codna 0.1.31__tar.gz → 0.1.32__tar.gz

{codna-0.1.31 → codna-0.1.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.31
+Version: 0.1.32
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -119,20 +119,22 @@ codna mcp
 Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
 repo understanding as a local tool.
 
-## Optional Local Memory
+## Local Memory And Telys
 
-Optional local code-memory support is available through:
+The base Codna install includes local code-memory support and the packaged
+Telys SDK/runtime/license:
 
 ```bash
-pip install "codna[memory]"
+pip install codna
 ```
 
-The memory extra uses the public Telys SDK internally for on-device retrieval,
-but the user-facing artifact is still Codna. Supported platform wheels include
-the signed native Telys runtime and Codna OEM license at release time. Source
-distributions intentionally exclude bundled native runtime artifacts; source
-checkout and unsupported-platform development can point Codna at an explicit
-runtime with `TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+Users install Codna once. There is no separate user-facing Telys publishing,
+download, license, or install step. The optional `codna[memory]` extra only
+adds heavier retrieval/rerank/language packages for experiments; it is not
+required for the default Codna + Telys runtime path. Source distributions
+intentionally exclude bundled native runtime artifacts; source checkout and
+unsupported-platform development can point Codna at an explicit runtime with
+`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
 
 ## Security And Local Files
 

{codna-0.1.31 → codna-0.1.32}/README.md

@@ -50,20 +50,22 @@ codna mcp
 Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
 repo understanding as a local tool.
 
-## Optional Local Memory
+## Local Memory And Telys
 
-Optional local code-memory support is available through:
+The base Codna install includes local code-memory support and the packaged
+Telys SDK/runtime/license:
 
 ```bash
-pip install "codna[memory]"
+pip install codna
 ```
 
-The memory extra uses the public Telys SDK internally for on-device retrieval,
-but the user-facing artifact is still Codna. Supported platform wheels include
-the signed native Telys runtime and Codna OEM license at release time. Source
-distributions intentionally exclude bundled native runtime artifacts; source
-checkout and unsupported-platform development can point Codna at an explicit
-runtime with `TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+Users install Codna once. There is no separate user-facing Telys publishing,
+download, license, or install step. The optional `codna[memory]` extra only
+adds heavier retrieval/rerank/language packages for experiments; it is not
+required for the default Codna + Telys runtime path. Source distributions
+intentionally exclude bundled native runtime artifacts; source checkout and
+unsupported-platform development can point Codna at an explicit runtime with
+`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
 
 ## Security And Local Files
 

{codna-0.1.31 → codna-0.1.32}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.31"
+__version__ = "0.1.32"

{codna-0.1.31 → codna-0.1.32}/codna/cli.py

@@ -529,10 +529,10 @@ def cmd_secure(args) -> None:
         if args.open_pr:
             _die("--open-pr needs the privilege-separated writer + a scoped token; "
                  "`--engine local --fix` applies to the local checkout but opens no PR.")
-        _run_local_fix(args, ingest=ingest, engine=engine, policy=policy, manifest=manifest)
+        return _run_local_fix(args, ingest=ingest, engine=engine, policy=policy, manifest=manifest)
     else:
-        _run_remediation(args, ingest=ingest, rid=rid, snapshot_id=snap["snapshot_id"],
-                         url=url, key=key, policy=policy, manifest=manifest)
+        return _run_remediation(args, ingest=ingest, rid=rid, snapshot_id=snap["snapshot_id"],
+                                url=url, key=key, policy=policy, manifest=manifest)
 
 
 def _repo_slug(repo_dir: str, override: str | None) -> str:
@@ -558,7 +558,12 @@ class _NoWriter:
         raise RuntimeError("report-only mode does not open PRs")
 
 
-def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
+def _secure_fix_exit_code(*, eligible: int, remediated: int) -> int:
+    """Signal CI failure when requested eligible fixes did not all verify."""
+    return 1 if eligible > remediated else 0
+
+
+def _run_local_fix(args, *, ingest, engine, policy, manifest) -> int:
     """Local secure fix: prove, verify, close, then apply the patch to the checkout."""
     import os
 
@@ -598,7 +603,9 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> None:
         else:
             status = f"blocked: obligation not closed (closure={o.closure})"
         print(f"  [{o.classification}] {o.rule_id}  {status}")
-    print(f"  remediated: {len(report.remediated)}/{report.eligible}")
+    remediated = len(report.remediated)
+    print(f"  remediated: {remediated}/{report.eligible}")
+    return _secure_fix_exit_code(eligible=report.eligible, remediated=remediated)
 
 
 def _run_remediation(args, *, ingest, rid, snapshot_id, url, key, policy, manifest) -> None:

{codna-0.1.31 → codna-0.1.32}/codna/mcp_server.py

@@ -212,7 +212,7 @@ def _build_server():
         """Find and fix a bug. Runs the full codna agent (Cline) + engine + risk simulation.
 
         repo: a local path or a git URL. issue: what's broken (e.g. the failing test).
-        model: optional provider-qualified model such as openai-native/gpt-5.5.
+        model: optional provider-qualified model such as openai/gpt-5.5.
         open_pr: when false (default) this is READ-ONLY — returns the plan (root cause, confidence,
           patch reference) and changes nothing. When true, codna pushes a fix branch and OPENS A
           PULL REQUEST — this needs a git URL for `repo` and a GITHUB_TOKEN with write access.

{codna-0.1.31 → codna-0.1.32}/codna/memory.py

@@ -1,8 +1,8 @@
 """Codna's local, in-process code memory — a thin consumer seam over Telys.
 
-Telys is an OPTIONAL dependency: ``pip install 'codna[memory]'`` installs the public ``telys`` SDK and
-local recall dependencies. Codna release wheels bundle the signed on-device runtime as Codna package
-data; Codna does not depend on a private runtime wheel in public PyPI metadata. Codna resolves the native kernel from explicit ``$TELYS_KERNEL`` /
+Telys ships with base ``codna`` as the public SDK plus Codna's signed on-device runtime package
+data. ``codna[memory]`` only adds heavier optional retrieval/rerank dependencies; Codna does not depend
+on a private runtime wheel in public PyPI metadata. Codna resolves the native kernel from explicit ``$TELYS_KERNEL`` /
 ``$AME_KERNEL``, a packaged ``codna/_telys_runtime`` artifact, ``$CODNA_TELYS_INSTALL_ROOT``,
 ``build/local-telys`` in a source checkout, or a verified Telys runtime install. Core codna never imports
 it — every telys import here is lazy, so ``from codna.memory import CodeMemory`` works without the extra
@@ -11,7 +11,7 @@ and only fails (with a friendly message) when you actually use it.
 OEM license handling is explicit and secret-safe. Codna holds a 100-year OEM Telys entitlement that
 covers every Codna user, so users never obtain their own Telys license. A release wheel may bake that
 license alongside the packaged kernel (``codna/_telys_runtime/oem-license.jwt``, staged at build time,
-never committed) so ``codna[memory]`` activates with zero configuration. An explicit
+never committed) so base ``codna`` activates with zero Telys configuration. An explicit
 ``CODNA_TELYS_LICENSE_JWT`` / ``CODNA_TELYS_LICENSE_PATH`` always overrides the bundled default. Either
 way the license is verified offline through Telys and only metadata is retained — the JWT is never
 returned or logged. Set ``CODNA_TELYS_LICENSE_REQUIRED=1`` in channels that must fail closed.
@@ -60,7 +60,7 @@ _PACKAGE_RUNTIME_MANIFEST = "manifest.json"
 _PACKAGE_RUNTIME_SCHEMA_VERSION = 1
 # Codna holds a 100-year OEM Telys entitlement covering every Codna user, so users never obtain their
 # own Telys license. When a release bakes that OEM license here (a companion to the packaged kernel,
-# staged at build time — never committed), codna[memory] activates with zero user configuration.
+# staged at build time — never committed), base codna activates with zero user configuration.
 _PACKAGE_LICENSE_FILENAME = "oem-license.jwt"
 _LAST_KERNEL_RESOLUTION: dict | None = None
 
@@ -263,10 +263,10 @@ def _kernel_hint() -> str:
 
 def _runtime_install_hint() -> str:
     return (
-        "the Telys runtime is not installed. Install the extra with `pip install 'codna[memory]'`, then "
-        "run `codna login` to authorize this device and provision the on-device runtime (free for one "
-        "device). For source checkout or unsupported-platform development, use a Codna-packaged runtime "
-        "artifact or set TELYS_KERNEL/CODNA_TELYS_INSTALL_ROOT."
+        "the Telys runtime is not installed. Reinstall or upgrade `codna` from a platform wheel that "
+        "bundles the signed runtime, then run `codna login` to authorize this device if a per-device "
+        "login license is needed. For source checkout or unsupported-platform development, use a "
+        "Codna-packaged runtime artifact or set TELYS_KERNEL/CODNA_TELYS_INSTALL_ROOT."
     )
 
 
@@ -276,9 +276,8 @@ def _require_telys():
         from telys import Telys, scope_key
     except ImportError as exc:
         raise CodeMemoryError(
-            "code memory needs the optional Telys SDK — install it with `pip install 'codna[memory]'`; "
-            "if the SDK is already installed, reinstall `codna` from a platform wheel or activate a "
-            "Codna-packaged signed runtime"
+            "code memory needs the Telys SDK shipped with base `codna`; reinstall or upgrade `codna` "
+            "from a platform wheel, or activate a Codna-packaged signed runtime"
         ) from exc
     _configure_telys_kernel_env()
     try:
@@ -384,7 +383,8 @@ def _load_telys_license_metadata() -> dict:
         from telys import verify as license_verify
     except ImportError as exc:
         raise CodeMemoryError(
-            "Telys license is configured but the Telys verifier is unavailable; install codna[memory]"
+            "Telys license is configured but the Telys verifier is unavailable; reinstall or upgrade "
+            "codna from a platform wheel"
         ) from exc
     try:
         claims = license_verify.verify_license(token, now=int(time.time()))

{codna-0.1.31 → codna-0.1.32}/codna/telys_onboarding.py

@@ -82,10 +82,10 @@ def run_login(
     apply_telys_hosts()
     try:
         from telys import login as telys_login
-    except ImportError as exc:  # optional extra not installed
+    except ImportError as exc:  # broken or incomplete codna install
         raise OnboardingError(
-            "Codna device onboarding needs the Telys SDK — reinstall `codna` from a platform wheel "
-            "or install it with `pip install 'codna[memory]'`"
+            "Codna device onboarding needs the Telys SDK shipped with base `codna`; reinstall or "
+            "upgrade `codna` from a platform wheel"
         ) from exc
 
     if open_browser is None:

{codna-0.1.31 → codna-0.1.32}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.31
+Version: 0.1.32
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -119,20 +119,22 @@ codna mcp
 Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
 repo understanding as a local tool.
 
-## Optional Local Memory
+## Local Memory And Telys
 
-Optional local code-memory support is available through:
+The base Codna install includes local code-memory support and the packaged
+Telys SDK/runtime/license:
 
 ```bash
-pip install "codna[memory]"
+pip install codna
 ```
 
-The memory extra uses the public Telys SDK internally for on-device retrieval,
-but the user-facing artifact is still Codna. Supported platform wheels include
-the signed native Telys runtime and Codna OEM license at release time. Source
-distributions intentionally exclude bundled native runtime artifacts; source
-checkout and unsupported-platform development can point Codna at an explicit
-runtime with `TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+Users install Codna once. There is no separate user-facing Telys publishing,
+download, license, or install step. The optional `codna[memory]` extra only
+adds heavier retrieval/rerank/language packages for experiments; it is not
+required for the default Codna + Telys runtime path. Source distributions
+intentionally exclude bundled native runtime artifacts; source checkout and
+unsupported-platform development can point Codna at an explicit runtime with
+`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
 
 ## Security And Local Files
 

{codna-0.1.31 → codna-0.1.32}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.31"
+version = "0.1.32"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.31 → codna-0.1.32}/tests/test_cli_parser.py

@@ -46,6 +46,13 @@ def test_secure_evidence_dir_flags():
     assert args.evidence_dir == ".codna/evidence"
 
 
+def test_secure_fix_exit_code_fails_when_eligible_findings_remain_unremediated():
+    assert cli_module._secure_fix_exit_code(eligible=0, remediated=0) == 0
+    assert cli_module._secure_fix_exit_code(eligible=1, remediated=1) == 0
+    assert cli_module._secure_fix_exit_code(eligible=2, remediated=1) == 1
+    assert cli_module._secure_fix_exit_code(eligible=1, remediated=0) == 1
+
+
 def test_secure_open_pr_subcommand_wired():
     args = build_parser().parse_args(
         ["secure-open-pr", "--evidence", "evidence/", "--repo-slug", "o/r", "--base-branch", "main"]

{codna-0.1.31 → codna-0.1.32}/tests/test_mcp_recall.py

@@ -18,7 +18,7 @@ def test_recall_without_telys_is_friendly(monkeypatch, tmp_path):
     monkeypatch.setitem(sys.modules, "telys", None)
     monkeypatch.setitem(sys.modules, "telys.embedding", None)
     out = recall_json(repo=str(tmp_path), query="anything")
-    assert out.startswith("codna_recall error:") and "reinstall `codna`" in out
+    assert out.startswith("codna_recall error:") and "reinstall or upgrade `codna`" in out
 
 
 def test_recall_auto_index_uses_all_languages_sentinel(monkeypatch, tmp_path):

{codna-0.1.31 → codna-0.1.32}/tests/test_memory_errors.py

@@ -24,13 +24,16 @@ def _clear_kernel_env(monkeypatch):
     monkeypatch.setattr(memory_module, "_LAST_KERNEL_RESOLUTION", None)
 
 
-def test_require_telys_missing_extra_is_friendly(monkeypatch):
-    # Force `from telys import ...` to fail regardless of whether the extra is installed.
+def test_require_telys_missing_sdk_is_friendly(monkeypatch):
+    # Force `from telys import ...` to fail regardless of whether the package is installed correctly.
     monkeypatch.setitem(sys.modules, "telys", None)
     monkeypatch.setitem(sys.modules, "telys.embedding", None)
     with pytest.raises(CodeMemoryError) as ei:
         _require_telys()
-    assert "codna[memory]" in str(ei.value)        # tells the user exactly how to fix it
+    message = str(ei.value)
+    assert "Telys SDK shipped with base `codna`" in message
+    assert "platform wheel" in message
+    assert "codna[memory]" not in message
 
 
 def test_require_telys_missing_embedding_runtime_is_friendly(monkeypatch):

{codna-0.1.31 → codna-0.1.32}/tests/test_packaging.py

@@ -82,6 +82,15 @@ def test_core_install_includes_local_telys_support_without_heavy_rerankers():
     assert "wordllama" not in joined
 
 
+def test_cli_readme_documents_base_codna_telys_install_contract():
+    readme = (ROOT / "cli" / "README.md").read_text(encoding="utf-8")
+
+    assert 'pip install "codna[memory]"' not in readme
+    assert "pip install codna" in readme
+    assert "Users install Codna once" in readme
+    assert "no separate user-facing Telys" in readme
+
+
 def test_core_install_uses_public_dependencies_only():
     data = _data()["project"]
     deps = data["dependencies"]
@@ -290,7 +299,8 @@ def test_public_action_examples_use_current_github_owner():
         ROOT / "examples" / "codna-autofix.yml",
     ]
     combined = "\n".join(path.read_text(encoding="utf-8") for path in paths)
-    assert "thyn-ai/codna@v1" in combined
+    assert "thyn-ai/codna-action@v1" in combined
+    assert "uses: thyn-ai/codna@v1" not in combined
     assert "escrypto-labs/codna@v1" not in combined
     assert "codna-ai/fix-action" not in combined
 

{codna-0.1.31 → codna-0.1.32}/tests/test_release_readiness.py

@@ -363,9 +363,84 @@ def test_safe_publish_requires_oidc_job_success_and_upload_skipped():
         == "https://pypi.org/manage/account/publishing/"
     )
     assert uploaded_check.status == "fail"
-    assert uploaded_check.details["required_jobs"]["publish codna to PyPI"] == "skipped"
+    assert uploaded_check.details["source_version"] is None
+    assert uploaded_check.details["public_version"] is None
     assert "without PyPI trusted-publisher OIDC verification" in skipped_check.message
-    assert "PyPI upload was not skipped" in uploaded_check.message
+    assert "PyPI does not report the source version" in uploaded_check.message
+
+
+def test_safe_publish_accepts_real_publish_when_pypi_reports_source_version():
+    tool = _load_script()
+    runs = [
+        {
+            "workflowName": "publish cli",
+            "headSha": "abc",
+            "status": "completed",
+            "conclusion": "success",
+            "event": "workflow_dispatch",
+            "databaseId": 123,
+            "url": "https://github.example/runs/123",
+        }
+    ]
+    run_details = {
+        123: {
+            "jobs": [
+                {"name": "build and verify codna distribution", "conclusion": "success"},
+                {"name": "verify PyPI trusted publisher OIDC", "conclusion": "skipped"},
+                {"name": "publish codna to PyPI", "conclusion": "success"},
+            ]
+        }
+    }
+
+    check = tool.check_safe_publish_workflow(
+        runs,
+        head_sha="abc",
+        run_details_by_id=run_details,
+        pypi_token_secret_scopes=["environment"],
+        source_version="0.1.32",
+        public_version="0.1.32",
+    )
+
+    assert check.status == "pass"
+    assert "publish=true" in check.message
+    assert check.details["source_version"] == "0.1.32"
+    assert check.details["public_version"] == "0.1.32"
+    assert check.details["pypi_token_secret_scopes"] == ["environment"]
+
+
+def test_safe_publish_real_publish_fails_until_pypi_reports_source_version():
+    tool = _load_script()
+    runs = [
+        {
+            "workflowName": "publish cli",
+            "headSha": "abc",
+            "status": "completed",
+            "conclusion": "success",
+            "event": "workflow_dispatch",
+            "databaseId": 123,
+        }
+    ]
+    run_details = {
+        123: {
+            "jobs": [
+                {"name": "build and verify codna distribution", "conclusion": "success"},
+                {"name": "publish codna to PyPI", "conclusion": "success"},
+            ]
+        }
+    }
+
+    check = tool.check_safe_publish_workflow(
+        runs,
+        head_sha="abc",
+        run_details_by_id=run_details,
+        source_version="0.1.32",
+        public_version="0.1.31",
+    )
+
+    assert check.status == "fail"
+    assert "PyPI does not report the source version" in check.message
+    assert check.details["source_version"] == "0.1.32"
+    assert check.details["public_version"] == "0.1.31"
 
 
 def test_safe_publish_reports_completed_oidc_failure_precisely():

{codna-0.1.31 → codna-0.1.32}/tests/test_telys_onboarding.py

@@ -98,7 +98,9 @@ def test_run_login_without_telys_raises_onboarding_error(monkeypatch):
     monkeypatch.setitem(sys.modules, "telys", None)
     with pytest.raises(OnboardingError) as excinfo:
         onb.run_login(open_browser=False)
-    assert "reinstall `codna`" in str(excinfo.value)
+    message = str(excinfo.value)
+    assert "reinstall or upgrade `codna`" in message
+    assert "codna[memory]" not in message
 
 
 # ---- ensure_licensed hook ----------------------------------------------------------------------