refactorai-cli 0.7.12__tar.gz → 0.7.14__tar.gz

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.7.12
+Version: 0.7.14
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.2.22
+Requires-Dist: refactorai-core>=3.2.23
 
 # refactorai-cli
 
@@ -66,6 +66,55 @@ the managed host toolchain when no container runtime is available. `refactor
 doctor` reports the selected environment (and `refactor doctor --sandbox` shows
 its full state), so a run and diagnostics always agree.
 
+## Customizing refactor.config
+
+`refactor init` writes a **bare-minimum** `refactor.config`: just `version`,
+`project_id`, and a CLI-managed block seeded to `local_heuristic`. A normal
+developer never edits this file by hand — pick the mode (and provider keys, if
+any) in the web UI or via `refactor setup --mode <variant>`.
+
+### The managed block (single source of truth for the mode)
+
+```
+# >>> refactor managed (synced from server; do not edit) >>>
+execution_variant: cloud_byok
+provider: openai
+model_id: gpt-4.1-mini
+credential_ref: cred_01J...
+# <<< refactor managed <<<
+```
+
+- Owned by the CLI. `refactor setup` (terminal) writes it immediately; a change
+  made in the web UI is pulled into this block on the next `refactor doctor` /
+  `refactor watch` / `refactor setup` (**server-wins**).
+- Only these keys live here: `execution_variant`, `provider`, `model_id`,
+  `base_url` (local_model), `credential_ref`. **Secrets are never written** —
+  keep provider keys in the environment and reference them as `${ENV_VAR}`.
+
+### What each mode needs
+
+| variant          | you provide                                             |
+| ---------------- | ------------------------------------------------------- |
+| `local_heuristic`| nothing                                                 |
+| `local_model`    | nothing (setup writes the Ollama provider/model block)  |
+| `local_byok`     | provider API key in the env (`${VAR}`); provider/model via UI/setup |
+| `local_managed`  | nothing                                                 |
+| `cloud_byok`     | provider API key in env (or a UI credential); provider/model via UI/setup |
+| `cloud_managed`  | nothing                                                 |
+
+### Advanced knobs and precedence
+
+Advanced settings (`sandbox`, `verification`, `intelligence`, `compliance`,
+`watch`, `timeout`, `exclude`, `model_context_overrides`, …) are **not** written
+by `init`; add only the ones you need anywhere **outside** the managed block.
+`refactor init --full` writes the fully-annotated template with every knob if you
+prefer to start from that.
+
+Resolution precedence: CLI flags → environment (`provider_key`,
+`REFACTOR_PROVIDER`) → the synced managed block → code defaults. A key you place
+outside the managed block (later in the file) also takes precedence over the
+block, so power users can pin values while normal syncing continues.
+
 ## Local development install
 
 From repository root:

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/README.md

@@ -54,6 +54,55 @@ the managed host toolchain when no container runtime is available. `refactor
 doctor` reports the selected environment (and `refactor doctor --sandbox` shows
 its full state), so a run and diagnostics always agree.
 
+## Customizing refactor.config
+
+`refactor init` writes a **bare-minimum** `refactor.config`: just `version`,
+`project_id`, and a CLI-managed block seeded to `local_heuristic`. A normal
+developer never edits this file by hand — pick the mode (and provider keys, if
+any) in the web UI or via `refactor setup --mode <variant>`.
+
+### The managed block (single source of truth for the mode)
+
+```
+# >>> refactor managed (synced from server; do not edit) >>>
+execution_variant: cloud_byok
+provider: openai
+model_id: gpt-4.1-mini
+credential_ref: cred_01J...
+# <<< refactor managed <<<
+```
+
+- Owned by the CLI. `refactor setup` (terminal) writes it immediately; a change
+  made in the web UI is pulled into this block on the next `refactor doctor` /
+  `refactor watch` / `refactor setup` (**server-wins**).
+- Only these keys live here: `execution_variant`, `provider`, `model_id`,
+  `base_url` (local_model), `credential_ref`. **Secrets are never written** —
+  keep provider keys in the environment and reference them as `${ENV_VAR}`.
+
+### What each mode needs
+
+| variant          | you provide                                             |
+| ---------------- | ------------------------------------------------------- |
+| `local_heuristic`| nothing                                                 |
+| `local_model`    | nothing (setup writes the Ollama provider/model block)  |
+| `local_byok`     | provider API key in the env (`${VAR}`); provider/model via UI/setup |
+| `local_managed`  | nothing                                                 |
+| `cloud_byok`     | provider API key in env (or a UI credential); provider/model via UI/setup |
+| `cloud_managed`  | nothing                                                 |
+
+### Advanced knobs and precedence
+
+Advanced settings (`sandbox`, `verification`, `intelligence`, `compliance`,
+`watch`, `timeout`, `exclude`, `model_context_overrides`, …) are **not** written
+by `init`; add only the ones you need anywhere **outside** the managed block.
+`refactor init --full` writes the fully-annotated template with every knob if you
+prefer to start from that.
+
+Resolution precedence: CLI flags → environment (`provider_key`,
+`REFACTOR_PROVIDER`) → the synced managed block → code defaults. A key you place
+outside the managed block (later in the file) also takes precedence over the
+block, so power users can pin values while normal syncing continues.
+
 ## Local development install
 
 From repository root:

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.7.12"
+version = "0.7.14"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.2.22",
+  "refactorai-core>=3.2.23",
 ]
 
 [project.scripts]

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.7.12"
+__version__ = "0.7.14"

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/refactorai_cli/commands/run_cmds.py

@@ -30,6 +30,7 @@ from refactor_core.constitution import (
     CONSTITUTION_FILENAME,
     DEFAULT_CONFIG,
     DEFAULT_CONSTITUTION,
+    MINIMAL_CONFIG,
     find_project_files,
     has_raw_secret_literal,
     load_config,
@@ -158,17 +159,22 @@ def _sandbox_runtime():
     return _sr
 
 
-def _default_config_for_init() -> tuple[str, str]:
-    """Return the config `init` writes: always the ``local_heuristic`` default.
+def _default_config_for_init(full: bool = False) -> tuple[str, str]:
+    """Return the config `init` writes.
 
-    Mode selection is a *setup*-time concern (docs/46): after ``init`` the
-    developer picks the execution variant in the web UI or via ``refactor setup
-    --mode``, which persists it to ``refactor.config`` (and the server project).
-    ``init`` therefore never derives the mode from prior setup-backend state --
-    that legacy coupling produced configs whose variant disagreed with the
-    server's default and is intentionally removed.
+    By default this is the bare-minimum template (docs/46): ``version`` +
+    the CLI-managed block seeded to ``local_heuristic``. A normal developer never
+    hand-edits it -- they pick a mode in the web UI or via ``refactor setup
+    --mode`` and the managed block is filled in by the CLI. ``--full`` writes the
+    fully-annotated template with every advanced knob for power users.
+
+    Mode selection is a *setup*-time concern: ``init`` never derives the mode
+    from prior setup-backend state (that legacy coupling produced configs whose
+    variant disagreed with the server default and is intentionally removed).
     """
-    return DEFAULT_CONFIG, "default"
+    if full:
+        return DEFAULT_CONFIG, "full"
+    return MINIMAL_CONFIG, "default"
 
 _SEVERITY_STYLE = {
     "critical": "bold red",
@@ -1356,6 +1362,12 @@ def init(
         "--force",
         help=f"Overwrite existing {CONSTITUTION_FILENAME} and {CONFIG_FILENAME}.",
     ),
+    full: bool = typer.Option(
+        False,
+        "--full",
+        hidden=True,
+        help="Write the fully-annotated refactor.config template (power users).",
+    ),
 ) -> None:
     """Create `refactor.consti` + `refactor.config` and register the project.
 
@@ -1422,7 +1434,7 @@ def init(
         raise typer.Exit(code=1)
 
     consti_target.write_text(DEFAULT_CONSTITUTION, encoding="utf-8")
-    config_text, _config_profile = _default_config_for_init()
+    config_text, _config_profile = _default_config_for_init(full=full)
     config_text = _inject_project_id(config_text, project_id)
     config_target.write_text(config_text, encoding="utf-8")
     gitignore_updated = _ensure_refactor_gitignore(project_root)

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/refactorai_cli/commands/runtime_proxy_cmds.py

@@ -79,6 +79,30 @@ def _engine_runs_on_server() -> bool:
     return engine_is_remote(_project_execution_mode())
 
 
+def _sync_mode_from_server_if_possible(command_name: str | None = None) -> None:
+    """Best-effort server->local mode sync before routing.
+
+    Fixes the stale-mode chicken-and-egg: when a developer changes the mode in
+    the web UI, the local ``refactor.config`` may still point at the previous
+    variant. If dispatch reads that stale local value first, commands can route
+    to the wrong engine path (for example ``doctor`` going to the runtime path
+    instead of the local CLI cloud path), so the sync never runs and the local
+    mode never updates.
+
+    This helper is intentionally silent and fail-open (offline/auth issues are
+    ignored) so command routing remains robust.
+    """
+    try:
+        from refactorai_cli.mode_sync import sync_execution_variant_from_server
+
+        emit = None
+        if command_name == "doctor":
+            emit = lambda m: console.print(f"[dim]{m}[/dim]")
+        sync_execution_variant_from_server(Path.cwd(), emit=emit)
+    except Exception:
+        return
+
+
 def _active_runtime_artifact() -> Path:
     status = runtime_status()
     version = str(status.get("active_version") or "").strip()
@@ -181,6 +205,7 @@ def _dispatch(command_name: str, passthrough_args: list[str]) -> None:
     host-engine variants (``local_model`` / ``local_heuristic``) execute via the
     downloaded runtime artifact.
     """
+    _sync_mode_from_server_if_possible(command_name)
     if _engine_runs_on_server():
         _delegate_to_run_cmds(command_name, passthrough_args)
         return

refactorai_cli-0.7.14/refactorai_cli/mode_sync.py

@@ -0,0 +1,171 @@
+"""Execution-mode sync between the server project and local ``refactor.config``.
+
+The web UI sets a project's ``execution_mode`` on the server (JWT). The CLI
+authenticates with a developer key and treats the server as the source of truth
+(server-wins): ``setup`` / ``doctor`` / ``watch`` pull the server mode and write
+it into the local ``refactor.config`` so a UI change reflects in terminal runs.
+``refactor setup --mode`` also pushes the chosen variant up so both agree.
+
+All operations are best-effort: offline / unauthenticated / unbound projects are
+a silent no-op so they never break the surrounding command.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Callable
+
+from refactor_core.constitution import (
+    CONFIG_FILENAME,
+    MANAGED_KEYS,
+    find_project_files,
+    load_config,
+    upsert_managed_block,
+)
+from refactor_core.execution_variant import normalize_execution_variant
+from refactor_core.store import resolve_project_id
+
+from refactorai_cli.client import PlatformClient
+from refactorai_cli.credentials import resolve_developer_key
+
+
+def _local_config_path(project_root: Path) -> Path | None:
+    files = find_project_files(project_root)
+    if files:
+        return Path(files[1])
+    candidate = Path(project_root) / CONFIG_FILENAME
+    return candidate if candidate.is_file() else None
+
+
+def _current_managed_values(project_root: Path) -> dict:
+    """Current values of the managed keys as parsed from refactor.config."""
+    config_path = _local_config_path(project_root)
+    if config_path is None:
+        return {}
+    try:
+        settings = getattr(load_config(config_path), "settings", {}) or {}
+    except Exception:
+        return {}
+    values: dict = {}
+    for key in MANAGED_KEYS:
+        raw = settings.get(key)
+        if raw is None:
+            continue
+        text = str(raw).strip()
+        if text:
+            values[key] = text
+    return values
+
+
+def _desired_managed_fields(record: dict, current: dict, server_variant: str) -> dict:
+    """Compute the managed-block fields from the server record (server-wins).
+
+    When the server carries a remote provider (BYOK/managed set from the UI), the
+    provider/model/credential come from the server and any local ``base_url`` is
+    dropped. Otherwise (heuristic / terminal-set local_model, where the server has
+    no provider) the local provider/model/base_url are preserved and only the
+    variant is reconciled.
+    """
+    provider = str(record.get("inference_provider") or "").strip()
+    model_id = str(record.get("model_id") or "").strip()
+    credential_ref = str(record.get("provider_credential_ref") or "").strip()
+
+    fields: dict = {"execution_variant": server_variant}
+    if provider:
+        fields["provider"] = provider
+        if model_id:
+            fields["model_id"] = model_id
+        if credential_ref:
+            fields["credential_ref"] = credential_ref
+    else:
+        for key in ("provider", "model_id", "base_url", "credential_ref"):
+            if current.get(key):
+                fields[key] = current[key]
+    return fields
+
+
+def sync_execution_variant_from_server(
+    project_root: Path,
+    *,
+    client: PlatformClient | None = None,
+    emit: Callable[[str], None] | None = None,
+) -> str | None:
+    """Pull the server project's execution settings into the managed config block.
+
+    Server-wins for the managed keys (execution_variant / provider / model_id /
+    credential_ref). Secrets (``provider_key``) are never written -- they stay in
+    the environment. Returns the applied variant when the local config changed,
+    else ``None`` (already in sync, offline, unauthenticated, or unbound project).
+    """
+    try:
+        project_id = resolve_project_id(project_root)
+        if not project_id:
+            return None
+        resolved = resolve_developer_key(project_root)
+        if not resolved:
+            return None
+        client = client or PlatformClient()
+        record = client.get_project_execution_mode(resolved.key, project_id)
+    except Exception:
+        return None
+
+    server_variant = normalize_execution_variant((record or {}).get("execution_mode"))
+    if not server_variant:
+        return None
+
+    config_path = _local_config_path(project_root)
+    if config_path is None:
+        return None
+
+    current = _current_managed_values(project_root)
+    desired = _desired_managed_fields(record or {}, current, server_variant)
+
+    # No-op when the managed keys already match (compare only managed keys).
+    current_managed = {k: current.get(k) for k in MANAGED_KEYS if current.get(k)}
+    if desired == current_managed:
+        return None
+
+    try:
+        text = config_path.read_text(encoding="utf-8")
+        new_text = upsert_managed_block(text, desired)
+        if not new_text.endswith("\n"):
+            new_text += "\n"
+        if new_text == text:
+            return None
+        config_path.write_text(new_text, encoding="utf-8")
+    except OSError:
+        return None
+
+    if emit:
+        emit(f"Synced execution_variant from server: {server_variant}")
+    return server_variant
+
+
+def push_execution_variant_to_server(
+    project_root: Path,
+    variant: str,
+    *,
+    client: PlatformClient | None = None,
+    emit: Callable[[str], None] | None = None,
+) -> bool:
+    """Push a locally chosen execution variant to the server project.
+
+    Best-effort; returns ``True`` on a successful push, else ``False``.
+    """
+    normalized = normalize_execution_variant(variant)
+    if not normalized:
+        return False
+    try:
+        project_id = resolve_project_id(project_root)
+        if not project_id:
+            return False
+        resolved = resolve_developer_key(project_root)
+        if not resolved:
+            return False
+        client = client or PlatformClient()
+        client.set_project_execution_mode(resolved.key, project_id, normalized)
+    except Exception:
+        return False
+    if emit:
+        emit(f"Pushed execution_variant to server: {normalized}")
+    return True

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/refactorai_cli/setup_flow.py

@@ -598,38 +598,30 @@ def _local_model_provider_values() -> tuple[str, str]:
     return model_id, f"http://127.0.0.1:{port}/v1"
 
 
-def _apply_local_model_provider_block(text: str) -> str:
-    """Swap the default heuristic provider block for an Ollama block (local_model).
-
-    Only rewrites when the untouched heuristic default is still present, so a
-    developer who already configured a provider is never overwritten.
-    """
+def _local_model_managed_fields() -> dict:
+    """Managed-block fields for ``local_model`` (Ollama provider + model/base_url)."""
     model_id, base_url = _local_model_provider_values()
-    return text.replace(
-        "# Heuristic (local, no LLM) - default for execution_variant: local_heuristic\n"
-        "provider: heuristic\n"
-        "model_id: heuristic-local-v1",
-        "# Ollama (local engine) - configured by `refactor setup --mode local_model`\n"
-        "provider: ollama\n"
-        f"model_id: {model_id}\n"
-        f"base_url: {base_url}",
-        1,
-    )
+    return {
+        "execution_variant": LOCAL_MODEL,
+        "provider": "ollama",
+        "model_id": model_id,
+        "base_url": base_url,
+    }
 
 
 def _persist_variant_to_project_config(variant: str, emit: Callable[[str], None] | None = None) -> None:
-    """Write the chosen ``execution_variant`` into the project's refactor.config.
+    """Write the chosen ``execution_variant`` into the CLI-managed config block.
 
     Keeps a UI-selected or terminal-selected mode as the single source of truth
     for subsequent runs (doctor/review/code read it from config). For
-    ``local_model`` it also swaps the default heuristic provider block for a local
-    Ollama block (docs/46: local_model provider config is a setup concern, not an
-    init concern). Best-effort: a missing config or write error never fails setup.
+    ``local_model`` the block also carries the local Ollama provider/model/base_url
+    (docs/46: local_model provider config is a setup concern, not an init concern).
+    Best-effort: a missing config or write error never fails setup.
     """
     if not variant:
         return
     try:
-        from refactor_core.constitution import find_project_files
+        from refactor_core.constitution import find_project_files, upsert_managed_block
 
         files = find_project_files()
         if not files:
@@ -637,20 +629,12 @@ def _persist_variant_to_project_config(variant: str, emit: Callable[[str], None]
         _consti_path, config_path = files
         config_path = Path(config_path)
         text = config_path.read_text(encoding="utf-8")
-        if variant == LOCAL_MODEL:
-            text = _apply_local_model_provider_block(text)
-        lines = text.splitlines()
-        new_line = f"execution_variant: {variant}"
-        replaced = False
-        for idx, line in enumerate(lines):
-            if line.strip().startswith("execution_variant:"):
-                if line.strip() != new_line:
-                    lines[idx] = new_line
-                replaced = True
-                break
-        if not replaced:
-            lines.append(new_line)
-        config_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        fields = _local_model_managed_fields() if variant == LOCAL_MODEL else {"execution_variant": variant}
+        new_text = upsert_managed_block(text, fields)
+        if not new_text.endswith("\n"):
+            new_text += "\n"
+        if new_text != text:
+            config_path.write_text(new_text, encoding="utf-8")
         if emit:
             emit(f"Recorded execution_variant: {variant} in refactor.config.")
     except Exception:

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.7.12
+Version: 0.7.14
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.2.22
+Requires-Dist: refactorai-core>=3.2.23
 
 # refactorai-cli
 
@@ -66,6 +66,55 @@ the managed host toolchain when no container runtime is available. `refactor
 doctor` reports the selected environment (and `refactor doctor --sandbox` shows
 its full state), so a run and diagnostics always agree.
 
+## Customizing refactor.config
+
+`refactor init` writes a **bare-minimum** `refactor.config`: just `version`,
+`project_id`, and a CLI-managed block seeded to `local_heuristic`. A normal
+developer never edits this file by hand — pick the mode (and provider keys, if
+any) in the web UI or via `refactor setup --mode <variant>`.
+
+### The managed block (single source of truth for the mode)
+
+```
+# >>> refactor managed (synced from server; do not edit) >>>
+execution_variant: cloud_byok
+provider: openai
+model_id: gpt-4.1-mini
+credential_ref: cred_01J...
+# <<< refactor managed <<<
+```
+
+- Owned by the CLI. `refactor setup` (terminal) writes it immediately; a change
+  made in the web UI is pulled into this block on the next `refactor doctor` /
+  `refactor watch` / `refactor setup` (**server-wins**).
+- Only these keys live here: `execution_variant`, `provider`, `model_id`,
+  `base_url` (local_model), `credential_ref`. **Secrets are never written** —
+  keep provider keys in the environment and reference them as `${ENV_VAR}`.
+
+### What each mode needs
+
+| variant          | you provide                                             |
+| ---------------- | ------------------------------------------------------- |
+| `local_heuristic`| nothing                                                 |
+| `local_model`    | nothing (setup writes the Ollama provider/model block)  |
+| `local_byok`     | provider API key in the env (`${VAR}`); provider/model via UI/setup |
+| `local_managed`  | nothing                                                 |
+| `cloud_byok`     | provider API key in env (or a UI credential); provider/model via UI/setup |
+| `cloud_managed`  | nothing                                                 |
+
+### Advanced knobs and precedence
+
+Advanced settings (`sandbox`, `verification`, `intelligence`, `compliance`,
+`watch`, `timeout`, `exclude`, `model_context_overrides`, …) are **not** written
+by `init`; add only the ones you need anywhere **outside** the managed block.
+`refactor init --full` writes the fully-annotated template with every knob if you
+prefer to start from that.
+
+Resolution precedence: CLI flags → environment (`provider_key`,
+`REFACTOR_PROVIDER`) → the synced managed block → code defaults. A key you place
+outside the managed block (later in the file) also takes precedence over the
+block, so power users can pin values while normal syncing continues.
+
 ## Local development install
 
 From repository root:

{refactorai_cli-0.7.12 → refactorai_cli-0.7.14}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.2.22
+refactorai-core>=3.2.23

refactorai_cli-0.7.12/refactorai_cli/mode_sync.py

@@ -1,140 +0,0 @@
-"""Execution-mode sync between the server project and local ``refactor.config``.
-
-The web UI sets a project's ``execution_mode`` on the server (JWT). The CLI
-authenticates with a developer key and treats the server as the source of truth
-(server-wins): ``setup`` / ``doctor`` / ``watch`` pull the server mode and write
-it into the local ``refactor.config`` so a UI change reflects in terminal runs.
-``refactor setup --mode`` also pushes the chosen variant up so both agree.
-
-All operations are best-effort: offline / unauthenticated / unbound projects are
-a silent no-op so they never break the surrounding command.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-from typing import Callable
-
-from refactor_core.constitution import CONFIG_FILENAME, find_project_files
-from refactor_core.execution_variant import (
-    normalize_execution_variant,
-    resolve_execution_variant,
-)
-from refactor_core.store import resolve_project_id
-
-from refactorai_cli.client import PlatformClient
-from refactorai_cli.credentials import resolve_developer_key
-
-
-def _local_config_path(project_root: Path) -> Path | None:
-    files = find_project_files(project_root)
-    if files:
-        return Path(files[1])
-    candidate = Path(project_root) / CONFIG_FILENAME
-    return candidate if candidate.is_file() else None
-
-
-def _read_local_variant(project_root: Path) -> str:
-    files = find_project_files(project_root)
-    if not files:
-        return ""
-    try:
-        from refactor_core.constitution import load_constitution
-
-        constitution = load_constitution(files[0])
-        return resolve_execution_variant(getattr(constitution, "settings", {}) or {})
-    except Exception:
-        return ""
-
-
-def _write_variant_to_config(config_path: Path, variant: str) -> bool:
-    """Replace (or append) the ``execution_variant`` line in refactor.config."""
-    try:
-        text = config_path.read_text(encoding="utf-8")
-    except OSError:
-        return False
-    lines = text.splitlines()
-    new_line = f"execution_variant: {variant}"
-    replaced = False
-    for idx, line in enumerate(lines):
-        if line.strip().startswith("execution_variant:"):
-            if line.strip() == new_line:
-                return False
-            lines[idx] = new_line
-            replaced = True
-            break
-    if not replaced:
-        lines.append(new_line)
-    try:
-        config_path.write_text("\n".join(lines) + "\n", encoding="utf-8")
-    except OSError:
-        return False
-    return True
-
-
-def sync_execution_variant_from_server(
-    project_root: Path,
-    *,
-    client: PlatformClient | None = None,
-    emit: Callable[[str], None] | None = None,
-) -> str | None:
-    """Pull the server project's execution mode into local config (server-wins).
-
-    Returns the newly applied variant when the local config was updated, else
-    ``None`` (already in sync, offline, unauthenticated, or unbound project).
-    """
-    try:
-        project_id = resolve_project_id(project_root)
-        if not project_id:
-            return None
-        resolved = resolve_developer_key(project_root)
-        if not resolved:
-            return None
-        client = client or PlatformClient()
-        record = client.get_project_execution_mode(resolved.key, project_id)
-    except Exception:
-        return None
-
-    server_variant = normalize_execution_variant((record or {}).get("execution_mode"))
-    if not server_variant:
-        return None
-    if server_variant == _read_local_variant(project_root):
-        return None
-    config_path = _local_config_path(project_root)
-    if config_path is None:
-        return None
-    if _write_variant_to_config(config_path, server_variant):
-        if emit:
-            emit(f"Synced execution_variant from server: {server_variant}")
-        return server_variant
-    return None
-
-
-def push_execution_variant_to_server(
-    project_root: Path,
-    variant: str,
-    *,
-    client: PlatformClient | None = None,
-    emit: Callable[[str], None] | None = None,
-) -> bool:
-    """Push a locally chosen execution variant to the server project.
-
-    Best-effort; returns ``True`` on a successful push, else ``False``.
-    """
-    normalized = normalize_execution_variant(variant)
-    if not normalized:
-        return False
-    try:
-        project_id = resolve_project_id(project_root)
-        if not project_id:
-            return False
-        resolved = resolve_developer_key(project_root)
-        if not resolved:
-            return False
-        client = client or PlatformClient()
-        client.set_project_execution_mode(resolved.key, project_id, normalized)
-    except Exception:
-        return False
-    if emit:
-        emit(f"Pushed execution_variant to server: {normalized}")
-    return True