refactorai-cli 0.5.9__tar.gz → 0.7.0__tar.gz

{refactorai_cli-0.5.9 → refactorai_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.5.9
+Version: 0.7.0
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{refactorai_cli-0.5.9 → refactorai_cli-0.7.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.5.9"
+version = "0.7.0"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"

{refactorai_cli-0.5.9 → refactorai_cli-0.7.0}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.5.9"
+__version__ = "0.7.0"

{refactorai_cli-0.5.9 → refactorai_cli-0.7.0}/refactorai_cli/cloud_rr.py

@@ -25,6 +25,7 @@ from __future__ import annotations
 from collections import deque
 import contextlib
 import hashlib
+import json
 import os
 import re
 import shlex
@@ -55,7 +56,7 @@ from refactor_core.refactor_requests import (
     save_request,
 )
 from refactor_core.host_toolchain import provision_for_command
-from refactor_core.store import create_run
+from refactor_core.store import create_run, resolve_store_dir
 from refactor_core.testcmd import (
     _SKIP_DIRS,
     _configured_command,
@@ -67,6 +68,13 @@ from refactorai_cli.auth import ensure_authenticated
 from refactorai_cli.settings import platform_url
 
 _ENV_ASSIGN_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=.*$")
+_WORKSPACE_DIRNAME = "workspace"
+_WORKSPACE_NAME = "host"
+_WORKSPACE_CACHE_DIRNAME = "cache"
+# Directory names never mirrored into (or pruned from) the managed workspace:
+# git metadata, the central store, and heavy dependency dirs that are restored
+# in-workspace and cached across runs.
+_WORKSPACE_EXCLUDE = {".git", ".refactor", "node_modules"}
 
 # Manifest/config files that reveal how a project runs its tests. Sent (truncated)
 # to the server for agentic test-command discovery when deterministic detection
@@ -104,7 +112,7 @@ def _read_source(project_root: Path, rel: str) -> str:
 
 
 def _run_test(
-    project_root: Path, test_command: str | None, *, env: dict | None = None
+    execution_root: Path, test_command: str | None, *, env: dict | None = None
 ) -> tuple[bool, str]:
     """Run the configured test command on the host; (passed, detail).
 
@@ -126,7 +134,7 @@ def _run_test(
         proc = subprocess.run(
             command,
             shell=True,
-            cwd=str(project_root),
+            cwd=str(execution_root),
             capture_output=True,
             text=True,
             timeout=600,
@@ -140,7 +148,7 @@ def _run_test(
 
 
 def _run_command_with_progress(
-    project_root: Path,
+    execution_root: Path,
     command: str,
     *,
     env: dict | None = None,
@@ -157,7 +165,7 @@ def _run_command_with_progress(
         proc = subprocess.Popen(
             command,
             shell=True,
-            cwd=str(project_root),
+            cwd=str(execution_root),
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             text=True,
@@ -358,6 +366,105 @@ def _managed_toolchain_enabled(config: dict) -> bool:
     return True
 
 
+def _deps_restore_policy(config: dict) -> str:
+    """Return dependency-restore policy: ``auto`` (default), ``always``, ``never``."""
+    verification = (config or {}).get("verification")
+    raw = "auto"
+    if isinstance(verification, dict):
+        raw = str(verification.get("deps_restore_policy", "auto") or "auto")
+    policy = raw.strip().lower()
+    return policy if policy in {"auto", "always", "never"} else "auto"
+
+
+def _sha256_file(path: Path) -> str:
+    """Hash a file's bytes; ``""`` when unreadable/missing."""
+    if not path.is_file():
+        return ""
+    digest = hashlib.sha256()
+    try:
+        with path.open("rb") as fh:
+            for chunk in iter(lambda: fh.read(1024 * 1024), b""):
+                digest.update(chunk)
+    except OSError:
+        return ""
+    return digest.hexdigest()
+
+
+def _read_json(path: Path) -> dict:
+    try:
+        raw = path.read_text(encoding="utf-8")
+    except OSError:
+        return {}
+    try:
+        obj = json.loads(raw)
+    except json.JSONDecodeError:
+        return {}
+    return obj if isinstance(obj, dict) else {}
+
+
+def _write_json_atomic(path: Path, payload: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_name(f"{path.name}.tmp")
+    tmp.write_text(json.dumps(payload, sort_keys=True), encoding="utf-8")
+    tmp.replace(path)
+
+
+def _node_lockfile(project_root: Path) -> Path | None:
+    for name in ("pnpm-lock.yaml", "yarn.lock", "package-lock.json", "npm-shrinkwrap.json"):
+        path = project_root / name
+        if path.is_file():
+            return path
+    return None
+
+
+def _node_install_command(project_root: Path) -> tuple[str, str]:
+    lockfile = _node_lockfile(project_root)
+    if lockfile is None:
+        return "npm", "npm install"
+    if lockfile.name == "pnpm-lock.yaml":
+        return "corepack", "corepack pnpm install --frozen-lockfile"
+    if lockfile.name == "yarn.lock":
+        return "corepack", "corepack yarn install --immutable"
+    return "npm", "npm ci"
+
+
+def _node_deps_state_path(project_root: Path) -> Path:
+    return resolve_store_dir(project_root) / "toolchain-state" / "node-deps.json"
+
+
+def _node_deps_fingerprint(project_root: Path, env: dict, install_command: str) -> tuple[str, dict]:
+    lockfile = _node_lockfile(project_root)
+    node_bin = shutil.which("node", path=(env or {}).get("PATH"))
+    metadata = {
+        "install_command": install_command,
+        "package_json_sha256": _sha256_file(project_root / "package.json"),
+        "lockfile_name": lockfile.name if lockfile else "",
+        "lockfile_sha256": _sha256_file(lockfile) if lockfile else "",
+        # A different binary path often means a different runtime version/build.
+        "node_binary_path": str(Path(node_bin).resolve()) if node_bin else "",
+    }
+    digest = hashlib.sha256(
+        json.dumps(metadata, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).hexdigest()
+    return digest, metadata
+
+
+def _should_restore_node_dependencies(
+    project_root: Path, env: dict, install_command: str
+) -> tuple[bool, str, dict]:
+    """Return ``(should_restore, reason, marker_payload)`` for node deps."""
+    fingerprint, metadata = _node_deps_fingerprint(project_root, env, install_command)
+    payload = {"fingerprint": fingerprint, "metadata": metadata}
+    if not (project_root / "node_modules").is_dir():
+        return True, "node_modules missing", payload
+    state = _read_json(_node_deps_state_path(project_root))
+    if not state:
+        return True, "cache marker missing", payload
+    if str(state.get("fingerprint") or "") != fingerprint:
+        return True, "dependency fingerprint changed", payload
+    return False, "dependency fingerprint unchanged", payload
+
+
 def _detected_is_provisionable(command: str | None) -> bool:
     """True when every missing binary of ``command`` maps to a managed runtime.
 
@@ -403,7 +510,7 @@ def _merge_toolchain_env(base: dict | None, new: dict) -> dict:
 
 
 def _provision_toolchain(
-    project_root: Path,
+    execution_root: Path,
     test_command: str | None,
     config: dict,
     *,
@@ -428,6 +535,10 @@ def _provision_toolchain(
     from refactor_core.host_toolchain import binary_to_runtime, guidance_for_binary
 
     def _on_progress(msg: str) -> None:
+        # Warm-path reuse is expected on every run; suppress it to keep cloud RR
+        # progress noise low while still surfacing real downloads/extracts.
+        if str(msg).startswith("reusing "):
+            return
         _emit(progress_cb, phase="rr", event="toolchain_provisioning", detail=msg)
 
     merged_env: dict | None = None
@@ -457,40 +568,82 @@ def _provision_toolchain(
             continue
         _emit(progress_cb, phase="rr", event="toolchain_ready", runtime=runtime)
         merged_env = _merge_toolchain_env(merged_env, env)
-        _restore_dependencies(project_root, runtime, merged_env, progress_cb)
+        _restore_dependencies(execution_root, runtime, merged_env, progress_cb, config=config)
 
     return merged_env, " ".join(n for n in notes if n).strip()
 
 
 def _restore_dependencies(
-    project_root: Path, runtime: str, env: dict, progress_cb: Callable[[dict], None] | None
+    project_root: Path,
+    runtime: str,
+    env: dict,
+    progress_cb: Callable[[dict], None] | None,
+    *,
+    config: dict,
 ) -> None:
     """Restore project dependencies with the provisioned toolchain (best effort).
 
     Mirrors the sandbox dependency-restore step so the test command has its deps
     present. Failures are non-fatal: the test run surfaces the real error.
     """
+    policy = _deps_restore_policy(config)
+    if policy == "never":
+        _emit(
+            progress_cb,
+            phase="rr",
+            event="toolchain_provisioning",
+            detail=f"dependency restore skipped for {runtime} (policy=never)",
+        )
+        return
     if runtime == "node" and (project_root / "package.json").is_file():
+        install_binary, install_command = _node_install_command(project_root)
+        marker_payload: dict | None = None
+        if policy == "auto":
+            should_restore, reason, marker_payload = _should_restore_node_dependencies(
+                project_root, env, install_command
+            )
+            if not should_restore:
+                _emit(
+                    progress_cb,
+                    phase="rr",
+                    event="toolchain_provisioning",
+                    detail=f"skipping node dependency restore ({reason})",
+                )
+                return
         _emit(
             progress_cb,
             phase="rr",
             event="toolchain_provisioning",
-            detail="step 1/1: npm install (streaming output below)",
+            detail=f"step 1/1: {install_command} (streaming output below)",
         )
+        if not _binary_on_path(install_binary, env=env):
+            _emit(
+                progress_cb,
+                phase="rr",
+                event="toolchain_provisioning",
+                detail=(
+                    f"skipping node dependency restore: '{install_binary}' is not available "
+                    f"for {install_command}"
+                ),
+            )
+            return
         ok, detail = _run_command_with_progress(
             project_root,
-            "npm install",
+            install_command,
             env=env,
             progress_cb=progress_cb,
             label="npm",
             timeout=1800,
         )
+        if ok and policy == "auto" and marker_payload is not None:
+            with contextlib.suppress(OSError):
+                _write_json_atomic(_node_deps_state_path(project_root), marker_payload)
         if not ok:
             _emit(
                 progress_cb,
                 phase="rr",
                 event="toolchain_provisioning",
-                detail=f"npm install finished with errors: {detail}",
+                detail=f"{install_command} finished with errors: {detail}",
             )
     elif runtime == "python":
         if (project_root / "requirements.txt").is_file():
@@ -579,6 +732,184 @@ def _collect_test_manifests(
     return docs
 
 
+def _workspace_root(project_root: Path) -> Path:
+    return resolve_store_dir(project_root) / _WORKSPACE_DIRNAME / _WORKSPACE_NAME
+
+
+def _workspace_cache_root(project_root: Path) -> Path:
+    return resolve_store_dir(project_root) / _WORKSPACE_CACHE_DIRNAME
+
+
+def _workspace_env(project_root: Path, base_env: dict | None) -> dict | None:
+    env = dict(base_env) if base_env is not None else None
+    cache_root = _workspace_cache_root(project_root)
+    npm_cache = cache_root / "npm"
+    yarn_cache = cache_root / "yarn"
+    pnpm_store = cache_root / "pnpm-store"
+    for directory in (npm_cache, yarn_cache, pnpm_store):
+        with contextlib.suppress(OSError):
+            directory.mkdir(parents=True, exist_ok=True)
+    if env is None:
+        return None
+    env.setdefault("npm_config_cache", str(npm_cache))
+    env.setdefault("YARN_CACHE_FOLDER", str(yarn_cache))
+    env.setdefault("PNPM_STORE_DIR", str(pnpm_store))
+    return env
+
+
+def _has_excluded_component(rel: Path, exclude: set[str]) -> bool:
+    return any(part in exclude for part in rel.parts)
+
+
+def _needs_copy(src: Path, dst: Path) -> bool:
+    """True when ``dst`` is missing or differs from ``src`` (size/mtime)."""
+    try:
+        s = src.stat()
+    except OSError:
+        return False
+    try:
+        d = dst.stat()
+    except OSError:
+        return True
+    return int(s.st_mtime) != int(d.st_mtime) or s.st_size != d.st_size
+
+
+def _sync_working_tree(
+    src: Path, dst: Path, *, exclude: set[str], skip_abs: set[Path]
+) -> None:
+    """Incrementally mirror the working tree ``src`` into ``dst``.
+
+    Copies tracked *and* untracked files (so gitignored inputs a test needs — a
+    local ``.env``, fixtures — are present) while skipping heavy/managed dirs
+    (``exclude`` by name, ``skip_abs`` by absolute path). Unchanged files are
+    left alone (size+mtime check) so re-runs are cheap, and files deleted in the
+    source are removed from the mirror. Excluded dirs (e.g. the workspace's own
+    ``node_modules``) are never copied *or* deleted, so dependency caches persist.
+    """
+    src = Path(src)
+    dst = Path(dst)
+    dst.mkdir(parents=True, exist_ok=True)
+
+    seen_files: set[str] = set()
+    seen_dirs: set[str] = set()
+    for root, dirs, files in os.walk(src):
+        root_path = Path(root)
+        # Prune excluded/managed dirs in place so os.walk never descends them.
+        dirs[:] = [
+            d
+            for d in dirs
+            if d not in exclude and (root_path / d).resolve() not in skip_abs
+        ]
+        rel_root = root_path.relative_to(src)
+        for d in dirs:
+            rel = rel_root / d
+            seen_dirs.add(rel.as_posix())
+            with contextlib.suppress(OSError):
+                (dst / rel).mkdir(parents=True, exist_ok=True)
+        for f in files:
+            rel = rel_root / f
+            seen_files.add(rel.as_posix())
+            source_file = src / rel
+            target_file = dst / rel
+            if _needs_copy(source_file, target_file):
+                with contextlib.suppress(OSError):
+                    target_file.parent.mkdir(parents=True, exist_ok=True)
+                    shutil.copy2(source_file, target_file)
+
+    # Deletion phase: drop mirror entries whose source no longer exists, never
+    # touching anything under an excluded component (node_modules, caches, .git).
+    for root, dirs, files in os.walk(dst, topdown=False):
+        rel_root = Path(root).relative_to(dst)
+        if _has_excluded_component(rel_root, exclude):
+            continue
+        for f in files:
+            rel = rel_root / f
+            if _has_excluded_component(rel, exclude):
+                continue
+            if rel.as_posix() not in seen_files:
+                with contextlib.suppress(OSError):
+                    (Path(root) / f).unlink()
+        for d in dirs:
+            if d in exclude:
+                continue
+            rel = rel_root / d
+            if rel.as_posix() not in seen_dirs:
+                with contextlib.suppress(OSError):
+                    (Path(root) / d).rmdir()
+
+
+def _prepare_managed_workspace(project_root: Path, *, progress_cb: Callable[[dict], None] | None) -> Path:
+    """Mirror the project's working tree into the managed workspace and return it.
+
+    The mirror (not a HEAD worktree) reflects exactly what the developer has on
+    disk, so behavior verification matches reality even with uncommitted or
+    gitignored files. Installs/tests run here; the real repo is never touched.
+    """
+    workspace = _workspace_root(project_root)
+    with contextlib.suppress(OSError):
+        workspace.parent.mkdir(parents=True, exist_ok=True)
+    skip_abs: set[Path] = set()
+    with contextlib.suppress(Exception):
+        skip_abs.add(resolve_store_dir(project_root).resolve())
+    with contextlib.suppress(Exception):
+        skip_abs.add(workspace.resolve())
+    try:
+        _sync_working_tree(
+            project_root, workspace, exclude=set(_WORKSPACE_EXCLUDE), skip_abs=skip_abs
+        )
+    except OSError as exc:
+        raise CloudRRError(f"failed to prepare managed workspace: {exc}") from exc
+    _emit(
+        progress_cb,
+        phase="rr",
+        event="workspace_ready",
+        detail=f"managed workspace ready at {workspace}",
+    )
+    return workspace
+
+
+def prune_workspace(project_root: Path, *, include_cache: bool = False) -> list[str]:
+    """Remove the managed workspace mirror (and optionally its dep caches).
+
+    Returns the list of removed absolute paths. Safe to call when nothing has
+    been provisioned yet (returns an empty list).
+    """
+    removed: list[str] = []
+    base = resolve_store_dir(project_root) / _WORKSPACE_DIRNAME
+    if base.exists():
+        shutil.rmtree(base, ignore_errors=True)
+        removed.append(str(base))
+    if include_cache:
+        cache = _workspace_cache_root(project_root)
+        if cache.exists():
+            shutil.rmtree(cache, ignore_errors=True)
+            removed.append(str(cache))
+    return removed
+
+
+def workspace_paths(project_root: Path) -> dict:
+    """Return the managed workspace + cache locations for ``project_root``."""
+    return {
+        "workspace": _workspace_root(project_root),
+        "cache": _workspace_cache_root(project_root),
+    }
+
+
+def _git_status_porcelain(project_root: Path) -> str:
+    try:
+        proc = subprocess.run(
+            ["git", "-C", str(project_root), "status", "--porcelain"],
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+    except (subprocess.SubprocessError, OSError):
+        return ""
+    if proc.returncode != 0:
+        return ""
+    return (proc.stdout or "").strip()
+
+
 def _discover_test_command_via_cloud(
     *,
     project_root: Path,
@@ -846,6 +1177,18 @@ def run_cloud_refactor_requests(
     if requests is None:
         requests = pending_requests(project_root)
 
+    run_store = create_run(project_root)
+    run_id = run_store.run_id
+    resolved_model = model_hint or str(
+        constitution.get_setting("model_id", "managed-default") or "managed-default"
+    )
+    outcomes: list[dict] = []
+    counts = {"applied": 0, "denied": 0, "failed": 0, "deferred": 0}
+    notes: list[str] = []
+    stopped = False
+    stop_reason = ""
+    model_id = resolved_model
+
     _emit(
         progress_cb,
         phase="rr",
@@ -854,18 +1197,51 @@ def run_cloud_refactor_requests(
         test_command=test_command or "",
         execution_env="cloud",
     )
+    execution_root = _prepare_managed_workspace(project_root, progress_cb=progress_cb)
+    status_before = _git_status_porcelain(project_root)
 
     # Managed host toolchain: when the resolved command's runtime is missing from
     # the host PATH, download a pinned runtime into the central store and run
     # tests with it (no container, no system changes). ``toolchain_env`` is None
     # when nothing was provisioned (already runnable / no managed runtime).
     toolchain_env, toolchain_note = _provision_toolchain(
-        project_root,
+        execution_root,
         test_command,
         config,
         consent_cb=toolchain_consent_cb,
         progress_cb=progress_cb,
     )
+    toolchain_env = _workspace_env(project_root, toolchain_env)
+    status_after_toolchain = _git_status_porcelain(project_root)
+    if status_after_toolchain != status_before:
+        reason = (
+            "managed workspace invariant violated: toolchain/dependency setup changed the project "
+            "working tree before any RR patch was applied; aborting run."
+        )
+        _emit(
+            progress_cb,
+            phase="rr",
+            event="workspace_dirty_abort",
+            reason=reason,
+        )
+        notes = []
+        if testcmd_note:
+            notes.append(testcmd_note)
+        if toolchain_note:
+            notes.append(toolchain_note)
+        notes.append(reason)
+        return _build_artifact(
+            run_store,
+            run_id,
+            constitution,
+            model_id,
+            outcomes,
+            counts,
+            notes,
+            stopped=True,
+            stop_reason=reason,
+            test_command=test_command,
+        )
 
     # python3-only hosts: rewrite a bare `python` test command to `python3` when
     # we did NOT provision a managed runtime (managed provisioning already
@@ -882,23 +1258,10 @@ def run_cloud_refactor_requests(
                 previous=test_command,
             )
             test_command = normalized
-
-    run_store = create_run(project_root)
-    run_id = run_store.run_id
-    resolved_model = model_hint or str(
-        constitution.get_setting("model_id", "managed-default") or "managed-default"
-    )
-
-    outcomes: list[dict] = []
-    counts = {"applied": 0, "denied": 0, "failed": 0, "deferred": 0}
-    notes: list[str] = []
     if testcmd_note:
         notes.append(testcmd_note)
     if toolchain_note:
         notes.append(toolchain_note)
-    stopped = False
-    stop_reason = ""
-    model_id = resolved_model
 
     if not requests:
         return _build_artifact(
@@ -1009,7 +1372,7 @@ def run_cloud_refactor_requests(
             current_rr_id = action.get("rr_id", "") or current_rr_id
             _emit(progress_cb, phase="rr", event="test_generating", rr_id=current_rr_id)
             _write_generated_test(project_root, current_rr_id, action, by_id)
-            passed, detail = _run_test(project_root, test_command, env=toolchain_env)
+            passed, detail = _run_test(execution_root, test_command, env=toolchain_env)
             _emit(progress_cb, phase="rr", event="baseline_test", rr_id=current_rr_id,
                   passed=passed, detail=detail,
                   execution_env="host+toolchain" if toolchain_env else "host")
@@ -1086,7 +1449,12 @@ def run_cloud_refactor_requests(
                         approved=True,
                     )
                 passed, detail, files = _apply_and_verify(
-                    project_root, run_store.run_dir, diff_text, test_command, env=toolchain_env
+                    project_root,
+                    execution_root,
+                    run_store.run_dir,
+                    diff_text,
+                    test_command,
+                    env=toolchain_env,
                 )
                 pending.applied = True
                 if passed:
@@ -1186,7 +1554,13 @@ def _write_generated_test(project_root: Path, rr_id: str, action: dict, by_id: d
 
 
 def _apply_and_verify(
-    project_root: Path, run_dir: Path, diff_text: str, test_command, *, env: dict | None = None
+    project_root: Path,
+    execution_root: Path,
+    run_dir: Path,
+    diff_text: str,
+    test_command,
+    *,
+    env: dict | None = None,
 ) -> tuple[bool, str, list[str]]:
     """Apply the diff (with backup), run the test; revert on red.
 
@@ -1204,17 +1578,24 @@ def _apply_and_verify(
     if not changes:
         return False, "diff produced no file changes", []
     changed_files = list(changes.keys())
+    verify_backup_dir = run_dir / "workspace-backup"
+    verify_backup_dir.mkdir(parents=True, exist_ok=True)
     try:
-        apply_changes(project_root, run_dir, changes)
+        apply_changes(execution_root, verify_backup_dir, changes)
     except Exception as exc:
         return False, f"apply failed: {exc}", changed_files
-    passed, detail = _run_test(project_root, test_command, env=env)
+    passed, detail = _run_test(execution_root, test_command, env=env)
     if not passed:
         try:
-            revert_from_backup(project_root, run_dir)
+            revert_from_backup(execution_root, verify_backup_dir)
         except Exception as exc:  # keep going; report both
             detail = f"{detail}; revert error: {exc}"
-    return passed, detail, changed_files
+        return passed, detail, changed_files
+    try:
+        apply_changes(project_root, run_dir, changes)
+    except Exception as exc:
+        return False, f"apply to project failed after successful verify: {exc}", changed_files
+    return True, detail, changed_files
 
 
 def _record_outcome(project_root, by_id, rr_id, verdict, message, attempts,

{refactorai_cli-0.5.9 → refactorai_cli-0.7.0}/refactorai_cli/commands/run_cmds.py

@@ -2273,6 +2273,9 @@ def _refactor_branch_name(
     template: str = "refactor/{branch}/{shortsha}",
 ) -> str:
     """Compose ``refactor/<sanitized-branch>/<shortsha>`` (detached-safe)."""
+    from refactorai_cli.refactor_branch_store import debase_source_branch
+
+    source_branch = debase_source_branch(source_branch)
     if source_branch and source_branch != "HEAD":
         branch = _sanitize_branch_component(source_branch)
     else:
@@ -2671,7 +2674,11 @@ def _prepare_refactor_branch(
     if not source_sha:
         console.print(f"[yellow]code: could not resolve commit '{commit}' for branch; applying in place.[/yellow]")
         return None
-    source_branch = git_scope.current_branch(project_root)
+    # Anchor to the developer's primary branch, never the current HEAD: when a
+    # terminal action runs while HEAD is already on a refactor sub-branch, using
+    # the current branch would nest the name (``refactor/refactor/...``). The
+    # primary branch keeps every sub-branch flat and its source association true.
+    source_branch = git_scope.resolve_primary_branch(project_root)
     branch_name = _refactor_branch_name(source_branch, source_sha, template=template)
 
     # The reviewed commit names the branch + anchors metadata; the checkout base