codna 0.1.33__tar.gz → 0.1.35__tar.gz

{codna-0.1.33 → codna-0.1.35}/MANIFEST.in

@@ -5,6 +5,9 @@ exclude codna/_telys_runtime/*.dll
 exclude codna/_telys_runtime/manifest.json
 exclude codna/_telys_runtime/oem-license.jwt
 recursive-exclude codna/_telys_runtime libame_kernel.* lib*.dylib lib*.so *.dll manifest.json oem-license.jwt
+exclude codna/_agent_core_runtime/codna-sidecar
+exclude codna/_agent_core_runtime/codna-sidecar.exe
+recursive-exclude codna/_agent_core_runtime codna-sidecar codna-sidecar.exe
 recursive-exclude .codna *
 recursive-exclude .codna-memory *
 recursive-exclude codna __pycache__ *.py[cod] *.pyo

{codna-0.1.33 → codna-0.1.35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.33
+Version: 0.1.35
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.33 → codna-0.1.35}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.33"
+__version__ = "0.1.35"

codna-0.1.35/codna/_wheel_guard.py

@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+MANIFEST_NAME = "manifest.json"
+KERNEL_GLOB = "libame_kernel.*"
+SIDECAR_RUNTIME_DIRNAME = "_agent_core_runtime"
+SIDECAR_BINARY_NAMES = ("codna-sidecar", "codna-sidecar.exe")
+
+
+def package_runtime_dir() -> Path:
+    return Path(__file__).resolve().parent / "_telys_runtime"
+
+
+def sidecar_runtime_dir() -> Path:
+    return Path(__file__).resolve().parent / SIDECAR_RUNTIME_DIRNAME
+
+
+def has_native_sidecar(sidecar_dir: Path | None = None) -> bool:
+    directory = sidecar_dir if sidecar_dir is not None else sidecar_runtime_dir()
+    return directory.is_dir() and any((directory / name).is_file() for name in SIDECAR_BINARY_NAMES)
+
+
+def staged_runtime_files(runtime_dir: Path) -> tuple[Path | None, tuple[Path, ...]]:
+    manifest = runtime_dir / MANIFEST_NAME
+    kernels = tuple(sorted(runtime_dir.glob(KERNEL_GLOB))) if runtime_dir.is_dir() else ()
+    return (manifest if manifest.exists() else None), kernels
+
+
+def requires_platform_wheel(runtime_dir: Path) -> bool:
+    # A wheel that ships ANY native artifact — the Telys kernel OR the compiled agent-core sidecar —
+    # must be platform-specific, never py3-none-any. The sidecar dir is the Telys dir's sibling, so
+    # this stays a pure function of runtime_dir's location.
+    manifest, kernels = staged_runtime_files(runtime_dir)
+    sidecar_dir = runtime_dir.parent / SIDECAR_RUNTIME_DIRNAME
+    return manifest is not None or bool(kernels) or has_native_sidecar(sidecar_dir)
+
+
+def validate_wheel_filename(wheel_name: str, runtime_dir: Path) -> None:
+    if requires_platform_wheel(runtime_dir) and wheel_name.endswith("-py3-none-any.whl"):
+        raise ValueError(
+            "native package-runtime artifacts (Telys kernel or agent-core sidecar) "
+            "require a platform-specific wheel tag"
+        )

{codna-0.1.33 → codna-0.1.35}/codna/agent-core/run-server.bundle.mjs

@@ -255131,7 +255131,18 @@ async function resolveProviderConfig(args) {
 function buildSystemPrompt(args) {
   const disabledTools = suppressedTools(args);
   const taskKind = args.task_kind ?? "fix";
-  const guidance = taskKind === "triage" ? [
+  const guidance = taskKind === "review" ? [
+    "You are Codna's automated code-review agent.",
+    "Review the provided pull-request diff for REAL, HIGH-CONFIDENCE defects only: correctness bugs, security vulnerabilities, and clear performance regressions.",
+    "Do NOT report style, formatting, naming, documentation, or speculative concerns. If you are not confident an issue is real and actionable, omit it.",
+    "Prefer findings on lines the diff changed. You may read files and search the repository to confirm a finding, but keep exploration minimal.",
+    "Do not modify files. Do not run commands. Do not ask questions.",
+    "The repository root is the current working directory.",
+    "When referring to files, use repository-relative paths only (for example: src/app.ts). Never use absolute paths.",
+    'Your FINAL message MUST be a single JSON object and NOTHING else (no prose, no code fences): {"findings": Finding[]}.',
+    `Finding = {"path": string (repo-relative), "line": integer (1-based line in the file's NEW version), "end_line"?: integer, "severity": "high"|"medium"|"low", "category": "correctness"|"security"|"performance", "title": string (<=80 chars), "explanation": string, "suggested_patch"?: string, "confidence": number in [0,1]}.`,
+    'If there are no high-confidence issues, return {"findings": []}. Never invent findings to fill space.'
+  ] : taskKind === "triage" ? [
     "You are Algenta's repository analysis agent.",
     "Inspect the repository and answer the task directly.",
     "Do not modify files.",

{codna-0.1.33 → codna-0.1.35}/codna/agent-core/vendor/cline/algenta/adapter.ts

@@ -15,6 +15,7 @@ import {
 } from "./proof-provider";
 import {
 	EXACT_RESTORE_SHELL_ONLY_DISABLED_TOOLS,
+	SHELL_TOOLS,
 	WRITE_TOOLS,
 	exactRestoreDisablesPatchTools,
 	exactRestoreShellOnlyTools,
@@ -26,7 +27,8 @@ import { type EngineContext, algentaTools, engineContext } from "./tools";
 export interface RunAgentArgs {
 	working_dir: string;
 	prompt: string; // the task
-	task_kind?: "fix" | "triage";
+	// "review" = read-only code review of a diff; emits structured findings JSON (no writes, no shell).
+	task_kind?: "fix" | "triage" | "review";
 	injected_context?: string; // token-compressed evidence bundle (repo intelligence)
 	provider?: string; // default "anthropic"
 	model?: string; // default = provider's defaultModelId
@@ -169,11 +171,18 @@ export function buildToolPolicies(
 		toolPolicies.editor = { enabled: false, autoApprove: false };
 		toolPolicies.apply_patch = { enabled: false, autoApprove: false };
 	}
-	if (args.task_kind === "triage") {
+	if (args.task_kind === "triage" || args.task_kind === "review") {
 		for (const toolName of WRITE_TOOLS) {
 			toolPolicies[toolName] = { enabled: false };
 		}
 	}
+	// A review pass is read-only AND must not execute project code: disable the shell too, so it
+	// reviews from the diff + file reads only. (Enforced below the model — not a prompt promise.)
+	if (args.task_kind === "review") {
+		for (const toolName of SHELL_TOOLS) {
+			toolPolicies[toolName] = { enabled: false };
+		}
+	}
 	return toolPolicies;
 }
 
@@ -181,7 +190,21 @@ export function buildSystemPrompt(args: RunAgentArgs): string {
 	const disabledTools = suppressedTools(args);
 	const taskKind = args.task_kind ?? "fix";
 	const guidance =
-		taskKind === "triage"
+		taskKind === "review"
+			? [
+					"You are Codna's automated code-review agent.",
+					"Review the provided pull-request diff for REAL, HIGH-CONFIDENCE defects only: correctness bugs, security vulnerabilities, and clear performance regressions.",
+					"Do NOT report style, formatting, naming, documentation, or speculative concerns. If you are not confident an issue is real and actionable, omit it.",
+					"Prefer findings on lines the diff changed. You may read files and search the repository to confirm a finding, but keep exploration minimal.",
+					"Do not modify files. Do not run commands. Do not ask questions.",
+					"The repository root is the current working directory.",
+					"When referring to files, use repository-relative paths only (for example: src/app.ts). Never use absolute paths.",
+					// Output contract — the caller parses this verbatim.
+					'Your FINAL message MUST be a single JSON object and NOTHING else (no prose, no code fences): {"findings": Finding[]}.',
+					'Finding = {"path": string (repo-relative), "line": integer (1-based line in the file\'s NEW version), "end_line"?: integer, "severity": "high"|"medium"|"low", "category": "correctness"|"security"|"performance", "title": string (<=80 chars), "explanation": string, "suggested_patch"?: string, "confidence": number in [0,1]}.',
+					'If there are no high-confidence issues, return {"findings": []}. Never invent findings to fill space.',
+				]
+			: taskKind === "triage"
 			? [
 					"You are Algenta's repository analysis agent.",
 					"Inspect the repository and answer the task directly.",

{codna-0.1.33 → codna-0.1.35}/codna/agent-core/vendor/cline/algenta/fix-runner.ts

@@ -7,7 +7,12 @@ import { runAgent } from "./adapter";
 const res: Awaited<ReturnType<typeof runAgent>> = await runAgent({
 	working_dir: process.env.FIX_WORKING_DIR as string,
 	prompt: process.env.FIX_PROMPT as string,
-	task_kind: process.env.FIX_TASK_KIND === "triage" ? "triage" : "fix",
+	task_kind:
+		process.env.FIX_TASK_KIND === "triage"
+			? "triage"
+			: process.env.FIX_TASK_KIND === "review"
+				? "review"
+				: "fix",
 	provider: process.env.FIX_PROVIDER || "anthropic",
 	...(process.env.FIX_MODEL ? { model: process.env.FIX_MODEL } : {}),
 	limits: {

codna-0.1.35/codna/agent-core/vendor/cline/algenta/review-policy.test.ts

@@ -0,0 +1,42 @@
+// task_kind:"review" is read-only below the model: writes AND the shell are disabled, and the
+// system prompt carries the structured-findings JSON output contract.
+import { expect, test } from "bun:test";
+import { buildSystemPrompt, buildToolPolicies } from "./adapter";
+
+const reviewArgs = { working_dir: "/work", prompt: "review this diff", task_kind: "review" } as never;
+
+test("review disables write tools AND the shell (read-only, no code execution)", () => {
+	const policies = buildToolPolicies(reviewArgs);
+	expect(policies.editor).toEqual({ enabled: false });
+	expect(policies.apply_patch).toEqual({ enabled: false });
+	expect(policies.run_commands).toEqual({ enabled: false });
+});
+
+test("review keeps read/search tools enabled (may confirm a finding)", () => {
+	const policies = buildToolPolicies(reviewArgs);
+	// no explicit disable entry → covered by the "*" wildcard (enabled)
+	expect(policies.read_files).toBeUndefined();
+	expect(policies.search_codebase).toBeUndefined();
+	expect(policies["*"]).toEqual({ enabled: true, autoApprove: true });
+});
+
+test("review system prompt states the findings JSON output contract", () => {
+	const p = buildSystemPrompt(reviewArgs);
+	expect(p).toContain("code-review agent");
+	expect(p).toContain('{"findings"');
+	expect(p).toContain("confidence");
+	expect(p).toContain("Do not modify files");
+});
+
+test("triage still disables writes but NOT the shell (unchanged)", () => {
+	const triage = buildToolPolicies({ working_dir: "/work", prompt: "x", task_kind: "triage" } as never);
+	expect(triage.editor).toEqual({ enabled: false });
+	expect(triage.run_commands).toBeUndefined();
+});
+
+test("fix leaves write + shell tools enabled (unchanged)", () => {
+	const fix = buildToolPolicies({ working_dir: "/work", prompt: "x", task_kind: "fix" } as never);
+	expect(fix.editor).toBeUndefined();
+	expect(fix.apply_patch).toBeUndefined();
+	expect(fix.run_commands).toBeUndefined();
+});

{codna-0.1.33 → codna-0.1.35}/codna/agent-core/vendor/cline/algenta/task-policy.ts

@@ -1,4 +1,4 @@
-export type AgentTaskKind = "fix" | "triage";
+export type AgentTaskKind = "fix" | "triage" | "review";
 
 export interface TaskPolicyArgs {
 	prompt: string;

{codna-0.1.33 → codna-0.1.35}/codna/cli.py

@@ -464,7 +464,10 @@ def cmd_secure(args) -> None:
     manifest = None
     if args.verification:
         from .manifest import load_manifest, ManifestError
-        manifest = load_manifest(args.verification)
+        try:
+            manifest = load_manifest(args.verification)
+        except ManifestError as exc:
+            _die(f"invalid verification manifest {args.verification}: {exc}")
         policy, config_digest = manifest.policy, manifest.scanner.configuration_digest
         if args.open_pr:
             try:
@@ -686,23 +689,9 @@ def cmd_mcp(args):
 
 
 def cmd_review(args) -> int:
-    """Read-only risk review of a change: diff the working tree (or vs --base) + triage the changes."""
+    """Read-only review of a change (findings by default, ``--triage`` for engine risk-triage)."""
     from . import review
-    c = _client()
-    result = review.run_review(c, args)
-    if getattr(args, "as_json", False):
-        print(json.dumps(result, indent=2))
-        return 0
-    if not result.get("changed_files"):
-        print(f"codna: {result.get('note', 'no changes to review')}")
-        return 0
-    files = result["changed_files"]
-    print(f"✓ reviewed {len(files)} changed file(s) vs {result['base']}")
-    print(f"  changed      : {', '.join(files[:8])}" + (" …" if len(files) > 8 else ""))
-    print(f"  suspect files: {', '.join(result['suspect_files']) or '(none)'}")
-    if result.get("suspect_symbols"):
-        print(f"  suspect syms : {', '.join(result['suspect_symbols'][:8])}")
-    return 0
+    return review.dispatch(args, _client)
 
 
 def cmd_init(args) -> int:
@@ -896,11 +885,22 @@ def build_parser() -> argparse.ArgumentParser:
                     help="for `install`: write the project-local config (Cursor) instead of the user config")
     pm.set_defaults(func=cmd_mcp)
 
-    prv = sub.add_parser("review", help="Read-only risk review of a change (diff → triage the changed files).")
+    prv = sub.add_parser("review", help="Read-only review of a change (diff → structured bug findings; optionally post to a PR).")
     prv.add_argument("repo", nargs="?", default=".", help="local repo path (default: current dir)")
     prv.add_argument("--base", help="diff against this ref (default: HEAD — all uncommitted changes)")
-    prv.add_argument("--issue", help="focus the review (e.g. 'check the auth refactor')")
-    prv.add_argument("--ref", help="branch/tag/commit to register")
+    prv.add_argument("--diff", help="diff range to review, e.g. origin/main...HEAD (overrides --base)")
+    prv.add_argument("--pr", help="PR to review/post to: 123, owner/repo#123, or a PR URL")
+    prv.add_argument("--post", action="store_true", help="post the findings to the PR (one review + a 'Codna Review' check); needs --pr + a write token")
+    prv.add_argument("--github-token", dest="github_token", help="write token for --post (else $GITHUB_TOKEN / $CODNA_GITHUB_TOKEN)")
+    prv.add_argument("--min-confidence", dest="min_confidence", type=float, help="only report findings at/above this confidence (default from codna.yaml or 0.75)")
+    prv.add_argument("--max-findings", dest="max_findings", type=int, help="cap the number of findings (default from codna.yaml or 10)")
+    prv.add_argument("--blocking", action="store_true", help="make the 'Codna Review' check fail on a blocking-severity finding (default: non-blocking)")
+    prv.add_argument("--effort", choices=("low", "medium", "high"), help="review depth: high = more thorough (more agent iterations), low = cheaper (default: medium)")
+    prv.add_argument("--full", action="store_true", help="review the WHOLE PR, not only commits pushed since Codna's last review (default: incremental)")
+    prv.add_argument("--model", help="planner/review model (default: provider default)")
+    prv.add_argument("--triage", action="store_true", help="legacy: engine-backed risk triage (suspect files/symbols) instead of findings")
+    prv.add_argument("--issue", help="triage mode: focus the review (e.g. 'check the auth refactor')")
+    prv.add_argument("--ref", help="branch/tag/commit to register (triage mode)")
     prv.add_argument("--json", dest="as_json", action="store_true", help="emit the review result as JSON")
     prv.set_defaults(func=cmd_review, uses_config=True)
 

codna-0.1.35/codna/cline_agent.py

@@ -0,0 +1,182 @@
+"""Drive codna's vendored Cline agent (agent-core) to remediate a repo in place.
+
+This is the agentic-fix executor behind `codna secure --fix`: it shells out to `bun` running the
+vendored Cline SDK, which edits files in `working_dir`. The engine seam is optional — with only an
+ANTHROPIC_API_KEY the agent runs as a plain coding agent (no HTTP engine/sidecar required).
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import tempfile
+from pathlib import Path
+
+
+class ClineAgentError(Exception):
+    pass
+
+
+def _agent_core_dir() -> Path:
+    """Locate the vendored Cline SDK root (agent-core/vendor/cline)."""
+    env = os.environ.get("CODNA_AGENT_CORE_DIR")
+    if env:
+        return Path(env)
+    for parent in Path(__file__).resolve().parents:
+        cand = parent / "agent-core" / "vendor" / "cline"
+        if (cand / "algenta" / "adapter.ts").exists():
+            return cand
+    raise ClineAgentError(
+        "could not locate agent-core/vendor/cline; set CODNA_AGENT_CORE_DIR to its path."
+    )
+
+
+def _ensure_cline_data_dir(env: dict[str, str]) -> str:
+    configured = env.get("CLINE_DATA_DIR", "").strip()
+    if configured:
+        data_dir = Path(configured).expanduser()
+    else:
+        data_dir = Path(tempfile.gettempdir()) / "codna-cline-data"
+        env["CLINE_DATA_DIR"] = str(data_dir)
+    data_dir.mkdir(parents=True, exist_ok=True)
+    return str(data_dir)
+
+
+def run_cline_fix(
+    working_dir: str,
+    prompt: str,
+    *,
+    task_kind: str = "fix",
+    provider: str = "anthropic",
+    model: str | None = None,
+    max_iterations: int = 20,
+    timeout_s: int = 360,
+) -> dict:
+    """Run the Cline agent against `working_dir` (it edits files in place). Returns the agent's
+    result summary ({status, iterations, model, text, usage}). Raises ClineAgentError on failure."""
+    core = _agent_core_dir()
+    if not (core / "algenta" / "fix-runner.ts").exists():
+        raise ClineAgentError(f"fix-runner.ts not found under {core}")
+    if not (core / "node_modules").is_dir():
+        raise ClineAgentError(f"vendored SDK not built (no node_modules) under {core}")
+    if task_kind not in {"fix", "triage", "review"}:
+        raise ClineAgentError(f"unsupported cline task_kind '{task_kind}'")
+
+    env = dict(os.environ)
+    _ensure_cline_data_dir(env)
+    env["FIX_WORKING_DIR"] = str(working_dir)
+    env["FIX_PROMPT"] = prompt
+    env["FIX_TASK_KIND"] = task_kind
+    env["FIX_PROVIDER"] = provider
+    env["FIX_MAX_ITERATIONS"] = str(max_iterations)
+    if model:
+        env["FIX_MODEL"] = model
+
+    try:
+        proc = subprocess.run(
+            ["bun", "algenta/fix-runner.ts"],
+            cwd=str(core), env=env, capture_output=True, text=True, timeout=timeout_s,
+        )
+    except FileNotFoundError as exc:
+        raise ClineAgentError("`bun` not found on PATH — required to run the Cline agent.") from exc
+    except subprocess.TimeoutExpired as exc:
+        raise ClineAgentError(f"cline agent timed out after {timeout_s}s") from exc
+
+    for line in proc.stdout.splitlines():
+        if line.startswith("RESULT "):
+            return json.loads(line[len("RESULT "):])
+    raise ClineAgentError(
+        f"cline agent produced no RESULT (rc={proc.returncode}); stderr tail: {proc.stderr[-300:]}"
+    )
+
+
+def extract_findings_json(text: str) -> list[dict]:
+    """Parse the reviewer's final message into a list of raw finding dicts.
+
+    The review prompt asks for a bare ``{"findings": [...]}`` object, but models sometimes wrap it in
+    prose or a ```json code fence. Be tolerant: try a strict parse first, then scan for the first
+    balanced JSON object/array. Raises ClineAgentError only when nothing parseable is present.
+    """
+    raw = (text or "").strip()
+    if not raw:
+        return []
+
+    def _coerce(obj) -> list[dict] | None:
+        if isinstance(obj, dict):
+            found = obj.get("findings")
+            if isinstance(found, list):
+                return [f for f in found if isinstance(f, dict)]
+            return None
+        if isinstance(obj, list):
+            return [f for f in obj if isinstance(f, dict)]
+        return None
+
+    # 1) Strict: the whole message is the JSON we asked for.
+    try:
+        coerced = _coerce(json.loads(raw))
+        if coerced is not None:
+            return coerced
+    except (json.JSONDecodeError, ValueError):
+        pass
+
+    # 2) Strip a ```json … ``` fence if present.
+    if "```" in raw:
+        import re
+
+        for block in re.findall(r"```(?:json)?\s*(.*?)```", raw, flags=re.DOTALL):
+            try:
+                coerced = _coerce(json.loads(block.strip()))
+                if coerced is not None:
+                    return coerced
+            except (json.JSONDecodeError, ValueError):
+                continue
+
+    # 3) Scan for the first balanced {...} or [...] and try to parse it.
+    for opener, closer in (("{", "}"), ("[", "]")):
+        start = raw.find(opener)
+        while start != -1:
+            depth = 0
+            for i in range(start, len(raw)):
+                if raw[i] == opener:
+                    depth += 1
+                elif raw[i] == closer:
+                    depth -= 1
+                    if depth == 0:
+                        chunk = raw[start : i + 1]
+                        try:
+                            coerced = _coerce(json.loads(chunk))
+                            if coerced is not None:
+                                return coerced
+                        except (json.JSONDecodeError, ValueError):
+                            pass
+                        break
+            start = raw.find(opener, start + 1)
+
+    raise ClineAgentError("review agent did not return parseable findings JSON")
+
+
+def run_cline_review(
+    working_dir: str,
+    prompt: str,
+    *,
+    provider: str = "anthropic",
+    model: str | None = None,
+    max_iterations: int = 12,
+    timeout_s: int = 240,
+) -> tuple[list[dict], dict]:
+    """Run the read-only review agent against ``working_dir`` and return ``(raw_findings, result)``.
+
+    ``raw_findings`` is the parsed (but not yet validated/normalized) finding dicts from the agent's
+    final message; ``result`` is the raw agent summary ({status, iterations, model, text, usage}).
+    Read-only is enforced below the model by the adapter (writes + shell disabled for task_kind=review).
+    """
+    result = run_cline_fix(
+        working_dir,
+        prompt,
+        task_kind="review",
+        provider=provider,
+        model=model,
+        max_iterations=max_iterations,
+        timeout_s=timeout_s,
+    )
+    return extract_findings_json(result.get("text", "")), result

{codna-0.1.33 → codna-0.1.35}/codna/packaged_repository_advanced.py

@@ -488,11 +488,30 @@ def _agent_summary(result: PackagedAgentRunResult) -> dict[str, Any]:
 
 
 def _confidence(result: PackagedAgentRunResult, changed_files: list[str]) -> float:
-    if result.terminal_state == "succeeded" and changed_files:
-        return 0.78
-    if result.status == "succeeded" and changed_files:
-        return 0.7
-    return 0.0
+    """A REAL, per-run PRE-verification confidence derived from the agent-run signals — not a fixed
+    number. It reflects how the run actually went (a clean terminal success vs hitting an iteration or
+    mistake limit) tempered by blast radius (a one-file fix is more trustworthy than a sprawling one).
+    This is an ESTIMATE; the actual proof is the test-loop / engine risk gate, so it is kept coarse and
+    capped below certainty rather than presented as a precise probability."""
+    if not changed_files or not (result.patch_diff or "").strip():
+        return 0.0  # no change produced → no confidence to report
+    success = {"succeeded", "success", "completed"}
+    ts = (result.terminal_state or "").strip().lower()
+    st = (result.status or "").strip().lower()
+    if ts in success or st in success:
+        base = 0.70
+    elif ts in {"max_iterations", "mistake_limit"} or st in {"max_iterations", "mistake_limit"}:
+        base = 0.40  # ran out of room / kept erroring — less decisive
+    else:
+        base = 0.25  # aborted / error / unknown terminal state
+    n = len(changed_files)
+    if n == 1:
+        base += 0.15
+    elif n == 2:
+        base += 0.05
+    elif n >= 5:
+        base -= 0.15
+    return round(max(0.0, min(0.9, base)), 2)
 
 
 def _summary_text(agent_text: str, issue_text: str) -> str:

{codna-0.1.33 → codna-0.1.35}/codna/project_rules.py

@@ -10,7 +10,10 @@ from __future__ import annotations
 import os
 
 # Checked in order; all present files are concatenated (AGENTS.md is the primary, emerging standard).
-_RULES_FILES = ("AGENTS.md", ".codna/rules.md", ".codna/rules", ".cursorrules", ".cursor/rules.md")
+# `.cursor/BUGBOT.md` / `BUGBOT.md` are Cursor Bugbot's review-rules files — reading them gives repos
+# already configured for Bugbot drop-in guidance under Codna with zero migration.
+_RULES_FILES = ("AGENTS.md", ".codna/rules.md", ".codna/rules", ".codna/review.md",
+                ".cursorrules", ".cursor/rules.md", ".cursor/BUGBOT.md", "BUGBOT.md")
 _MAX_BYTES = 16 * 1024