refactorai-cli 0.3.4__tar.gz → 0.3.8__tar.gz

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.4
+Version: 0.3.8
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.4
+Requires-Dist: refactorai-core>=3.0.5
 
 # refactorai-cli
 

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.3.4"
+version = "0.3.8"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.0.4",
+  "refactorai-core>=3.0.5",
 ]
 
 [project.scripts]

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.3.4"
+__version__ = "0.3.8"

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/client.py

@@ -44,3 +44,21 @@ class PlatformClient:
                 f"Key validation failed ({response.status_code})", status_code=response.status_code
             )
         return response.json()
+
+    def list_key_accounts(self, developer_key: str) -> list[dict]:
+        try:
+            response = httpx.get(
+                f"{self.base_url}/v1/keys/accounts",
+                headers={"Authorization": f"Bearer {developer_key}"},
+                timeout=self.timeout,
+            )
+        except httpx.HTTPError as exc:
+            raise PlatformError(f"Could not reach platform at {self.base_url}: {exc}") from exc
+        if response.status_code == 401:
+            raise PlatformError("Developer key is invalid or revoked", status_code=401)
+        if response.status_code >= 400:
+            raise PlatformError(
+                f"Account discovery failed ({response.status_code})", status_code=response.status_code
+            )
+        payload = response.json()
+        return payload if isinstance(payload, list) else []

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/cloud_rr.py

@@ -51,7 +51,12 @@ from refactor_core.refactor_requests import (
     save_request,
 )
 from refactor_core.store import create_run
-from refactor_core.testcmd import _SKIP_DIRS, discover_test_command, resolve_test_command
+from refactor_core.testcmd import (
+    _SKIP_DIRS,
+    _configured_command,
+    discover_test_command,
+    resolve_test_command,
+)
 
 from refactorai_cli.auth import ensure_authenticated
 from refactorai_cli.settings import platform_url
@@ -257,18 +262,47 @@ def _resolve_cloud_test_command(
     """Resolve a test command for a cloud run; return ``(command, note)``.
 
     Layered resolution so the developer usually needs no config:
-    1. configured ``verification.tests.command`` or root-marker detection,
-    2. deterministic monorepo discovery (subproject test setups),
-    3. agentic discovery (server infers from manifests), preflight-validated.
+    1. configured ``verification.tests.command`` (explicit developer intent),
+    2. root-marker detection / deterministic monorepo discovery (subproject
+       test setups),
+    3. agentic discovery (server infers from manifests).
+
+    Cloud runs execute tests on the HOST (no sandbox), so every candidate is
+    preflight-validated against the host ``PATH`` before it is committed to. An
+    explicitly *configured* command is honored even when preflight fails (the
+    developer may know something we don't, e.g. a shell-resolved binary), but the
+    mismatch is surfaced as a note. Marker/monorepo-*detected* commands that fail
+    preflight are NOT returned: resolution falls through to server discovery so a
+    runnable alternative can be suggested instead of locking in an un-runnable
+    command (e.g. ``npm test`` when ``npm`` is not installed on the host).
     """
-    configured = resolve_test_command(project_root, config)
+    # 1) Explicitly configured command: honor developer intent, but warn if the
+    #    toolchain is not visible on the host PATH.
+    configured = _configured_command(config)
     if configured:
-        return configured, ""
+        if _client_preflight_command(project_root, configured):
+            return configured, ""
+        return configured, (
+            f"configured test command '{configured}' was not found on the host PATH; "
+            "cloud runs execute tests on the host, so it may fail. Install the "
+            "toolchain or update verification.tests.command."
+        )
 
-    discovered = discover_test_command(project_root)
-    if discovered:
-        return discovered, f"auto-detected test command: {discovered}"
+    # 2) Root-marker / monorepo detection: only usable if runnable on the host.
+    detected = resolve_test_command(project_root, config) or discover_test_command(project_root)
+    if detected:
+        if _client_preflight_command(project_root, detected):
+            return detected, f"auto-detected test command: {detected}"
+        # Detected but not runnable on the host -> fall through to server
+        # discovery rather than committing to an un-runnable command.
+        detected_note = (
+            f"auto-detected test command '{detected}' but its toolchain was not "
+            "found on the host PATH; trying server discovery."
+        )
+    else:
+        detected_note = ""
 
+    # 3) Server-assisted discovery, preflight-validated.
     suggested = _discover_test_command_via_cloud(
         project_root=project_root,
         constitution=constitution,
@@ -280,11 +314,12 @@ def _resolve_cloud_test_command(
     if suggested and _client_preflight_command(project_root, suggested):
         return suggested, f"server-suggested test command: {suggested}"
     if suggested:
-        return None, (
+        note = (
             f"server suggested test command '{suggested}' but its toolchain was not "
-            "found on PATH; skipped."
+            "found on the host PATH; skipped."
         )
-    return None, ""
+        return None, f"{detected_note} {note}".strip() if detected_note else note
+    return None, detected_note
 
 
 class _Session:

refactorai_cli-0.3.8/refactorai_cli/commands/account_cmds.py

@@ -0,0 +1,76 @@
+"""`refactor account` commands for account context selection."""
+
+from __future__ import annotations
+
+import typer
+from rich.console import Console
+from rich.table import Table
+
+from refactorai_cli.auth import AuthError, ensure_authenticated
+from refactorai_cli.client import PlatformClient, PlatformError
+from refactorai_cli.credentials import load_credentials, save_credentials
+
+console = Console()
+app = typer.Typer(
+    name="account",
+    help="List and switch account context for the current developer key.",
+    no_args_is_help=True,
+    add_completion=False,
+)
+
+
+def _discover_accounts() -> tuple[list[dict], dict]:
+    try:
+        auth_ctx = ensure_authenticated(force_remote=True)
+    except AuthError as exc:
+        console.print(f"[red]Not authenticated:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    client = PlatformClient()
+    try:
+        rows = client.list_key_accounts(auth_ctx.key.key)
+    except PlatformError as exc:
+        console.print(f"[red]Could not load accounts:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+    return rows, load_credentials()
+
+
+@app.command("list")
+def account_list() -> None:
+    rows, creds = _discover_accounts()
+    active_slug = str(creds.get("active_account_slug") or "")
+    if not rows:
+        console.print("[dim]No accounts available for this key.[/dim]")
+        return
+    table = Table(title="Accounts")
+    table.add_column("current")
+    table.add_column("slug")
+    table.add_column("name")
+    table.add_column("type")
+    table.add_column("role")
+    for row in rows:
+        slug = str(row.get("slug") or "")
+        table.add_row("*" if slug and slug == active_slug else "", slug, str(row.get("display_name") or ""), str(row.get("type") or ""), str(row.get("role") or ""))
+    console.print(table)
+
+
+@app.command("use")
+def account_use(
+    slug: str = typer.Argument(..., help="Account slug to set active."),
+) -> None:
+    rows, creds = _discover_accounts()
+    selected = next((row for row in rows if str(row.get("slug") or "").lower() == slug.lower()), None)
+    if selected is None:
+        console.print(f"[red]Account not available for this key:[/red] {slug}")
+        raise typer.Exit(code=1)
+    creds["active_account_id"] = selected.get("id")
+    creds["active_account_slug"] = selected.get("slug")
+    save_credentials(creds)
+    console.print(f"[green]Active account set:[/green] {selected.get('slug')} ({selected.get('display_name')})")
+
+
+@app.command("current")
+def account_current() -> None:
+    creds = load_credentials()
+    slug = creds.get("active_account_slug") or "<unset>"
+    account_id = creds.get("active_account_id") or "<unset>"
+    console.print(f"[bold]active_account_slug[/bold]: {slug}\n[bold]active_account_id[/bold]: {account_id}")

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/commands/auth_cmds.py

@@ -43,6 +43,8 @@ def login(
         {
             "developer_key": developer_key,
             "account_id": payload.get("account_id"),
+            "active_account_id": payload.get("account_id"),
+            "active_account_slug": payload.get("account_slug"),
             "platform_url": platform_url(),
             "masked_key": mask_key(developer_key),
         }
@@ -80,6 +82,7 @@ def whoami() -> None:
     suffix = " (cached)" if ctx.cached else ""
     console.print(
         f"[bold]account[/bold]: {ctx.account_id}\n"
+        f"[bold]active_account_slug[/bold]: {load_credentials().get('active_account_slug') or 'unknown'}\n"
         f"[bold]key[/bold]: {mask_key(ctx.key.key)} (source: {source})\n"
         f"[bold]quota_remaining[/bold]: {quota}{suffix}"
     )

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/commands/run_cmds.py

@@ -53,6 +53,13 @@ from refactor_core.apply import (
 from refactor_core.budgeting import compute_budget
 from refactor_core.capabilities import resolve_capabilities
 from refactor_core.gate import evaluate_gate
+from refactor_core.merge_gate import (
+    build_merge_contract,
+    merge_contract_result,
+    resolve_merge_gate_settings,
+    run_l4_adapter,
+    should_run_l4,
+)
 from refactor_core.refactor_requests import (
     DEFERRED,
     RequestSuppression,
@@ -68,7 +75,11 @@ from refactor_core.refactor_ops import remediation_hint
 from refactor_core.indexing import index_target
 from refactor_core.models import Finding, GeneratedTest, PatchGroup, RunArtifact
 from refactor_core.rules import annotate_documents_with_rules, filter_documents_by_rules
-from refactor_core.security import merge_refactor_findings, suppress_findings_for_rr
+from refactor_core.security import (
+    compute_semgrep_security_summary,
+    merge_refactor_findings,
+    suppress_findings_for_rr,
+)
 from refactor_core.security.semgrep_runner import EMBEDDED_SEMGREP_SENTINEL
 from refactor_core.security.suppression import SecuritySuppression
 from refactor_core.store import (
@@ -635,7 +646,8 @@ def _cloud_inference(
     model_hint: str | None = None,
     findings: list | None = None,
 ) -> RunArtifact:
-    max_alerts = int(constitution.get_setting("max_alerts_per_run", 5) or 5)
+    _raw_alerts = constitution.get_setting("max_alerts_per_run", 5)
+    max_alerts = int(_raw_alerts if _raw_alerts is not None else 5)
     gate_mode = str(constitution.get_setting("gate_mode", "strict") or "strict")
     excludes = set(constitution.get_setting("exclude", []) or [])
     documents = index_target(Path(project_root), target, excludes=excludes)
@@ -709,13 +721,40 @@ def _cloud_inference(
         raise RuntimeError(f"Cloud inference failed ({response.status_code}): {response.text[:500]}")
 
     data = response.json() if response.content else {}
-    findings = [Finding.model_validate(item) for item in (data.get("findings") or [])][:max_alerts]
-    patches = [PatchGroup.model_validate(item) for item in (data.get("patches") or [])][:max_alerts]
+    _no_cap = max_alerts <= 0
+    findings = [Finding.model_validate(item) for item in (data.get("findings") or [])]
+    patches = [PatchGroup.model_validate(item) for item in (data.get("patches") or [])]
     generated_tests = [
         GeneratedTest.model_validate(item) for item in (data.get("generated_tests") or [])
-    ][:max_alerts]
+    ]
+    if not _no_cap:
+        findings = findings[:max_alerts]
+        patches = patches[:max_alerts]
+        generated_tests = generated_tests[:max_alerts]
     gate = evaluate_gate(findings, [], mode=gate_mode)
 
+    # Optional security-scan enrichment (R19). Semgrep is an additive signal and
+    # strictly fail-open: it never blocks the core cloud run and the gate stays
+    # driven by model findings only. Prefer the server-side baseline (Phase 2)
+    # when the platform ran it; otherwise fall back to a client-side scan against
+    # the local checkout (Phase 1) so parity holds against older backends.
+    security_summary: dict = {}
+    security_notes: list[str] = []
+    server_summary = data.get("security_summary")
+    if isinstance(server_summary, dict) and server_summary.get("enabled"):
+        security_summary = server_summary
+    else:
+        try:
+            security_summary, security_notes = compute_semgrep_security_summary(
+                project_root=Path(project_root),
+                constitution=constitution,
+                target=target,
+                base_findings=findings,
+            )
+        except Exception as exc:  # optional feature must never fail the cloud run
+            security_summary = {}
+            security_notes = [f"Security baseline scan skipped (unexpected error): {exc}"]
+
     run_id = uuid.uuid4().hex[:12]
     if stage == "review":
         summary = (
@@ -736,9 +775,11 @@ def _cloud_inference(
         summary=summary,
         constitution_hash=constitution.content_hash,
         model_id=str(data.get("model_id") or payload["model_hint"]),
+        notes=security_notes,
         rule_source=rule_meta.get("rule_source", ""),
         rule_pattern=rule_meta.get("rule_pattern", ""),
         rule_hash=rule_meta.get("rule_hash", ""),
+        security_summary=security_summary,
     )
 
 
@@ -1893,6 +1934,7 @@ def review(
         artifact=artifact,
     )
     _apply_compliance_gate_to_artifact(artifact)
+    _apply_merge_contract_to_artifact(artifact, project_root, project_config)
     run_store.write_artifact(artifact, target=target, status="completed")
     if compliance_frameworks:
         summary = dict(getattr(artifact, "compliance_summary", {}) or {})
@@ -2109,6 +2151,7 @@ def code(
                 artifact=review_artifact,
             )
             _apply_compliance_gate_to_artifact(review_artifact)
+            _apply_merge_contract_to_artifact(review_artifact, project_root, project_config)
             if compliance_frameworks:
                 summary = dict(getattr(review_artifact, "compliance_summary", {}) or {})
                 console.print(
@@ -2685,6 +2728,94 @@ def _apply_compliance_gate_to_artifact(artifact: RunArtifact) -> None:
     artifact.gate.blocking_reasons["reasons"] = reasons
 
 
+def _detect_changed_files(project_root: Path) -> list[str] | None:
+    """Best-effort list of changed files via git (staged + unstaged + untracked).
+
+    Returns ``None`` when git is unavailable or the path is not a repo, so the
+    change-size guardrail degrades to "unknown" rather than a false value.
+    """
+    try:
+        proc = subprocess.run(
+            ["git", "status", "--porcelain"],
+            cwd=str(project_root),
+            capture_output=True,
+            text=True,
+            timeout=15,
+            check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0:
+        return None
+    files: list[str] = []
+    for line in (proc.stdout or "").splitlines():
+        name = line[3:].strip() if len(line) > 3 else line.strip()
+        if " -> " in name:  # rename: take the destination path
+            name = name.split(" -> ", 1)[1].strip()
+        if name:
+            files.append(name)
+    return files
+
+
+def _agent_meta_from_env() -> dict:
+    """Resolve agent-authorship metadata from the environment (CI-friendly)."""
+    authored = os.environ.get("REFACTOR_AGENT_AUTHORED", "").strip().lower() in {
+        "1",
+        "true",
+        "yes",
+        "on",
+    }
+    risk_tier = os.environ.get("REFACTOR_AGENT_RISK_TIER", "").strip().lower()
+    return {"authored": authored, "risk_tier": risk_tier}
+
+
+def _apply_merge_contract_to_artifact(
+    artifact: RunArtifact, project_root: Path, project_config
+) -> None:
+    """Assemble the R24 merge contract from existing run outcomes.
+
+    Runs identically for every execution mode (local/cloud_managed/cloud_byok):
+    the CLI always assembles the artifact and persists the report locally, so the
+    contract is computed once here from the gate/compliance/security signals.
+
+    The expensive real-system (L4) layer runs only when it is required (strict
+    profile, agent policy, or an explicit ``REFACTOR_MERGE_RUN_L4`` opt-in) so the
+    fast inner loop stays cheap (R24 Phase 2).
+    """
+    settings = resolve_merge_gate_settings(
+        dict(getattr(project_config, "settings", {}) or {})
+    )
+    agent_meta = _agent_meta_from_env()
+    changed_files = _detect_changed_files(project_root)
+    changed_count = len(changed_files) if isinstance(changed_files, list) else None
+
+    l4_verdict = None
+    if should_run_l4(settings, agent_authored=bool(agent_meta.get("authored"))):
+        console.print("[dim]merge gate: running real-system (L4) validation...[/dim]")
+        try:
+            l4_verdict = run_l4_adapter(
+                settings,
+                project_root=project_root,
+                run_id=str(getattr(artifact, "run_id", "") or ""),
+                constitution_hash=str(getattr(artifact, "constitution_hash", "") or ""),
+                changed_files=changed_files or [],
+            )
+        except Exception as exc:  # adapter must never crash the run
+            l4_verdict = {"status": "error", "reason_code": f"l4_adapter_error: {exc}"[:200]}
+
+    contract = build_merge_contract(
+        gate=artifact.gate.model_dump(),
+        compliance_summary=dict(getattr(artifact, "compliance_summary", {}) or {}),
+        security_summary=dict(getattr(artifact, "security_summary", {}) or {}),
+        settings=settings,
+        constitution_hash=str(getattr(artifact, "constitution_hash", "") or ""),
+        agent_meta=agent_meta,
+        l4_verdict=l4_verdict,
+        changed_files_count=changed_count,
+    )
+    artifact.merge_contract = contract
+
+
 def _report_framework_suppressions(
     suppressions: list[RequestSuppression], *, artifact: RunArtifact | None = None
 ) -> None:
@@ -3002,6 +3133,11 @@ def check(
         "--compliance-gate",
         help="Also enforce latest run compliance gate status (for CI/PR pipelines).",
     ),
+    merge_gate: bool = typer.Option(
+        False,
+        "--merge-gate",
+        help="Also enforce the latest run merge contract result (for CI/PR pipelines).",
+    ),
 ) -> None:
     """Check the constitution for committed secrets (developer/provider keys)."""
     files = find_project_files()
@@ -3013,6 +3149,7 @@ def check(
     config = load_config(config_path)
     findings = raw_secret_matches(constitution) + raw_secret_matches_config(config)
     compliance_failed = False
+    merge_failed = False
     if compliance_gate:
         run_dir = head_run_dir(consti_path.parent)
         if run_dir is None:
@@ -3031,6 +3168,29 @@ def check(
                 )
             else:
                 console.print("[green]Compliance gate[/green]: passed")
+    if merge_gate:
+        run_dir = head_run_dir(consti_path.parent)
+        if run_dir is None:
+            console.print("[yellow]Merge gate check skipped:[/yellow] no runs yet.")
+        else:
+            report = read_report(run_dir) or {}
+            contract = report.get("merge_contract", {}) if isinstance(report, dict) else {}
+            result = merge_contract_result(contract)
+            if result == "blocked":
+                merge_failed = True
+                reasons = contract.get("blocking_reasons") or ["merge_contract_blocked"]
+                console.print(
+                    "[red]Merge gate blocked[/red] "
+                    f"(profile={contract.get('profile', 'unknown')}): "
+                    + ", ".join(str(r) for r in reasons)
+                )
+            elif result == "passed":
+                console.print(
+                    f"[green]Merge gate[/green]: passed "
+                    f"(profile={contract.get('profile', 'unknown')})"
+                )
+            else:
+                console.print("[yellow]Merge gate[/yellow]: no contract in latest run.")
     if findings:
         kinds = ", ".join(sorted({kind for kind, _ in findings}))
         console.print(
@@ -3038,11 +3198,99 @@ def check(
             f"{consti_path} or {config_path}. Replace secrets with `${{ENV_VAR}}` references."
         )
         raise typer.Exit(code=1 if strict else 0)
-    if compliance_failed:
+    if compliance_failed or merge_failed:
         raise typer.Exit(code=1 if strict else 0)
     console.print("[green]OK[/green]: no committed secret-like literals detected.")
 
 
+def gate() -> None:
+    """Show the resolved merge contract for the latest run (R24, read-only)."""
+    _require_auth()
+    project_root, _constitution, project_config = _load_project()
+    settings = resolve_merge_gate_settings(
+        dict(getattr(project_config, "settings", {}) or {})
+    )
+    console.print("[bold]Merge gate[/bold]")
+    console.print(
+        f"  profile: {settings.profile}  "
+        f"security_threshold={settings.security_threshold}  "
+        f"require_compliance_pass={settings.require_compliance_pass}  "
+        f"l4_adapter={settings.real_system_adapter}"
+    )
+
+    run_dir = head_run_dir(project_root)
+    report = read_report(run_dir) if run_dir else {}
+    contract = (
+        dict((report or {}).get("merge_contract", {}) or {})
+        if isinstance(report, dict)
+        else {}
+    )
+    if not contract:
+        console.print(
+            "[yellow]No merge contract in the latest run.[/yellow] "
+            "Run `refactor review` to produce one."
+        )
+        return
+
+    layers = contract.get("layers", {}) if isinstance(contract.get("layers"), dict) else {}
+    table = Table(title="Layers of confidence", show_lines=False)
+    table.add_column("layer", no_wrap=True)
+    table.add_column("enforcement", no_wrap=True)
+    table.add_column("status", no_wrap=True)
+    table.add_column("reason", no_wrap=True)
+    for layer_id in ("well_formed", "internally_correct", "boundary_compatible", "system_correct"):
+        entry = layers.get(layer_id, {}) if isinstance(layers.get(layer_id), dict) else {}
+        code = str(entry.get("code", "")) or layer_id
+        table.add_row(
+            f"{code} {layer_id}",
+            str(entry.get("class", "off")),
+            str(entry.get("status", "unknown")),
+            str(entry.get("reason_code", "") or "-"),
+        )
+    console.print(table)
+
+    # Real-system (L4) verdict details, when the adapter ran.
+    l4 = layers.get("system_correct", {}) if isinstance(layers.get("system_correct"), dict) else {}
+    nf = l4.get("non_functional", {}) if isinstance(l4.get("non_functional"), dict) else {}
+    if l4.get("status") in {"passed", "failed", "error"} or nf.get("within_budget") is not None:
+        parts = [f"status={l4.get('status', 'unknown')}"]
+        if nf.get("p95_latency_ms") is not None:
+            parts.append(f"p95={nf.get('p95_latency_ms')}ms")
+        if nf.get("error_rate_pct") is not None:
+            parts.append(f"error_rate={nf.get('error_rate_pct')}%")
+        if nf.get("within_budget") is not None:
+            parts.append(f"within_budget={nf.get('within_budget')}")
+        console.print("  L4 real-system: " + " ".join(parts))
+        evidence = str(l4.get("evidence_url", "") or "")
+        if evidence:
+            console.print(f"    evidence: {evidence}")
+
+    agent = contract.get("agent", {}) if isinstance(contract.get("agent"), dict) else {}
+    if agent.get("authored"):
+        console.print(
+            f"  agent: authored=true risk_tier={agent.get('risk_tier', '') or 'unknown'} "
+            f"require_l4={agent.get('require_l4', False)}"
+        )
+    changed = contract.get("changed_files_count")
+    if isinstance(changed, int):
+        console.print(f"  changed_files={changed}")
+
+    result = merge_contract_result(contract)
+    result_color = "green" if result == "passed" else ("red" if result == "blocked" else "yellow")
+    console.print(
+        f"  quality_gate={contract.get('quality_gate', 'unknown')}  "
+        f"compliance={contract.get('compliance', 'unknown')}  "
+        f"security_findings={int((contract.get('security', {}) or {}).get('normalized_count', 0) or 0)}"
+    )
+    console.print(f"  result: [{result_color}]{result}[/{result_color}]")
+    reasons = contract.get("blocking_reasons") or []
+    if reasons:
+        console.print("  blocking_reasons: " + ", ".join(str(r) for r in reasons))
+    consti_hash = str(contract.get("constitution_hash", "") or "")
+    if consti_hash:
+        console.print(f"  [dim]constitution_hash={consti_hash}[/dim]")
+
+
 def _mask_secret(value: str) -> str:
     value = value.strip()
     if len(value) <= 8:

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/commands/runtime_proxy_cmds.py

@@ -75,7 +75,17 @@ def _delegate_to_run_cmds(command_name: str, passthrough_args: list[str]) -> Non
     real command signature (options, arguments, help) is honored without manual
     argument parsing. Exit codes propagate to the caller.
     """
-    from refactorai_cli.commands import run_cmds
+    try:
+        from refactorai_cli.commands import run_cmds
+    except ModuleNotFoundError as exc:
+        if exc.name == "refactor_core.merge_gate":
+            console.print(
+                "[red]Installed refactor core is too old for this CLI.[/red]\n"
+                "Please upgrade both packages:\n"
+                "  pip install --upgrade refactorai-core refactorai-cli"
+            )
+            raise typer.Exit(code=1) from exc
+        raise
 
     func = getattr(run_cmds, command_name, None)
     if func is None:  # pragma: no cover - defensive; all cloud verbs exist
@@ -219,3 +229,10 @@ def config(ctx: typer.Context) -> None:
 def compliance(ctx: typer.Context) -> None:
     """Inspect compliance packs/coverage via proprietary runtime."""
     _exec_runtime("compliance", list(ctx.args))
+
+
+def gate(ctx: typer.Context) -> None:
+    """Show the latest run's merge contract (read-only; handled locally)."""
+    # The merge contract is read from the local run report and needs no
+    # proprietary runtime, so it is handled locally for every execution mode.
+    _delegate_to_run_cmds("gate", list(ctx.args))

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli/main.py

@@ -2,10 +2,14 @@
 
 from __future__ import annotations
 
+import os
+import sys
+
 import typer
 
 from refactorai_cli import __version__
 from refactorai_cli.commands import (
+    account_cmds,
     auth_cmds,
     cloud_cmds,
     engine_cmds,
@@ -23,6 +27,50 @@ app = typer.Typer(
 )
 
 
+_INTRO_COMMANDS = {"setup", "doctor", "review", "code"}
+_TIP_BY_COMMAND = {
+    "setup": "Next: refactor doctor",
+    "doctor": "Next: refactor review .",
+    "review": "Next: refactor code . --apply",
+    "code": "Next: refactor review .",
+}
+_TITLE_BY_COMMAND = {
+    "setup": "Refactor Setup Agent",
+    "doctor": "Refactor Doctor Agent",
+    "review": "Refactor Review Agent",
+    "code": "Refactor Code Agent",
+}
+_COLOR_BY_COMMAND = {
+    "setup": ("245", "250", "247"),   # base, soft, art
+    "doctor": ("39", "117", "81"),
+    "review": ("214", "222", "220"),
+    "code": ("46", "120", "82"),
+}
+
+
+def _print_agent_intro(command_name: str) -> None:
+    # Keep this lightweight and TTY-only so scripts/non-interactive usage are unchanged.
+    if not sys.stdout.isatty():
+        return
+    title = _TITLE_BY_COMMAND.get(command_name, "Refactor Agent")
+    tip = _TIP_BY_COMMAND.get(command_name, "Next: refactor review .")
+    base, soft, art = _COLOR_BY_COMMAND.get(command_name, ("46", "120", "82"))
+    color_bold = f"\033[1;38;5;{base}m"
+    color_soft = f"\033[38;5;{soft}m"
+    color_art = f"\033[38;5;{art}m"
+    reset = "\033[0m"
+    typer.echo("")
+    typer.echo(f"{color_bold}{title}{reset}")
+    typer.echo(f"{color_soft}Model: Sonnet 4.5{reset}")
+    typer.echo(f"Welcome back, {os.environ.get('USER', 'developer')}")
+    typer.echo("")
+    typer.echo(f"{color_art}      *  [■ ■]  *{reset}")
+    typer.echo(f"{color_art}      *   \\_/   *{reset}")
+    typer.echo("")
+    typer.echo(f"{color_bold}Tip:{reset} {tip}")
+    typer.echo("")
+
+
 def _version_callback(value: bool) -> None:
     if value:
         typer.echo(f"refactor {__version__}")
@@ -31,6 +79,7 @@ def _version_callback(value: bool) -> None:
 
 @app.callback()
 def main(
+    ctx: typer.Context,
     version: bool = typer.Option(
         False,
         "--version",
@@ -41,11 +90,15 @@ def main(
     ),
 ) -> None:
     """refactor CLI."""
+    command_name = (ctx.invoked_subcommand or "").strip().lower()
+    if command_name in _INTRO_COMMANDS:
+        _print_agent_intro(command_name)
 
 
 # Auth (R7.1)
 app.command()(auth_cmds.login)
 app.command()(auth_cmds.whoami)
+app.add_typer(account_cmds.app, name="account")
 
 # Project / run surface (proxied to activated runtime artifact)
 _RUNTIME_CTX = {"allow_extra_args": True, "ignore_unknown_options": True}
@@ -65,6 +118,7 @@ app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.check)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.doctor)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.config)
 app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.compliance)
+app.command(context_settings=_RUNTIME_CTX)(runtime_proxy_cmds.gate)
 
 app.command()(setup_cmds.setup)
 

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.3.4
+Version: 0.3.8
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.0.4
+Requires-Dist: refactorai-core>=3.0.5
 
 # refactorai-cli
 

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ refactorai_cli.egg-info/entry_points.txt
 refactorai_cli.egg-info/requires.txt
 refactorai_cli.egg-info/top_level.txt
 refactorai_cli/commands/__init__.py
+refactorai_cli/commands/account_cmds.py
 refactorai_cli/commands/auth_cmds.py
 refactorai_cli/commands/cloud_cmds.py
 refactorai_cli/commands/engine_cmds.py

{refactorai_cli-0.3.4 → refactorai_cli-0.3.8}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.0.4
+refactorai-core>=3.0.5