codna 0.1.24__tar.gz → 0.1.26__tar.gz

{codna-0.1.24 → codna-0.1.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.24
+Version: 0.1.26
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.24 → codna-0.1.26}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.24"
+__version__ = "0.1.26"

{codna-0.1.24 → codna-0.1.26}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/codna/codna/cli/codna-0.1.24/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/home/runner/work/codna/codna/cli/codna-0.1.26/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.1.24 → codna-0.1.26}/codna/cli.py

@@ -254,7 +254,7 @@ def _engine_url_key():
     legacy HTTP-only surfaces. Normal repository triage/fix uses _client(), which
     defaults to the in-process local SDK path and does not call this function.
     """
-    keys = _runtime_keys()
+    keys = _runtime_keys(include_keychain=False)
     config = resolve_runtime_config(keys=keys)
     if config.remote_engine_url:
         return config.remote_engine_url.rstrip("/"), _api_key(keys)
@@ -270,8 +270,8 @@ def _remote_http_timeout() -> httpx.Timeout:
         raise CodnaError(str(exc)) from exc
 
 
-def _client():
-    keys = _runtime_keys()
+def _client(*, include_keychain: bool = False):
+    keys = _runtime_keys(include_keychain=include_keychain)
     config = resolve_runtime_config(keys=keys)
     if not config.remote_engine_url:
         from .local_client import LocalCodnaRuntimeClient
@@ -409,7 +409,7 @@ def cmd_fix(args) -> int:
     """Find + fix a bug. With --apply runs the risk gate + applies to a local branch; with --tests it
     then re-runs the repo's tests and, up to --max-iterations, re-fixes until green. --json for scripts."""
     from . import fix_run
-    c = _client()
+    c = _client(include_keychain=True)
     as_json = getattr(args, "as_json", False)
     if as_json:
         import contextlib
@@ -510,10 +510,10 @@ def cmd_secure(args) -> None:
     if not (args.open_pr or args.fix):
         return
     if args.engine == "local":
-        # Self-hosted detect→fix→verify→close via the agentic Cline SDK; report-only.
+        # Self-hosted detect→fix→verify→close via the agentic Cline SDK; local checkout apply only.
         if args.open_pr:
             _die("--open-pr needs the privilege-separated writer + a scoped token; "
-                 "`--engine local --fix` is report-only (it proves the fix but opens no PR).")
+                 "`--engine local --fix` applies to the local checkout but opens no PR.")
         _run_local_fix(args, ingest=ingest, engine=engine, policy=policy, manifest=manifest)
     else:
         _run_remediation(args, ingest=ingest, rid=rid, snapshot_id=snap["snapshot_id"],
@@ -544,8 +544,7 @@ class _NoWriter:
 
 
 def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
-    """`--engine local --fix`: detect (refengine) → fix (Cline SDK) → verify (manifest
-    build/tests) → re-prove closure (refengine). Report-only; opens no PR."""
+    """Local secure fix: prove, verify, close, then apply the patch to the checkout."""
     import os
 
     from .localfix import run_local_fix
@@ -561,8 +560,8 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
 
     print("\ncodna: remediating eligible findings with the agentic Cline SDK (local engine) …")
     report = run_local_fix(
-        ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model),
-        repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds,
+        ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model, keys=_runtime_keys()),
+        repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds, apply_to_repo=True,
     )
 
     print(f"\n✓ local fix: {report.eligible} eligible finding(s) processed")
@@ -570,13 +569,17 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
         if not o.eligible:
             continue
         if o.remediated:
-            tag = ("tests pass" if o.tests_passed else
-                   "no tests configured" if o.tests_passed is None else "")
+            tag = "tests pass" if o.tests_passed else "no tests configured" if o.tests_passed is None else ""
             status = f"REMEDIATED — closure={o.closure}" + (f", {tag}" if tag else "")
+            status += ", applied to checkout" if o.target_applied is True else ""
         elif not o.integrity_ok:
             status = f"blocked: patch integrity ({o.integrity_reason})"
         elif o.tests_passed is False:
             status = f"blocked: tests failed (closure={o.closure})"
+        elif o.target_applied is False:
+            status = f"blocked: target apply failed ({o.target_apply_reason})"
+        elif o.target_tests_passed is False:
+            status = f"blocked: target tests failed ({o.target_apply_reason})"
         else:
             status = f"blocked: obligation not closed (closure={o.closure})"
         print(f"  [{o.classification}] {o.rule_id}  {status}")
@@ -756,7 +759,7 @@ def cmd_login(args) -> int:
     from . import byok_cli
     provider_status = byok_cli.ensure_local_provider_key(
         interactive=sys.stdin.isatty() and sys.stdout.isatty(),
-        runtime_keys=_runtime_keys(),
+        runtime_keys=_runtime_keys(include_keychain=False),
     )
 
     # Report success without echoing anything derived from the API key — the key (and its prefix) is a
@@ -778,7 +781,7 @@ def cmd_doctor(args) -> int:
         stop_stack = bool(getattr(args, "stop_stack", False))
         if start_stack and stop_stack:
             _die("--start-stack and --stop-stack are mutually exclusive")
-        keys = _runtime_keys(include_keychain=start_stack)
+        keys = _runtime_keys(include_keychain=False)
         if stop_stack:
             payload = stop_agent_core_runtime(keys=keys)
             payload["mojo_workers"] = _doctor_mojo_worker_diagnostics(keys)
@@ -874,7 +877,7 @@ def build_parser() -> argparse.ArgumentParser:
     ps.add_argument("--verification", help="codna-security.yaml manifest (required for --open-pr)")
     ps.add_argument("--open-pr", dest="open_pr", action="store_true",
                     help="open a fix PR per reachable finding (requires a resolved manifest)")
-    ps.add_argument("--fix", action="store_true", help="remediate eligible findings (report-only, no PR)")
+    ps.add_argument("--fix", action="store_true", help="remediate eligible findings in the local checkout (no PR)")
     ps.add_argument("--github-token", help="write token for --open-pr (or env GITHUB_TOKEN)")
     ps.add_argument("--base-branch", help="PR base branch (default: repo default)")
     ps.add_argument("--repo-slug", dest="repo_slug", help="owner/repo for --open-pr (else derived from the git remote)")

codna-0.1.26/codna/localfix.py

@@ -0,0 +1,217 @@
+"""`run_local_fix` — the self-hosted detect→fix→verify→close loop behind
+`codna secure --fix --engine local`.
+
+No remote engine and no SAST scanner image required: reachability and closure both come from the
+bounded `LocalReferenceEngine`, and the patch comes from the agentic Cline SDK
+(`ClinePatchGenerator`). It is the local analogue of `run_secure` + `LocalWorker` for air-gapped
+or scanner-less environments, and it keeps the same discipline:
+
+  * ineligible findings (per policy) are reported but NEVER fixed;
+  * every generated patch is subject to the G4 anti-evasion check BEFORE it is applied;
+  * the patched proof tree must pass the manifest's build/test commands;
+  * the original obligation must be independently re-proven `closed` after the fix; and
+  * CLI fix mode applies the verified diff to the user's checkout and re-runs verification there.
+
+It never opens PRs itself (that needs the privilege-separated writer + a scoped token, which
+`--open-pr` wires through `run_secure`).
+"""
+from __future__ import annotations
+
+import shutil
+import subprocess
+import sys
+from dataclasses import dataclass
+
+from .evasion import reject_evasion
+from .findings import IngestResult, digest_of
+from .policy import Policy
+from .secure import Patch, SecurityEngine
+from .worktree import EphemeralWorktree
+
+
+@dataclass
+class TargetApplyResult:
+    applied: bool
+    tests_passed: bool | None = None
+    reason: str = ""
+
+
+@dataclass
+class LocalFixOutcome:
+    canonical_id: str
+    rule_id: str
+    classification: str
+    eligible: bool
+    reason: str
+    fix_applied: bool = False
+    integrity_ok: bool = False
+    integrity_reason: str = ""
+    tests_passed: bool | None = None  # None = not run (no test commands configured)
+    closure: str = "n/a"
+    diff: str = ""
+    target_applied: bool | None = None  # None = target apply was not requested.
+    target_tests_passed: bool | None = None
+    target_apply_reason: str = ""
+
+    @property
+    def remediated(self) -> bool:
+        """A finding is remediated only when the fix applied cleanly, passed the integrity
+        check, did not regress the tests, and the obligation re-proves `closed`."""
+        return (
+            self.fix_applied
+            and self.integrity_ok
+            and self.tests_passed is not False
+            and self.closure == "closed"
+            and self.target_applied is not False
+            and self.target_tests_passed is not False
+        )
+
+
+@dataclass
+class LocalFixReport:
+    findings_total: int
+    eligible: int
+    outcomes: list[LocalFixOutcome]
+
+    @property
+    def remediated(self) -> list[LocalFixOutcome]:
+        return [o for o in self.outcomes if o.remediated]
+
+
+def run_local_fix(
+    ingest: IngestResult,
+    *,
+    engine: SecurityEngine,
+    patch_generator,
+    repo_dir: str,
+    commit: str,
+    policy: Policy,
+    test_cmds: list[list[str]] | None = None,
+    apply_to_repo: bool = False,
+) -> LocalFixReport:
+    """Run detect→fix→verify→close for every eligible finding.
+
+    The agent always works against an isolated worktree pinned to the SARIF-bound commit. When
+    ``apply_to_repo`` is true, the verified diff is then applied to the caller's checkout with
+    ``git apply --check`` first and verification is run again on the target checkout.
+    """
+    outcomes: list[LocalFixOutcome] = []
+    eligible = 0
+
+    for finding in ingest.findings:
+        if finding.quarantined:
+            outcomes.append(LocalFixOutcome(
+                finding.canonical_id, finding.rule_id, "quarantined", False, "artifact path escape"))
+            continue
+
+        verdict = engine.analyze(ingest, finding)
+        is_eligible, reason = policy.is_autofix_eligible(verdict.classification)
+        if not is_eligible:
+            outcomes.append(LocalFixOutcome(
+                finding.canonical_id, finding.rule_id, verdict.classification.value, False, reason))
+            continue
+        eligible += 1
+
+        outcome = LocalFixOutcome(
+            finding.canonical_id, finding.rule_id, verdict.classification.value, True, reason)
+        with EphemeralWorktree(repo_dir, commit) as wt:
+            diff = patch_generator(finding, wt.path)
+            integrity = reject_evasion(diff)
+            outcome.diff = diff
+            outcome.integrity_ok = integrity.ok
+            outcome.integrity_reason = (
+                "ok" if integrity.ok
+                else "; ".join(v.reason_code for v in integrity.violations)
+            )
+            if not integrity.ok:
+                # Patch rejected by anti-evasion — never apply it.
+                outcomes.append(outcome)
+                continue
+
+            wt.apply_patch(diff)
+            outcome.fix_applied = True
+            if test_cmds:
+                outcome.tests_passed = _run_verification_commands(test_cmds, cwd=wt.path)
+            closure = engine.reprove_closure(finding, Patch(digest_of(diff), diff=diff))
+            outcome.closure = closure.closure_status.value
+            if apply_to_repo and _proof_passed(outcome):
+                target = _apply_verified_patch_to_repo(repo_dir, diff, test_cmds or [])
+                outcome.target_applied = target.applied
+                outcome.target_tests_passed = target.tests_passed
+                outcome.target_apply_reason = target.reason
+        outcomes.append(outcome)
+
+    return LocalFixReport(len(ingest.findings), eligible, outcomes)
+
+
+def _proof_passed(outcome: LocalFixOutcome) -> bool:
+    return (
+        outcome.fix_applied
+        and outcome.integrity_ok
+        and outcome.tests_passed is not False
+        and outcome.closure == "closed"
+    )
+
+
+def _run_verification_commands(commands: list[list[str]], *, cwd: str) -> bool:
+    return all(
+        subprocess.run(_verification_command(cmd), cwd=cwd, capture_output=True).returncode == 0
+        for cmd in commands
+    )
+
+
+def _apply_verified_patch_to_repo(repo_dir: str, diff: str, test_cmds: list[list[str]]) -> TargetApplyResult:
+    check = _git_apply(repo_dir, diff, "--check")
+    if check.returncode != 0:
+        return TargetApplyResult(False, reason=_format_git_apply_error("target apply check failed", check))
+
+    applied = _git_apply(repo_dir, diff)
+    if applied.returncode != 0:
+        return TargetApplyResult(False, reason=_format_git_apply_error("target apply failed", applied))
+
+    if not test_cmds:
+        return TargetApplyResult(True)
+
+    if _run_verification_commands(test_cmds, cwd=repo_dir):
+        return TargetApplyResult(True, tests_passed=True)
+
+    rollback = _git_apply(repo_dir, diff, "-R")
+    if rollback.returncode == 0:
+        return TargetApplyResult(
+            False,
+            tests_passed=False,
+            reason="target verification failed after apply; patch rolled back",
+        )
+    return TargetApplyResult(
+        True,
+        tests_passed=False,
+        reason=_format_git_apply_error("target verification failed after apply; rollback failed", rollback),
+    )
+
+
+def _git_apply(repo_dir: str, diff: str, *args: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["git", "-C", repo_dir, "apply", "--whitespace=nowarn", *args, "-"],
+        input=diff,
+        capture_output=True,
+        text=True,
+    )
+
+
+def _format_git_apply_error(prefix: str, proc: subprocess.CompletedProcess) -> str:
+    detail = (proc.stderr or proc.stdout or "").strip()
+    if not detail:
+        return prefix
+    return f"{prefix}: {detail[:500]}"
+
+
+def _verification_command(cmd: list[str]) -> list[str]:
+    """Run manifest `python ...` commands with the interpreter executing Codna when needed.
+
+    macOS and minimal containers often expose only `python3`, while virtualenv console scripts run
+    under an exact interpreter path. Treat bare `python` as the current interpreter if it is not on
+    PATH; explicit paths, `python3`, and every other command remain operator-controlled.
+    """
+    if not cmd or cmd[0] != "python" or shutil.which("python"):
+        return cmd
+    return [sys.executable, *cmd[1:]]

{codna-0.1.24 → codna-0.1.26}/codna/mcp_server.py

@@ -111,7 +111,7 @@ def fix_json(repo: str = ".", issue: str = "", ref: str = "", open_pr: bool = Fa
     """
     repo = _default_repo(repo)
     try:
-        c = _client()
+        c = _client(include_keychain=True)
         if open_pr:
             # Same path the CLI's `codna fix --open-pr` uses (engine apply -> real PR), so the
             # MCP tool and CLI are one behavior. run_fix() would sys.exit on bad input, which

codna-0.1.26/codna/patchgen.py

@@ -0,0 +1,225 @@
+"""Engine-backed patch generator — the remediation seam the worker invokes.
+
+`LocalWorker.remediate` calls a `patch_generator(finding, cwd) -> diff`. The real generator is
+codna's existing decision-plan agent: it turns a security finding into a remediation obligation
+("fix this source→sink without changing behavior, don't touch tests/CI/suppressions"), asks the
+engine to produce a fix, and returns the unified diff for the worker to apply in its sandboxed
+worktree.
+
+Transport is the same injected `post(path, body) -> dict` callable the `EngineAdapter` uses, so
+this is testable offline with a stub. The generated diff is then subject to the worker's G4
+anti-evasion check before it is ever applied.
+"""
+from __future__ import annotations
+
+import contextlib
+import hashlib
+import os
+from pathlib import Path
+from typing import Callable, Mapping
+
+from .findings import NormalizedFinding
+from .runtime.config import ConfigValue
+
+PostFn = Callable[[str, dict], dict]
+
+
+class PatchGenError(Exception):
+    pass
+
+
+def finding_issue(finding: NormalizedFinding) -> str:
+    """Render a finding as a remediation obligation for the agent."""
+    loc = finding.primary_location
+    where = f"{loc.uri}:{loc.start_line}" if loc and loc.start_line else (loc.uri if loc else "(unknown location)")
+    flow = ""
+    if finding.code_flows:
+        seq = finding.code_flows[0]
+        if seq:
+            src, sink = seq[0], seq[-1]
+            flow = f" Dataflow: {src.uri}:{src.start_line} -> {sink.uri}:{sink.start_line}."
+    return (
+        f"Security finding {finding.rule_id} ({finding.severity.value}, kind={finding.finding_kind.value}) "
+        f"at {where}: {finding.message}.{flow} "
+        "Remediate the vulnerability without changing behavior. "
+        "Do NOT modify tests, CI, scanner configuration, or suppressions."
+    )
+
+
+class EnginePatchGenerator:
+    def __init__(
+        self,
+        post: PostFn,
+        *,
+        repository_id: str,
+        snapshot_id: str,
+        model: str = "repository.verified_agentic_v1",
+    ):
+        self._post = post
+        self.repository_id = repository_id
+        self.snapshot_id = snapshot_id
+        self.model = model
+
+    def __call__(self, finding: NormalizedFinding, cwd: str) -> str:
+        resp = self._post(
+            f"/v1/repositories/{self.repository_id}/decision-plan",
+            {
+                "snapshot_id": self.snapshot_id,
+                "model": self.model,
+                "signals": {
+                    "issue_text": finding_issue(finding),
+                    "security_finding": {
+                        "canonical_id": finding.canonical_id,
+                        "rule_id": finding.rule_id,
+                        "finding_kind": finding.finding_kind.value,
+                    },
+                },
+            },
+        )
+        diff = resp.get("patch_diff") or (resp.get("decision_plan") or {}).get("patch_diff")
+        if not diff or not str(diff).strip():
+            raise PatchGenError(f"engine returned no patch for {finding.rule_id} ({finding.canonical_id})")
+        return diff
+
+
+class ClinePatchGenerator:
+    """`patch_generator(finding, cwd) -> diff` backed by the agentic Cline SDK (agent-core).
+
+    This is the self-hosted remediation seam: instead of asking a remote engine for a patch, it
+    drives codna's bundled sidecar agent against an isolated workspace and returns the captured
+    unified diff for the caller to subject to the G4 anti-evasion check and then apply.
+    """
+
+    def __init__(
+        self,
+        *,
+        model: str | None = None,
+        max_iterations: int = 20,
+        timeout_s: int = 360,
+        keys: Mapping[str, ConfigValue] | None = None,
+    ):
+        self.model = model
+        self.max_iterations = max_iterations
+        self.timeout_s = timeout_s
+        self.keys = keys
+
+    def __call__(self, finding: NormalizedFinding, cwd: str) -> str:
+        from .packaged_agent_runner import SidecarPackagedAgentRunner
+        from .packaged_repository_advanced import PackagedAgentRunRequest
+        from .runtime.config import resolve_runtime_config
+
+        prompt = (
+            finding_issue(finding)
+            + " Edit only the vulnerable source file(s); use REPOSITORY-RELATIVE paths."
+        )
+        snapshot_id = _secure_snapshot_id(cwd, finding)
+        request = PackagedAgentRunRequest(
+            repository_id=_secure_repository_id(cwd),
+            snapshot_id=snapshot_id,
+            repo_root=Path(cwd).resolve(strict=True),
+            issue_text=prompt,
+            model=_packaged_model(self.model),
+            signals={
+                "issue_text": prompt,
+                "security_finding": {
+                    "canonical_id": finding.canonical_id,
+                    "rule_id": finding.rule_id,
+                    "finding_kind": finding.finding_kind.value,
+                },
+            },
+            evidence_bundle=_evidence_bundle(cwd, finding),
+            snapshot={
+                "snapshot_id": snapshot_id,
+                "snapshot_file_count": _count_repo_files(cwd),
+                "raw_repo_token_estimate": _estimate_repo_tokens(cwd),
+            },
+        )
+        runner = SidecarPackagedAgentRunner(config=resolve_runtime_config(keys=self.keys), keys=self.keys)
+        with _scoped_agent_limits(self.max_iterations, self.timeout_s):
+            diff = runner.run(request).patch_diff
+        if not diff.strip():
+            raise PatchGenError(f"cline agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
+        return diff
+
+
+def _packaged_model(model: str | None) -> str:
+    requested = (model or "").strip()
+    if not requested:
+        return "repository.verified_agentic_v1"
+    if requested.startswith("repository.") or "/" in requested:
+        return requested
+    return f"anthropic/{requested}"
+
+
+@contextlib.contextmanager
+def _scoped_agent_limits(max_iterations: int, timeout_s: int):
+    updates = {
+        "ALGENTA_AGENT_MAX_TURNS": str(max_iterations),
+        "ALGENTA_AGENT_TURN_TIMEOUT_MS": str(max(1, timeout_s) * 1000),
+    }
+    previous = {key: os.environ.get(key) for key in updates}
+    try:
+        os.environ.update(updates)
+        yield
+    finally:
+        for key, value in previous.items():
+            if value is None:
+                os.environ.pop(key, None)
+            else:
+                os.environ[key] = value
+
+
+def _secure_repository_id(cwd: str) -> str:
+    digest = hashlib.sha256(str(Path(cwd).resolve()).encode("utf-8")).hexdigest()[:16]
+    return f"secure_local_{digest}"
+
+
+def _secure_snapshot_id(cwd: str, finding: NormalizedFinding) -> str:
+    raw = f"{Path(cwd).resolve()}|{finding.canonical_id}"
+    return "secure_snapshot_" + hashlib.sha256(raw.encode("utf-8")).hexdigest()[:16]
+
+
+def _evidence_bundle(cwd: str, finding: NormalizedFinding) -> dict:
+    path = finding.primary_location.uri if finding.primary_location else ""
+    items = []
+    if path:
+        items.append(
+            {
+                "file_path": path,
+                "symbol_name": None,
+                "snippet": _source_snippet(cwd, path, finding.primary_location.start_line),
+            }
+        )
+    return {
+        "suspect_files": [path] if path else [],
+        "suspect_symbols": [],
+        "evidence_items": items,
+    }
+
+
+def _source_snippet(cwd: str, relative_path: str, start_line: int | None) -> str:
+    path = Path(cwd) / relative_path
+    try:
+        lines = path.read_text(encoding="utf-8", errors="replace").splitlines()
+    except OSError:
+        return ""
+    line = max(1, int(start_line or 1))
+    begin = max(1, line - 8)
+    end = min(len(lines), line + 8)
+    return "\n".join(f"{idx}: {lines[idx - 1]}" for idx in range(begin, end + 1))
+
+
+def _count_repo_files(cwd: str) -> int:
+    return sum(1 for path in Path(cwd).rglob("*") if path.is_file() and ".git" not in path.parts)
+
+
+def _estimate_repo_tokens(cwd: str) -> int:
+    total = 0
+    for path in Path(cwd).rglob("*"):
+        if not path.is_file() or ".git" in path.parts:
+            continue
+        try:
+            total += max(1, path.stat().st_size // 4)
+        except OSError:
+            continue
+    return total

{codna-0.1.24 → codna-0.1.26}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.24
+Version: 0.1.26
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.24 → codna-0.1.26}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.24"
+version = "0.1.26"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.24 → codna-0.1.26}/tests/test_cli_fix.py

@@ -54,7 +54,7 @@ def test_cmd_fix_surfaces_structured_engine_failure(monkeypatch):
                 status_code=422,
             )
 
-    monkeypatch.setattr("codna.cli._client", lambda: FailingClient())
+    monkeypatch.setattr("codna.cli._client", lambda **_kwargs: FailingClient())
     monkeypatch.setattr("codna.cli._register", lambda *args, **kwargs: ("repo_1", {"snapshot_id": "snap_1"}))
     monkeypatch.setattr("codna.cli._dump", lambda value: value)
     args = SimpleNamespace(
@@ -112,7 +112,7 @@ def test_cmd_fix_raises_when_apply_fails(monkeypatch):
                 details={"simulation_id": "sim-1"},
             )
 
-    monkeypatch.setattr("codna.cli._client", lambda: FailingApplyClient())
+    monkeypatch.setattr("codna.cli._client", lambda **_kwargs: FailingApplyClient())
     monkeypatch.setattr("codna.cli._register", lambda *args, **kwargs: ("repo_1", {"snapshot_id": "snap_1"}))
     monkeypatch.setattr("codna.cli._dump", lambda value: value)
     args = SimpleNamespace(
@@ -177,7 +177,7 @@ def test_cmd_fix_open_pr_uses_remote_pr_apply(monkeypatch, capsys):
         }
         return "repo_1", {"snapshot_id": "snap_1"}
 
-    monkeypatch.setattr("codna.cli._client", lambda: OpenPrClient())
+    monkeypatch.setattr("codna.cli._client", lambda **_kwargs: OpenPrClient())
     monkeypatch.setattr("codna.cli._register", fake_register)
     monkeypatch.setattr("codna.cli._dump", lambda value: value)
     args = SimpleNamespace(

{codna-0.1.24 → codna-0.1.26}/tests/test_cli_parser.py

@@ -88,8 +88,14 @@ def test_main_formats_coded_errors_without_traceback(monkeypatch, capsys):
 
 
 def test_main_formats_runtime_config_errors_without_die(monkeypatch, capsys):
+    from codna import keystore
+
+    def forbidden_keychain_read():
+        raise AssertionError("runtime config errors for passive commands must not read OS keychain secrets")
+
     monkeypatch.setenv("CODNA_ENGINE_URL", "http://127.0.0.1:9999")
     monkeypatch.delenv("CODNA_ALLOW_LOOPBACK_ENGINE_URL", raising=False)
+    monkeypatch.setattr(keystore, "config_values", forbidden_keychain_read)
 
     rc = cli_module.main(["triage", "."])
 

{codna-0.1.24 → codna-0.1.26}/tests/test_cli_surface_parity.py

@@ -94,7 +94,7 @@ def test_cmd_triage_json_output(monkeypatch, capsys):
                 "workspace_evidence_bundle_ref": "bundle-1",
             }
 
-    monkeypatch.setattr(cli, "_client", lambda: _FakeClient())
+    monkeypatch.setattr(cli, "_client", lambda **_kwargs: _FakeClient())
     monkeypatch.setattr(cli, "_register", lambda c, repo, ref, focus_paths=None: ("rid-1", {"snapshot_id": "snap-1", "snapshot_file_count": 3}))
     monkeypatch.setattr(cli, "_issue_focus_paths", lambda local, issue: [])
     monkeypatch.setattr(cli, "_dump", lambda x: x)
@@ -200,7 +200,7 @@ def test_capabilities_doc_matches_mcp_tool_contracts():
     assert "mode                 fix or secure" in doc
     assert "The current `action.yml` does not expose secure mode" not in doc
     assert "secure mode read-only" in doc
-    assert "CODNA_ENABLE_KEYCHAIN" in doc
+    assert "CODNA_DISABLE_KEYCHAIN" in doc
     assert "do not trigger OS authorization prompts" in doc
 
     parser = cli.build_parser()