refactorai-cli 0.7.16__tar.gz → 0.7.18__tar.gz

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.7.16
+Version: 0.7.18
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.2.23
+Requires-Dist: refactorai-core>=3.2.24
 
 # refactorai-cli
 

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.7.16"
+version = "0.7.18"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.2.23",
+  "refactorai-core>=3.2.24",
 ]
 
 [project.scripts]

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.7.16"
+__version__ = "0.7.18"

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/refactorai_cli/commands/run_cmds.py

@@ -8,6 +8,7 @@ generation and application.
 from __future__ import annotations
 
 import hashlib
+import importlib.util
 import os
 import json
 import re
@@ -669,6 +670,60 @@ def _guard_local_inference_ready(variant: str) -> None:
         )
 
 
+# Subpackages that ship ONLY in the private engine wheel (R21 core split) and are
+# intentionally absent from a public pip/pipx install of ``refactorai-core``. The
+# engine is proprietary: it runs on the Refactor server (server-engine variants)
+# or inside the separately downloaded runtime artifact (local_model /
+# local_heuristic, dispatched via ``runtime_proxy_cmds._exec_runtime``). It is
+# never a client dependency, so ``run_cmds`` must never partially import it.
+_ENGINE_ONLY_ROOT = "refactor_core.execution"
+
+
+def _engine_importable() -> bool:
+    """True when the proprietary local engine is importable in this process.
+
+    Present only in monorepo/source checkouts (where the engine tree exists) --
+    never in a public client install, which excludes the engine subpackages from
+    the wheel. Used as a capability gate so the client never *attempts* an engine
+    import (which would both crash with a raw ``ModuleNotFoundError`` and, in a
+    source checkout, execute proprietary code on the developer's machine).
+    """
+    try:
+        return importlib.util.find_spec(_ENGINE_ONLY_ROOT) is not None
+    except (ImportError, ValueError):
+        return False
+
+
+def _guard_local_engine(constitution) -> None:
+    """Refuse to run the local (in-process) engine path on a client install.
+
+    ``run_cmds`` serves the server-engine variants (``local_byok`` /
+    ``local_managed`` / ``cloud_*``); the router
+    (``runtime_proxy_cmds._dispatch``) sends host-engine variants
+    (``local_model`` / ``local_heuristic``) to the downloaded runtime artifact.
+    A local-engine branch here is therefore only valid in a source checkout where
+    the engine is present. When it is not importable, fail with an actionable
+    routing/mode message *before* importing anything -- never a raw
+    ``ModuleNotFoundError`` and never a partial import of proprietary code.
+    """
+    if _engine_importable():
+        return
+    variant = _execution_variant(constitution)
+    console.print(
+        "[red]This command reached the local engine path, which is not part of "
+        "the public install.[/red]\n"
+        f"Execution variant: [bold]{variant}[/bold]\n"
+        "The refactor engine is proprietary and never installed on the "
+        "developer machine: server-engine modes (local_byok / local_managed / "
+        "cloud_byok / cloud_managed) run it remotely, and local_model / "
+        "local_heuristic run it via the downloaded runtime artifact.\n"
+        "Check the project's execution mode in refactor.config or the web UI, "
+        "then rerun. If the mode is already a server-engine mode, this is a "
+        "routing bug (the run should never have taken the local engine path)."
+    )
+    raise typer.Exit(code=1)
+
+
 def _documents_digest(documents: list | None) -> str:
     """Stable digest of the exact documents sent to the platform.
 
@@ -3298,6 +3353,7 @@ def review(
             if scope and scope.get("summary"):
                 artifact.notes.append(f"Commit-scoped review intent: {scope['summary']}")
         else:
+            _guard_local_engine(constitution)
             from refactor_core.execution.orchestrator import run_with_mode
             from refactor_core.providers import get_provider
 
@@ -3337,6 +3393,10 @@ def review(
                 "[yellow]review note:[/yellow] sandbox preflight issue detected. "
                 "Review continued; address sandbox install/toolchain incompatibilities for best results."
             )
+    except typer.Exit:
+        # Clean, already-reported exits (e.g. the local-engine routing guard)
+        # must propagate as-is, not be re-wrapped into a generic failure.
+        raise
     except Exception as exc:  # provider/transport errors should not crash the CLI
         console.print(f"[red]Review failed:[/red] {_sanitize_runtime_error_message(exc)}")
         raise typer.Exit(code=1) from exc
@@ -3663,6 +3723,7 @@ def code(
                 )
         selected_provider = None
         if not engine_remote:
+            _guard_local_engine(constitution)
             from refactor_core.providers import get_provider
 
             _guard_local_inference_ready(_execution_variant(constitution))
@@ -3748,6 +3809,7 @@ def code(
                 )
                 cloud_review_findings = list(review_artifact.findings or [])
             else:
+                _guard_local_engine(constitution)
                 from refactor_core.execution.orchestrator import run_with_mode
 
                 with console.status("[cyan]review[/cyan] analyzing...", spinner="dots") as status:
@@ -3857,6 +3919,7 @@ def code(
         else:
             # Local mode is unchanged: dispatch to the local executor with the
             # local provider and no cloud hooks.
+            _guard_local_engine(constitution)
             from refactor_core.execution.rr_executor import run_refactor_requests
 
             with console.status("[cyan]code[/cyan] running...", spinner="dots") as status:
@@ -3999,6 +4062,7 @@ def requests(
         if not deferred_rrs:
             console.print("[dim]No deferred requests to retry.[/dim]")
         else:
+            _guard_local_engine(constitution)
             from refactor_core.execution.rr_executor import run_refactor_requests
             from refactor_core.providers import get_provider
 

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/refactorai_cli/mode_sync.py

@@ -17,9 +17,10 @@ from typing import Callable
 
 from refactor_core.constitution import (
     CONFIG_FILENAME,
+    MANAGED_BLOCK_BEGIN,
+    MANAGED_BLOCK_END,
     MANAGED_KEYS,
     find_project_files,
-    load_config,
     upsert_managed_block,
 )
 from refactor_core.execution_variant import normalize_execution_variant
@@ -38,33 +39,90 @@ def _local_config_path(project_root: Path) -> Path | None:
 
 
 def _current_managed_values(project_root: Path) -> dict:
-    """Current values of the managed keys as parsed from refactor.config."""
+    """Current values from the raw managed block (no env interpolation)."""
     config_path = _local_config_path(project_root)
     if config_path is None:
         return {}
     try:
-        settings = getattr(load_config(config_path), "settings", {}) or {}
-    except Exception:
+        text = config_path.read_text(encoding="utf-8")
+    except OSError:
+        return {}
+    begin = text.find(MANAGED_BLOCK_BEGIN)
+    if begin == -1:
+        return {}
+    end = text.find(MANAGED_BLOCK_END, begin)
+    if end == -1:
         return {}
+    body = text[begin + len(MANAGED_BLOCK_BEGIN) : end]
     values: dict = {}
-    for key in MANAGED_KEYS:
-        raw = settings.get(key)
-        if raw is None:
+    for line in body.splitlines():
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#") or ":" not in stripped:
             continue
-        text = str(raw).strip()
-        if text:
-            values[key] = text
+        key, raw = stripped.split(":", 1)
+        key = key.strip()
+        if key not in MANAGED_KEYS:
+            continue
+        value = raw.strip()
+        if value:
+            values[key] = value
     return values
 
 
+_LOCAL_BYOK_ENV_DEFAULTS: dict[str, dict[str, str]] = {
+    "openai": {
+        "provider_key": "${OPENAI_API_KEY}",
+        "model_id": "${OPENAI_MODEL_ID}",
+        "base_url": "${OPENAI_BASE_URL}",
+    },
+    "anthropic": {
+        "provider_key": "${ANTHROPIC_API_KEY}",
+        "model_id": "${ANTHROPIC_MODEL_ID}",
+    },
+    "openrouter": {
+        "provider_key": "${OPENROUTER_API_KEY}",
+        "model_id": "${OPENROUTER_MODEL_ID}",
+        "base_url": "${OPENROUTER_BASE_URL}",
+    },
+    "nvidia": {
+        "provider_key": "${NVIDIA_API_KEY}",
+        "model_id": "${NVIDIA_MODEL_ID}",
+        "base_url": "${NVIDIA_BASE_URL}",
+    },
+    "azure_openai": {
+        "provider_key": "${AZURE_OPENAI_API_KEY}",
+        "model_id": "${AZURE_OPENAI_DEPLOYMENT}",
+        "base_url": "${AZURE_OPENAI_ENDPOINT}",
+        "api_version": "${AZURE_OPENAI_API_VERSION}",
+    },
+    "vertex_ai": {
+        "provider_key": "${GOOGLE_OAUTH_ACCESS_TOKEN}",
+        "model_id": "${VERTEX_MODEL_ID}",
+        "project": "${GOOGLE_CLOUD_PROJECT}",
+        "region": "${GOOGLE_CLOUD_LOCATION}",
+    },
+    "bedrock": {
+        "provider_key": "${AWS_BEARER_TOKEN_BEDROCK}",
+        "model_id": "${BEDROCK_MODEL_ID}",
+        "region": "${AWS_REGION}",
+    },
+    "ollama": {
+        "model_id": "${OLLAMA_MODEL_ID}",
+        "base_url": "${OLLAMA_BASE_URL}",
+    },
+}
+
+
 def _desired_managed_fields(record: dict, current: dict, server_variant: str) -> dict:
     """Compute the managed-block fields from the server record (server-wins).
 
     When the server carries a remote provider (BYOK/managed set from the UI), the
-    provider/model/credential come from the server and any local ``base_url`` is
-    dropped. Otherwise (heuristic / terminal-set local_model, where the server has
-    no provider) the local provider/model/base_url are preserved and only the
-    variant is reconciled.
+    provider/model/credential come from the server. Provider-local extras
+    (``provider_key`` env token, region/project/base_url/api_version) are preserved
+    from the local managed block so sync does not strip local BYOK readiness.
+    Otherwise (heuristic / terminal-set local_model, where the server has no
+    provider) local provider-scoped values are preserved and only the variant is
+    reconciled.
     """
     provider = str(record.get("inference_provider") or "").strip()
     model_id = str(record.get("model_id") or "").strip()
@@ -77,8 +135,20 @@ def _desired_managed_fields(record: dict, current: dict, server_variant: str) ->
             fields["model_id"] = model_id
         if credential_ref:
             fields["credential_ref"] = credential_ref
+        # Preserve local provider-scoped values when server record doesn't carry
+        # them. This keeps local BYOK config/env wiring stable across syncs.
+        for key in ("model_id", "provider_key", "base_url", "region", "project", "api_version"):
+            if key not in fields and current.get(key):
+                fields[key] = current[key]
+        # Local BYOK should be immediately runnable from env after sync. Seed
+        # provider-specific env-token placeholders when missing.
+        if server_variant == "local_byok":
+            defaults = _LOCAL_BYOK_ENV_DEFAULTS.get(provider, {})
+            for key, value in defaults.items():
+                if not str(fields.get(key) or "").strip():
+                    fields[key] = value
     else:
-        for key in ("provider", "model_id", "base_url", "credential_ref"):
+        for key in ("provider", "model_id", "provider_key", "base_url", "region", "project", "api_version", "credential_ref"):
             if current.get(key):
                 fields[key] = current[key]
     return fields
@@ -92,10 +162,11 @@ def sync_execution_variant_from_server(
 ) -> str | None:
     """Pull the server project's execution settings into the managed config block.
 
-    Server-wins for the managed keys (execution_variant / provider / model_id /
-    credential_ref). Secrets (``provider_key``) are never written -- they stay in
-    the environment. Returns the applied variant when the local config changed,
-    else ``None`` (already in sync, offline, unauthenticated, or unbound project).
+    Server-wins for mode/provider identity, while preserving provider-local env
+    wiring in the managed block. ``provider_key`` is written only as an env token
+    placeholder (for example ``${OPENAI_API_KEY}``) and never as a raw secret.
+    Returns the applied variant when the local config changed, else ``None``
+    (already in sync, offline, unauthenticated, or unbound project).
     """
     try:
         project_id = resolve_project_id(project_root)

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.7.16
+Version: 0.7.18
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.2.23
+Requires-Dist: refactorai-core>=3.2.24
 
 # refactorai-cli
 

{refactorai_cli-0.7.16 → refactorai_cli-0.7.18}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.2.23
+refactorai-core>=3.2.24