refactorai-cli 0.7.1__tar.gz → 0.7.3__tar.gz

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.7.1
+Version: 0.7.3
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.2.13
+Requires-Dist: refactorai-core>=3.2.15
 
 # refactorai-cli
 

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "refactorai-cli"
-version = "0.7.1"
+version = "0.7.3"
 description = "Local-first CLI for the refactor platform"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "httpx>=0.27.0",
   "rich>=13.7.0",
   "PyYAML>=6.0.1",
-  "refactorai-core>=3.2.13",
+  "refactorai-core>=3.2.15",
 ]
 
 [project.scripts]

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli/__init__.py

@@ -5,4 +5,4 @@ the shared `refactor_core` pipeline from a project folder while staying
 authenticated to the hosted platform via a developer key.
 """
 
-__version__ = "0.7.1"
+__version__ = "0.7.3"

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli/client.py

@@ -118,3 +118,28 @@ class PlatformClient:
             )
         payload = response.json()
         return payload if isinstance(payload, list) else []
+
+    def resolve_org_bootstrap(self, developer_key: str) -> dict:
+        """Resolve the org governance bootstrap context for the key's account.
+
+        Returns ``{account_context, org_policy_profile, org_config_profile}``.
+        Org fields are ``None`` for personal accounts. Used by
+        ``refactor policy sync`` to refresh the local read-only org cache.
+        """
+        try:
+            response = httpx.get(
+                f"{self.base_url}/v1/keys/org-bootstrap",
+                headers={"Authorization": f"Bearer {developer_key}"},
+                timeout=self.timeout,
+            )
+        except httpx.HTTPError as exc:
+            raise PlatformError(f"Could not reach platform at {self.base_url}: {exc}") from exc
+        if response.status_code == 401:
+            raise PlatformError("Developer key is invalid or revoked", status_code=401)
+        if response.status_code >= 400:
+            raise PlatformError(
+                f"Org policy resolution failed ({response.status_code})",
+                status_code=response.status_code,
+            )
+        payload = response.json()
+        return payload if isinstance(payload, dict) else {}

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli/commands/auth_cmds.py

@@ -1,14 +1,17 @@
-"""`refactor login` and `refactor whoami`."""
+"""`refactor login`, `refactor logout`, and `refactor whoami`."""
 
 from __future__ import annotations
 
+import shutil
+
 import typer
 from rich.console import Console
 
 from refactorai_cli.auth import AuthError, ensure_authenticated
 from refactorai_cli.client import PlatformClient, PlatformError
 from refactorai_cli.credentials import load_credentials, save_credentials
-from refactorai_cli.settings import mask_key, platform_url
+from refactorai_cli.local_paths import credentials_path, validation_cache_dir
+from refactorai_cli.settings import env_api_key, mask_key, platform_url
 
 console = Console()
 
@@ -86,3 +89,37 @@ def whoami() -> None:
         f"[bold]key[/bold]: {mask_key(ctx.key.key)} (source: {source})\n"
         f"[bold]quota_remaining[/bold]: {quota}{suffix}"
     )
+
+
+def logout() -> None:
+    """Clear central credentials and cached key validation state."""
+    creds_path = credentials_path()
+    cache_dir = validation_cache_dir()
+    removed_credentials = False
+    removed_cache = False
+
+    try:
+        if creds_path.exists():
+            creds_path.unlink()
+            removed_credentials = True
+    except OSError as exc:
+        console.print(f"[red]Logout failed:[/red] Could not remove {creds_path}: {exc}")
+        raise typer.Exit(code=1) from exc
+
+    try:
+        if cache_dir.exists():
+            shutil.rmtree(cache_dir)
+            removed_cache = True
+    except OSError as exc:
+        console.print(f"[red]Logout failed:[/red] Could not remove {cache_dir}: {exc}")
+        raise typer.Exit(code=1) from exc
+
+    if removed_credentials or removed_cache:
+        console.print("[green]Logged out.[/green] Cleared saved credentials and validation cache.")
+    else:
+        console.print("[dim]No saved credentials were found.[/dim]")
+    if env_api_key():
+        console.print(
+            "[yellow]Note:[/yellow] REFACTOR_API_KEY is set in your environment; "
+            "that key still takes precedence."
+        )

refactorai_cli-0.7.3/refactorai_cli/commands/policy_cmds.py

@@ -0,0 +1,168 @@
+"""``refactor policy`` — inspect and sync organization governance.
+
+Organization policy is authoritative on the cloud and cached read-only under
+``~/.refactor`` (never in the repo). These commands let a developer:
+
+* ``refactor policy show`` — view the resolved org policy + config guardrails
+  and their integrity/version status (offline, read-only).
+* ``refactor policy sync`` — refresh the local cache from the cloud (resolves
+  ``ORG_POLICY_STALE`` after an admin publishes a new version, or restores a
+  locally tampered cache).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import typer
+from rich.console import Console
+
+from refactor_core.org_policy import verify_policy_integrity
+from refactor_core.store import (
+    read_governance_events,
+    read_org_policy_cache,
+    resolve_project_id as resolve_store_project_id,
+    summarize_governance_events,
+    write_org_policy_cache,
+)
+
+from refactorai_cli.auth import AuthError, ensure_authenticated
+from refactorai_cli.client import PlatformClient, PlatformError
+
+app = typer.Typer(help="Inspect and sync organization governance policy.")
+console = Console()
+
+
+def _project_root() -> Path:
+    try:
+        return Path.cwd()
+    except OSError as exc:
+        console.print("[red]Could not resolve the current project directory.[/red]")
+        raise typer.Exit(code=1) from exc
+
+
+@app.command("show")
+def show() -> None:
+    """Show the resolved organization policy and config guardrails (read-only)."""
+    project_root = _project_root()
+    pid = resolve_store_project_id(project_root)
+    cached = read_org_policy_cache(project_root, project_id=pid or None)
+    if not cached:
+        console.print(
+            "[dim]This project is not organization-governed "
+            "(personal account, or no org policy resolved at init).[/dim]"
+        )
+        raise typer.Exit(code=0)
+
+    markdown, meta = cached
+    policy = meta.get("policy", {}) if isinstance(meta, dict) else {}
+    config = meta.get("config", {}) if isinstance(meta, dict) else {}
+    account_slug = meta.get("account_slug") if isinstance(meta, dict) else ""
+
+    source = str(policy.get("source") or "system_default")
+    version = policy.get("version")
+    integrity_ok = verify_policy_integrity(markdown, str(policy.get("hash") or ""))
+
+    console.print(f"[bold]Organization[/bold]: {account_slug or '?'}")
+    console.print(f"[bold]Policy source[/bold]: {source} (v{version})")
+    console.print(
+        f"[bold]Integrity[/bold]: "
+        + ("[green]OK[/green]" if integrity_ok else "[red]TAMPERED — run `refactor policy sync`[/red]")
+    )
+    console.print(f"[bold]Resolved at[/bold]: {meta.get('resolved_at') if isinstance(meta, dict) else '?'}")
+
+    locked = list(config.get("locked_paths") or [])
+    required = list(config.get("required_paths") or [])
+    forbidden = list(config.get("forbidden_paths") or [])
+    console.print(
+        "[bold]Config guardrails[/bold]: "
+        f"locked={locked or '—'} required={required or '—'} forbidden={forbidden or '—'}"
+    )
+
+    summary = summarize_governance_events(
+        read_governance_events(project_root, project_id=pid or None)
+    )
+    if summary.get("total"):
+        counts = summary.get("counts", {})
+        console.print(
+            "[bold]Enforcement history[/bold]: "
+            f"ok={counts.get('ok', 0)} "
+            f"tamper={counts.get('tamper', 0)} "
+            f"guardrail_violation={counts.get('guardrail_violation', 0)} "
+            f"(last {summary.get('last_ts') or '—'})"
+        )
+
+    console.print("\n[bold]Organization Policy[/bold]:")
+    if markdown.strip():
+        console.print(markdown.strip())
+    else:
+        console.print("[dim](none — organization has not published a policy; system defaults apply)[/dim]")
+
+
+@app.command("sync")
+def sync() -> None:
+    """Refresh the local org policy/config cache from the cloud."""
+    project_root = _project_root()
+    pid = resolve_store_project_id(project_root)
+
+    try:
+        auth_ctx = ensure_authenticated(project_root, force_remote=True)
+    except AuthError as exc:
+        console.print(f"[red]Authentication required to sync org policy:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+
+    client = PlatformClient()
+    try:
+        data = client.resolve_org_bootstrap(auth_ctx.key.key)
+    except PlatformError as exc:
+        console.print(f"[red]Could not resolve organization policy:[/red] {exc}")
+        raise typer.Exit(code=1) from exc
+
+    account_ctx = data.get("account_context") or {}
+    policy_ctx = data.get("org_policy_profile")
+    config_ctx = data.get("org_config_profile")
+
+    if not policy_ctx and not config_ctx:
+        console.print(
+            "[dim]Account is personal / not organization-governed; nothing to sync.[/dim]"
+        )
+        raise typer.Exit(code=0)
+
+    policy_ctx = policy_ctx or {}
+    config_ctx = config_ctx or {}
+
+    previous = read_org_policy_cache(project_root, project_id=pid or None)
+    old_version = None
+    if previous is not None:
+        old_version = (previous[1].get("policy", {}) or {}).get("version")
+
+    write_org_policy_cache(
+        project_root,
+        project_id=pid or None,
+        account_slug=str(account_ctx.get("slug") or auth_ctx.account_slug or ""),
+        policy_source=str(policy_ctx.get("source") or "system_default"),
+        policy_version=int(policy_ctx.get("version") or 0),
+        policy_hash=str(policy_ctx.get("org_policies_hash") or ""),
+        policy_markdown=str(policy_ctx.get("org_policies_markdown") or ""),
+        policy_profile_id=policy_ctx.get("profile_id"),
+        config_source=str(config_ctx.get("source") or "system_default"),
+        config_version=int(config_ctx.get("version") or 0),
+        config_profile_id=config_ctx.get("profile_id"),
+        config_template_yaml=str(config_ctx.get("config_template_yaml") or ""),
+        locked_paths=list(config_ctx.get("locked_paths") or []),
+        required_paths=list(config_ctx.get("required_paths") or []),
+        forbidden_paths=list(config_ctx.get("forbidden_paths") or []),
+    )
+
+    new_version = int(policy_ctx.get("version") or 0)
+    slug = account_ctx.get("slug") or auth_ctx.account_slug or "?"
+    if old_version is not None and new_version != old_version:
+        console.print(
+            f"[green]Synced[/green] organization policy for [bold]{slug}[/bold]: "
+            f"v{old_version} → v{new_version}."
+        )
+    else:
+        console.print(
+            f"[green]Synced[/green] organization policy for [bold]{slug}[/bold] (v{new_version})."
+        )
+    console.print("[dim]Cache refreshed under ~/.refactor (never written into your repo).[/dim]")

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli/commands/run_cmds.py

@@ -33,9 +33,16 @@ from refactor_core.constitution import (
     has_raw_secret_literal,
     load_config,
     load_constitution,
+    parse_config,
     raw_secret_matches,
     raw_secret_matches_config,
 )
+from refactor_core.org_policy import (
+    ORG_POLICY_TAMPERED,
+    assemble_effective_body,
+    check_config_guardrails,
+    verify_policy_integrity,
+)
 from refactor_core.compliance_settings import (
     ComplianceSelectionError,
     resolve_compliance_selection,
@@ -91,8 +98,11 @@ from refactor_core.store import (
     head_run_dir,
     list_runs,
     prune_runs,
+    read_org_policy_cache,
+    record_governance_event,
     resolve_project_id as resolve_store_project_id,
     resolve_store_dir,
+    write_org_policy_cache,
     read_findings,
     read_report,
     read_sandbox_install_history,
@@ -911,9 +921,115 @@ def _load_project() -> tuple[Path, object, object]:
     constitution = load_constitution(consti_path)
     config = load_config(config_path)
     _warn_raw_key(constitution, config)
+    _apply_org_governance(consti_path.parent, constitution, config)
     return consti_path.parent, constitution, config
 
 
+def _apply_org_governance(project_root: Path, constitution, config) -> None:
+    """Enforce org governance and assemble the effective constitution.
+
+    For org-governed projects (a home-level org cache exists) this runs three
+    deterministic, offline checks before any command touches the pipeline:
+
+    1. Tamper detection — the cached org policy must still match its pinned hash.
+    2. Config guardrails — locked/required/forbidden config paths.
+    3. Precedence assembly — org policy is prepended to the constitution body so
+       the engine always sees it first ("org wins").
+
+    Personal accounts (no cache) are a no-op. ``REFACTOR_ORG_POLICY_ENFORCEMENT
+    =warn`` downgrades blocking to warnings for emergency use.
+    """
+    try:
+        pid = resolve_store_project_id(project_root)
+        cached = read_org_policy_cache(project_root, project_id=pid or None)
+    except Exception:
+        cached = None
+    if not cached:
+        return
+
+    markdown, meta = cached
+    policy_meta = meta.get("policy", {}) if isinstance(meta, dict) else {}
+    config_meta = meta.get("config", {}) if isinstance(meta, dict) else {}
+    account_slug = str(meta.get("account_slug") or "") if isinstance(meta, dict) else ""
+    warn_only = (
+        str(os.environ.get("REFACTOR_ORG_POLICY_ENFORCEMENT", "block")).strip().lower() == "warn"
+    )
+
+    pid_for_ledger = None
+    try:
+        pid_for_ledger = resolve_store_project_id(project_root)
+    except Exception:
+        pid_for_ledger = None
+
+    def _telemetry(event: str, *, detail: str = "", codes: list[str] | None = None) -> None:
+        # Local-only observability; never let it break the command.
+        try:
+            record_governance_event(
+                project_root,
+                project_id=pid_for_ledger or None,
+                event=event,
+                detail=detail,
+                codes=codes,
+            )
+        except Exception:
+            pass
+
+    def _block(message: str) -> None:
+        if warn_only:
+            console.print(f"[yellow]Warning (enforcement bypassed):[/yellow] {message}")
+            return
+        console.print(message)
+        raise typer.Exit(code=1)
+
+    # 1) Tamper detection.
+    if not verify_policy_integrity(markdown, str(policy_meta.get("hash") or "")):
+        _telemetry("tamper", detail=account_slug, codes=[ORG_POLICY_TAMPERED])
+        _block(
+            f"[red]{ORG_POLICY_TAMPERED}[/red]: the cached organization policy for account "
+            f"[bold]{account_slug or '?'}[/bold] was modified locally and no longer matches the "
+            "version published by your organization. Run `refactor policy sync` to restore it."
+        )
+
+    # 2) Config guardrails.
+    org_settings: dict = {}
+    template_yaml = str(config_meta.get("template_yaml") or "")
+    if template_yaml.strip():
+        try:
+            org_settings = dict(parse_config(template_yaml).settings or {})
+        except Exception:
+            org_settings = {}
+    violations = check_config_guardrails(
+        dict(getattr(config, "settings", {}) or {}),
+        org_settings,
+        locked_paths=list(config_meta.get("locked_paths") or []),
+        required_paths=list(config_meta.get("required_paths") or []),
+        forbidden_paths=list(config_meta.get("forbidden_paths") or []),
+    )
+    if violations:
+        _telemetry(
+            "guardrail_violation",
+            detail=account_slug,
+            codes=[v.code for v in violations],
+        )
+        for violation in violations:
+            console.print(f"[red]{violation.code}[/red]: {violation.detail}")
+        console.print(
+            "[dim]These settings are governed by your organization. Update "
+            f"{CONFIG_FILENAME} to comply, or ask an org admin to change the policy.[/dim]"
+        )
+        if not warn_only:
+            raise typer.Exit(code=1)
+
+    # 3) Effective-constitution assembly (org policy first; charter underneath).
+    if markdown.strip():
+        constitution.body = assemble_effective_body(
+            getattr(constitution, "body", "") or "", markdown
+        )
+
+    # Clean pass: record a compliant outcome for observability.
+    _telemetry("ok", detail=account_slug)
+
+
 def _print_store_context(project_root) -> None:
     """Surface the resolved project id + central store dir for this run.
 
@@ -1150,16 +1266,54 @@ def init(
     config_target.write_text(config_text, encoding="utf-8")
 
     constitution = load_constitution(consti_target)
-    record = register_project(
-        project_root, constitution_hash=constitution.content_hash, project_id=project_id
-    )
+    register_project(project_root, constitution_hash=constitution.content_hash, project_id=project_id)
+
+    # Org-governed projects: materialize the resolved org policy + config
+    # guardrails at HOME level only (never in the repo). The committed
+    # refactor.consti stays charter-only; the org policy is authoritative on the
+    # cloud and cached read-only under ~/.refactor for offline/runtime assembly.
+    org_policy_ctx = created.get("org_policy_profile") if isinstance(created, dict) else None
+    org_config_ctx = created.get("org_config_profile") if isinstance(created, dict) else None
+    account_ctx = created.get("account_context") if isinstance(created, dict) else None
+    org_cached_meta: dict | None = None
+    if isinstance(org_policy_ctx, dict) or isinstance(org_config_ctx, dict):
+        policy_ctx = org_policy_ctx or {}
+        config_ctx = org_config_ctx or {}
+        org_cached_meta = write_org_policy_cache(
+            project_root,
+            project_id=project_id,
+            account_slug=str((account_ctx or {}).get("slug") or account_slug or ""),
+            policy_source=str(policy_ctx.get("source") or "system_default"),
+            policy_version=int(policy_ctx.get("version") or 0),
+            policy_hash=str(policy_ctx.get("org_policies_hash") or ""),
+            policy_markdown=str(policy_ctx.get("org_policies_markdown") or ""),
+            policy_profile_id=policy_ctx.get("profile_id"),
+            config_source=str(config_ctx.get("source") or "system_default"),
+            config_version=int(config_ctx.get("version") or 0),
+            config_profile_id=config_ctx.get("profile_id"),
+            config_template_yaml=str(config_ctx.get("config_template_yaml") or ""),
+            locked_paths=list(config_ctx.get("locked_paths") or []),
+            required_paths=list(config_ctx.get("required_paths") or []),
+            forbidden_paths=list(config_ctx.get("forbidden_paths") or []),
+        )
+
     console.print(f"[green]Created[/green] {consti_target}")
     console.print(f"[green]Created[/green] {config_target}")
-    account_note = f" (account {account_slug})" if account_slug else ""
+    account_type = str((account_ctx or {}).get("type") or "").strip().lower()
+    account_name = str((account_ctx or {}).get("display_name") or "").strip()
+    account_slug = str((account_ctx or {}).get("slug") or account_slug or "").strip()
+    if account_type == "organization":
+        account_label = "organization"
+    elif account_type:
+        account_label = account_type
+    else:
+        account_label = "account"
+    account_parts = [part for part in (account_name, account_slug) if part]
+    account_value = " / ".join(account_parts) if account_parts else auth_ctx.account_id
     console.print(
-        f"[green]Linked[/green] to cloud project [bold]{project_name}[/bold]"
-        f"{account_note}. The project id is saved in {CONFIG_FILENAME}; "
-        "rename the project or attach a repository anytime from the web UI."
+        f"[green]Linked[/green] cloud project [bold]{project_name}[/bold]. "
+        f"{account_label.title()}: [bold]{account_value}[/bold]. "
+        f"Project id saved in {CONFIG_FILENAME}."
     )
     if config_profile == "local_server":
         console.print(
@@ -1172,13 +1326,26 @@ def init(
             "(mode=cloud_byok, env-key-first via provider_key; credential_ref is optional fallback)."
         )
     console.print(
-        f"[green]Registered[/green] project in central store: {resolve_store_dir(project_root)}"
-    )
-    console.print(
-        f"Only {CONSTITUTION_FILENAME} and {CONFIG_FILENAME} are added to your repo; "
-        "all run state stays under ~/.refactor "
-        f"(encoded: {record['encoded']})."
+        f"Only {CONSTITUTION_FILENAME} and {CONFIG_FILENAME} are added to your repo. "
+        "Runtime state stays outside the repository."
     )
+    if org_cached_meta is not None:
+        policy_meta = org_cached_meta.get("policy", {}) if isinstance(org_cached_meta, dict) else {}
+        source = str(policy_meta.get("source") or "system_default")
+        version = policy_meta.get("version")
+        if source == "active":
+            console.print(
+                f"[green]Applied[/green] organization policy (v{version}) from account "
+                f"[bold]{org_cached_meta.get('account_slug') or account_slug}[/bold]. "
+                f"It is cached locally and layered above your "
+                f"editable {CONSTITUTION_FILENAME} charter at run time; it is never "
+                "written into your repo."
+            )
+        else:
+            console.print(
+                "[dim]Organization has no published policy yet; using system defaults. "
+                f"Your {CONSTITUTION_FILENAME} charter is fully in effect.[/dim]"
+            )
     _offer_commit_hook(project_root)
 
 

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli/main.py

@@ -16,6 +16,7 @@ from refactorai_cli.commands import (
     engine_cmds,
     hook_cmds,
     model_cmds,
+    policy_cmds,
     pre_push_cmds,
     request_cmds,
     runtime_cmds,
@@ -118,6 +119,7 @@ def main(
 
 # Auth (R7.1)
 app.command()(auth_cmds.login)
+app.command()(auth_cmds.logout)
 app.command()(auth_cmds.whoami)
 app.add_typer(account_cmds.app, name="account")
 
@@ -172,6 +174,9 @@ app.add_typer(watch_cmds.watch_app, name="watch")
 app.add_typer(branch_cmds.app, name="branch")
 app.add_typer(request_cmds.app, name="request")
 
+# Organization governance: inspect/sync org policy + config guardrails (docs/45).
+app.add_typer(policy_cmds.app, name="policy")
+
 
 if __name__ == "__main__":
     app()

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: refactorai-cli
-Version: 0.7.1
+Version: 0.7.3
 Summary: Local-first CLI for the refactor platform
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -8,7 +8,7 @@ Requires-Dist: typer>=0.12.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: rich>=13.7.0
 Requires-Dist: PyYAML>=6.0.1
-Requires-Dist: refactorai-core>=3.2.13
+Requires-Dist: refactorai-core>=3.2.15
 
 # refactorai-cli
 

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli.egg-info/SOURCES.txt

@@ -38,6 +38,7 @@ refactorai_cli/commands/cloud_cmds.py
 refactorai_cli/commands/engine_cmds.py
 refactorai_cli/commands/hook_cmds.py
 refactorai_cli/commands/model_cmds.py
+refactorai_cli/commands/policy_cmds.py
 refactorai_cli/commands/pre_push_cmds.py
 refactorai_cli/commands/request_cmds.py
 refactorai_cli/commands/rules_cmds.py

{refactorai_cli-0.7.1 → refactorai_cli-0.7.3}/refactorai_cli.egg-info/requires.txt

@@ -2,4 +2,4 @@ typer>=0.12.0
 httpx>=0.27.0
 rich>=13.7.0
 PyYAML>=6.0.1
-refactorai-core>=3.2.13
+refactorai-core>=3.2.15