codna 0.1.0__py3-none-any.whl

codna/secure.py

@@ -0,0 +1,250 @@
+"""`run_secure` — the orchestration brain of codna's security-proof autofix.
+
+It sequences the proof loop and the PR-open gate by DELEGATING to three injected
+privilege-separated collaborators; it contains no proof, sandbox, or GitHub logic itself
+(those live in the engine, the worker, and the writer respectively). Keeping orchestration
+free of execution means CLI/MCP/Action can all call `run_secure` as thin adapters and the
+whole flow is testable offline with stubs.
+
+Privilege domains (see the plan):
+  * `SecurityEngine` — independent reachability + closure proofs (the authority).
+  * `Worker` — runs UNTRUSTED code (baseline scan, patch-gen, build/tests, scanner rerun)
+    in a sandbox with no write token; emits a signed attestation.
+  * `Writer` — cannot execute repo code; verifies the attestation and opens the draft PR
+    with a narrowly-scoped token.
+
+Per the spec: ineligible findings are never remediated, and there is exactly ONE verified
+finding per PR.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Protocol
+
+from .evidence import Attestation
+from .findings import Classification, ClosureStatus, IngestResult, NormalizedFinding
+from .gate import GateDecision, GateInput, evaluate_gate
+from .policy import Policy
+
+
+# --------------------------------------------------------------------- verdicts
+
+@dataclass
+class ReachVerdict:
+    classification: Classification
+    envelope_complete: bool = True
+    proof_type: str | None = None
+
+
+@dataclass
+class Patch:
+    patch_digest: str
+    integrity_ok: bool = True
+    integrity_reason: str = "ok"
+    diff: str = ""  # the unified diff; the writer re-verifies digest_of(diff) == patch_digest
+
+
+@dataclass
+class VerifyResult:
+    build_passed: bool
+    tests_passed: bool
+    mojo_ok: bool
+    scanner_confirms_gone: bool
+    scan_not_degraded: bool
+
+
+@dataclass
+class ClosureVerdict:
+    closure_status: ClosureStatus
+    alternate_path_found: bool = False
+    new_blocking_findings: list = field(default_factory=list)
+
+
+# --------------------------------------------------------------------- seams
+
+class SecurityEngine(Protocol):
+    def analyze(self, ingest: IngestResult, finding: NormalizedFinding) -> ReachVerdict: ...
+    def reprove_closure(self, finding: NormalizedFinding, patch: Patch) -> ClosureVerdict: ...
+
+
+class Worker(Protocol):
+    def reproduce_baseline(self, finding: NormalizedFinding) -> bool: ...
+    def remediate(self, finding: NormalizedFinding) -> Patch: ...
+    def verify(self, finding: NormalizedFinding, patch: Patch) -> VerifyResult: ...
+    def attest(self, finding: NormalizedFinding, patch: Patch, decision_inputs: dict) -> Attestation: ...
+
+
+class Writer(Protocol):
+    def base_unchanged(self, ingest: IngestResult) -> bool: ...
+    def open_draft_pr(self, finding: NormalizedFinding, patch: Patch, attestation: Attestation) -> str | None: ...
+
+
+# --------------------------------------------------------------------- report
+
+@dataclass
+class FindingDecision:
+    canonical_id: str
+    classification: Classification
+    gate: GateDecision | None
+    opened: bool
+    pr_url: str | None
+    skipped_reason: str | None
+
+
+@dataclass
+class SecureReport:
+    findings_total: int
+    analyzed: int
+    eligible: int
+    decisions: list[FindingDecision]
+
+    @property
+    def opened_prs(self) -> list[str]:
+        return [d.pr_url for d in self.decisions if d.opened and d.pr_url]
+
+
+def run_secure(
+    ingest: IngestResult,
+    *,
+    engine: SecurityEngine,
+    worker: Worker,
+    writer: Writer,
+    policy: Policy,
+    open_pr: bool = False,
+) -> SecureReport:
+    """Drive the full loop for every (non-quarantined) finding. Returns a `SecureReport`;
+    opens at most one draft PR per finding, and only when every gate condition holds."""
+    decisions: list[FindingDecision] = []
+    analyzed = eligible = 0
+
+    for finding in ingest.findings:
+        if finding.quarantined:
+            decisions.append(_skip(finding, Classification.UNKNOWN, "artifact quarantined (path escape)"))
+            continue
+
+        analyzed += 1
+        verdict = engine.analyze(ingest, finding)
+
+        is_eligible, elig_reason = policy.is_autofix_eligible(verdict.classification)
+        if not is_eligible:
+            # Ineligible findings are reported but NEVER remediated (no patch generated).
+            decisions.append(_skip(finding, verdict.classification, f"not autofix-eligible: {elig_reason}"))
+            continue
+        eligible += 1
+
+        baseline_ok = worker.reproduce_baseline(finding)
+        patch = worker.remediate(finding)
+        verify = worker.verify(finding, patch)
+        closure = engine.reprove_closure(finding, patch)
+
+        gate_input = GateInput(
+            provenance_valid=ingest.provenance_valid,
+            baseline_reproduced=baseline_ok,
+            classification=verdict.classification,
+            patch_integrity_ok=patch.integrity_ok,
+            build_passed=verify.build_passed,
+            tests_passed=verify.tests_passed,
+            mojo_ok=verify.mojo_ok,
+            scanner_confirms_gone=verify.scanner_confirms_gone,
+            scan_not_degraded=verify.scan_not_degraded,
+            closure_status=closure.closure_status,
+            alternate_path_found=closure.alternate_path_found,
+            new_blocking_findings=closure.new_blocking_findings,
+            attestation_ok=False,  # set below once attested + verified
+            base_unchanged=False,
+        )
+
+        # Attestation + base revalidation are only meaningful if everything else holds and
+        # we actually intend to open a PR; compute them last (steps 20–22).
+        attestation = worker.attest(finding, patch, {"classification": verdict.classification.value})
+        base_unchanged = writer.base_unchanged(ingest)
+        gate_input.attestation_ok = attestation is not None
+        gate_input.base_unchanged = base_unchanged
+
+        decision = evaluate_gate(gate_input, policy)
+        opened = False
+        pr_url = None
+        if decision.should_open_pr and open_pr:
+            # The writer independently re-verifies (attestation, digest, base unchanged); any
+            # failure there means no PR — never propagate a writer error into the report.
+            try:
+                pr_url = writer.open_draft_pr(finding, patch, attestation)
+            except Exception:  # noqa: BLE001 - writer abort -> simply no PR
+                pr_url = None
+            opened = pr_url is not None
+
+        decisions.append(
+            FindingDecision(
+                canonical_id=finding.canonical_id,
+                classification=verdict.classification,
+                gate=decision,
+                opened=opened,
+                pr_url=pr_url,
+                skipped_reason=None,
+            )
+        )
+
+    return SecureReport(
+        findings_total=len(ingest.findings),
+        analyzed=analyzed,
+        eligible=eligible,
+        decisions=decisions,
+    )
+
+
+# --------------------------------------------------------------------- Tier-1 report
+
+@dataclass
+class ClassifyRow:
+    canonical_id: str
+    rule_id: str
+    finding_kind: str
+    classification: str
+    eligible: bool
+    reason: str
+
+
+@dataclass
+class Tier1Report:
+    """Read-only, ZERO-LLM-token reachability report — the fast wedge. Says which findings
+    are exploitable/production-reachable and which would be autofix-eligible, WITHOUT
+    remediating anything (no patch-gen, build, or scanner rerun = no Tier-2 work)."""
+
+    rows: list[ClassifyRow]
+
+    def counts(self) -> dict[str, int]:
+        out: dict[str, int] = {}
+        for r in self.rows:
+            out[r.classification] = out.get(r.classification, 0) + 1
+        return out
+
+    @property
+    def eligible(self) -> int:
+        return sum(1 for r in self.rows if r.eligible)
+
+
+def classify_only(ingest: IngestResult, *, engine: "SecurityEngine", policy: Policy) -> Tier1Report:
+    """Tier-1: classify every finding's reachability and report eligibility. Uses the
+    engine's batch analysis (one request per snapshot) and spends no LLM tokens."""
+    rows: list[ClassifyRow] = []
+    for f in ingest.findings:
+        if f.quarantined:
+            rows.append(ClassifyRow(f.canonical_id, f.rule_id, f.finding_kind.value,
+                                    "quarantined", False, "artifact path escape"))
+            continue
+        verdict = engine.analyze(ingest, f)
+        eligible, reason = policy.is_autofix_eligible(verdict.classification)
+        rows.append(ClassifyRow(f.canonical_id, f.rule_id, f.finding_kind.value,
+                                verdict.classification.value, eligible, reason))
+    return Tier1Report(rows)
+
+
+def _skip(finding: NormalizedFinding, classification: Classification, reason: str) -> FindingDecision:
+    return FindingDecision(
+        canonical_id=finding.canonical_id,
+        classification=classification,
+        gate=None,
+        opened=False,
+        pr_url=None,
+        skipped_reason=reason,
+    )

codna/supervisor.py

@@ -0,0 +1,108 @@
+"""Compatibility wrapper for the owned fixed local runtime manager.
+
+The normal user path is `codna fix` / `codna doctor --start-stack`. This module remains as a
+dev-facing shell entrypoint so existing wrappers can start, inspect, or stop the same runtime.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import sys
+from .runtime import LocalRuntimeError, ensure_running, inspect_runtime, stop_runtime
+from .runtime.config import DEFAULT_PORT_BASE
+
+STATE_PATH = Path(os.environ.get("CODNA_LOCAL_STACK_STATE") or (Path.home() / ".codna" / "runtime" / "local-stack.json"))
+LEGACY_STATE_PATH = Path(os.environ.get("CODNA_LAUNCHER_STATE") or (Path.home() / ".codna" / "launcher.state"))
+
+
+def resolve_port_base(value: str | None = None) -> int:
+    raw = value if value is not None else os.environ.get("CODNA_PORT_BASE")
+    if raw in (None, ""):
+        return DEFAULT_PORT_BASE
+    try:
+        port_base = int(raw)
+    except ValueError as exc:
+        raise ValueError("CODNA_PORT_BASE must be an integer.") from exc
+    if port_base < 1024 or port_base > 65534:
+        raise ValueError("CODNA_PORT_BASE must be between 1024 and 65534.")
+    return port_base
+
+
+def local_runtime_urls(port_base: int | None = None) -> tuple[str, str]:
+    base = resolve_port_base(None if port_base is None else str(port_base))
+    return f"http://127.0.0.1:{base}", f"http://127.0.0.1:{base + 1}"
+
+
+def read_state() -> dict | None:
+    status = inspect_runtime()
+    return status.get("state") if status.get("local") else None
+
+
+def start_detached() -> dict:
+    endpoint = ensure_running()
+    payload = inspect_runtime()
+    payload["started"] = {
+        "engine_url": endpoint.engine_url,
+        "sidecar_url": endpoint.sidecar_url,
+        "local": endpoint.local,
+        "port_base": endpoint.port_base,
+        "runtime_id": endpoint.runtime_id,
+    }
+    return payload
+
+
+def stop_running() -> dict:
+    return stop_runtime()
+
+
+def status_payload() -> dict:
+    return inspect_runtime()
+
+
+def serve() -> int:
+    start_detached()
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="python -m codna.supervisor",
+        description="Manage the local Codna engine + sidecar supervisor.",
+    )
+    subparsers = parser.add_subparsers(dest="command")
+    subparsers.add_parser("serve", help="Run the managed stack in the foreground.")
+    subparsers.add_parser("start", help="Start the managed stack in the background.")
+    subparsers.add_parser("stop", help="Stop the managed background stack.")
+    subparsers.add_parser("status", help="Print the managed stack state.")
+    parser.set_defaults(command="serve")
+    args = parser.parse_args(argv)
+
+    if args.command == "serve":
+        return serve()
+    if args.command == "start":
+        try:
+            print(json.dumps(start_detached(), indent=2))
+            return 0
+        except LocalRuntimeError as exc:
+            print(
+                json.dumps(exc.to_dict(), indent=2),
+                file=sys.stderr,
+            )
+            return 1
+    if args.command == "stop":
+        try:
+            payload = stop_running()
+            print(json.dumps(payload, indent=2))
+            return 0
+        except LocalRuntimeError as exc:
+            print(json.dumps(exc.to_dict(), indent=2), file=sys.stderr)
+            return 1
+    print(json.dumps(status_payload(), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

codna/worker.py

@@ -0,0 +1,161 @@
+"""LocalWorker — the analysis-worker privilege domain.
+
+Runs the UNTRUSTED parts of the loop (baseline scan, patch generation, build, tests, scanner
+rerun, closure inputs) in an ephemeral worktree pinned at the exact commit, inside a sandbox
+that holds NO write credentials and denies egress, then emits a SIGNED evidence attestation.
+It never opens a PR — that is the writer's domain.
+
+Composition only: it wires `Sandbox` (enforcement) + `EphemeralWorktree` (isolation) +
+`reject_evasion` (G4) + `build_attestation` (G9). Execution seams (`scan`, `run_cmd`,
+`mojo_gate`, `patch_generator`) are injectable so the worker is testable offline; the defaults
+shell out through the sandbox.
+"""
+from __future__ import annotations
+
+import os
+from typing import Callable
+
+from .evasion import reject_evasion
+from .evidence import Attestation, Signer, build_attestation, new_nonce
+from .findings import IngestResult, NormalizedFinding, digest_of
+from .manifest import VerificationManifest
+from .netjail import default_network_backend
+from .sandbox import Sandbox, SandboxResult, scrub_env
+from .sarif import ingest_sarif
+from .secure import Patch, VerifyResult
+from .worktree import EphemeralWorktree
+
+
+class WorkerError(Exception):
+    pass
+
+
+class LocalWorker:
+    def __init__(
+        self,
+        *,
+        repo_dir: str,
+        commit: str,
+        manifest: VerificationManifest,
+        signer: Signer,
+        patch_generator: Callable[[NormalizedFinding, str], str],
+        scan: Callable[[str, str], IngestResult] | None = None,
+        run_cmd: Callable[[list, str], SandboxResult] | None = None,
+        mojo_gate: Callable[[str], bool] | None = None,
+        nonce_fn: Callable[[], str] = new_nonce,
+        base_env: dict | None = None,
+        allowed_paths=None,
+        dependency_diff_verified: bool = False,
+    ):
+        self.repo_dir = repo_dir
+        self.commit = commit
+        self.manifest = manifest
+        self.signer = signer
+        self.patch_generator = patch_generator
+        # Sandbox construction scrubs + asserts no write credentials (PRIV-01/02); the network
+        # backend (if available on this host) hard-denies egress for untrusted commands.
+        self.sandbox = Sandbox(
+            network=manifest.sandbox.network,
+            timeout_seconds=manifest.sandbox.timeout_seconds,
+            env=scrub_env(dict(base_env if base_env is not None else os.environ)),
+            network_backend=default_network_backend(),
+        )
+        self._run = run_cmd or (lambda argv, cwd: self.sandbox.run(argv, cwd=cwd))
+        self._scan = scan or self._default_scan
+        self._mojo = mojo_gate or (lambda diff: True)
+        self._nonce_fn = nonce_fn
+        self.allowed_paths = allowed_paths
+        self.dependency_diff_verified = dependency_diff_verified
+        self._wt: EphemeralWorktree | None = None
+        self._baseline: IngestResult | None = None
+        self._artifacts: dict = {}
+
+    # -- default execution seam ------------------------------------------------------
+
+    def _default_scan(self, cwd: str, phase: str) -> IngestResult:
+        sc = self.manifest.scanner
+        res = self._run(sc.command, cwd)
+        if not res.accepted(sc.accepted_exit_codes):
+            raise WorkerError(f"scanner exited {res.returncode} in phase {phase} "
+                              f"(accepted {list(sc.accepted_exit_codes)})")
+        return ingest_sarif(os.path.join(cwd, sc.output))
+
+    def _reset_worktree(self) -> None:
+        if self._wt is not None:
+            self._wt.remove()
+        self._wt = EphemeralWorktree(self.repo_dir, self.commit).create()
+        self._artifacts = {}
+
+    # -- Worker protocol -------------------------------------------------------------
+
+    def reproduce_baseline(self, finding: NormalizedFinding) -> bool:
+        self._reset_worktree()
+        ingest = self._scan(self._wt.path, "baseline")
+        self._baseline = ingest
+        self._artifacts["scanner_outputs"] = {
+            "baseline": {"findings": len(ingest.findings), "rules_digest": ingest.scanner.rules_digest}
+        }
+        # Semantic equivalence on the unpatched snapshot == same canonical id (G2).
+        return any(f.canonical_id == finding.canonical_id for f in ingest.findings)
+
+    def remediate(self, finding: NormalizedFinding) -> Patch:
+        if self._wt is None:
+            raise WorkerError("remediate called before reproduce_baseline")
+        diff = self.patch_generator(finding, self._wt.path)
+        integrity = reject_evasion(
+            diff, allowed_paths=self.allowed_paths,
+            dependency_diff_verified=self.dependency_diff_verified,
+        )
+        self._artifacts["patch_diff"] = diff
+        if integrity.ok:
+            self._wt.apply_patch(diff)
+        self._artifacts["resulting_tree"] = self._wt.tree_digest()
+        return Patch(
+            patch_digest=digest_of(diff),
+            integrity_ok=integrity.ok,
+            integrity_reason="ok" if integrity.ok else "; ".join(v.reason_code for v in integrity.violations),
+            diff=diff,
+        )
+
+    def verify(self, finding: NormalizedFinding, patch: Patch) -> VerifyResult:
+        wt = self._wt.path
+        build_passed = all(self._run(cmd, wt).returncode == 0 for cmd in self.manifest.build)
+        test_results = [self._run(cmd, wt) for cmd in self.manifest.tests]
+        tests_passed = all(r.returncode == 0 for r in test_results)
+        mojo_ok = bool(self._mojo(self._artifacts.get("patch_diff", "")))
+
+        patched = self._scan(wt, "patched")
+        scanner_confirms_gone = not any(f.canonical_id == finding.canonical_id for f in patched.findings)
+        base = self._baseline
+        scan_not_degraded = bool(
+            base is not None
+            and patched.scanner.name == base.scanner.name
+            and patched.scanner.rules_digest == base.scanner.rules_digest
+            and patched.scanner.rules_count >= base.scanner.rules_count
+        )
+
+        self._artifacts.setdefault("scanner_outputs", {})["patched"] = {
+            "findings": len(patched.findings), "rules_digest": patched.scanner.rules_digest
+        }
+        self._artifacts["test_logs"] = "\n".join(r.stdout for r in test_results)[:8192]
+        self._artifacts["mojo_verdict"] = {"ok": mojo_ok}
+        return VerifyResult(build_passed, tests_passed, mojo_ok, scanner_confirms_gone, scan_not_degraded)
+
+    def attest(self, finding: NormalizedFinding, patch: Patch, decision_inputs: dict) -> Attestation:
+        return build_attestation(
+            self.signer,
+            nonce=self._nonce_fn(),
+            original_commit=self.commit,
+            patch_digest=patch.patch_digest,
+            resulting_tree=self._artifacts.get("resulting_tree", "sha256:tree:none"),
+            scanner_outputs=self._artifacts.get("scanner_outputs", {}),
+            proof_results=decision_inputs.get("proof_results", {"classification": decision_inputs.get("classification")}),
+            test_logs=self._artifacts.get("test_logs", ""),
+            mojo_verdict=self._artifacts.get("mojo_verdict", {}),
+            policy_decision=decision_inputs.get("policy_decision", decision_inputs),
+        )
+
+    def close(self) -> None:
+        if self._wt is not None:
+            self._wt.remove()
+            self._wt = None

codna/worktree.py

@@ -0,0 +1,73 @@
+"""Ephemeral git worktree pinned at an exact commit.
+
+The worker analyzes/patches code in a throwaway worktree checked out at the EXACT commit the
+proof is bound to (a detached checkout, never a moving branch ref), and tears it down on both
+success and failure. This isolates patch generation from the user's checkout and guarantees
+the analyzed tree matches the snapshot (PI-WT-01/03/05, PRIV-05/06).
+
+Uses git directly (no network). `git apply` and tree-hashing run here so the worker can compute
+the resulting-tree digest that the attestation binds.
+"""
+from __future__ import annotations
+
+import subprocess
+import tempfile
+
+
+class WorktreeError(Exception):
+    pass
+
+
+def _git(repo_dir: str, *args: str, check: bool = True) -> str:
+    proc = subprocess.run(
+        ["git", "-C", repo_dir, *args],
+        capture_output=True, text=True,
+    )
+    if check and proc.returncode != 0:
+        raise WorktreeError(f"git {' '.join(args)} -> {proc.returncode}: {proc.stderr.strip()}")
+    return proc.stdout
+
+
+class EphemeralWorktree:
+    """Context manager: a detached worktree at `commit`, removed (force + prune) on exit —
+    on success AND on exception."""
+
+    def __init__(self, repo_dir: str, commit: str, prefix: str = "codna-wt-"):
+        self.repo_dir = repo_dir
+        self.commit = commit
+        self.path = tempfile.mkdtemp(prefix=prefix)
+
+    def create(self) -> "EphemeralWorktree":
+        # --force lets us reuse the freshly-created empty temp dir; --detach pins the commit.
+        _git(self.repo_dir, "worktree", "add", "--detach", "--force", self.path, self.commit)
+        return self
+
+    def __enter__(self) -> "EphemeralWorktree":
+        return self.create()
+
+    def __exit__(self, *exc) -> None:
+        self.remove()
+
+    def remove(self) -> None:
+        _git(self.repo_dir, "worktree", "remove", "--force", self.path, check=False)
+        _git(self.repo_dir, "worktree", "prune", check=False)
+
+    @property
+    def head_commit(self) -> str:
+        return _git(self.path, "rev-parse", "HEAD").strip()
+
+    def tree_digest(self) -> str:
+        """sha of the current working tree (after staging) — what the patch produced."""
+        _git(self.path, "add", "-A")
+        return "sha256:tree:" + _git(self.path, "write-tree").strip()
+
+    def apply_patch(self, diff: str) -> None:
+        """Apply a unified diff to the worktree. Raises WorktreeError on a rejected/empty patch."""
+        if not diff.strip():
+            raise WorktreeError("empty patch")
+        proc = subprocess.run(
+            ["git", "-C", self.path, "apply", "--whitespace=nowarn", "-"],
+            input=diff, capture_output=True, text=True,
+        )
+        if proc.returncode != 0:
+            raise WorktreeError(f"git apply failed: {proc.stderr.strip()}")