codna 0.1.2__tar.gz → 0.1.4__tar.gz

{codna-0.1.2 → codna-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.2
+Version: 0.1.4
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.2 → codna-0.1.4}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.2"
+__version__ = "0.1.4"

{codna-0.1.2 → codna-0.1.4}/codna/agent_core_runtime.py

@@ -4,6 +4,7 @@ import uuid
 import hashlib
 import json
 import os
+import re
 import time
 from dataclasses import dataclass
 from datetime import UTC, datetime
@@ -68,6 +69,21 @@ PROVIDER_RUNTIME_ENV_KEYS = (
 LEGACY_REQUEST_MODE_ENV_KEYS = (
     "AGENT_CORE_TELYS_LOCALIZE_ENABLED",
 )
+AGENT_CORE_READY_TIMEOUT_ENV = "CODNA_AGENT_CORE_READY_TIMEOUT_SECONDS"
+AGENT_CORE_READY_TIMEOUT_MIN_S = 5.0
+AGENT_CORE_READY_TIMEOUT_MAX_S = 300.0
+AGENT_CORE_LOG_TAIL_BYTES = 16 * 1024
+AGENT_CORE_LOG_TAIL_LINES = 120
+SECRET_VALUE_PATTERN = re.compile(
+    r"(?i)(bearer|basic)\s+[a-z0-9._~+/=-]+|"
+    r"pypi-[a-z0-9._~+/=-]+|"
+    r"gh[pousr]_[a-z0-9_]+|"
+    r"sk-[a-z0-9_-]+"
+)
+SECRET_ASSIGNMENT_PATTERN = re.compile(
+    r"(?i)\b(api[_-]?key|token|secret|password|authorization)"
+    r"([\"']?\s*[:=]\s*[\"']?)([^\"'\s,}]+)"
+)
 
 
 @dataclass(frozen=True)
@@ -114,6 +130,69 @@ def _probe_summary(probe: ProbeResult) -> dict[str, Any]:
     }
 
 
+def _agent_core_ready_timeout_seconds() -> float:
+    raw = os.environ.get(AGENT_CORE_READY_TIMEOUT_ENV)
+    if raw is None or not raw.strip():
+        return SIDECAR_READY_TIMEOUT_S
+    try:
+        value = float(raw)
+    except ValueError as exc:
+        raise LocalRuntimeError(
+            "agent_core_ready_timeout_invalid",
+            "Codna agent-core readiness timeout must be numeric seconds.",
+            {
+                "env": AGENT_CORE_READY_TIMEOUT_ENV,
+                "value": raw,
+                "min_seconds": AGENT_CORE_READY_TIMEOUT_MIN_S,
+                "max_seconds": AGENT_CORE_READY_TIMEOUT_MAX_S,
+            },
+        ) from exc
+    if not AGENT_CORE_READY_TIMEOUT_MIN_S <= value <= AGENT_CORE_READY_TIMEOUT_MAX_S:
+        raise LocalRuntimeError(
+            "agent_core_ready_timeout_invalid",
+            "Codna agent-core readiness timeout is outside the allowed range.",
+            {
+                "env": AGENT_CORE_READY_TIMEOUT_ENV,
+                "value": raw,
+                "min_seconds": AGENT_CORE_READY_TIMEOUT_MIN_S,
+                "max_seconds": AGENT_CORE_READY_TIMEOUT_MAX_S,
+            },
+        )
+    return value
+
+
+def _redact_log_text(text: str) -> str:
+    redacted = SECRET_VALUE_PATTERN.sub(lambda match: f"{match.group(1)} [redacted]" if match.group(1) else "[redacted]", text)
+    return SECRET_ASSIGNMENT_PATTERN.sub(r"\1\2[redacted]", redacted)
+
+
+def _read_log_tail(path: Path) -> dict[str, Any]:
+    try:
+        size = path.stat().st_size
+    except FileNotFoundError:
+        return {"available": False, "path": str(path), "reason": "missing"}
+    except OSError as exc:
+        return {"available": False, "path": str(path), "reason": str(exc)}
+    try:
+        with path.open("rb") as handle:
+            if size > AGENT_CORE_LOG_TAIL_BYTES:
+                handle.seek(size - AGENT_CORE_LOG_TAIL_BYTES)
+            data = handle.read(AGENT_CORE_LOG_TAIL_BYTES)
+    except OSError as exc:
+        return {"available": False, "path": str(path), "reason": str(exc)}
+    text = data.decode("utf-8", errors="replace")
+    if size > AGENT_CORE_LOG_TAIL_BYTES and "\n" in text:
+        text = text.split("\n", 1)[1]
+    lines = _redact_log_text(text).splitlines()[-AGENT_CORE_LOG_TAIL_LINES:]
+    return {
+        "available": True,
+        "path": str(path),
+        "truncated": size > AGENT_CORE_LOG_TAIL_BYTES,
+        "max_bytes": AGENT_CORE_LOG_TAIL_BYTES,
+        "recent_lines": lines,
+    }
+
+
 def _load_state(config: RuntimeConfig) -> dict[str, Any] | None:
     payload = read_json(_state_path(config))
     return payload if isinstance(payload, dict) else None
@@ -585,11 +664,12 @@ def _start_sidecar(
     rotate_log(sidecar_log, max_bytes=LOG_ROTATE_BYTES, backups=LOG_ROTATE_FILES)
     runtime_id = str(uuid.uuid4())
     command, cwd, env = _sidecar_spawn(config, runtime_id, keys=keys)
+    ready_timeout_s = _agent_core_ready_timeout_seconds()
     process = spawn_detached_process(command, cwd=cwd, env=env, log_path=sidecar_log)
     probe = wait_until_ready(
         probe_sidecar_ready,
         config.sidecar_url,
-        timeout_s=SIDECAR_READY_TIMEOUT_S,
+        timeout_s=ready_timeout_s,
         request_timeout_s=READY_TIMEOUT_S,
     )
     if not probe.ok:
@@ -602,7 +682,9 @@ def _start_sidecar(
                 "target_url": f"{config.sidecar_url}/ready",
                 "state_path": str(_state_path(config)),
                 "log_path": str(sidecar_log),
+                "timeout_seconds": ready_timeout_s,
                 "probe": _probe_summary(probe),
+                "log_tail": _read_log_tail(sidecar_log),
             },
         )
     healthy, probes = _service_is_codna_sidecar(config)
@@ -616,7 +698,9 @@ def _start_sidecar(
                 "target_url": f"{config.sidecar_url}/health",
                 "state_path": str(_state_path(config)),
                 "log_path": str(sidecar_log),
+                "timeout_seconds": ready_timeout_s,
                 "probe": probes,
+                "log_tail": _read_log_tail(sidecar_log),
             },
         )
     state = _write_state(config, runtime_id=runtime_id, pid=process.pid, keys=keys)

{codna-0.1.2 → codna-0.1.4}/codna/packaged_agent_runner.py

@@ -5,7 +5,7 @@ import os
 import shutil
 import subprocess
 from dataclasses import dataclass
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Any, Mapping
 
 import httpx
@@ -33,6 +33,19 @@ _WORKSPACE_SKIP_DIRS = {
     "target",
     "venv",
 }
+_PATCH_CAPTURE_SKIP_DIRS = _WORKSPACE_SKIP_DIRS | {
+    ".cache",
+    ".mypy_cache",
+    ".pytest_cache",
+    ".ruff_cache",
+    ".tox",
+}
+_PATCH_CAPTURE_SKIP_FILES = {
+    ".coverage",
+    ".DS_Store",
+    "coverage.xml",
+}
+_PATCH_CAPTURE_SKIP_SUFFIXES = (".pyc", ".pyo")
 
 
 @dataclass(frozen=True)
@@ -205,15 +218,64 @@ def _cleanup_workspace(repo_root: Path, workspace: _Workspace) -> None:
 
 
 def _capture_patch(workspace: Path) -> str:
-    subprocess.run(
-        ["git", "-C", str(workspace), "add", "-N", "."],
+    _add_untracked_patch_candidates(workspace)
+    result = subprocess.run(
+        ["git", "-C", str(workspace), "diff", "--binary", "--no-ext-diff", "--"],
         capture_output=True,
         text=True,
         check=False,
         timeout=60,
     )
+    if result.returncode != 0:
+        raise PackagedRepositoryAdvancedError(
+            "agent_patch_capture_failed",
+            "Codna could not capture the local agent patch.",
+            {"workspace": str(workspace), "stderr": result.stderr[-2000:]},
+        )
+    return result.stdout
+
+
+def _add_untracked_patch_candidates(workspace: Path) -> None:
     result = subprocess.run(
-        ["git", "-C", str(workspace), "diff", "--binary", "--no-ext-diff", "--"],
+        ["git", "-C", str(workspace), "ls-files", "--others", "--exclude-standard", "-z"],
+        capture_output=True,
+        check=False,
+        timeout=60,
+    )
+    if result.returncode != 0:
+        raise PackagedRepositoryAdvancedError(
+            "agent_patch_capture_failed",
+            "Codna could not inspect untracked local agent patch files.",
+            {"workspace": str(workspace), "stderr": result.stderr.decode("utf-8", "replace")[-2000:]},
+        )
+    candidates = [
+        path
+        for path in _decode_git_z_paths(result.stdout)
+        if _should_capture_untracked_patch_file(path)
+    ]
+    for start in range(0, len(candidates), 100):
+        _git_add_intent_to_add(workspace, candidates[start : start + 100])
+
+
+def _decode_git_z_paths(raw: bytes) -> list[str]:
+    return [item.decode("utf-8", "surrogateescape") for item in raw.split(b"\0") if item]
+
+
+def _should_capture_untracked_patch_file(path: str) -> bool:
+    parsed = PurePosixPath(path)
+    if any(part in _PATCH_CAPTURE_SKIP_DIRS for part in parsed.parts):
+        return False
+    name = parsed.name
+    if name in _PATCH_CAPTURE_SKIP_FILES:
+        return False
+    return not name.endswith(_PATCH_CAPTURE_SKIP_SUFFIXES)
+
+
+def _git_add_intent_to_add(workspace: Path, paths: list[str]) -> None:
+    if not paths:
+        return
+    result = subprocess.run(
+        ["git", "-C", str(workspace), "add", "-N", "--", *paths],
         capture_output=True,
         text=True,
         check=False,
@@ -222,10 +284,9 @@ def _capture_patch(workspace: Path) -> str:
     if result.returncode != 0:
         raise PackagedRepositoryAdvancedError(
             "agent_patch_capture_failed",
-            "Codna could not capture the local agent patch.",
+            "Codna could not stage local agent patch candidates for capture.",
             {"workspace": str(workspace), "stderr": result.stderr[-2000:]},
         )
-    return result.stdout
 
 
 def _init_baseline_git_repo(workspace: Path) -> None:

{codna-0.1.2 → codna-0.1.4}/codna/packaged_git.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import os
 import re
 import subprocess
+from base64 import b64encode
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping
@@ -318,9 +319,10 @@ def _git_auth_env(repository_url: str, token: str | None) -> dict[str, str] | No
     env = dict(os.environ)
     env["GIT_TERMINAL_PROMPT"] = "0"
     if token and repository_url.startswith(("http://", "https://")):
+        credential = b64encode(f"x-access-token:{token}".encode("utf-8")).decode("ascii")
         env["GIT_CONFIG_COUNT"] = "1"
         env["GIT_CONFIG_KEY_0"] = "http.extraHeader"
-        env["GIT_CONFIG_VALUE_0"] = f"AUTHORIZATION: bearer {token}"
+        env["GIT_CONFIG_VALUE_0"] = f"AUTHORIZATION: basic {credential}"
     return env
 
 

{codna-0.1.2 → codna-0.1.4}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.2
+Version: 0.1.4
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.2 → codna-0.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.2"
+version = "0.1.4"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.2 → codna-0.1.4}/tests/test_agent_core_runtime.py

@@ -75,6 +75,55 @@ def test_agent_core_start_reports_missing_sidecar_runtime(tmp_path, monkeypatch)
     assert excinfo.value.details["expected_entrypoint"].endswith("run-server.mjs")
 
 
+def test_agent_core_ready_timeout_defaults_to_local_runtime_budget(monkeypatch) -> None:
+    monkeypatch.delenv(agent_core_runtime.AGENT_CORE_READY_TIMEOUT_ENV, raising=False)  # noqa: SLF001
+
+    assert agent_core_runtime._agent_core_ready_timeout_seconds() == agent_core_runtime.SIDECAR_READY_TIMEOUT_S  # noqa: SLF001
+
+
+@pytest.mark.parametrize("value", ["abc", "4.9", "301"])
+def test_agent_core_ready_timeout_rejects_invalid_values(monkeypatch, value: str) -> None:
+    monkeypatch.setenv(agent_core_runtime.AGENT_CORE_READY_TIMEOUT_ENV, value)  # noqa: SLF001
+
+    with pytest.raises(LocalRuntimeError) as excinfo:
+        agent_core_runtime._agent_core_ready_timeout_seconds()  # noqa: SLF001
+
+    assert excinfo.value.code == "agent_core_ready_timeout_invalid"
+    assert excinfo.value.details["env"] == agent_core_runtime.AGENT_CORE_READY_TIMEOUT_ENV  # noqa: SLF001
+
+
+def test_agent_core_ready_timeout_accepts_valid_override(monkeypatch) -> None:
+    monkeypatch.setenv(agent_core_runtime.AGENT_CORE_READY_TIMEOUT_ENV, "120")  # noqa: SLF001
+
+    assert agent_core_runtime._agent_core_ready_timeout_seconds() == 120.0  # noqa: SLF001
+
+
+def test_agent_core_log_tail_is_bounded_and_redacted(tmp_path) -> None:
+    log_path = tmp_path / "local-sidecar.log"
+    log_path.write_text(
+        "\n".join(
+            [
+                "startup line",
+                "Authorization: Bearer secret-token-value",
+                "OPENAI_API_KEY=sk-secretvalue",
+                "PYPI_TOKEN=pypi-secretvalue",
+                "ready failed",
+            ]
+        ),
+        encoding="utf-8",
+    )
+
+    payload = agent_core_runtime._read_log_tail(log_path)  # noqa: SLF001
+
+    assert payload["available"] is True
+    rendered = "\n".join(payload["recent_lines"])
+    assert "ready failed" in rendered
+    assert "secret-token-value" not in rendered
+    assert "sk-secretvalue" not in rendered
+    assert "pypi-secretvalue" not in rendered
+    assert "[redacted]" in rendered
+
+
 def test_agent_core_reuses_owned_runtime_only_when_fingerprint_matches(tmp_path, monkeypatch) -> None:
     monkeypatch.setenv("CODNA_RUNTIME_ROOT", str(tmp_path / ".codna"))
     config = resolve_runtime_config()

{codna-0.1.2 → codna-0.1.4}/tests/test_cli_parser.py

@@ -112,6 +112,13 @@ def test_github_action_uses_cli_without_forcing_remote_engine_or_hiding_failures
     text = action.read_text(encoding="utf-8")
 
     assert 'default: ""' in text
+    assert "uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6" in text
+    assert "bun-version: 1.3.13" in text
+    assert "bun install --frozen-lockfile" in text
+    assert "bun run build:sdk" in text
+    assert "bash algenta/postbuild.sh" in text
+    assert 'echo "CODNA_SIDECAR_DIR=$GITHUB_ACTION_PATH/agent-core" >> "$GITHUB_ENV"' in text
+    assert 'CODNA_AGENT_CORE_READY_TIMEOUT_SECONDS: "120"' in text
     assert "export CODNA_ENGINE_URL" in text
     assert "CODNA_ENGINE_URL: ${{ inputs.engine-url }}" not in text
     assert 'out="$(codna "${args[@]}" 2>&1)" || true' not in text

{codna-0.1.2 → codna-0.1.4}/tests/test_local_client.py

@@ -17,6 +17,7 @@ from codna.runtime.config import ConfigValue
 import codna.local_client as local_client_module
 import codna.local_mojo_daemon as mojo_daemon_module
 import codna.local_mojo_pool as mojo_pool_module
+import codna.packaged_agent_runner as packaged_agent_runner_module
 
 
 def _git(repo: Path, *args: str) -> str:
@@ -30,6 +31,29 @@ def _git(repo: Path, *args: str) -> str:
     return result.stdout
 
 
+def test_packaged_agent_patch_capture_excludes_generated_untracked_artifacts(tmp_path) -> None:
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    (repo / "app.py").write_text("def price():\n    return 1\n", encoding="utf-8")
+    _git(repo, "init", "-b", "main")
+    _git(repo, "add", "app.py")
+    _git(repo, "-c", "user.email=a@example.com", "-c", "user.name=Tester", "commit", "-m", "initial")
+    (repo / "app.py").write_text("def price():\n    return 2\n", encoding="utf-8")
+    (repo / "new_module.py").write_text("def tax():\n    return 0\n", encoding="utf-8")
+    (repo / "__pycache__").mkdir()
+    (repo / "__pycache__" / "app.cpython-313.pyc").write_bytes(b"cache")
+    (repo / ".pytest_cache").mkdir()
+    (repo / ".pytest_cache" / "README.md").write_text("cache\n", encoding="utf-8")
+
+    patch = packaged_agent_runner_module._capture_patch(repo)
+
+    assert "diff --git a/app.py b/app.py" in patch
+    assert "diff --git a/new_module.py b/new_module.py" in patch
+    assert "__pycache__" not in patch
+    assert ".pytest_cache" not in patch
+    assert ".pyc" not in patch
+
+
 class _Dumpable:
     def __init__(self, payload):
         self.payload = payload

{codna-0.1.2 → codna-0.1.4}/tests/test_packaged_remote_pr.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from base64 import b64decode
 import json
 import subprocess
 from pathlib import Path
@@ -8,7 +9,7 @@ import pytest
 
 from codna import local_client as local_client_module
 from codna.local_client import LocalCodnaClientError, LocalCodnaRuntimeClient
-from codna.packaged_git import PackagedGitError, materialize_repository
+from codna.packaged_git import PackagedGitError, _git_auth_env, materialize_repository
 from codna.packaged_repository_advanced import PackagedAgentRunResult
 
 
@@ -163,6 +164,31 @@ def test_packaged_github_repo_rejects_embedded_url_credentials(tmp_path) -> None
     assert excinfo.value.code == "invalid_connector_config"
 
 
+def test_git_auth_env_uses_github_https_basic_header(monkeypatch) -> None:
+    monkeypatch.setenv("EXISTING_ENV", "1")
+
+    env = _git_auth_env("https://github.com/owner/private-repo.git", "ghs_test_token")
+
+    assert env is not None
+    assert env["EXISTING_ENV"] == "1"
+    assert env["GIT_TERMINAL_PROMPT"] == "0"
+    assert env["GIT_CONFIG_COUNT"] == "1"
+    assert env["GIT_CONFIG_KEY_0"] == "http.extraHeader"
+    assert env["GIT_CONFIG_VALUE_0"].startswith("AUTHORIZATION: basic ")
+    assert "ghs_test_token" not in env["GIT_CONFIG_VALUE_0"]
+    encoded = env["GIT_CONFIG_VALUE_0"].removeprefix("AUTHORIZATION: basic ")
+    assert b64decode(encoded).decode("utf-8") == "x-access-token:ghs_test_token"
+
+
+def test_git_auth_env_disables_prompts_without_token() -> None:
+    env = _git_auth_env("https://github.com/owner/public-repo.git", None)
+
+    assert env is not None
+    assert env["GIT_TERMINAL_PROMPT"] == "0"
+    assert "GIT_CONFIG_COUNT" not in env
+    assert "GIT_CONFIG_VALUE_0" not in env
+
+
 def _force_packaged_backend(tmp_path: Path, monkeypatch) -> None:
     monkeypatch.delenv("ALGENTA_ENGINE_DIR", raising=False)
     monkeypatch.setenv("CODNA_RUNTIME_ROOT", str(tmp_path / ".codna"))

{codna-0.1.2 → codna-0.1.4}/tests/test_packaging.py

@@ -183,6 +183,10 @@ def test_github_action_preserves_codna_failure_status_without_forcing_remote_eng
     assert 'pipx install --force "$package_path"' in action
     assert 'python3 -m pip install --user --upgrade "$package_path"' in action
     assert 'echo "$HOME/.local/bin" >> "$GITHUB_PATH"' in action
+    assert "bun install --frozen-lockfile" in action
+    assert "bun run build:sdk" in action
+    assert "bash algenta/postbuild.sh" in action
+    assert 'echo "CODNA_SIDECAR_DIR=$GITHUB_ACTION_PATH/agent-core" >> "$GITHUB_ENV"' in action
     assert "CODNA_ACTION_ENGINE_URL: ${{ inputs.engine-url }}" in action
     assert 'export CODNA_ENGINE_URL="$CODNA_ACTION_ENGINE_URL"' in action
     assert 'export CODNA_ENGINE_URL="${{ inputs.engine-url }}"' not in action
@@ -296,14 +300,30 @@ def test_cli_publish_workflow_uses_trusted_publishing_and_contract_verification(
     assert "actions/upload-artifact" not in workflow
     assert "actions/download-artifact" not in workflow
     assert "python -m build cli" not in workflow
-    assert workflow.count("python scripts/build_cli_release_dist.py") == 3
+    # 4 = build-verify base build + Linux platform + macOS platform + the base-wheel fallback build.
+    assert workflow.count("python scripts/build_cli_release_dist.py") == 4
     assert workflow.count("python scripts/verify_pypi_trusted_publisher.py") == 2
     assert workflow.count("python scripts/download_telys_runtime_bundle.py") == 2
     assert workflow.count("--require-staged-runtime") == 2
+    # base-wheel fallback: publish py3-none-any + sdist without platform Telys-runtime staging
+    # (kernel installs separately via `telys runtime install`); platform staging/build steps are
+    # gated OFF when base_wheel_only is requested.
+    assert "base_wheel_only" in workflow
+    assert "inputs.base_wheel_only != true" in workflow
+    assert "inputs.base_wheel_only == true" in workflow
     assert workflow.count("python scripts/verify_cli_wheel_tags.py --cli-dir cli") == 2
     assert workflow.count("python -m twine check cli/dist/*") == 2
     assert "pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b" in workflow
-    assert "password:" not in workflow
+    # Publish auth policy: trusted-publisher OIDC is PREFERRED; a GATED PyPI API-token fallback is
+    # allowed so a release does not hard-block on trusted-publisher registration (which is a one-time
+    # PyPI UI step). The token/password credential is confined to the token-gated publish step
+    # (PUBLISH_AUTH == 'token') and the OIDC path carries no password. See publish-cli.yml
+    # "Select publish auth (token fallback vs trusted-publisher OIDC)".
+    assert "PUBLISH_AUTH=token" in workflow and "PUBLISH_AUTH=oidc" in workflow
+    assert "env.PUBLISH_AUTH == 'oidc'" in workflow
+    assert "env.PUBLISH_AUTH == 'token'" in workflow
+    assert "password: ${{ secrets.PYPI_TOKEN }}" in workflow
+    assert workflow.count("password:") == 1  # ONLY the gated token-fallback step, nowhere else
     assert "api-token:" not in workflow