codna 0.1.25__tar.gz → 0.1.26__tar.gz

{codna-0.1.25 → codna-0.1.26}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.25
+Version: 0.1.26
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.25 → codna-0.1.26}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.25"
+__version__ = "0.1.26"

{codna-0.1.25 → codna-0.1.26}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/home/runner/work/codna/codna/cli/codna-0.1.25/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/home/runner/work/codna/codna/cli/codna-0.1.26/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.1.25 → codna-0.1.26}/codna/cli.py

@@ -510,10 +510,10 @@ def cmd_secure(args) -> None:
     if not (args.open_pr or args.fix):
         return
     if args.engine == "local":
-        # Self-hosted detect→fix→verify→close via the agentic Cline SDK; report-only.
+        # Self-hosted detect→fix→verify→close via the agentic Cline SDK; local checkout apply only.
         if args.open_pr:
             _die("--open-pr needs the privilege-separated writer + a scoped token; "
-                 "`--engine local --fix` is report-only (it proves the fix but opens no PR).")
+                 "`--engine local --fix` applies to the local checkout but opens no PR.")
         _run_local_fix(args, ingest=ingest, engine=engine, policy=policy, manifest=manifest)
     else:
         _run_remediation(args, ingest=ingest, rid=rid, snapshot_id=snap["snapshot_id"],
@@ -544,8 +544,7 @@ class _NoWriter:
 
 
 def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
-    """`--engine local --fix`: detect (refengine) → fix (Cline SDK) → verify (manifest
-    build/tests) → re-prove closure (refengine). Report-only; opens no PR."""
+    """Local secure fix: prove, verify, close, then apply the patch to the checkout."""
     import os
 
     from .localfix import run_local_fix
@@ -562,7 +561,7 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
     print("\ncodna: remediating eligible findings with the agentic Cline SDK (local engine) …")
     report = run_local_fix(
         ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model, keys=_runtime_keys()),
-        repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds,
+        repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds, apply_to_repo=True,
     )
 
     print(f"\n✓ local fix: {report.eligible} eligible finding(s) processed")
@@ -570,13 +569,17 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
         if not o.eligible:
             continue
         if o.remediated:
-            tag = ("tests pass" if o.tests_passed else
-                   "no tests configured" if o.tests_passed is None else "")
+            tag = "tests pass" if o.tests_passed else "no tests configured" if o.tests_passed is None else ""
             status = f"REMEDIATED — closure={o.closure}" + (f", {tag}" if tag else "")
+            status += ", applied to checkout" if o.target_applied is True else ""
         elif not o.integrity_ok:
             status = f"blocked: patch integrity ({o.integrity_reason})"
         elif o.tests_passed is False:
             status = f"blocked: tests failed (closure={o.closure})"
+        elif o.target_applied is False:
+            status = f"blocked: target apply failed ({o.target_apply_reason})"
+        elif o.target_tests_passed is False:
+            status = f"blocked: target tests failed ({o.target_apply_reason})"
         else:
             status = f"blocked: obligation not closed (closure={o.closure})"
         print(f"  [{o.classification}] {o.rule_id}  {status}")
@@ -874,7 +877,7 @@ def build_parser() -> argparse.ArgumentParser:
     ps.add_argument("--verification", help="codna-security.yaml manifest (required for --open-pr)")
     ps.add_argument("--open-pr", dest="open_pr", action="store_true",
                     help="open a fix PR per reachable finding (requires a resolved manifest)")
-    ps.add_argument("--fix", action="store_true", help="remediate eligible findings (report-only, no PR)")
+    ps.add_argument("--fix", action="store_true", help="remediate eligible findings in the local checkout (no PR)")
     ps.add_argument("--github-token", help="write token for --open-pr (or env GITHUB_TOKEN)")
     ps.add_argument("--base-branch", help="PR base branch (default: repo default)")
     ps.add_argument("--repo-slug", dest="repo_slug", help="owner/repo for --open-pr (else derived from the git remote)")

{codna-0.1.25 → codna-0.1.26}/codna/localfix.py

@@ -8,11 +8,12 @@ or scanner-less environments, and it keeps the same discipline:
 
   * ineligible findings (per policy) are reported but NEVER fixed;
   * every generated patch is subject to the G4 anti-evasion check BEFORE it is applied;
-  * the patched tree must pass the manifest's build/test commands; and
-  * the original obligation must be independently re-proven `closed` after the fix.
+  * the patched proof tree must pass the manifest's build/test commands;
+  * the original obligation must be independently re-proven `closed` after the fix; and
+  * CLI fix mode applies the verified diff to the user's checkout and re-runs verification there.
 
-It is report-only — it proves the fix locally but does not open PRs (that needs the privilege-
-separated writer + a scoped token, which `--open-pr` wires through `run_secure`).
+It never opens PRs itself (that needs the privilege-separated writer + a scoped token, which
+`--open-pr` wires through `run_secure`).
 """
 from __future__ import annotations
 
@@ -28,6 +29,13 @@ from .secure import Patch, SecurityEngine
 from .worktree import EphemeralWorktree
 
 
+@dataclass
+class TargetApplyResult:
+    applied: bool
+    tests_passed: bool | None = None
+    reason: str = ""
+
+
 @dataclass
 class LocalFixOutcome:
     canonical_id: str
@@ -41,6 +49,9 @@ class LocalFixOutcome:
     tests_passed: bool | None = None  # None = not run (no test commands configured)
     closure: str = "n/a"
     diff: str = ""
+    target_applied: bool | None = None  # None = target apply was not requested.
+    target_tests_passed: bool | None = None
+    target_apply_reason: str = ""
 
     @property
     def remediated(self) -> bool:
@@ -51,6 +62,8 @@ class LocalFixOutcome:
             and self.integrity_ok
             and self.tests_passed is not False
             and self.closure == "closed"
+            and self.target_applied is not False
+            and self.target_tests_passed is not False
         )
 
 
@@ -74,8 +87,14 @@ def run_local_fix(
     commit: str,
     policy: Policy,
     test_cmds: list[list[str]] | None = None,
+    apply_to_repo: bool = False,
 ) -> LocalFixReport:
-    """Run detect→fix→verify→close for every eligible finding in an isolated worktree."""
+    """Run detect→fix→verify→close for every eligible finding.
+
+    The agent always works against an isolated worktree pinned to the SARIF-bound commit. When
+    ``apply_to_repo`` is true, the verified diff is then applied to the caller's checkout with
+    ``git apply --check`` first and verification is run again on the target checkout.
+    """
     outcomes: list[LocalFixOutcome] = []
     eligible = 0
 
@@ -112,17 +131,80 @@ def run_local_fix(
             wt.apply_patch(diff)
             outcome.fix_applied = True
             if test_cmds:
-                outcome.tests_passed = all(
-                    subprocess.run(_verification_command(cmd), cwd=wt.path, capture_output=True).returncode == 0
-                    for cmd in test_cmds
-                )
+                outcome.tests_passed = _run_verification_commands(test_cmds, cwd=wt.path)
             closure = engine.reprove_closure(finding, Patch(digest_of(diff), diff=diff))
             outcome.closure = closure.closure_status.value
+            if apply_to_repo and _proof_passed(outcome):
+                target = _apply_verified_patch_to_repo(repo_dir, diff, test_cmds or [])
+                outcome.target_applied = target.applied
+                outcome.target_tests_passed = target.tests_passed
+                outcome.target_apply_reason = target.reason
         outcomes.append(outcome)
 
     return LocalFixReport(len(ingest.findings), eligible, outcomes)
 
 
+def _proof_passed(outcome: LocalFixOutcome) -> bool:
+    return (
+        outcome.fix_applied
+        and outcome.integrity_ok
+        and outcome.tests_passed is not False
+        and outcome.closure == "closed"
+    )
+
+
+def _run_verification_commands(commands: list[list[str]], *, cwd: str) -> bool:
+    return all(
+        subprocess.run(_verification_command(cmd), cwd=cwd, capture_output=True).returncode == 0
+        for cmd in commands
+    )
+
+
+def _apply_verified_patch_to_repo(repo_dir: str, diff: str, test_cmds: list[list[str]]) -> TargetApplyResult:
+    check = _git_apply(repo_dir, diff, "--check")
+    if check.returncode != 0:
+        return TargetApplyResult(False, reason=_format_git_apply_error("target apply check failed", check))
+
+    applied = _git_apply(repo_dir, diff)
+    if applied.returncode != 0:
+        return TargetApplyResult(False, reason=_format_git_apply_error("target apply failed", applied))
+
+    if not test_cmds:
+        return TargetApplyResult(True)
+
+    if _run_verification_commands(test_cmds, cwd=repo_dir):
+        return TargetApplyResult(True, tests_passed=True)
+
+    rollback = _git_apply(repo_dir, diff, "-R")
+    if rollback.returncode == 0:
+        return TargetApplyResult(
+            False,
+            tests_passed=False,
+            reason="target verification failed after apply; patch rolled back",
+        )
+    return TargetApplyResult(
+        True,
+        tests_passed=False,
+        reason=_format_git_apply_error("target verification failed after apply; rollback failed", rollback),
+    )
+
+
+def _git_apply(repo_dir: str, diff: str, *args: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["git", "-C", repo_dir, "apply", "--whitespace=nowarn", *args, "-"],
+        input=diff,
+        capture_output=True,
+        text=True,
+    )
+
+
+def _format_git_apply_error(prefix: str, proc: subprocess.CompletedProcess) -> str:
+    detail = (proc.stderr or proc.stdout or "").strip()
+    if not detail:
+        return prefix
+    return f"{prefix}: {detail[:500]}"
+
+
 def _verification_command(cmd: list[str]) -> list[str]:
     """Run manifest `python ...` commands with the interpreter executing Codna when needed.
 

{codna-0.1.25 → codna-0.1.26}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.25
+Version: 0.1.26
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.25 → codna-0.1.26}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.25"
+version = "0.1.26"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.25 → codna-0.1.26}/tests/test_localfix.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 import json
 import os
 import subprocess
+import sys
 
 import codna.localfix as localfix_module
 from codna.findings import Classification, ClosureStatus
@@ -103,6 +104,59 @@ def test_python_verification_command_uses_current_interpreter_when_absent(tmp_pa
     assert report.outcomes[0].tests_passed is True
 
 
+def test_apply_to_repo_applies_verified_patch_to_checkout(tmp_path):
+    repo, sha = _init_repo(tmp_path)
+    report = run_local_fix(
+        INGEST, engine=StubEngine(), patch_generator=gen_parameterize,
+        repo_dir=repo, commit=sha, policy=PROD_POLICY, test_cmds=[["true"]], apply_to_repo=True,
+    )
+
+    o = report.outcomes[0]
+    assert o.remediated is True
+    assert o.target_applied is True
+    assert o.target_tests_passed is True
+    assert "?" in open(os.path.join(repo, "src", "app.py")).read()
+
+
+def test_apply_to_repo_blocks_when_target_patch_no_longer_applies(tmp_path):
+    repo, sha = _init_repo(tmp_path)
+    app = os.path.join(repo, "src", "app.py")
+    open(app, "w").write('def q(cur, u):\n    return cur.execute("changed")\n')
+
+    report = run_local_fix(
+        INGEST, engine=StubEngine(), patch_generator=gen_parameterize,
+        repo_dir=repo, commit=sha, policy=PROD_POLICY, test_cmds=[["true"]], apply_to_repo=True,
+    )
+
+    o = report.outcomes[0]
+    assert o.remediated is False
+    assert o.target_applied is False
+    assert o.target_apply_reason.startswith("target apply check failed")
+    assert "changed" in open(app).read()
+
+
+def test_apply_to_repo_rolls_back_when_target_verification_fails(tmp_path):
+    repo, sha = _init_repo(tmp_path)
+    open(os.path.join(repo, "target-only"), "w").write("present only in caller checkout\n")
+    test_cmd = [
+        sys.executable,
+        "-c",
+        "from pathlib import Path; raise SystemExit(1 if Path('target-only').exists() else 0)",
+    ]
+
+    report = run_local_fix(
+        INGEST, engine=StubEngine(), patch_generator=gen_parameterize,
+        repo_dir=repo, commit=sha, policy=PROD_POLICY, test_cmds=[test_cmd], apply_to_repo=True,
+    )
+
+    o = report.outcomes[0]
+    assert o.remediated is False
+    assert o.target_applied is False
+    assert o.target_tests_passed is False
+    assert o.target_apply_reason == "target verification failed after apply; patch rolled back"
+    assert "?" not in open(os.path.join(repo, "src", "app.py")).read()
+
+
 def test_ineligible_finding_is_never_fixed(tmp_path):
     repo, sha = _init_repo(tmp_path)
     # default policy autofixes only 'exploitable'; production-reachable is NOT eligible