codna 0.1.3__tar.gz → 0.1.5__tar.gz

{codna-0.1.3 → codna-0.1.5}/MANIFEST.in

@@ -1,6 +1,7 @@
 exclude codna/_telys_runtime/libame_kernel.*
 exclude codna/_telys_runtime/manifest.json
-recursive-exclude codna/_telys_runtime libame_kernel.* manifest.json
+exclude codna/_telys_runtime/oem-license.jwt
+recursive-exclude codna/_telys_runtime libame_kernel.* manifest.json oem-license.jwt
 recursive-exclude .codna *
 recursive-exclude .codna-memory *
 global-exclude keys.txt .keys.txt .env .env.* *.log *.pem *.key *.jwt local-stack.json launcher.state

{codna-0.1.3 → codna-0.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.3
+Version: 0.1.5
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -30,6 +30,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.28.0
+Requires-Dist: keyring>=24
 Requires-Dist: mcp>=1.2.0
 Requires-Dist: pyarrow>=15.0.0
 Provides-Extra: mcp

{codna-0.1.3 → codna-0.1.5}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.3"
+__version__ = "0.1.5"

{codna-0.1.3 → codna-0.1.5}/codna/agent_core_runtime.py

@@ -4,6 +4,7 @@ import uuid
 import hashlib
 import json
 import os
+import re
 import time
 from dataclasses import dataclass
 from datetime import UTC, datetime
@@ -68,6 +69,21 @@ PROVIDER_RUNTIME_ENV_KEYS = (
 LEGACY_REQUEST_MODE_ENV_KEYS = (
     "AGENT_CORE_TELYS_LOCALIZE_ENABLED",
 )
+AGENT_CORE_READY_TIMEOUT_ENV = "CODNA_AGENT_CORE_READY_TIMEOUT_SECONDS"
+AGENT_CORE_READY_TIMEOUT_MIN_S = 5.0
+AGENT_CORE_READY_TIMEOUT_MAX_S = 300.0
+AGENT_CORE_LOG_TAIL_BYTES = 16 * 1024
+AGENT_CORE_LOG_TAIL_LINES = 120
+SECRET_VALUE_PATTERN = re.compile(
+    r"(?i)(bearer|basic)\s+[a-z0-9._~+/=-]+|"
+    r"pypi-[a-z0-9._~+/=-]+|"
+    r"gh[pousr]_[a-z0-9_]+|"
+    r"sk-[a-z0-9_-]+"
+)
+SECRET_ASSIGNMENT_PATTERN = re.compile(
+    r"(?i)\b(api[_-]?key|token|secret|password|authorization)"
+    r"([\"']?\s*[:=]\s*[\"']?)([^\"'\s,}]+)"
+)
 
 
 @dataclass(frozen=True)
@@ -114,6 +130,69 @@ def _probe_summary(probe: ProbeResult) -> dict[str, Any]:
     }
 
 
+def _agent_core_ready_timeout_seconds() -> float:
+    raw = os.environ.get(AGENT_CORE_READY_TIMEOUT_ENV)
+    if raw is None or not raw.strip():
+        return SIDECAR_READY_TIMEOUT_S
+    try:
+        value = float(raw)
+    except ValueError as exc:
+        raise LocalRuntimeError(
+            "agent_core_ready_timeout_invalid",
+            "Codna agent-core readiness timeout must be numeric seconds.",
+            {
+                "env": AGENT_CORE_READY_TIMEOUT_ENV,
+                "value": raw,
+                "min_seconds": AGENT_CORE_READY_TIMEOUT_MIN_S,
+                "max_seconds": AGENT_CORE_READY_TIMEOUT_MAX_S,
+            },
+        ) from exc
+    if not AGENT_CORE_READY_TIMEOUT_MIN_S <= value <= AGENT_CORE_READY_TIMEOUT_MAX_S:
+        raise LocalRuntimeError(
+            "agent_core_ready_timeout_invalid",
+            "Codna agent-core readiness timeout is outside the allowed range.",
+            {
+                "env": AGENT_CORE_READY_TIMEOUT_ENV,
+                "value": raw,
+                "min_seconds": AGENT_CORE_READY_TIMEOUT_MIN_S,
+                "max_seconds": AGENT_CORE_READY_TIMEOUT_MAX_S,
+            },
+        )
+    return value
+
+
+def _redact_log_text(text: str) -> str:
+    redacted = SECRET_VALUE_PATTERN.sub(lambda match: f"{match.group(1)} [redacted]" if match.group(1) else "[redacted]", text)
+    return SECRET_ASSIGNMENT_PATTERN.sub(r"\1\2[redacted]", redacted)
+
+
+def _read_log_tail(path: Path) -> dict[str, Any]:
+    try:
+        size = path.stat().st_size
+    except FileNotFoundError:
+        return {"available": False, "path": str(path), "reason": "missing"}
+    except OSError as exc:
+        return {"available": False, "path": str(path), "reason": str(exc)}
+    try:
+        with path.open("rb") as handle:
+            if size > AGENT_CORE_LOG_TAIL_BYTES:
+                handle.seek(size - AGENT_CORE_LOG_TAIL_BYTES)
+            data = handle.read(AGENT_CORE_LOG_TAIL_BYTES)
+    except OSError as exc:
+        return {"available": False, "path": str(path), "reason": str(exc)}
+    text = data.decode("utf-8", errors="replace")
+    if size > AGENT_CORE_LOG_TAIL_BYTES and "\n" in text:
+        text = text.split("\n", 1)[1]
+    lines = _redact_log_text(text).splitlines()[-AGENT_CORE_LOG_TAIL_LINES:]
+    return {
+        "available": True,
+        "path": str(path),
+        "truncated": size > AGENT_CORE_LOG_TAIL_BYTES,
+        "max_bytes": AGENT_CORE_LOG_TAIL_BYTES,
+        "recent_lines": lines,
+    }
+
+
 def _load_state(config: RuntimeConfig) -> dict[str, Any] | None:
     payload = read_json(_state_path(config))
     return payload if isinstance(payload, dict) else None
@@ -585,11 +664,12 @@ def _start_sidecar(
     rotate_log(sidecar_log, max_bytes=LOG_ROTATE_BYTES, backups=LOG_ROTATE_FILES)
     runtime_id = str(uuid.uuid4())
     command, cwd, env = _sidecar_spawn(config, runtime_id, keys=keys)
+    ready_timeout_s = _agent_core_ready_timeout_seconds()
     process = spawn_detached_process(command, cwd=cwd, env=env, log_path=sidecar_log)
     probe = wait_until_ready(
         probe_sidecar_ready,
         config.sidecar_url,
-        timeout_s=SIDECAR_READY_TIMEOUT_S,
+        timeout_s=ready_timeout_s,
         request_timeout_s=READY_TIMEOUT_S,
     )
     if not probe.ok:
@@ -602,7 +682,9 @@ def _start_sidecar(
                 "target_url": f"{config.sidecar_url}/ready",
                 "state_path": str(_state_path(config)),
                 "log_path": str(sidecar_log),
+                "timeout_seconds": ready_timeout_s,
                 "probe": _probe_summary(probe),
+                "log_tail": _read_log_tail(sidecar_log),
             },
         )
     healthy, probes = _service_is_codna_sidecar(config)
@@ -616,7 +698,9 @@ def _start_sidecar(
                 "target_url": f"{config.sidecar_url}/health",
                 "state_path": str(_state_path(config)),
                 "log_path": str(sidecar_log),
+                "timeout_seconds": ready_timeout_s,
                 "probe": probes,
+                "log_tail": _read_log_tail(sidecar_log),
             },
         )
     state = _write_state(config, runtime_id=runtime_id, pid=process.pid, keys=keys)

codna-0.1.5/codna/byok_cli.py

@@ -0,0 +1,94 @@
+"""CLI glue for local BYOK — the on-device LLM provider key used by local `codna fix`.
+
+Thin layer over :mod:`codna.keystore`: the ``codna key {set,list,rm}`` command and the provider-key
+step folded into ``codna login``. The key stays on the device (OS keychain) and is never printed; the
+value is read via a no-echo prompt or ``--stdin`` (never argv, to avoid shell-history leaks). Split out
+of ``cli.py`` to keep that module under the modularity ceiling.
+"""
+from __future__ import annotations
+
+import json
+import sys
+from collections.abc import Mapping
+
+from . import keystore
+
+# LLM provider keys the local fixing agent needs (the engine key CODNA_API_KEY is not a model key).
+_PROVIDER_KEYS = tuple(k for k in keystore.MANAGED_KEYS if k != "CODNA_API_KEY")
+
+
+def provider_key_present(runtime_keys: Mapping[str, object]) -> bool:
+    """True if a NON-EMPTY LLM provider key resolves from env or the runtime key map.
+
+    Checks the resolved value, not mere key presence: a value-less ``keys.txt`` line (``ANTHROPIC_API_KEY=``)
+    is dropped by the engine's child-env builder, so treating it as "present" would skip onboarding and
+    leave the fixing agent with no usable key.
+    """
+    import os
+
+    if any((os.environ.get(name) or "").strip() for name in _PROVIDER_KEYS):
+        return True
+    return any(getattr(runtime_keys.get(name), "value", "").strip() for name in _PROVIDER_KEYS)
+
+
+def ensure_local_provider_key(*, interactive: bool, runtime_keys: Mapping[str, object]) -> str:
+    """Offer to store a provider key in the OS keychain if none is configured. Returns a status string.
+
+    Never prints the key. Interactive callers get a no-echo prompt; others get an actionable hint.
+    """
+    if provider_key_present(runtime_keys):
+        return "present"
+    if not interactive:
+        return "not-configured (run `codna key set <provider>`)"
+    try:
+        answer = input(
+            "\nNo local LLM provider key found. Add one now so `codna fix` runs on-device?\n"
+            "  Enter a provider (anthropic/openai/gemini/…) or press Enter to skip: "
+        ).strip()
+    except EOFError:
+        return "not-configured (run `codna key set <provider>`)"
+    if not answer:
+        return "skipped (run `codna key set <provider>` later)"
+    try:
+        import getpass
+
+        secret = getpass.getpass(f"  Paste the {answer} key (input hidden): ").strip()
+        if not secret:
+            return "skipped"
+        stored = keystore.set_key(answer, secret)
+    except keystore.KeystoreError as exc:
+        print(f"  could not store the key: {exc}", file=sys.stderr)
+        return "not-configured"
+    return f"stored:{stored}"
+
+
+def cmd_key(args) -> int:
+    """Manage the on-device LLM provider key(s) used by local `codna fix` (OS keychain; local BYOK)."""
+    action = getattr(args, "key_action", None)
+    try:
+        if action == "list":
+            print(json.dumps(
+                {"ok": True, "keys": keystore.stored_key_names(), "keychain": keystore.available()},
+                indent=2,
+            ))
+            return 0
+        if action == "rm":
+            existed = keystore.delete_key(args.provider)
+            print(json.dumps({"ok": True, "removed": existed, "provider": args.provider}, indent=2))
+            return 0
+        if action == "set":
+            # Read the secret WITHOUT echo / without argv (no shell-history leak). --stdin for CI.
+            if getattr(args, "stdin", False):
+                secret = sys.stdin.readline().strip()
+            else:
+                import getpass
+
+                secret = getpass.getpass(f"Paste the {args.provider} key (input hidden): ").strip()
+            stored = keystore.set_key(args.provider, secret)
+            print(json.dumps({"ok": True, "stored": stored}, indent=2))  # value never printed
+            return 0
+    except keystore.KeystoreError as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 1
+    print(json.dumps({"ok": False, "error": "usage: codna key {set|list|rm} …"}, indent=2), file=sys.stderr)
+    return 2

{codna-0.1.3 → codna-0.1.5}/codna/cli.py

@@ -62,8 +62,15 @@ def _keys_file_path() -> Path:
 
 
 def _runtime_keys():
+    # Precedence (env wins later at resolution time in runtime.config): keychain over legacy keys.txt,
+    # so `codna key set` takes effect even if a stale keys.txt exists. The keychain read never raises.
+    merged = {}
     path = _keys_file_path().expanduser()
-    return parse_keys_file_values(path) if path.is_file() else {}
+    if path.is_file():
+        merged.update(parse_keys_file_values(path))
+    from . import keystore
+    merged.update(keystore.config_values())
+    return merged
 
 
 def _api_key(keys) -> str | None:
@@ -789,6 +796,46 @@ def cmd_mcp(args) -> None:
     mcp_main()
 
 
+def cmd_login(args) -> int:
+    """Authorize THIS device for Codna memory (Telys device-code onboarding) — one app, per device.
+
+    Free for one device; a device always authorizes. Provisions the protected on-device runtime and a
+    device-scoped offline license so `codna` memory then runs fully offline.
+    """
+    from .telys_onboarding import OnboardingError, run_login
+
+    try:
+        result = run_login(
+            token=getattr(args, "token", None),
+            plan=getattr(args, "plan", "telys_developer"),
+            install=not getattr(args, "no_install", False),
+            open_browser=(False if getattr(args, "no_browser", False) else None),
+        )
+    except OnboardingError as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 1
+
+    # One-app onboarding: after authorizing the device, make sure a local LLM provider key exists so
+    # `codna fix` can run on-device. The key stays on the machine (OS keychain) — never sent to the cloud.
+    from . import byok_cli
+    provider_status = byok_cli.ensure_local_provider_key(
+        interactive=sys.stdin.isatty() and sys.stdout.isatty(),
+        runtime_keys=_runtime_keys(),
+    )
+
+    # Report success without echoing anything derived from the API key — the key (and its prefix) is a
+    # credential; codna never logs it. telys.login already cached it securely under $TELYS_HOME.
+    device_id = result.get("device_id") or ""
+    print(json.dumps({
+        "ok": True,
+        "device": (device_id[:12] + "…") if device_id else None,
+        "installed": bool(result.get("installed")),
+        "tier": result.get("tier"),
+        "provider_key": provider_status,
+    }, indent=2))
+    return 0
+
+
 def cmd_doctor(args) -> int:
     keys = _runtime_keys()
     try:
@@ -897,6 +944,28 @@ def build_parser() -> argparse.ArgumentParser:
 
     pm = sub.add_parser("mcp", help="Run codna as an MCP server (Cursor / Claude Desktop).")
     pm.set_defaults(func=cmd_mcp)
+
+    pl = sub.add_parser("login", help="Authorize this device for Codna memory (free for one device).")
+    pl.add_argument("--token", help="headless access token (or env TELYS_TOKEN) — skips the browser step")
+    pl.add_argument("--plan", default="telys_developer", help="onboarding plan (default: telys_developer)")
+    pl.add_argument("--no-install", dest="no_install", action="store_true",
+                    help="authorize + register only; skip provisioning the on-device runtime")
+    pl.add_argument("--no-browser", dest="no_browser", action="store_true",
+                    help="do not open a browser; print the verification URL + code to authorize elsewhere")
+    pl.set_defaults(func=cmd_login)
+
+    from .byok_cli import cmd_key
+    pk = sub.add_parser("key", help="Manage the on-device LLM provider key for local `codna fix` (OS keychain).")
+    pk_sub = pk.add_subparsers(dest="key_action")
+    pk_set = pk_sub.add_parser("set", help="Store a provider key (read via hidden prompt; never on the command line).")
+    pk_set.add_argument("provider", help="provider name (anthropic/openai/gemini/…) or *_API_KEY variable name")
+    pk_set.add_argument("--stdin", action="store_true", help="read the key from stdin (for CI) instead of prompting")
+    pk_set.set_defaults(func=cmd_key)
+    pk_list = pk_sub.add_parser("list", help="List which provider keys are stored (values never shown).")
+    pk_list.set_defaults(func=cmd_key)
+    pk_rm = pk_sub.add_parser("rm", help="Remove a stored provider key.")
+    pk_rm.add_argument("provider", help="provider name or *_API_KEY variable name")
+    pk_rm.set_defaults(func=cmd_key)
     return p
 
 

codna-0.1.5/codna/keystore.py

@@ -0,0 +1,179 @@
+"""On-device provider-key store for Codna (local BYOK), backed by the OS keychain.
+
+Local Codna keeps the user's LLM provider key (Anthropic/OpenAI/…) — and optionally the Codna engine
+key — ON THE DEVICE. It never travels to the cloud. This is the local counterpart to the website BYOK
+card (Supabase-authed, encrypted server-side): same "add your key" idea, storage chosen by where the
+model call runs. Here the call runs locally, so the key lives in the OS secure store (macOS Keychain,
+Windows Credential Manager, Linux Secret Service) via ``keyring`` — not a plaintext ``.env``.
+
+Resolution (see ``cli._runtime_keys`` + ``runtime.config``): an explicit env var always wins, then the
+keychain, then a legacy ``keys.txt``. The value is write-only from the CLI (``codna key set`` reads it
+via a no-echo prompt / stdin, never argv) and is never printed back.
+
+Every ``keyring`` touch is lazy + defensive: on a headless box with no backend, reads degrade to
+"absent" (the engine falls back to env) and writes raise :class:`KeystoreError` with an actionable hint
+— the fix hot path is never crashed by a missing keychain.
+"""
+from __future__ import annotations
+
+from .runtime.config import ConfigValue
+
+SERVICE = "codna"
+# Index entry: keyring backends can't enumerate stored items, so we keep our own name index under a
+# reserved username. (No secret lives in the index — only key NAMES.)
+_INDEX_USERNAME = "__codna_key_index__"
+
+# Provider/LLM keys the local engine forwards to the fixing agent (mirror of
+# runtime.local_stack.PROVIDER_CHILD_ENV_KEYS) + the Codna engine key. Only these may be stored.
+MANAGED_KEYS: tuple[str, ...] = (
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "GROQ_API_KEY",
+    "MISTRAL_API_KEY",
+    "OPENROUTER_API_KEY",
+    "XAI_API_KEY",
+    "CURSOR_API_KEY",
+    "CODNA_API_KEY",
+)
+
+# Friendly aliases so `codna key set anthropic` works (in addition to the raw env-var name).
+PROVIDER_ALIASES: dict[str, str] = {
+    "anthropic": "ANTHROPIC_API_KEY",
+    "openai": "OPENAI_API_KEY",
+    "gemini": "GEMINI_API_KEY",
+    "google": "GOOGLE_API_KEY",
+    "groq": "GROQ_API_KEY",
+    "mistral": "MISTRAL_API_KEY",
+    "openrouter": "OPENROUTER_API_KEY",
+    "xai": "XAI_API_KEY",
+    "cursor": "CURSOR_API_KEY",
+    "codna": "CODNA_API_KEY",
+    "engine": "CODNA_API_KEY",
+}
+
+
+class KeystoreError(RuntimeError):
+    """A keychain operation the user asked for could not be completed (surfaced with remediation)."""
+
+
+def _keyring():
+    """Import keyring or raise KeystoreError with an install hint. Never imported at module load."""
+    try:
+        import keyring
+    except Exception as exc:  # noqa: BLE001 - any import failure means no usable keychain
+        raise KeystoreError(
+            "the OS keychain is unavailable — install it with `pip install keyring` (bundled with "
+            "codna), or set the provider key as an environment variable instead"
+        ) from exc
+    return keyring
+
+
+def normalize_key_name(name: str) -> str:
+    """Map a provider alias or env-var name to a managed env-var key name (or raise)."""
+    raw = (name or "").strip()
+    if not raw:
+        raise KeystoreError("a provider name or *_API_KEY variable name is required")
+    alias = PROVIDER_ALIASES.get(raw.lower())
+    resolved = alias or raw.upper()
+    if resolved not in MANAGED_KEYS:
+        managed = ", ".join(sorted(set(PROVIDER_ALIASES) | set(MANAGED_KEYS)))
+        raise KeystoreError(f"unknown provider key '{name}'. Known: {managed}")
+    return resolved
+
+
+def available() -> bool:
+    """True if a usable OS keychain backend is present (best-effort, never raises)."""
+    try:
+        kr = _keyring()
+        kr.get_password(SERVICE, _INDEX_USERNAME)  # a real backend returns str|None; fail backend raises
+        return True
+    except Exception:  # noqa: BLE001 - KeystoreError (no keyring) or a backend that refuses reads
+        return False
+
+
+def _read_index() -> list[str]:
+    try:
+        kr = _keyring()
+        raw = kr.get_password(SERVICE, _INDEX_USERNAME)
+        # str() defends against a non-conformant backend returning a non-string (keyring's contract is
+        # Optional[str], but `codna key list/set/rm` must not traceback on a misbehaving third-party store).
+        names = [n.strip() for n in str(raw or "").split(",") if n.strip()]
+    except Exception:  # noqa: BLE001
+        return []
+    # Only surface names we still manage (defends against a hand-edited/legacy index).
+    return [n for n in names if n in MANAGED_KEYS]
+
+
+def _write_index(names: list[str]) -> None:
+    kr = _keyring()
+    unique = sorted({n for n in names if n in MANAGED_KEYS})
+    kr.set_password(SERVICE, _INDEX_USERNAME, ",".join(unique))
+
+
+def set_key(name: str, value: str) -> str:
+    """Store a provider key in the OS keychain. Returns the resolved env-var name."""
+    key = normalize_key_name(name)
+    token = (value or "").strip()
+    if not token:
+        raise KeystoreError("refusing to store an empty key")
+    kr = _keyring()
+    try:
+        kr.set_password(SERVICE, key, token)
+    except Exception as exc:  # noqa: BLE001 - backend write failure
+        raise KeystoreError(f"could not write to the OS keychain: {type(exc).__name__}") from exc
+    index = _read_index()
+    if key not in index:
+        _write_index([*index, key])
+    return key
+
+
+def get_key(name: str) -> str | None:
+    """Read a stored provider key, or None if absent / no keychain. Never raises."""
+    try:
+        key = normalize_key_name(name)
+        kr = _keyring()
+        value = kr.get_password(SERVICE, key)
+    except Exception:  # noqa: BLE001
+        return None
+    return value.strip() if value and value.strip() else None
+
+
+def delete_key(name: str) -> bool:
+    """Remove a stored provider key. Returns True if one existed. Idempotent."""
+    key = normalize_key_name(name)
+    kr = _keyring()
+    existed = False
+    try:
+        if kr.get_password(SERVICE, key):
+            existed = True  # observed present BEFORE delete, so a swallowed PasswordDeleteError can't reset it
+            kr.delete_password(SERVICE, key)
+    except Exception as exc:  # noqa: BLE001
+        # delete_password raises PasswordDeleteError when absent on some backends — treat as "gone".
+        from keyring.errors import PasswordDeleteError  # type: ignore
+
+        if not isinstance(exc, PasswordDeleteError):
+            raise KeystoreError(f"could not delete from the OS keychain: {type(exc).__name__}") from exc
+    index = _read_index()
+    if key in index:
+        _write_index([n for n in index if n != key])
+    return existed
+
+
+def stored_key_names() -> list[str]:
+    """Names of keys currently stored (values never returned). Best-effort; never raises."""
+    return [name for name in _read_index() if get_key(name)]
+
+
+def config_values() -> dict[str, ConfigValue]:
+    """Keychain-sourced keys as ConfigValues for the runtime key map. Never raises (returns {})."""
+    out: dict[str, ConfigValue] = {}
+    try:
+        for name in _read_index():
+            value = get_key(name)
+            if value:
+                out[name] = ConfigValue(key=name, value=value, source="keychain")
+    except Exception:  # noqa: BLE001 - a broken keychain must never break the fix hot path
+        return {}
+    return out