codna 0.1.23__tar.gz → 0.1.25__tar.gz

{codna-0.1.23 → codna-0.1.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.23
+Version: 0.1.25
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.23 → codna-0.1.25}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.23"
+__version__ = "0.1.25"

{codna-0.1.23 → codna-0.1.25}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/home/runner/work/codna/codna/cli/codna-0.1.25/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.1.23 → codna-0.1.25}/codna/cli.py

@@ -254,7 +254,7 @@ def _engine_url_key():
     legacy HTTP-only surfaces. Normal repository triage/fix uses _client(), which
     defaults to the in-process local SDK path and does not call this function.
     """
-    keys = _runtime_keys()
+    keys = _runtime_keys(include_keychain=False)
     config = resolve_runtime_config(keys=keys)
     if config.remote_engine_url:
         return config.remote_engine_url.rstrip("/"), _api_key(keys)
@@ -270,8 +270,8 @@ def _remote_http_timeout() -> httpx.Timeout:
         raise CodnaError(str(exc)) from exc
 
 
-def _client():
-    keys = _runtime_keys()
+def _client(*, include_keychain: bool = False):
+    keys = _runtime_keys(include_keychain=include_keychain)
     config = resolve_runtime_config(keys=keys)
     if not config.remote_engine_url:
         from .local_client import LocalCodnaRuntimeClient
@@ -409,7 +409,7 @@ def cmd_fix(args) -> int:
     """Find + fix a bug. With --apply runs the risk gate + applies to a local branch; with --tests it
     then re-runs the repo's tests and, up to --max-iterations, re-fixes until green. --json for scripts."""
     from . import fix_run
-    c = _client()
+    c = _client(include_keychain=True)
     as_json = getattr(args, "as_json", False)
     if as_json:
         import contextlib
@@ -561,7 +561,7 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
 
     print("\ncodna: remediating eligible findings with the agentic Cline SDK (local engine) …")
     report = run_local_fix(
-        ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model),
+        ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model, keys=_runtime_keys()),
         repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds,
     )
 
@@ -756,7 +756,7 @@ def cmd_login(args) -> int:
     from . import byok_cli
     provider_status = byok_cli.ensure_local_provider_key(
         interactive=sys.stdin.isatty() and sys.stdout.isatty(),
-        runtime_keys=_runtime_keys(),
+        runtime_keys=_runtime_keys(include_keychain=False),
     )
 
     # Report success without echoing anything derived from the API key — the key (and its prefix) is a
@@ -778,7 +778,7 @@ def cmd_doctor(args) -> int:
         stop_stack = bool(getattr(args, "stop_stack", False))
         if start_stack and stop_stack:
             _die("--start-stack and --stop-stack are mutually exclusive")
-        keys = _runtime_keys(include_keychain=start_stack)
+        keys = _runtime_keys(include_keychain=False)
         if stop_stack:
             payload = stop_agent_core_runtime(keys=keys)
             payload["mojo_workers"] = _doctor_mojo_worker_diagnostics(keys)

{codna-0.1.23 → codna-0.1.25}/codna/fix_run.py

@@ -12,6 +12,7 @@ you don't iterate a pushed PR from here).
 """
 from __future__ import annotations
 
+import contextlib
 import os
 import subprocess
 import time
@@ -19,6 +20,8 @@ from pathlib import Path
 
 from .fix_inputs import FixInputError, pr_body, resolve_issue, sim_id
 
+_REPOSITORY_AGENTIC_MODEL = "repository.verified_agentic_v1"
+
 
 def summarize_plan(plan: dict) -> dict:
     """Extract the stable fields the CLI reports (human + JSON) from a decision plan."""
@@ -80,6 +83,40 @@ def _int_or_zero(value) -> int:
     return 0
 
 
+def _decision_plan_model_and_agent_env(model: str | None) -> tuple[str, dict[str, str]]:
+    requested = (model or "").strip()
+    if not requested:
+        return _REPOSITORY_AGENTIC_MODEL, {}
+    if requested.startswith("repository."):
+        return requested, {}
+    if "/" not in requested:
+        return _REPOSITORY_AGENTIC_MODEL, {"ALGENTA_AGENT_MODEL": requested}
+    provider, model_id = requested.split("/", 1)
+    provider = provider.strip()
+    model_id = model_id.strip()
+    if not provider or not model_id:
+        return _REPOSITORY_AGENTIC_MODEL, {"ALGENTA_AGENT_MODEL": requested}
+    return _REPOSITORY_AGENTIC_MODEL, {
+        "ALGENTA_AGENT_PROVIDER": provider,
+        "ALGENTA_AGENT_MODEL": model_id,
+    }
+
+
+@contextlib.contextmanager
+def _scoped_agent_env(updates: dict[str, str]):
+    previous = {key: os.environ.get(key) for key in updates}
+    try:
+        for key, value in updates.items():
+            os.environ[key] = value
+        yield
+    finally:
+        for key, value in previous.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+
 def attach_usage_totals(result: dict) -> dict:
     """Expose aggregate model usage at the top level for scriptable ``codna fix --json`` users."""
     totals = {
@@ -137,12 +174,14 @@ def _plan_once(c, *, repo, ref, issue, failing, model, open_pr, gh_token):
         if guidance:
             sig["project_guidance"] = guidance
     tri = _cli._dump(c.triage_repository(rid, {"snapshot_id": snap["snapshot_id"], "signals": sig}))
-    plan = _cli._dump(c.create_repository_decision_plan(rid, {
-        "snapshot_id": snap["snapshot_id"],
-        "workspace_evidence_bundle_ref": tri.get("workspace_evidence_bundle_ref"),
-        "signals": sig,
-        "model": model,
-    }))
+    plan_model, agent_env = _decision_plan_model_and_agent_env(model)
+    with _scoped_agent_env(agent_env):
+        plan = _cli._dump(c.create_repository_decision_plan(rid, {
+            "snapshot_id": snap["snapshot_id"],
+            "workspace_evidence_bundle_ref": tri.get("workspace_evidence_bundle_ref"),
+            "signals": sig,
+            "model": plan_model,
+        }))
     return rid, snap, plan
 
 

{codna-0.1.23 → codna-0.1.25}/codna/local_mojo_pool.py

@@ -14,7 +14,7 @@ from pathlib import Path
 from types import ModuleType
 from typing import Any
 
-from .python_import_paths import compatible_engine_site_packages, site_packages_python_version
+from .python_import_paths import compatible_engine_site_packages
 from .runtime.config import RuntimeConfig
 
 LOCAL_MOJO_WARMUP_PAYLOAD = {

{codna-0.1.23 → codna-0.1.25}/codna/local_repository_shims.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import difflib
 import importlib
+import os
 import re
 import sys
 from pathlib import Path
@@ -100,7 +101,7 @@ def install_repository_module_suffix_support() -> None:
 
 
 def install_verified_agentic_diff_compatibility() -> None:
-    """Patch local Algenta verified-agentic diffs so `git apply` accepts them."""
+    """Patch local Algenta verified-agentic behavior for Codna's local runtime contract."""
     try:
         verified_agentic = _load_repository_module(
             "apps.api_server.services.repository_intelligence_verified_agentic"
@@ -122,19 +123,62 @@ def install_verified_agentic_diff_compatibility() -> None:
             "Local Algenta verified-agentic module is missing _unified_diff_from_tree_states.",
             {"module": verified_agentic.__name__},
         )
-    if getattr(current, "_codna_git_apply_compatible", False):
+    if not getattr(current, "_codna_git_apply_compatible", False):
+
+        def unified_diff_from_tree_states(before: dict[str, str], after: dict[str, str]) -> str:
+            return git_apply_compatible_unified_diff_from_tree_states(before, after)
+
+        unified_diff_from_tree_states.__name__ = "_unified_diff_from_tree_states"
+        unified_diff_from_tree_states.__qualname__ = "_unified_diff_from_tree_states"
+        unified_diff_from_tree_states.__module__ = verified_agentic.__name__
+        unified_diff_from_tree_states._codna_git_apply_compatible = True  # type: ignore[attr-defined]
+        verified_agentic._unified_diff_from_tree_states = unified_diff_from_tree_states
+        if hasattr(planner_generation, "_unified_diff_from_tree_states"):
+            planner_generation._unified_diff_from_tree_states = unified_diff_from_tree_states
+    _install_verified_agentic_agent_model_env_support(verified_agentic)
+
+
+def _install_verified_agentic_agent_model_env_support(verified_agentic: ModuleType) -> None:
+    original = getattr(verified_agentic, "_run_agent_with_failover", None)
+    if original is None:
+        raise LocalRepositoryShimError(
+            "local_repository_verified_agentic_model_env_shim_missing_target",
+            "Local Algenta verified-agentic module is missing _run_agent_with_failover.",
+            {"module": verified_agentic.__name__},
+        )
+    if getattr(original, "_codna_agent_model_env_support", False):
         return
 
-    def unified_diff_from_tree_states(before: dict[str, str], after: dict[str, str]) -> str:
-        return git_apply_compatible_unified_diff_from_tree_states(before, after)
+    async def run_agent_with_failover(
+        run_agent,
+        *,
+        working_dir,
+        task_spec,
+        injected_context,
+        limits,
+        root_path,
+    ):
+        provider = os.environ.get("ALGENTA_AGENT_PROVIDER") or None
+        model = os.environ.get("ALGENTA_AGENT_MODEL") or None
+        if provider or model:
+            task_spec = dict(task_spec)
+            engine = task_spec.get("engine")
+            engine = dict(engine) if isinstance(engine, dict) else {}
+            task_spec["engine"] = engine
+        return await original(
+            run_agent,
+            working_dir=working_dir,
+            task_spec=task_spec,
+            injected_context=injected_context,
+            limits=limits,
+            root_path=root_path,
+        )
 
-    unified_diff_from_tree_states.__name__ = "_unified_diff_from_tree_states"
-    unified_diff_from_tree_states.__qualname__ = "_unified_diff_from_tree_states"
-    unified_diff_from_tree_states.__module__ = verified_agentic.__name__
-    unified_diff_from_tree_states._codna_git_apply_compatible = True  # type: ignore[attr-defined]
-    verified_agentic._unified_diff_from_tree_states = unified_diff_from_tree_states
-    if hasattr(planner_generation, "_unified_diff_from_tree_states"):
-        planner_generation._unified_diff_from_tree_states = unified_diff_from_tree_states
+    run_agent_with_failover.__name__ = "_run_agent_with_failover"
+    run_agent_with_failover.__qualname__ = "_run_agent_with_failover"
+    run_agent_with_failover.__module__ = verified_agentic.__name__
+    run_agent_with_failover._codna_agent_model_env_support = True  # type: ignore[attr-defined]
+    verified_agentic._run_agent_with_failover = run_agent_with_failover
 
 
 def install_patch_artifact_newline_preservation() -> None:

{codna-0.1.23 → codna-0.1.25}/codna/localfix.py

@@ -16,7 +16,9 @@ separated writer + a scoped token, which `--open-pr` wires through `run_secure`)
 """
 from __future__ import annotations
 
+import shutil
 import subprocess
+import sys
 from dataclasses import dataclass
 
 from .evasion import reject_evasion
@@ -111,7 +113,7 @@ def run_local_fix(
             outcome.fix_applied = True
             if test_cmds:
                 outcome.tests_passed = all(
-                    subprocess.run(cmd, cwd=wt.path, capture_output=True).returncode == 0
+                    subprocess.run(_verification_command(cmd), cwd=wt.path, capture_output=True).returncode == 0
                     for cmd in test_cmds
                 )
             closure = engine.reprove_closure(finding, Patch(digest_of(diff), diff=diff))
@@ -119,3 +121,15 @@ def run_local_fix(
         outcomes.append(outcome)
 
     return LocalFixReport(len(ingest.findings), eligible, outcomes)
+
+
+def _verification_command(cmd: list[str]) -> list[str]:
+    """Run manifest `python ...` commands with the interpreter executing Codna when needed.
+
+    macOS and minimal containers often expose only `python3`, while virtualenv console scripts run
+    under an exact interpreter path. Treat bare `python` as the current interpreter if it is not on
+    PATH; explicit paths, `python3`, and every other command remain operator-controlled.
+    """
+    if not cmd or cmd[0] != "python" or shutil.which("python"):
+        return cmd
+    return [sys.executable, *cmd[1:]]

{codna-0.1.23 → codna-0.1.25}/codna/mcp_server.py

@@ -111,7 +111,7 @@ def fix_json(repo: str = ".", issue: str = "", ref: str = "", open_pr: bool = Fa
     """
     repo = _default_repo(repo)
     try:
-        c = _client()
+        c = _client(include_keychain=True)
         if open_pr:
             # Same path the CLI's `codna fix --open-pr` uses (engine apply -> real PR), so the
             # MCP tool and CLI are one behavior. run_fix() would sys.exit on bad input, which

{codna-0.1.23 → codna-0.1.25}/codna/packaged_repository_backend.py

@@ -17,6 +17,8 @@ SCHEMA_VERSION = 1
 BACKEND_MODE = "packaged_local_triage"
 MAX_SAMPLE_BYTES = 64 * 1024
 MAX_SNIPPET_CHARS = 900
+SNIPPET_CONTEXT_BEFORE = 4
+SNIPPET_CONTEXT_AFTER = 6
 MAX_EVIDENCE_ITEMS = 10
 TOKEN_BYTES = 4
 
@@ -236,6 +238,12 @@ class PackagedRepositoryBackendError(RuntimeError):
         self.details = details or {}
 
 
+@dataclass(frozen=True)
+class SnippetSelection:
+    snippet: str
+    symbol: str | None
+
+
 @dataclass(frozen=True)
 class FileEntry:
     path: str
@@ -713,8 +721,8 @@ def _score_entry(entry: FileEntry, terms: set[str], changed_files: set[str]) ->
 
 
 def _evidence_item(*, rank: int, entry: FileEntry, score: float, query: str) -> dict[str, Any]:
-    snippet = _snippet(entry.sample, _query_terms(query))
-    symbol = _top_symbol(entry.sample)
+    selection = _snippet_selection(entry.sample, _query_terms(query))
+    snippet = selection.snippet
     return {
         "evidence_id": "ev_" + _sha256_text(f"{rank}|{entry.path}|{entry.sample_sha256}")[:16],
         "rank": rank,
@@ -722,31 +730,74 @@ def _evidence_item(*, rank: int, entry: FileEntry, score: float, query: str) ->
         "source_ref": entry.path,
         "summary": f"{entry.path} ({entry.language}, {entry.token_estimate} estimated tokens)",
         "snippet": snippet,
-        "token_count": max(1, len(snippet.encode("utf-8")) // TOKEN_BYTES),
+        "token_count": min(max(1, entry.token_estimate), max(1, len(snippet.encode("utf-8")) // TOKEN_BYTES)),
         "score": float(score),
         "file_path": entry.path,
-        "symbol_name": symbol,
+        "symbol_name": selection.symbol,
     }
 
 
-def _snippet(sample: str, terms: set[str]) -> str:
+def _snippet_selection(sample: str, terms: set[str]) -> SnippetSelection:
     lines = [line.rstrip() for line in sample.splitlines()]
-    selected = ""
-    for line in lines:
-        line_lower = line.lower()
-        if any(term.lower() in line_lower for term in terms):
-            selected = line
-            break
-    if not selected:
-        selected = next((line for line in lines if line.strip()), "")
-    if len(selected) > MAX_SNIPPET_CHARS:
-        return selected[: MAX_SNIPPET_CHARS - 3] + "..."
-    return selected
-
-
-def _top_symbol(sample: str) -> str | None:
-    match = SYMBOL_RE.search(sample)
-    return match.group(1) if match else None
+    if not lines:
+        return SnippetSelection(snippet="", symbol=None)
+    selected_index = _best_snippet_line_index(lines, terms)
+    snippet = _numbered_context_window(lines, selected_index)
+    if len(snippet) > MAX_SNIPPET_CHARS:
+        snippet = snippet[: MAX_SNIPPET_CHARS - 3] + "..."
+    return SnippetSelection(snippet=snippet, symbol=_nearest_symbol(lines, selected_index))
+
+
+def _best_snippet_line_index(lines: list[str], terms: set[str]) -> int:
+    best_index = -1
+    best_score = 0
+    for index, line in enumerate(lines):
+        score = _snippet_line_score(line, terms)
+        if score > best_score:
+            best_score = score
+            best_index = index
+    if best_index >= 0:
+        return best_index
+    for index, line in enumerate(lines):
+        if line.strip():
+            return index
+    return 0
+
+
+def _snippet_line_score(line: str, terms: set[str]) -> int:
+    stripped = line.strip()
+    lower = stripped.lower()
+    score = 0
+    for term in terms:
+        normalized = term.lower()
+        count = lower.count(normalized)
+        if count:
+            score += count * (3 + min(len(normalized) // 4, 4))
+    if score and SYMBOL_RE.match(line):
+        score += 10
+    if score and stripped.startswith(("return ", "raise ", "assert ")):
+        score += 3
+    if score and stripped.startswith(("import ", "from ")):
+        score = max(1, score - 5)
+    return score
+
+
+def _numbered_context_window(lines: list[str], selected_index: int) -> str:
+    start = max(0, selected_index - SNIPPET_CONTEXT_BEFORE)
+    end = min(len(lines), selected_index + SNIPPET_CONTEXT_AFTER + 1)
+    return "\n".join(f"{index + 1:6}\t{lines[index]}" for index in range(start, end))
+
+
+def _nearest_symbol(lines: list[str], selected_index: int) -> str | None:
+    for index in range(selected_index, -1, -1):
+        match = SYMBOL_RE.match(lines[index])
+        if match:
+            return match.group(1)
+    for index in range(selected_index + 1, len(lines)):
+        match = SYMBOL_RE.match(lines[index])
+        if match:
+            return match.group(1)
+    return None
 
 
 def _suspect_symbols(evidence_items: list[dict[str, Any]]) -> list[str]:

codna-0.1.25/codna/patchgen.py

@@ -0,0 +1,225 @@
+"""Engine-backed patch generator — the remediation seam the worker invokes.
+
+`LocalWorker.remediate` calls a `patch_generator(finding, cwd) -> diff`. The real generator is
+codna's existing decision-plan agent: it turns a security finding into a remediation obligation
+("fix this source→sink without changing behavior, don't touch tests/CI/suppressions"), asks the
+engine to produce a fix, and returns the unified diff for the worker to apply in its sandboxed
+worktree.
+
+Transport is the same injected `post(path, body) -> dict` callable the `EngineAdapter` uses, so
+this is testable offline with a stub. The generated diff is then subject to the worker's G4
+anti-evasion check before it is ever applied.
+"""
+from __future__ import annotations
+
+import contextlib
+import hashlib
+import os
+from pathlib import Path
+from typing import Callable, Mapping
+
+from .findings import NormalizedFinding
+from .runtime.config import ConfigValue
+
+PostFn = Callable[[str, dict], dict]
+
+
+class PatchGenError(Exception):
+    pass
+
+
+def finding_issue(finding: NormalizedFinding) -> str:
+    """Render a finding as a remediation obligation for the agent."""
+    loc = finding.primary_location
+    where = f"{loc.uri}:{loc.start_line}" if loc and loc.start_line else (loc.uri if loc else "(unknown location)")
+    flow = ""
+    if finding.code_flows:
+        seq = finding.code_flows[0]
+        if seq:
+            src, sink = seq[0], seq[-1]
+            flow = f" Dataflow: {src.uri}:{src.start_line} -> {sink.uri}:{sink.start_line}."
+    return (
+        f"Security finding {finding.rule_id} ({finding.severity.value}, kind={finding.finding_kind.value}) "
+        f"at {where}: {finding.message}.{flow} "
+        "Remediate the vulnerability without changing behavior. "
+        "Do NOT modify tests, CI, scanner configuration, or suppressions."
+    )
+
+
+class EnginePatchGenerator:
+    def __init__(
+        self,
+        post: PostFn,
+        *,
+        repository_id: str,
+        snapshot_id: str,
+        model: str = "repository.verified_agentic_v1",
+    ):
+        self._post = post
+        self.repository_id = repository_id
+        self.snapshot_id = snapshot_id
+        self.model = model
+
+    def __call__(self, finding: NormalizedFinding, cwd: str) -> str:
+        resp = self._post(
+            f"/v1/repositories/{self.repository_id}/decision-plan",
+            {
+                "snapshot_id": self.snapshot_id,
+                "model": self.model,
+                "signals": {
+                    "issue_text": finding_issue(finding),
+                    "security_finding": {
+                        "canonical_id": finding.canonical_id,
+                        "rule_id": finding.rule_id,
+                        "finding_kind": finding.finding_kind.value,
+                    },
+                },
+            },
+        )
+        diff = resp.get("patch_diff") or (resp.get("decision_plan") or {}).get("patch_diff")
+        if not diff or not str(diff).strip():
+            raise PatchGenError(f"engine returned no patch for {finding.rule_id} ({finding.canonical_id})")
+        return diff
+
+
+class ClinePatchGenerator:
+    """`patch_generator(finding, cwd) -> diff` backed by the agentic Cline SDK (agent-core).
+
+    This is the self-hosted remediation seam: instead of asking a remote engine for a patch, it
+    drives codna's bundled sidecar agent against an isolated workspace and returns the captured
+    unified diff for the caller to subject to the G4 anti-evasion check and then apply.
+    """
+
+    def __init__(
+        self,
+        *,
+        model: str | None = None,
+        max_iterations: int = 20,
+        timeout_s: int = 360,
+        keys: Mapping[str, ConfigValue] | None = None,
+    ):
+        self.model = model
+        self.max_iterations = max_iterations
+        self.timeout_s = timeout_s
+        self.keys = keys
+
+    def __call__(self, finding: NormalizedFinding, cwd: str) -> str:
+        from .packaged_agent_runner import SidecarPackagedAgentRunner
+        from .packaged_repository_advanced import PackagedAgentRunRequest
+        from .runtime.config import resolve_runtime_config
+
+        prompt = (
+            finding_issue(finding)
+            + " Edit only the vulnerable source file(s); use REPOSITORY-RELATIVE paths."
+        )
+        snapshot_id = _secure_snapshot_id(cwd, finding)
+        request = PackagedAgentRunRequest(
+            repository_id=_secure_repository_id(cwd),
+            snapshot_id=snapshot_id,
+            repo_root=Path(cwd).resolve(strict=True),
+            issue_text=prompt,
+            model=_packaged_model(self.model),
+            signals={
+                "issue_text": prompt,
+                "security_finding": {
+                    "canonical_id": finding.canonical_id,
+                    "rule_id": finding.rule_id,
+                    "finding_kind": finding.finding_kind.value,
+                },
+            },
+            evidence_bundle=_evidence_bundle(cwd, finding),
+            snapshot={
+                "snapshot_id": snapshot_id,
+                "snapshot_file_count": _count_repo_files(cwd),
+                "raw_repo_token_estimate": _estimate_repo_tokens(cwd),
+            },
+        )
+        runner = SidecarPackagedAgentRunner(config=resolve_runtime_config(keys=self.keys), keys=self.keys)
+        with _scoped_agent_limits(self.max_iterations, self.timeout_s):
+            diff = runner.run(request).patch_diff
+        if not diff.strip():
+            raise PatchGenError(f"cline agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
+        return diff
+
+
+def _packaged_model(model: str | None) -> str:
+    requested = (model or "").strip()
+    if not requested:
+        return "repository.verified_agentic_v1"
+    if requested.startswith("repository.") or "/" in requested:
+        return requested
+    return f"anthropic/{requested}"
+
+
+@contextlib.contextmanager
+def _scoped_agent_limits(max_iterations: int, timeout_s: int):
+    updates = {
+        "ALGENTA_AGENT_MAX_TURNS": str(max_iterations),
+        "ALGENTA_AGENT_TURN_TIMEOUT_MS": str(max(1, timeout_s) * 1000),
+    }
+    previous = {key: os.environ.get(key) for key in updates}
+    try:
+        os.environ.update(updates)
+        yield
+    finally:
+        for key, value in previous.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+
+def _secure_repository_id(cwd: str) -> str:
+    digest = hashlib.sha256(str(Path(cwd).resolve()).encode("utf-8")).hexdigest()[:16]
+    return f"secure_local_{digest}"
+
+
+def _secure_snapshot_id(cwd: str, finding: NormalizedFinding) -> str:
+    raw = f"{Path(cwd).resolve()}|{finding.canonical_id}"
+    return "secure_snapshot_" + hashlib.sha256(raw.encode("utf-8")).hexdigest()[:16]
+
+
+def _evidence_bundle(cwd: str, finding: NormalizedFinding) -> dict:
+    path = finding.primary_location.uri if finding.primary_location else ""
+    items = []
+    if path:
+        items.append(
+            {
+                "file_path": path,
+                "symbol_name": None,
+                "snippet": _source_snippet(cwd, path, finding.primary_location.start_line),
+            }
+        )
+    return {
+        "suspect_files": [path] if path else [],
+        "suspect_symbols": [],
+        "evidence_items": items,
+    }
+
+
+def _source_snippet(cwd: str, relative_path: str, start_line: int | None) -> str:
+    path = Path(cwd) / relative_path
+    try:
+        lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
+    except OSError:
+        return ""
+    line = max(1, int(start_line or 1))
+    begin = max(1, line - 8)
+    end = min(len(lines), line + 8)
+    return "\n".join(f"{idx}: {lines[idx - 1]}" for idx in range(begin, end + 1))
+
+
+def _count_repo_files(cwd: str) -> int:
+    return sum(1 for path in Path(cwd).rglob("*") if path.is_file() and ".git" not in path.parts)
+
+
+def _estimate_repo_tokens(cwd: str) -> int:
+    total = 0
+    for path in Path(cwd).rglob("*"):
+        if not path.is_file() or ".git" in path.parts:
+            continue
+        try:
+            total += max(1, path.stat().st_size // 4)
+        except OSError:
+            continue
+    return total

{codna-0.1.23 → codna-0.1.25}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.23
+Version: 0.1.25
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.23 → codna-0.1.25}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.23"
+version = "0.1.25"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"