+                f"Account discovery failed ({response.status_code})", status_code=response.status_code
+            )
+        payload = response.json()
+        return payload if isinstance(payload, list) else []

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/cloud_rr.py

@@ -23,6 +23,9 @@ this design fixes. ``tests/test_cloud_rr_client_boundary.py`` enforces this.
 from __future__ import annotations
 
 import hashlib
+import re
+import shlex
+import shutil
 import subprocess
 from pathlib import Path
 from typing import Callable
@@ -48,11 +51,33 @@ from refactor_core.refactor_requests import (
     save_request,
 )
 from refactor_core.store import create_run
-from refactor_core.testcmd import resolve_test_command
+from refactor_core.testcmd import _SKIP_DIRS, discover_test_command, resolve_test_command
 
 from refactorai_cli.auth import ensure_authenticated
 from refactorai_cli.settings import platform_url
 
+_ENV_ASSIGN_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=.*$")
+
+# Manifest/config files that reveal how a project runs its tests. Sent (truncated)
+# to the server for agentic test-command discovery when deterministic detection
+# finds nothing.
+_MANIFEST_NAMES = (
+    "package.json",
+    "pyproject.toml",
+    "setup.cfg",
+    "setup.py",
+    "pytest.ini",
+    "tox.ini",
+    "noxfile.py",
+    "requirements.txt",
+    "Makefile",
+    "makefile",
+    "go.mod",
+    "Cargo.toml",
+    "build.gradle",
+    "pom.xml",
+)
+
 
 class CloudRRError(RuntimeError):
     """Raised when the cloud RR session cannot proceed."""
@@ -98,6 +123,170 @@ def _run_test(project_root: Path, test_command: str | None) -> tuple[bool, str]:
     return False, (proc.stdout or proc.stderr or "")[-500:]
 
 
+def _client_preflight_command(project_root: Path, command: str | None) -> bool:
+    """Return True when ``command`` looks runnable on this host.
+
+    Composite/shell commands (``&&``, subshells, pipes) run under ``shell=True``
+    and can't be reduced to one binary, so we trust them and let the real exit
+    code gate. Simple commands are validated by checking the leading binary is on
+    PATH — this guards against running (and charging for) a server-suggested
+    command whose toolchain isn't installed.
+    """
+    if not command or not str(command).strip():
+        return False
+    if any(op in command for op in ("&&", "||", ";", "|", "(", ")")):
+        return True
+    try:
+        tokens = shlex.split(command, posix=True)
+    except ValueError:
+        return False
+    while tokens and _ENV_ASSIGN_RE.match(tokens[0]):
+        tokens.pop(0)
+    if not tokens:
+        return False
+    binary = tokens[0]
+    if "/" in binary:
+        return Path(binary).expanduser().exists()
+    return shutil.which(binary) is not None
+
+
+def _collect_test_manifests(
+    project_root: Path, *, max_files: int = 24, max_bytes: int = 4000
+) -> list[dict]:
+    """Gather manifest snippets (repo root + immediate subdirs) for discovery."""
+    root = Path(project_root)
+    docs: list[dict] = []
+    dirs: list[Path] = [root]
+    try:
+        for child in sorted(root.iterdir(), key=lambda p: p.name):
+            if child.is_dir() and child.name not in _SKIP_DIRS and not child.name.startswith("."):
+                dirs.append(child)
+    except OSError:
+        return docs
+
+    for directory in dirs:
+        for name in _MANIFEST_NAMES:
+            path = directory / name
+            if not path.is_file():
+                continue
+            try:
+                content = path.read_text(encoding="utf-8", errors="replace")[:max_bytes]
+            except OSError:
+                continue
+            rel = path.relative_to(root)
+            docs.append({"path": str(rel), "content": content})
+            if len(docs) >= max_files:
+                return docs
+        tests_dir = directory / "tests"
+        if tests_dir.is_dir():
+            try:
+                names = sorted(p.name for p in tests_dir.iterdir() if p.is_file())[:40]
+            except OSError:
+                names = []
+            rel = tests_dir.relative_to(root)
+            docs.append({"path": f"{rel}/ (listing)", "content": "\n".join(names)})
+            if len(docs) >= max_files:
+                return docs
+    return docs
+
+
+def _discover_test_command_via_cloud(
+    *,
+    project_root: Path,
+    constitution,
+    execution_mode: str,
+    auth_ctx,
+    model_hint: str | None,
+    apply_byok_payload: Callable[[dict, object], None] | None,
+) -> str:
+    """Ask the server to infer a test command from the project's manifests.
+
+    Best-effort: any transport/parse/auth issue returns ``""`` so the caller
+    falls back to the existing defer-when-unverifiable behavior.
+    """
+    documents = _collect_test_manifests(project_root)
+    if not documents:
+        return ""
+    payload = {
+        "stage": "rr_discover_testcmd",
+        "constitution_hash": constitution.content_hash,
+        "constitution_body": getattr(constitution, "body", "") or "",
+        "model_hint": model_hint,
+        "documents": documents,
+        "execution_mode": execution_mode,
+    }
+    if execution_mode == "cloud_byok" and apply_byok_payload is not None:
+        apply_byok_payload(payload, constitution)
+    idem = hashlib.sha256(
+        "|".join(
+            [auth_ctx.account_id, execution_mode, constitution.content_hash, "rr_discover_testcmd"]
+        ).encode("utf-8")
+    ).hexdigest()
+    try:
+        resp = httpx.post(
+            f"{platform_url()}/v1/inference/refactor",
+            headers={
+                "Authorization": f"Bearer {auth_ctx.key.key}",
+                "Content-Type": "application/json",
+                "Idempotency-Key": idem,
+            },
+            json=payload,
+            timeout=45.0,
+        )
+    except httpx.HTTPError:
+        return ""
+    if resp.status_code != 200:
+        return ""
+    try:
+        data = resp.json() if resp.content else {}
+    except ValueError:
+        return ""
+    return str((data or {}).get("test_command", "") or "").strip()
+
+
+def _resolve_cloud_test_command(
+    *,
+    project_root: Path,
+    config: dict,
+    constitution,
+    execution_mode: str,
+    auth_ctx,
+    model_hint: str | None,
+    apply_byok_payload: Callable[[dict, object], None] | None,
+) -> tuple[str | None, str]:
+    """Resolve a test command for a cloud run; return ``(command, note)``.
+
+    Layered resolution so the developer usually needs no config:
+    1. configured ``verification.tests.command`` or root-marker detection,
+    2. deterministic monorepo discovery (subproject test setups),
+    3. agentic discovery (server infers from manifests), preflight-validated.
+    """
+    configured = resolve_test_command(project_root, config)
+    if configured:
+        return configured, ""
+
+    discovered = discover_test_command(project_root)
+    if discovered:
+        return discovered, f"auto-detected test command: {discovered}"
+
+    suggested = _discover_test_command_via_cloud(
+        project_root=project_root,
+        constitution=constitution,
+        execution_mode=execution_mode,
+        auth_ctx=auth_ctx,
+        model_hint=model_hint,
+        apply_byok_payload=apply_byok_payload,
+    )
+    if suggested and _client_preflight_command(project_root, suggested):
+        return suggested, f"server-suggested test command: {suggested}"
+    if suggested:
+        return None, (
+            f"server suggested test command '{suggested}' but its toolchain was not "
+            "found on PATH; skipped."
+        )
+    return None, ""
+
+
 class _Session:
     """Transport for the RR session endpoints with status-code error mapping."""
 
@@ -200,7 +389,15 @@ def run_cloud_refactor_requests(
 
     execution_mode = str(constitution.get_setting("mode", "cloud_managed") or "cloud_managed")
     auth_ctx = ensure_authenticated(project_root)
-    test_command = resolve_test_command(project_root, config)
+    test_command, testcmd_note = _resolve_cloud_test_command(
+        project_root=project_root,
+        config=config,
+        constitution=constitution,
+        execution_mode=execution_mode,
+        auth_ctx=auth_ctx,
+        model_hint=model_hint,
+        apply_byok_payload=apply_byok_payload,
+    )
 
     if requests is None:
         requests = pending_requests(project_root)
@@ -217,6 +414,8 @@ def run_cloud_refactor_requests(
     outcomes: list[dict] = []
     counts = {"applied": 0, "denied": 0, "failed": 0, "deferred": 0}
     notes: list[str] = []
+    if testcmd_note:
+        notes.append(testcmd_note)
     stopped = False
     stop_reason = ""
     model_id = resolved_model

refactorai_cli-0.3.5/refactorai_cli/commands/account_cmds.py

@@ -0,0 +1,76 @@
+"""`refactor account` commands for account context selection."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from refactorai_cli.auth import AuthError, ensure_authenticated
+from refactorai_cli.client import PlatformClient, PlatformError
+from refactorai_cli.credentials import load_credentials, save_credentials
+
+console = Console()
+app = typer.Typer(
+    name="account",
+    help="List and switch account context for the current developer key.",
+    no_args_is_help=True,
+    add_completion=False,
+)
+
+
+def _discover_accounts() -> tuple[list[dict], dict]:
+    try:
+        auth_ctx = ensure_authenticated(force_remote=True)
+    except AuthError as exc:
+        console.print(f"[red]Not authenticated:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    client = PlatformClient()
+    try:
+        rows = client.list_key_accounts(auth_ctx.key.key)
+    except PlatformError as exc:
+        console.print(f"[red]Could not load accounts:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    return rows, load_credentials()
+
+
+@app.command("list")
+def account_list() -> None:
+    rows, creds = _discover_accounts()
+    active_slug = str(creds.get("active_account_slug") or "")
+    if not rows:
+        console.print("[dim]No accounts available for this key.[/dim]")
+        return
+    table = Table(title="Accounts")
+    table.add_column("current")
+    table.add_column("slug")
+    table.add_column("name")
+    table.add_column("type")
+    table.add_column("role")
+    for row in rows:
+        slug = str(row.get("slug") or "")
+        table.add_row("*" if slug and slug == active_slug else "", slug, str(row.get("display_name") or ""), str(row.get("type") or ""), str(row.get("role") or ""))
+    console.print(table)
+
+
+@app.command("use")
+def account_use(
+    slug: str = typer.Argument(..., help="Account slug to set active."),
+) -> None:
+    rows, creds = _discover_accounts()
+    selected = next((row for row in rows if str(row.get("slug") or "").lower() == slug.lower()), None)
+    if selected is None:
+        console.print(f"[red]Account not available for this key:[/red] {slug}")
+        raise typer.Exit(code=1)
+    creds["active_account_id"] = selected.get("id")
+    creds["active_account_slug"] = selected.get("slug")
+    save_credentials(creds)
+    console.print(f"[green]Active account set:[/green] {selected.get('slug')} ({selected.get('display_name')})")
+
+
+@app.command("current")
+def account_current() -> None:
+    creds = load_credentials()
+    slug = creds.get("active_account_slug") or "<unset>"
+    account_id = creds.get("active_account_id") or "<unset>"
+    console.print(f"[bold]active_account_slug[/bold]: {slug}\n[bold]active_account_id[/bold]: {account_id}")

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/commands/auth_cmds.py

@@ -43,6 +43,8 @@ def login(
         {
             "developer_key": developer_key,
             "account_id": payload.get("account_id"),
+            "active_account_id": payload.get("account_id"),
+            "active_account_slug": payload.get("account_slug"),
             "platform_url": platform_url(),
             "masked_key": mask_key(developer_key),
         }
@@ -80,6 +82,7 @@ def whoami() -> None:
     suffix = " (cached)" if ctx.cached else ""
     console.print(
         f"[bold]account[/bold]: {ctx.account_id}\n"
+        f"[bold]active_account_slug[/bold]: {load_credentials().get('active_account_slug') or 'unknown'}\n"
         f"[bold]key[/bold]: {mask_key(ctx.key.key)} (source: {source})\n"
         f"[bold]quota_remaining[/bold]: {quota}{suffix}"
     )

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/commands/run_cmds.py

@@ -53,6 +53,13 @@ from refactor_core.apply import (
 from refactor_core.budgeting import compute_budget
 from refactor_core.capabilities import resolve_capabilities
 from refactor_core.gate import evaluate_gate
+from refactor_core.merge_gate import (
+    build_merge_contract,
+    merge_contract_result,
+    resolve_merge_gate_settings,
+    run_l4_adapter,
+    should_run_l4,
+)
 from refactor_core.refactor_requests import (
     DEFERRED,
     RequestSuppression,
@@ -68,7 +75,11 @@ from refactor_core.refactor_ops import remediation_hint
 from refactor_core.indexing import index_target
 from refactor_core.models import Finding, GeneratedTest, PatchGroup, RunArtifact
 from refactor_core.rules import annotate_documents_with_rules, filter_documents_by_rules
-from refactor_core.security import merge_refactor_findings, suppress_findings_for_rr
+from refactor_core.security import (
+    compute_semgrep_security_summary,
+    merge_refactor_findings,
+    suppress_findings_for_rr,
+)
 from refactor_core.security.semgrep_runner import EMBEDDED_SEMGREP_SENTINEL
 from refactor_core.security.suppression import SecuritySuppression
 from refactor_core.store import (
@@ -635,7 +646,8 @@ def _cloud_inference(
     model_hint: str | None = None,
     findings: list | None = None,
 ) -> RunArtifact:
-    max_alerts = int(constitution.get_setting("max_alerts_per_run", 5) or 5)
+    _raw_alerts = constitution.get_setting("max_alerts_per_run", 5)
+    max_alerts = int(_raw_alerts if _raw_alerts is not None else 5)
     gate_mode = str(constitution.get_setting("gate_mode", "strict") or "strict")
     excludes = set(constitution.get_setting("exclude", []) or [])
     documents = index_target(Path(project_root), target, excludes=excludes)
@@ -709,13 +721,40 @@ def _cloud_inference(
         raise RuntimeError(f"Cloud inference failed ({response.status_code}): {response.text[:500]}")
 
     data = response.json() if response.content else {}
-    findings = [Finding.model_validate(item) for item in (data.get("findings") or [])][:max_alerts]
-    patches = [PatchGroup.model_validate(item) for item in (data.get("patches") or [])][:max_alerts]
+    _no_cap = max_alerts <= 0
+    findings = [Finding.model_validate(item) for item in (data.get("findings") or [])]
+    patches = [PatchGroup.model_validate(item) for item in (data.get("patches") or [])]
     generated_tests = [
         GeneratedTest.model_validate(item) for item in (data.get("generated_tests") or [])
-    ][:max_alerts]
+    ]
+    if not _no_cap:
+        findings = findings[:max_alerts]
+        patches = patches[:max_alerts]
+        generated_tests = generated_tests[:max_alerts]
     gate = evaluate_gate(findings, [], mode=gate_mode)
 
+    # Optional security-scan enrichment (R19). Semgrep is an additive signal and
+    # strictly fail-open: it never blocks the core cloud run and the gate stays
+    # driven by model findings only. Prefer the server-side baseline (Phase 2)
+    # when the platform ran it; otherwise fall back to a client-side scan against
+    # the local checkout (Phase 1) so parity holds against older backends.
+    security_summary: dict = {}
+    security_notes: list[str] = []
+    server_summary = data.get("security_summary")
+    if isinstance(server_summary, dict) and server_summary.get("enabled"):
+        security_summary = server_summary
+    else:
+        try:
+            security_summary, security_notes = compute_semgrep_security_summary(
+                project_root=Path(project_root),
+                constitution=constitution,
+                target=target,
+                base_findings=findings,
+            )
+        except Exception as exc:  # optional feature must never fail the cloud run
+            security_summary = {}
+            security_notes = [f"Security baseline scan skipped (unexpected error): {exc}"]
+
     run_id = uuid.uuid4().hex[:12]
     if stage == "review":
         summary = (
@@ -736,9 +775,11 @@ def _cloud_inference(
         summary=summary,
         constitution_hash=constitution.content_hash,
         model_id=str(data.get("model_id") or payload["model_hint"]),
+        notes=security_notes,
         rule_source=rule_meta.get("rule_source", ""),
         rule_pattern=rule_meta.get("rule_pattern", ""),
         rule_hash=rule_meta.get("rule_hash", ""),
+        security_summary=security_summary,
     )
 
 
@@ -1893,6 +1934,7 @@ def review(
         artifact=artifact,
     )
     _apply_compliance_gate_to_artifact(artifact)
+    _apply_merge_contract_to_artifact(artifact, project_root, project_config)
     run_store.write_artifact(artifact, target=target, status="completed")
     if compliance_frameworks:
         summary = dict(getattr(artifact, "compliance_summary", {}) or {})
@@ -1956,7 +1998,7 @@ def code(
         help="Skip interactive issue approvals in agentic code mode.",
     ),
     on_rr_failure: str = typer.Option(
-        "stop",
+        "continue",
         "--on-rr-failure",
         help="RR failure behavior: stop | continue | defer.",
     ),
@@ -2109,6 +2151,7 @@ def code(
                 artifact=review_artifact,
             )
             _apply_compliance_gate_to_artifact(review_artifact)
+            _apply_merge_contract_to_artifact(review_artifact, project_root, project_config)
             if compliance_frameworks:
                 summary = dict(getattr(review_artifact, "compliance_summary", {}) or {})
                 console.print(
@@ -2227,7 +2270,7 @@ def requests(
         help="Auto-approve retry-deferred proposals.",
     ),
     on_rr_failure: str = typer.Option(
-        "stop",
+        "continue",
         "--on-rr-failure",
         help="RR failure behavior for retry: stop | continue | defer.",
     ),
@@ -2685,6 +2728,94 @@ def _apply_compliance_gate_to_artifact(artifact: RunArtifact) -> None:
     artifact.gate.blocking_reasons["reasons"] = reasons
 
 
+def _detect_changed_files(project_root: Path) -> list[str] | None:
+    """Best-effort list of changed files via git (staged + unstaged + untracked).
+
+    Returns ``None`` when git is unavailable or the path is not a repo, so the
+    change-size guardrail degrades to "unknown" rather than a false value.
+    """
+    try:
+        proc = subprocess.run(
+            ["git", "status", "--porcelain"],
+            cwd=str(project_root),
+            capture_output=True,
+            text=True,
+            timeout=15,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0:
+        return None
+    files: list[str] = []
+    for line in (proc.stdout or "").splitlines():
+        name = line[3:].strip() if len(line) > 3 else line.strip()
+        if " -> " in name:  # rename: take the destination path
+            name = name.split(" -> ", 1)[1].strip()
+        if name:
+            files.append(name)
+    return files
+
+
+def _agent_meta_from_env() -> dict:
+    """Resolve agent-authorship metadata from the environment (CI-friendly)."""
+    authored = os.environ.get("REFACTOR_AGENT_AUTHORED", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+    risk_tier = os.environ.get("REFACTOR_AGENT_RISK_TIER", "").strip().lower()
+    return {"authored": authored, "risk_tier": risk_tier}
+
+
+def _apply_merge_contract_to_artifact(
+    artifact: RunArtifact, project_root: Path, project_config
+) -> None:
+    """Assemble the R24 merge contract from existing run outcomes.
+
+    Runs identically for every execution mode (local/cloud_managed/cloud_byok):
+    the CLI always assembles the artifact and persists the report locally, so the
+    contract is computed once here from the gate/compliance/security signals.
+
+    The expensive real-system (L4) layer runs only when it is required (strict
+    profile, agent policy, or an explicit ``REFACTOR_MERGE_RUN_L4`` opt-in) so the
+    fast inner loop stays cheap (R24 Phase 2).
+    """
+    settings = resolve_merge_gate_settings(
+        dict(getattr(project_config, "settings", {}) or {})
+    )
+    agent_meta = _agent_meta_from_env()
+    changed_files = _detect_changed_files(project_root)
+    changed_count = len(changed_files) if isinstance(changed_files, list) else None
+
+    l4_verdict = None
+    if should_run_l4(settings, agent_authored=bool(agent_meta.get("authored"))):
+        console.print("[dim]merge gate: running real-system (L4) validation...[/dim]")
+        try:
+            l4_verdict = run_l4_adapter(
+                settings,
+                project_root=project_root,
+                run_id=str(getattr(artifact, "run_id", "") or ""),
+                constitution_hash=str(getattr(artifact, "constitution_hash", "") or ""),
+                changed_files=changed_files or [],
+            )
+        except Exception as exc:  # adapter must never crash the run
+            l4_verdict = {"status": "error", "reason_code": f"l4_adapter_error: {exc}"[:200]}
+
+    contract = build_merge_contract(
+        gate=artifact.gate.model_dump(),
+        compliance_summary=dict(getattr(artifact, "compliance_summary", {}) or {}),
+        security_summary=dict(getattr(artifact, "security_summary", {}) or {}),
+        settings=settings,
+        constitution_hash=str(getattr(artifact, "constitution_hash", "") or ""),
+        agent_meta=agent_meta,
+        l4_verdict=l4_verdict,
+        changed_files_count=changed_count,
+    )
+    artifact.merge_contract = contract
+
+
 def _report_framework_suppressions(
     suppressions: list[RequestSuppression], *, artifact: RunArtifact | None = None
 ) -> None:
@@ -3002,6 +3133,11 @@ def check(
         "--compliance-gate",
         help="Also enforce latest run compliance gate status (for CI/PR pipelines).",
     ),
+    merge_gate: bool = typer.Option(
+        False,
+        "--merge-gate",
+        help="Also enforce the latest run merge contract result (for CI/PR pipelines).",
+    ),
 ) -> None:
     """Check the constitution for committed secrets (developer/provider keys)."""
     files = find_project_files()
@@ -3013,6 +3149,7 @@ def check(
     config = load_config(config_path)
     findings = raw_secret_matches(constitution) + raw_secret_matches_config(config)
     compliance_failed = False
+    merge_failed = False
     if compliance_gate:
         run_dir = head_run_dir(consti_path.parent)
         if run_dir is None:
@@ -3031,6 +3168,29 @@ def check(
                 )
             else:
                 console.print("[green]Compliance gate[/green]: passed")
+    if merge_gate:
+        run_dir = head_run_dir(consti_path.parent)
+        if run_dir is None:
+            console.print("[yellow]Merge gate check skipped:[/yellow] no runs yet.")
+        else:
+            report = read_report(run_dir) or {}
+            contract = report.get("merge_contract", {}) if isinstance(report, dict) else {}
+            result = merge_contract_result(contract)
+            if result == "blocked":
+                merge_failed = True
+                reasons = contract.get("blocking_reasons") or ["merge_contract_blocked"]
+                console.print(
+                    "[red]Merge gate blocked[/red] "
+                    f"(profile={contract.get('profile', 'unknown')}): "
+                    + ", ".join(str(r) for r in reasons)
+                )
+            elif result == "passed":
+                console.print(
+                    f"[green]Merge gate[/green]: passed "
+                    f"(profile={contract.get('profile', 'unknown')})"
+                )
+            else:
+                console.print("[yellow]Merge gate[/yellow]: no contract in latest run.")
     if findings:
         kinds = ", ".join(sorted({kind for kind, _ in findings}))
         console.print(
@@ -3038,11 +3198,99 @@ def check(
             f"{consti_path} or {config_path}. Replace secrets with `${{ENV_VAR}}` references."
         )
         raise typer.Exit(code=1 if strict else 0)
-    if compliance_failed:
+    if compliance_failed or merge_failed:
         raise typer.Exit(code=1 if strict else 0)
     console.print("[green]OK[/green]: no committed secret-like literals detected.")
 
 
+def gate() -> None:
+    """Show the resolved merge contract for the latest run (R24, read-only)."""
+    _require_auth()
+    project_root, _constitution, project_config = _load_project()
+    settings = resolve_merge_gate_settings(
+        dict(getattr(project_config, "settings", {}) or {})
+    )
+    console.print("[bold]Merge gate[/bold]")
+    console.print(
+        f"  profile: {settings.profile}  "
+        f"security_threshold={settings.security_threshold}  "
+        f"require_compliance_pass={settings.require_compliance_pass}  "
+        f"l4_adapter={settings.real_system_adapter}"
+    )
+
+    run_dir = head_run_dir(project_root)
+    report = read_report(run_dir) if run_dir else {}
+    contract = (
+        dict((report or {}).get("merge_contract", {}) or {})
+        if isinstance(report, dict)
+        else {}
+    )
+    if not contract:
+        console.print(
+            "[yellow]No merge contract in the latest run.[/yellow] "
+            "Run `refactor review` to produce one."
+        )
+        return
+
+    layers = contract.get("layers", {}) if isinstance(contract.get("layers"), dict) else {}
+    table = Table(title="Layers of confidence", show_lines=False)
+    table.add_column("layer", no_wrap=True)
+    table.add_column("enforcement", no_wrap=True)
+    table.add_column("status", no_wrap=True)
+    table.add_column("reason", no_wrap=True)
+    for layer_id in ("well_formed", "internally_correct", "boundary_compatible", "system_correct"):
+        entry = layers.get(layer_id, {}) if isinstance(layers.get(layer_id), dict) else {}
+        code = str(entry.get("code", "")) or layer_id
+        table.add_row(
+            f"{code} {layer_id}",
+            str(entry.get("class", "off")),
+            str(entry.get("status", "unknown")),
+            str(entry.get("reason_code", "") or "-"),
+        )
+    console.print(table)
+
+    # Real-system (L4) verdict details, when the adapter ran.
+    l4 = layers.get("system_correct", {}) if isinstance(layers.get("system_correct"), dict) else {}
+    nf = l4.get("non_functional", {}) if isinstance(l4.get("non_functional"), dict) else {}
+    if l4.get("status") in {"passed", "failed", "error"} or nf.get("within_budget") is not None:
+        parts = [f"status={l4.get('status', 'unknown')}"]
+        if nf.get("p95_latency_ms") is not None:
+            parts.append(f"p95={nf.get('p95_latency_ms')}ms")
+        if nf.get("error_rate_pct") is not None:
+            parts.append(f"error_rate={nf.get('error_rate_pct')}%")
+        if nf.get("within_budget") is not None:
+            parts.append(f"within_budget={nf.get('within_budget')}")
+        console.print("  L4 real-system: " + " ".join(parts))
+        evidence = str(l4.get("evidence_url", "") or "")
+        if evidence:
+            console.print(f"    evidence: {evidence}")
+
+    agent = contract.get("agent", {}) if isinstance(contract.get("agent"), dict) else {}
+    if agent.get("authored"):
+        console.print(
+            f"  agent: authored=true risk_tier={agent.get('risk_tier', '') or 'unknown'} "
+            f"require_l4={agent.get('require_l4', False)}"
+        )
+    changed = contract.get("changed_files_count")
+    if isinstance(changed, int):
+        console.print(f"  changed_files={changed}")
+
+    result = merge_contract_result(contract)
+    result_color = "green" if result == "passed" else ("red" if result == "blocked" else "yellow")
+    console.print(
+        f"  quality_gate={contract.get('quality_gate', 'unknown')}  "
+        f"compliance={contract.get('compliance', 'unknown')}  "
+        f"security_findings={int((contract.get('security', {}) or {}).get('normalized_count', 0) or 0)}"
+    )
+    console.print(f"  result: [{result_color}]{result}[/{result_color}]")
+    reasons = contract.get("blocking_reasons") or []
+    if reasons:
+        console.print("  blocking_reasons: " + ", ".join(str(r) for r in reasons))
+    consti_hash = str(contract.get("constitution_hash", "") or "")
+    if consti_hash:
+        console.print(f"  [dim]constitution_hash={consti_hash}[/dim]")
+
+
 def _mask_secret(value: str) -> str:
     value = value.strip()
     if len(value) <= 8:
@@ -3484,7 +3732,7 @@ def _report_structural_readiness(project_root: Path, config) -> None:
     if not isinstance(structural, dict):
         structural = {}
     eq_mode = str(structural.get("equivalence_mode", "strict") or "strict")
-    rr_policy = str(structural.get("on_rr_failure", "stop") or "stop")
+    rr_policy = str(structural.get("on_rr_failure", "continue") or "continue")
     rewrite_mode = str(structural.get("reference_rewrite", "auto") or "auto")
     langs = structural.get("languages", [])
     rollout = str(structural.get("rollout", "default") or "default")

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/commands/runtime_proxy_cmds.py

@@ -219,3 +219,10 @@ def config(ctx: typer.Context) -> None:
 def compliance(ctx: typer.Context) -> None:
     """Inspect compliance packs/coverage via proprietary runtime."""
     _exec_runtime("compliance", list(ctx.args))
+
+
+def gate(ctx: typer.Context) -> None:
+    """Show the latest run's merge contract (read-only; handled locally)."""
+    # The merge contract is read from the local run report and needs no
+    # proprietary runtime, so it is handled locally for every execution mode.
+    _delegate_to_run_cmds("gate", list(ctx.args))

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli/main.py

@@ -2,10 +2,14 @@
 
 from __future__ import annotations
 
+import os
+import sys
+
 import typer
 
 from refactorai_cli import __version__
 from refactorai_cli.commands import (
+    account_cmds,
     auth_cmds,
     cloud_cmds,
     engine_cmds,
@@ -23,6 +27,43 @@ app = typer.Typer(
 )
 
 
+_INTRO_COMMANDS = {"setup", "doctor", "review", "code"}
+_TIP_BY_COMMAND = {
+    "setup": "Next: refactor doctor",
+    "doctor": "Next: refactor review .",
+    "review": "Next: refactor code . --apply",
+    "code": "Next: refactor review .",
+}
+_TITLE_BY_COMMAND = {
+    "setup": "Refactor Setup Agent",
+    "doctor": "Refactor Doctor Agent",
+    "review": "Refactor Review Agent",
+    "code": "Refactor Code Agent",
+}
+
+
+def _print_agent_intro(command_name: str) -> None:
+    # Keep this lightweight and TTY-only so scripts/non-interactive usage are unchanged.
+    if not sys.stdout.isatty():
+        return
+    title = _TITLE_BY_COMMAND.get(command_name, "Refactor Agent")
+    tip = _TIP_BY_COMMAND.get(command_name, "Next: refactor review .")
+    green_bold = "\033[1;38;5;46m"
+    green_soft = "\033[38;5;120m"
+    green_art = "\033[38;5;82m"
+    reset = "\033[0m"
+    typer.echo("")
+    typer.echo(f"{green_bold}{title}{reset}")
+    typer.echo(f"{green_soft}Model: Sonnet 4.5{reset}")
+    typer.echo(f"Welcome back, {os.environ.get('USER', 'developer')}")
+    typer.echo("")
+    typer.echo(f"{green_art}      *  [■ ■]  *{reset}")
+    typer.echo(f"{green_art}      *   \\_/   *{reset}")
+    typer.echo("")
+    typer.echo(f"{green_bold}Tip:{reset} {tip}")
+    typer.echo("")
+
+
 def _version_callback(value: bool) -> None:
     if value:
         typer.echo(f"refactor {__version__}")
@@ -31,6 +72,7 @@ def _version_callback(value: bool) -> None:
 
 @app.callback()
 def main(
+    ctx: typer.Context,
     version: bool = typer.Option(
         False,
         "--version",
@@ -41,11 +83,15 @@ def main(
     ),
 ) -> None:
     """refactor CLI."""
+    command_name = (ctx.invoked_subcommand or "").strip().lower()
+    if command_name in _INTRO_COMMANDS:
+        _print_agent_intro(command_name)
 
 
 # Auth (R7.1)
 app.command()(auth_cmds.login)
 app.command()(auth_cmds.whoami)
+app.add_typer(account_cmds.app, name="account")
 
 # Project / run surface (proxied to activated runtime artifact)
 _RUNTIME_CTX = {"allow_extra_args": True, "ignore_unknown_options": True}
@@ -65,6 +111,7 @@ app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.check)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.doctor)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.config)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.compliance)
+app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.gate)
 
 app.command()(setup_cmds.setup)
 

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.3
+Version: 0.3.5
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.3
+Requires-Dist: refactorai-core>=3.0.4
 
 # refactorai-cli
 
@@ -54,7 +54,7 @@ python -m twine upload ./refactorai-cli/dist/*
 ## Install test (local)
 
 ```bash
-python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.3-py3-none-any.whl
+python -m pip install ./refactorai-cli/dist/refactorai_cli-0.3.4-py3-none-any.whl
 refactor --version
 ```
 

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ refactorai_cli.egg-info/entry_points.txt
 refactorai_cli.egg-info/requires.txt
 refactorai_cli.egg-info/top_level.txt
 refactorai_cli/commands/__init__.py
+refactorai_cli/commands/account_cmds.py
 refactorai_cli/commands/auth_cmds.py
 refactorai_cli/commands/cloud_cmds.py
 refactorai_cli/commands/engine_cmds.py

{refactorai_cli-0.3.3 → refactorai_cli-0.3.5}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.0.3
+refactorai-core>=3.0.4