codna 0.1.18__tar.gz → 0.1.20__tar.gz

{codna-0.1.18 → codna-0.1.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.18
+Version: 0.1.20
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -119,21 +119,20 @@ codna mcp
 Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
 repo understanding as a local tool.
 
-## Local Memory
+## Optional Local Memory
 
-Base `pip install codna` includes Codna's local Telys recall path: the public
-Telys SDK, Codna's vendored local runtime package, and release-wheel native
-runtime artifacts for supported platforms. It also includes the generic
-tree-sitter language extractors used by local Telys recall for JS/TS, Go, Rust,
-Java, C/C++, C#, PHP, and Ruby; Python uses the stdlib AST extractor.
+Optional local code-memory support is available through:
 
-The optional `codna[memory]` extra adds heavier recall enhancements such as
-FAISS and WordLlama reranking. It is not required for basic on-device recall.
+```bash
+pip install "codna[memory]"
+```
 
-Source distributions intentionally exclude bundled native runtime artifacts and
-OEM licenses; platform wheels carry them at release time. Source-checkout and
-unsupported-platform development can point Codna at an explicit runtime with
-`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+The memory extra uses the public Telys SDK internally for on-device retrieval,
+but the user-facing artifact is still Codna. Supported platform wheels include
+the signed native Telys runtime and Codna OEM license at release time. Source
+distributions intentionally exclude bundled native runtime artifacts; source
+checkout and unsupported-platform development can point Codna at an explicit
+runtime with `TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
 
 ## Security And Local Files
 

{codna-0.1.18 → codna-0.1.20}/README.md

@@ -50,21 +50,20 @@ codna mcp
 Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
 repo understanding as a local tool.
 
-## Local Memory
+## Optional Local Memory
 
-Base `pip install codna` includes Codna's local Telys recall path: the public
-Telys SDK, Codna's vendored local runtime package, and release-wheel native
-runtime artifacts for supported platforms. It also includes the generic
-tree-sitter language extractors used by local Telys recall for JS/TS, Go, Rust,
-Java, C/C++, C#, PHP, and Ruby; Python uses the stdlib AST extractor.
+Optional local code-memory support is available through:
 
-The optional `codna[memory]` extra adds heavier recall enhancements such as
-FAISS and WordLlama reranking. It is not required for basic on-device recall.
+```bash
+pip install "codna[memory]"
+```
 
-Source distributions intentionally exclude bundled native runtime artifacts and
-OEM licenses; platform wheels carry them at release time. Source-checkout and
-unsupported-platform development can point Codna at an explicit runtime with
-`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+The memory extra uses the public Telys SDK internally for on-device retrieval,
+but the user-facing artifact is still Codna. Supported platform wheels include
+the signed native Telys runtime and Codna OEM license at release time. Source
+distributions intentionally exclude bundled native runtime artifacts; source
+checkout and unsupported-platform development can point Codna at an explicit
+runtime with `TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
 
 ## Security And Local Files
 

{codna-0.1.18 → codna-0.1.20}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.18"
+__version__ = "0.1.20"

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/run-server.bundle.mjs

@@ -254784,6 +254784,31 @@ function writeScopeBeforeTool(ctx) {
   }
   return;
 }
+function writeScopeBeforeToolForAllowedPaths(allowedPaths) {
+  const allowed = new Set((allowedPaths ?? []).map(normalizeAllowedPath).filter((path2) => Boolean(path2)));
+  return (ctx) => {
+    const base = writeScopeBeforeTool(ctx);
+    if (base || allowed.size === 0 || !WRITE_TOOLS.has(ctx.toolCall.toolName)) {
+      return base;
+    }
+    for (const path2 of extractWritePaths(ctx.input)) {
+      const normalized2 = normalizeAllowedPath(path2);
+      if (normalized2 && !allowed.has(normalized2)) {
+        return {
+          stop: true,
+          reason: `write-scope violation: '${path2}' is outside Codna's localized evidence set`
+        };
+      }
+    }
+    return;
+  };
+}
+function normalizeAllowedPath(rawPath) {
+  const p7 = rawPath.replace(/\\/g, "/").trim();
+  if (!p7 || scopeViolation(p7))
+    return null;
+  return p7.replace(/^\.\//, "");
+}
 
 // vendor/cline/algenta/proof-provider.ts
 var ALGENTA_PROOF_PROVIDER_ID = "algenta-proof";
@@ -255138,6 +255163,10 @@ function buildSystemPrompt(args) {
     guidance.push("If the bundle includes TARGET FILE EXCERPTS, use those exact lines for the edit and do not spend turns re-reading the same file.");
     guidance.push("If a TARGET FILE EXCERPT already marks the focus line or that the excerpt reaches EOF, do not call localize, read_files, or run_commands just to inspect that same file again before attempting the edit.");
   }
+  if (taskKind === "fix" && args.allowed_write_paths && args.allowed_write_paths.length > 0) {
+    guidance.push(`Only edit these repository-relative files in this localized run: ${args.allowed_write_paths.join(", ")}.`);
+    guidance.push("Do not create files from failing test ids such as package.module::test_name; those are identifiers, not paths.");
+  }
   return guidance.join(" ") + (args.injected_context ? `
 
 [REPOSITORY EVIDENCE BUNDLE \u2014 authoritative; prefer it over exploring the repo]
@@ -255145,6 +255174,7 @@ ${args.injected_context}` : "");
 }
 function buildStartConfig(args, provider) {
   const engineEnabled = Boolean(args.engine?.enabled && args.engine.url);
+  const beforeTool = writeScopeBeforeToolForAllowedPaths(args.allowed_write_paths);
   const budgetEnv = Number(process.env.AGENT_CORE_THINKING_BUDGET_TOKENS || 0);
   const isGemini = /gemini|google/i.test(provider.providerId);
   const thinkingBudgetTokens = budgetEnv > 0 && isGemini ? Math.max(128, budgetEnv) : undefined;
@@ -255162,7 +255192,7 @@ function buildStartConfig(args, provider) {
       enableTools: true,
       enableSpawnAgent: Boolean(args.enable_spawn_agent),
       enableAgentTeams: Boolean(args.enable_agent_teams),
-      hooks: engineEnabled ? { beforeTool: writeScopeBeforeTool, afterTool: mojoGateAfterTool } : { beforeTool: writeScopeBeforeTool },
+      hooks: engineEnabled ? { beforeTool, afterTool: mojoGateAfterTool } : { beforeTool },
       ...engineEnabled ? {
         pluginPaths: [
           new URL("./algenta-plugin.ts", import.meta.url).pathname
@@ -256284,6 +256314,7 @@ function buildRunAgentArgs(session) {
     limits: session.limits,
     enable_spawn_agent: session.enableSpawnAgent,
     enable_agent_teams: session.enableAgentTeams,
+    allowed_write_paths: session.allowedWritePaths,
     engine: engine ? { enabled: true, ...engine } : undefined
   };
 }
@@ -256747,6 +256778,7 @@ function normalizeSessionPayload(payload, owner) {
     suppressExploration: Boolean(args.suppress_exploration),
     enableSpawnAgent: Boolean(args.enable_spawn_agent),
     enableAgentTeams: Boolean(args.enable_agent_teams),
+    allowedWritePaths: stringArray(payload.allowed_write_paths),
     limits: args.limits,
     engine,
     policy,
@@ -257604,7 +257636,12 @@ async function handleRunCompatibility(request2, response) {
       });
       console.error(`[fallback] tier-1 (${session.toolProfile ?? "default"}) terminal=${session.terminalState} ` + `changed nothing/failed \u2192 escalating to ${FALLBACK_TOOL_PROFILE} (full exploration)`);
       resetWorkingTree(session.workingDir);
-      const session2 = normalizeSessionPayload({ ...enrichedPayload, suppress_exploration: false, tool_profile: FALLBACK_TOOL_PROFILE }, owner);
+      const session2 = normalizeSessionPayload({
+        ...enrichedPayload,
+        allowed_write_paths: [],
+        suppress_exploration: false,
+        tool_profile: FALLBACK_TOOL_PROFILE
+      }, owner);
       SERVER_STATE.sessions.set(session2.sessionId, session2);
       await startSession(EXECUTION_CONTEXT, session2, session2.prompt);
       runSession = session2;

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/adapter.ts

@@ -6,7 +6,7 @@
 // and tool metadata from the SDK result surface.
 import { ClineCore, Llms } from "@cline/core";
 import { mojoGateAfterTool } from "./mojo-gate";
-import { writeScopeBeforeTool } from "./write-scope";
+import { writeScopeBeforeToolForAllowedPaths } from "./write-scope";
 import {
 	ALGENTA_PROOF_API_KEY_ENV,
 	ALGENTA_PROOF_MODEL_ID,
@@ -43,6 +43,7 @@ export interface RunAgentArgs {
 	limits?: { maxIterations?: number; timeoutMs?: number };
 	enable_spawn_agent?: boolean;
 	enable_agent_teams?: boolean;
+	allowed_write_paths?: string[];
 	// Per-run engine config (B3/PR8): threaded into AsyncLocalStorage for the run instead of
 	// process-global env, so concurrent runs are isolated and no API key bleeds across tenants.
 	engine?: { enabled: boolean } & EngineContext;
@@ -234,6 +235,14 @@ export function buildSystemPrompt(args: RunAgentArgs): string {
 			"If a TARGET FILE EXCERPT already marks the focus line or that the excerpt reaches EOF, do not call localize, read_files, or run_commands just to inspect that same file again before attempting the edit.",
 		);
 	}
+	if (taskKind === "fix" && args.allowed_write_paths && args.allowed_write_paths.length > 0) {
+		guidance.push(
+			`Only edit these repository-relative files in this localized run: ${args.allowed_write_paths.join(", ")}.`,
+		);
+		guidance.push(
+			"Do not create files from failing test ids such as package.module::test_name; those are identifiers, not paths.",
+		);
+	}
 	return (
 		guidance.join(" ") +
 		(args.injected_context
@@ -247,6 +256,7 @@ export function buildStartConfig(
 	provider: ResolvedProviderConfig,
 ): Parameters<typeof ClineCore.prototype.start>[0] {
 	const engineEnabled = Boolean(args.engine?.enabled && args.engine.url);
+	const beforeTool = writeScopeBeforeToolForAllowedPaths(args.allowed_write_paths);
 	// Cap gemini's reasoning budget. gemini-2.5-pro leaves thinking effectively unbounded and
 	// over-generates (~9k output tokens for a 1-line fix → minutes/turn), whereas gpt-5.4/claude are
 	// efficient. AGENT_CORE_THINKING_BUDGET_TOKENS caps it FOR GEMINI ONLY (leave others at their
@@ -279,8 +289,8 @@ export function buildStartConfig(
 			// B7: the write-scope guard is ALWAYS on (blocks out-of-scope writes pre-disk),
 			// independent of engine mode. The govern (risk) hook is engine-gated.
 			hooks: engineEnabled
-				? { beforeTool: writeScopeBeforeTool, afterTool: mojoGateAfterTool }
-				: { beforeTool: writeScopeBeforeTool },
+				? { beforeTool, afterTool: mojoGateAfterTool }
+				: { beforeTool },
 			...(engineEnabled
 				? {
 						pluginPaths: [

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/policy.test.ts

@@ -114,6 +114,14 @@ test("session_id is path-validated; the artifact run id is server-generated (dec
 	expect(() => normalizeSessionPayload({ ...base, session_id: "a/b" }, "owner")).toThrow();
 });
 
+test("session stores localized allowed write paths per run", () => {
+	const session = normalizeSessionPayload(
+		{ ...base, allowed_write_paths: ["calc.py", "tests/test_calc.py"] },
+		"owner",
+	);
+	expect(session.allowedWritePaths).toEqual(["calc.py", "tests/test_calc.py"]);
+});
+
 test("proofRunDir rejects unsafe run ids and confines to the runs root", () => {
 	const ctx = { rootDir: "/tmp/root" } as never;
 	expect(proofRunDir(ctx, "run_abc-123")).toBe("/tmp/root/build/proofs/cline/runs/run_abc-123");

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/run-server.ts

@@ -210,7 +210,12 @@ async function handleRunCompatibility(
 			);
 			resetWorkingTree(session.workingDir);
 			const session2 = normalizeSessionPayload(
-				{ ...enrichedPayload, suppress_exploration: false, tool_profile: FALLBACK_TOOL_PROFILE },
+				{
+					...enrichedPayload,
+					allowed_write_paths: [],
+					suppress_exploration: false,
+					tool_profile: FALLBACK_TOOL_PROFILE,
+				},
 				owner,
 			);
 			SERVER_STATE.sessions.set(session2.sessionId, session2);

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/server/contracts.ts

@@ -126,6 +126,7 @@ export interface SessionRecord {
 	suppressExploration: boolean;
 	enableSpawnAgent: boolean;
 	enableAgentTeams: boolean;
+	allowedWritePaths: string[];
 	limits?: { maxIterations?: number; timeoutMs?: number };
 	engine: SessionEngineConfig;
 	policy: SessionPolicy;

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/server/execution.ts

@@ -61,6 +61,7 @@ export function buildRunAgentArgs(session: SessionRecord): RunAgentArgs {
 		limits: session.limits,
 		enable_spawn_agent: session.enableSpawnAgent,
 		enable_agent_teams: session.enableAgentTeams,
+		allowed_write_paths: session.allowedWritePaths,
 		// gates the Algenta tools/govern-hook in buildStartConfig (engineEnabled)
 		engine: engine ? { enabled: true, ...engine } : undefined,
 	};

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/server/policy.ts

@@ -354,6 +354,7 @@ export function normalizeSessionPayload(
 		suppressExploration: Boolean(args.suppress_exploration),
 		enableSpawnAgent: Boolean(args.enable_spawn_agent),
 		enableAgentTeams: Boolean(args.enable_agent_teams),
+		allowedWritePaths: stringArray(payload.allowed_write_paths),
 		limits: args.limits,
 		engine,
 		policy,

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/write-scope.test.ts

@@ -1,6 +1,10 @@
 // B7/PR10c: the write-scope beforeTool guard blocks out-of-scope writes pre-disk.
 import { expect, test } from "bun:test";
-import { scopeViolation, writeScopeBeforeTool } from "./write-scope";
+import {
+	scopeViolation,
+	writeScopeBeforeTool,
+	writeScopeBeforeToolForAllowedPaths,
+} from "./write-scope";
 
 const ctx = (toolName: string, input: unknown) => ({ toolCall: { toolName }, input }) as never;
 
@@ -24,3 +28,12 @@ test("non-write tools are not gated", () => {
 	expect(writeScopeBeforeTool(ctx("read_file", { path: "/anywhere/at/all" }))).toBeUndefined();
 	expect(writeScopeBeforeTool(ctx("grep", { pattern: "x" }))).toBeUndefined();
 });
+
+test("localized allowlist blocks writing files that are not evidence targets", () => {
+	const guard = writeScopeBeforeToolForAllowedPaths(["calc.py", "./tests/test_calc.py"]);
+	expect(guard(ctx("editor", { path: "calc.py" }))).toBeUndefined();
+	expect(guard(ctx("apply_patch", { files: ["tests/test_calc.py"] }))).toBeUndefined();
+	const blocked = guard(ctx("editor", { path: "tests.test_calc" }));
+	expect(blocked?.stop).toBe(true);
+	expect(blocked?.reason).toContain("outside Codna's localized evidence set");
+});

{codna-0.1.18 → codna-0.1.20}/codna/agent-core/vendor/cline/algenta/write-scope.ts

@@ -58,3 +58,36 @@ export function writeScopeBeforeTool(
 	}
 	return undefined;
 }
+
+export function writeScopeBeforeToolForAllowedPaths(
+	allowedPaths?: readonly string[],
+): (ctx: AgentBeforeToolContext) => AgentBeforeToolResult | undefined {
+	const allowed = new Set(
+		(allowedPaths ?? [])
+			.map(normalizeAllowedPath)
+			.filter((path): path is string => Boolean(path)),
+	);
+	return (ctx: AgentBeforeToolContext): AgentBeforeToolResult | undefined => {
+		const base = writeScopeBeforeTool(ctx);
+		if (base || allowed.size === 0 || !WRITE_TOOLS.has(ctx.toolCall.toolName)) {
+			return base;
+		}
+		for (const path of extractWritePaths(ctx.input)) {
+			const normalized = normalizeAllowedPath(path);
+			if (normalized && !allowed.has(normalized)) {
+				return {
+					stop: true,
+					reason:
+						`write-scope violation: '${path}' is outside Codna's localized evidence set`,
+				};
+			}
+		}
+		return undefined;
+	};
+}
+
+function normalizeAllowedPath(rawPath: string): string | null {
+	const p = rawPath.replace(/\\/g, "/").trim();
+	if (!p || scopeViolation(p)) return null;
+	return p.replace(/^\.\//, "");
+}

{codna-0.1.18 → codna-0.1.20}/codna/byok_cli.py

@@ -68,7 +68,7 @@ def cmd_key(args) -> int:
     try:
         if action == "list":
             print(json.dumps(
-                {"ok": True, "keys": keystore.stored_key_names(force=True), "keychain": keystore.available(force=True)},
+                {"ok": True, "keys": keystore.stored_key_names(), "keychain": keystore.available()},
                 indent=2,
             ))
             return 0

{codna-0.1.18 → codna-0.1.20}/codna/cli.py

@@ -24,7 +24,7 @@ from .focus_paths import _issue_focus_paths  # focus-path extraction (split out
 from .agent_core_runtime import ensure_agent_core_running, inspect_agent_core_runtime, stop_agent_core_runtime
 from .local_mojo_pool import legacy_global_mojo_worker_diagnostics, mojo_worker_diagnostics
 from .mcp_cli import cmd_mcp as _cmd_mcp
-from .webhook_cli import cmd_webhook
+from .webhook_cli import cmd_webhook as _cmd_webhook
 from .remote_http import RemoteHttpTimeoutError, remote_http_timeout
 from .runtime import LocalRuntimeError, ensure_running
 from .runtime.config import API_KEY_KEYS, RuntimeConfigError, parse_keys_file_values, resolve_runtime_config
@@ -689,8 +689,11 @@ def cmd_secure_open_pr(args) -> None:
     print(f"✓ opened draft PR: {url}")
 
 
+def cmd_webhook(args):
+    return _cmd_webhook(args)
 
-def cmd_mcp(args) -> int:
+
+def cmd_mcp(args):
     return _cmd_mcp(args, die=_die)
 
 

{codna-0.1.18 → codna-0.1.20}/codna/keystore.py

@@ -16,10 +16,7 @@ Every ``keyring`` touch is lazy + defensive: on a headless box with no backend,
 """
 from __future__ import annotations
 
-import json
 import os
-import subprocess
-import sys
 
 from .runtime.config import ConfigValue
 
@@ -27,10 +24,6 @@ SERVICE = "codna"
 # Index entry: keyring backends can't enumerate stored items, so we keep our own name index under a
 # reserved username. (No secret lives in the index — only key NAMES.)
 _INDEX_USERNAME = "__codna_key_index__"
-_KEYCHAIN_READ_TIMEOUT_ENV = "CODNA_KEYCHAIN_READ_TIMEOUT_SECONDS"
-_ENABLE_PASSIVE_KEYCHAIN_ENV = "CODNA_ENABLE_KEYCHAIN"
-_DISABLE_KEYCHAIN_ENV = "CODNA_DISABLE_KEYCHAIN"
-_DEFAULT_KEYCHAIN_READ_TIMEOUT_SECONDS = 2.0
 
 # Provider/LLM keys the local engine forwards to the fixing agent (mirror of
 # runtime.local_stack.PROVIDER_CHILD_ENV_KEYS) + the Codna engine key. Only these may be stored.
@@ -67,8 +60,15 @@ class KeystoreError(RuntimeError):
     """A keychain operation the user asked for could not be completed (surfaced with remediation)."""
 
 
+def disabled() -> bool:
+    """True when keychain access is explicitly disabled for headless/test execution."""
+    return os.environ.get("CODNA_DISABLE_KEYCHAIN", "").strip().lower() in {"1", "true", "yes", "on"}
+
+
 def _keyring():
     """Import keyring or raise KeystoreError with an install hint. Never imported at module load."""
+    if disabled():
+        raise KeystoreError("OS keychain access is disabled by CODNA_DISABLE_KEYCHAIN=1")
     try:
         import keyring
     except Exception as exc:  # noqa: BLE001 - any import failure means no usable keychain
@@ -79,116 +79,6 @@ def _keyring():
     return keyring
 
 
-def _keychain_read_timeout_seconds() -> float:
-    raw = os.environ.get(_KEYCHAIN_READ_TIMEOUT_ENV, str(_DEFAULT_KEYCHAIN_READ_TIMEOUT_SECONDS))
-    try:
-        value = float(raw)
-    except ValueError:
-        return _DEFAULT_KEYCHAIN_READ_TIMEOUT_SECONDS
-    if value <= 0 or value > 30:
-        return _DEFAULT_KEYCHAIN_READ_TIMEOUT_SECONDS
-    return value
-
-
-def passive_keychain_reads_enabled() -> bool:
-    """True only when normal runtime/config probes may read OS keychain secrets.
-
-    macOS may prompt on every keychain password read. Normal Codna commands must not trigger
-    authorization dialogs just to check whether a provider key exists. Explicit `codna key ...`
-    commands bypass this guard because the user intentionally requested keychain access.
-    """
-    disabled = os.environ.get(_DISABLE_KEYCHAIN_ENV, "").strip().lower()
-    if disabled in {"1", "true", "yes", "on"}:
-        return False
-    enabled = os.environ.get(_ENABLE_PASSIVE_KEYCHAIN_ENV, "").strip().lower()
-    return enabled in {"1", "true", "yes", "on"}
-
-
-def _using_default_keyring_loader() -> bool:
-    return getattr(_keyring, "__module__", None) == __name__ and getattr(_keyring, "__name__", None) == "_keyring"
-
-
-def _keychain_snapshot_subprocess(*, include_values: bool) -> tuple[bool, list[str], dict[str, str]]:
-    script = """
-import json
-SERVICE = {service!r}
-INDEX_USERNAME = {index!r}
-MANAGED_KEYS = set({managed!r})
-INCLUDE_VALUES = {include_values!r}
-try:
-    import keyring
-    raw = keyring.get_password(SERVICE, INDEX_USERNAME)
-    names = [name.strip() for name in str(raw or "").split(",") if name.strip() in MANAGED_KEYS]
-    present = []
-    values = {{}}
-    for name in names:
-        value = keyring.get_password(SERVICE, name)
-        if value and str(value).strip():
-            present.append(name)
-            if INCLUDE_VALUES:
-                values[name] = str(value).strip()
-    print(json.dumps({{"available": True, "keys": present, "values": values}}))
-except Exception:
-    print(json.dumps({{"available": False, "keys": [], "values": {{}}}}))
-""".format(
-        service=SERVICE,
-        index=_INDEX_USERNAME,
-        managed=MANAGED_KEYS,
-        include_values=include_values,
-    )
-    try:
-        completed = subprocess.run(
-            [sys.executable, "-c", script],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=_keychain_read_timeout_seconds(),
-        )
-    except (OSError, subprocess.TimeoutExpired):
-        return False, [], {}
-    if completed.returncode != 0:
-        return False, [], {}
-    try:
-        payload = json.loads(completed.stdout)
-    except json.JSONDecodeError:
-        return False, [], {}
-    available = bool(payload.get("available"))
-    keys = [name for name in payload.get("keys", []) if name in MANAGED_KEYS]
-    raw_values = payload.get("values") if isinstance(payload.get("values"), dict) else {}
-    values = {
-        name: str(value).strip()
-        for name, value in raw_values.items()
-        if name in MANAGED_KEYS and str(value).strip()
-    }
-    return available, keys, values
-
-
-def _keychain_snapshot_direct(*, include_values: bool) -> tuple[bool, list[str], dict[str, str]]:
-    try:
-        kr = _keyring()
-        kr.get_password(SERVICE, _INDEX_USERNAME)
-        names = _read_index()
-        values: dict[str, str] = {}
-        present: list[str] = []
-        for name in names:
-            value = get_key(name)
-            if value:
-                present.append(name)
-                if include_values:
-                    values[name] = value
-        return True, present, values
-    except Exception:  # noqa: BLE001
-        return False, [], {}
-
-
-def _keychain_snapshot(*, include_values: bool, force: bool = False) -> tuple[bool, list[str], dict[str, str]]:
-    if not force and not passive_keychain_reads_enabled():
-        return False, [], {}
-    if _using_default_keyring_loader():
-        return _keychain_snapshot_subprocess(include_values=include_values)
-    return _keychain_snapshot_direct(include_values=include_values)
-
-
 def normalize_key_name(name: str) -> str:
     """Map a provider alias or env-var name to a managed env-var key name (or raise)."""
     raw = (name or "").strip()
@@ -202,10 +92,17 @@ def normalize_key_name(name: str) -> str:
     return resolved
 
 
-def available(*, force: bool = False) -> bool:
+def available() -> bool:
     """True if a usable OS keychain backend is present (best-effort, never raises)."""
-    available, _keys, _values = _keychain_snapshot(include_values=False, force=force)
-    return available
+    if disabled():
+        return False
+    try:
+        kr = _keyring()
+        backend = getattr(kr, "get_keyring", lambda: None)()
+        priority = getattr(backend, "priority", 0)
+        return priority is None or float(priority) > 0
+    except Exception:  # noqa: BLE001 - KeystoreError (no keyring) or a backend that refuses reads
+        return False
 
 
 def _read_index() -> list[str]:
@@ -236,17 +133,11 @@ def set_key(name: str, value: str) -> str:
     kr = _keyring()
     try:
         kr.set_password(SERVICE, key, token)
-        persisted = kr.get_password(SERVICE, key)
-    except Exception as exc:  # noqa: BLE001 - backend write/read failure
+    except Exception as exc:  # noqa: BLE001 - backend write failure
         raise KeystoreError(f"could not write to the OS keychain: {type(exc).__name__}") from exc
-    if not persisted or str(persisted).strip() != token:
-        raise KeystoreError("could not verify the OS keychain write; no key was stored")
     index = _read_index()
     if key not in index:
-        try:
-            _write_index([*index, key])
-        except Exception as exc:  # noqa: BLE001 - backend write failure
-            raise KeystoreError(f"could not update the OS keychain index: {type(exc).__name__}") from exc
+        _write_index([*index, key])
     return key
 
 
@@ -282,18 +173,19 @@ def delete_key(name: str) -> bool:
     return existed
 
 
-def stored_key_names(*, force: bool = False) -> list[str]:
-    """Names of keys currently stored (values never returned). Best-effort; never raises."""
-    _available, names, _values = _keychain_snapshot(include_values=False, force=force)
-    return names
-
+def stored_key_names() -> list[str]:
+    """Names in the key index (values never read or returned). Best-effort; never raises."""
+    return _read_index()
 
-def config_values(*, force: bool = False) -> dict[str, ConfigValue]:
-    """Keychain-sourced keys as ConfigValues for the runtime key map. Never raises (returns {}).
 
-    Passive reads are disabled by default to avoid OS authorization prompts during normal commands.
-    Set CODNA_ENABLE_KEYCHAIN=1 to opt into keychain-backed runtime config, or use explicit
-    `codna key ...` commands which pass force=True.
-    """
-    _available, _names, values = _keychain_snapshot(include_values=True, force=force)
-    return {name: ConfigValue(key=name, value=value, source="keychain") for name, value in values.items()}
+def config_values() -> dict[str, ConfigValue]:
+    """Keychain-sourced keys as ConfigValues for the runtime key map. Never raises (returns {})."""
+    out: dict[str, ConfigValue] = {}
+    try:
+        for name in _read_index():
+            value = get_key(name)
+            if value:
+                out[name] = ConfigValue(key=name, value=value, source="keychain")
+    except Exception:  # noqa: BLE001 - a broken keychain must never break the fix hot path
+        return {}
+    return out