codna 0.1.41__tar.gz → 0.1.43__tar.gz

{codna-0.1.41 → codna-0.1.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.41
+Version: 0.1.43
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.41 → codna-0.1.43}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.41"
+__version__ = "0.1.43"

{codna-0.1.41 → codna-0.1.43}/codna/cli.py

@@ -846,8 +846,8 @@ def build_parser() -> argparse.ArgumentParser:
     ps.add_argument("--from-sarif", dest="from_sarif", required=True,
                     help="path to the scanner's SARIF output (CodeQL/Semgrep/Snyk/Trivy)")
     ps.add_argument("--ref", help="branch/tag/commit")
-    ps.add_argument("--engine", choices=["remote", "local"], default="remote",
-                    help="reachability engine: 'remote' (decision-engine) or 'local' (bounded self-host reference)")
+    ps.add_argument("--engine", choices=["remote", "local"], default="local",
+                    help="reachability engine: 'local' (bounded self-host reference) or explicit 'remote'")
     ps.add_argument("--verification", help="codna-security.yaml manifest (required for --open-pr)")
     ps.add_argument("--open-pr", dest="open_pr", action="store_true",
                     help="open a fix PR per reachable finding (requires a resolved manifest)")

{codna-0.1.41 → codna-0.1.43}/codna/webhook.py

@@ -23,6 +23,7 @@ import hmac
 import json
 import os
 import re
+import sys
 from dataclasses import dataclass
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
@@ -34,6 +35,12 @@ SECURE_LABEL = "codna-secure"
 _FAILING_CONCLUSIONS = {"failure", "timed_out", "startup_failure", "action_required"}
 _WEBHOOK_SECRET_ENV = "CODNA_GITHUB_WEBHOOK_SECRET"
 _MAX_BODY_BYTES = 25 * 1024 * 1024  # GitHub caps webhook payloads at ~25 MB; reject anything larger
+_SENSITIVE_TEXT_RE = re.compile(
+    r"(gh[opsu]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]+|"
+    r"sk-[A-Za-z0-9_-]{20,}|pypi-[A-Za-z0-9_-]{20,}|"
+    r"-----BEGIN [A-Z ]+PRIVATE KEY-----.*?-----END [A-Z ]+PRIVATE KEY-----)",
+    re.DOTALL,
+)
 
 
 class WebhookError(RuntimeError):
@@ -299,11 +306,40 @@ def codna_command(job: WebhookJob, *, repo_url: str | None = None, sarif_path: s
     raise WebhookError("unknown_job_kind", f"unknown job kind {job.kind!r}")
 
 
+def _redact_debug_value(value: Any) -> Any:
+    if isinstance(value, str):
+        return _SENSITIVE_TEXT_RE.sub("<redacted>", value)[:500]
+    if isinstance(value, dict):
+        return {str(k): _redact_debug_value(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_redact_debug_value(v) for v in value[:20]]
+    return value
+
+
+def _queue_debug_payload(server: Any) -> dict[str, Any]:
+    queue = getattr(server, "queue", None)
+    pool = getattr(server, "worker_pool", None)
+    payload: dict[str, Any] = {
+        "service": "codna-webhook",
+        "queue": {"configured": queue is not None},
+        "worker_pool": pool.diagnostics() if pool is not None else {"configured": False},
+    }
+    if queue is not None:
+        payload["queue"] = {
+            "configured": True,
+            "counts": queue.counts(),
+            "recent": _redact_debug_value(queue.recent(limit=10)),
+        }
+    return payload
+
+
 def default_queue_path() -> str:
     """Where the durable job queue lives (override with CODNA_WEBHOOK_QUEUE, e.g. a Fly volume)."""
     override = os.environ.get("CODNA_WEBHOOK_QUEUE")
     if override:
-        return override
+        path = Path(override).expanduser()
+        path.parent.mkdir(parents=True, exist_ok=True)
+        return str(path)
     root = Path(os.environ.get("CODNA_RUNTIME_ROOT") or (Path.home() / ".codna"))
     path = root / "webhook" / "queue.db"
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -327,10 +363,38 @@ class _Handler(BaseHTTPRequestHandler):
 
     def do_GET(self) -> None:  # noqa: N802 (stdlib naming)
         # Liveness/readiness for load balancers + Fly health checks. Never leaks config.
-        if self.path.rstrip("/") in ("/health", "/healthz", "/ready", ""):
+        path = self.path.rstrip("/")
+        if path in ("/health", "/healthz", ""):
             configured = bool(os.environ.get(_WEBHOOK_SECRET_ENV))
             self._reply(200 if configured else 503, {"service": "codna-webhook", "ok": configured})
             return
+        if path == "/ready":
+            secret_ready = bool(os.environ.get(_WEBHOOK_SECRET_ENV))
+            if os.environ.get("GITHUB_TOKEN"):
+                app_ready = True
+            else:
+                from .webhook_github import app_auth_config_ready
+
+                app_ready = app_auth_config_ready(os.environ.get("GITHUB_APP_ID"), os.environ.get("GITHUB_APP_PRIVATE_KEY"))
+            pool = getattr(self.server, "worker_pool", None)
+            pool_diag = pool.diagnostics() if pool is not None else None
+            worker_ready = True if pool_diag is None else bool(pool_diag.get("ready"))
+            ready = secret_ready and app_ready and worker_ready
+            self._reply(200 if ready else 503, {
+                "service": "codna-webhook",
+                "ok": ready,
+                "checks": {"webhook_secret": secret_ready, "github_app_auth": app_ready,
+                           "worker_pool": worker_ready},
+            })
+            return
+        if path == "/debug/queue":
+            secret = os.environ.get(_WEBHOOK_SECRET_ENV, "")
+            token = self.headers.get("X-Codna-Debug-Token", "")
+            if not secret or not hmac.compare_digest(secret, token):
+                self._reply(401, {"error": "unauthorized"})
+                return
+            self._reply(200, _queue_debug_payload(self.server))
+            return
         self._reply(404, {"error": "not_found"})
 
     def do_POST(self) -> None:  # noqa: N802 (stdlib naming)
@@ -395,10 +459,9 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
 
     Requires ``CODNA_GITHUB_WEBHOOK_SECRET``. App auth is ``GITHUB_APP_ID`` /
     ``GITHUB_APP_PRIVATE_KEY`` (a plain ``GITHUB_TOKEN`` also works for single-repo
-    self-hosting). The fix agent needs a provider LLM key set under its own env var
-    (``ANTHROPIC_API_KEY`` / ``OPENAI_API_KEY`` / ``GEMINI_API_KEY`` / ...) and, for the
-    engine-behind path, ``CODNA_ENGINE_URL`` (or ``ALGENTA_ENGINE_URL``) + ``CODNA_API_KEY`` —
-    the worker forwards exactly those into each job's scrubbed env.
+    self-hosting). The worker runs the packaged Codna CLI in a scrubbed workspace and forwards
+    only the scoped GitHub token plus an optional per-installation ``CODNA_API_KEY`` when the
+    install is linked to a Codna account.
     """
     require_webhook_secret()
     import signal
@@ -417,6 +480,8 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
     pool.start()
     httpd = ThreadingHTTPServer((host, port), _Handler)
     httpd.queue = queue  # type: ignore[attr-defined]
+    httpd.worker_pool = pool  # type: ignore[attr-defined]
+    print(f"codna webhook: listening on {host}:{port}/webhooks/github", file=sys.stderr)
 
     def _graceful(_sig: int, _frame: Any) -> None:
         # serve_forever() can't shut itself down from its own thread — do it from another.

{codna-0.1.41 → codna-0.1.43}/codna/webhook_cli.py

@@ -20,7 +20,6 @@ def cmd_webhook(args):
     port = int(getattr(args, "port", 8080))
     try:
         require_webhook_secret()
-        print(f"codna webhook: listening on {host}:{port}/webhooks/github", file=sys.stderr)
         serve(host=host, port=port)
     except WebhookError as exc:
         _die(str(exc))

{codna-0.1.41 → codna-0.1.43}/codna/webhook_github.py

@@ -37,6 +37,18 @@ def scoped_token_request(repo_full_name: str, kind: str) -> dict[str, Any]:
     return {"repositories": [repo_name], "permissions": token_permissions_for(kind)}
 
 
+def normalize_private_key_pem(private_key_pem: str) -> str:
+    """Normalize PEM values from secret stores.
+
+    Some secret import paths preserve multiline PEMs, while dotenv-style import paths store
+    escaped ``\n`` sequences. GitHub App auth must accept both without weakening validation.
+    """
+    value = private_key_pem.strip().strip('"').strip("'")
+    if "\\n" in value and "\n" not in value:
+        value = value.replace("\\n", "\n")
+    return value.strip()
+
+
 def _app_jwt(app_id: str, private_key_pem: str, *, now: int) -> str:
     import base64
 
@@ -49,11 +61,22 @@ def _app_jwt(app_id: str, private_key_pem: str, *, now: int) -> str:
     header = _b64url(json.dumps({"alg": "RS256", "typ": "JWT"}).encode())
     claims = _b64url(json.dumps({"iat": now - 60, "exp": now + 540, "iss": str(app_id)}).encode())
     signing_input = f"{header}.{claims}".encode()
-    key = serialization.load_pem_private_key(private_key_pem.encode(), password=None)
+    key = serialization.load_pem_private_key(normalize_private_key_pem(private_key_pem).encode(), password=None)
     signature = key.sign(signing_input, padding.PKCS1v15(), hashes.SHA256())
     return f"{header}.{claims}.{_b64url(signature)}"
 
 
+def app_auth_config_ready(app_id: str | None, private_key_pem: str | None) -> bool:
+    """Return True only when App auth config is present and can sign a JWT locally."""
+    if not (app_id and private_key_pem):
+        return False
+    try:
+        _app_jwt(app_id, private_key_pem, now=1_700_000_000)
+    except Exception:  # noqa: BLE001 - readiness reports false, not secret-bearing details
+        return False
+    return True
+
+
 def installation_token(
     app_id: str,
     private_key_pem: str,
@@ -100,11 +123,11 @@ def check_run_payload(name: str, head_sha: str, *, status: str, conclusion: str
 
 
 def create_check_run(repo_full_name: str, token: str, *, name: str, head_sha: str, summary: str) -> int | None:
-    """Create an in_progress Check Run so status shows in the PR UI. Returns its id (or None)."""
+    """Create an in_progress Check Run so status shows in the PR UI. Returns its id."""
     try:
         import httpx
-    except Exception:  # noqa: BLE001
-        return None
+    except Exception as exc:  # noqa: BLE001
+        raise WebhookError("check_run_unavailable", f"Check Run creation needs httpx: {exc}") from exc
     resp = httpx.post(
         f"{_API}/repos/{repo_full_name}/check-runs",
         headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
@@ -112,22 +135,27 @@ def create_check_run(repo_full_name: str, token: str, *, name: str, head_sha: st
         timeout=30.0, follow_redirects=True,
     )
     if resp.status_code >= 300:
-        return None
-    return resp.json().get("id")
+        raise WebhookError("check_run_create_failed", f"create check run: {resp.status_code} {resp.text[:200]}")
+    check_run_id = resp.json().get("id")
+    if not check_run_id:
+        raise WebhookError("check_run_create_failed", "create check run: GitHub returned no check_run id")
+    return check_run_id
 
 
 def update_check_run(repo_full_name: str, token: str, check_run_id: int, *, conclusion: str, summary: str,
                      name: str = "codna") -> None:
     try:
         import httpx
-    except Exception:  # noqa: BLE001
-        return
-    httpx.patch(
+    except Exception as exc:  # noqa: BLE001
+        raise WebhookError("check_run_unavailable", f"Check Run update needs httpx: {exc}") from exc
+    resp = httpx.patch(
         f"{_API}/repos/{repo_full_name}/check-runs/{check_run_id}",
         headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
         json=check_run_payload(name, "", status="completed", conclusion=conclusion, summary=summary),
         timeout=30.0, follow_redirects=True,
     )
+    if resp.status_code >= 300:
+        raise WebhookError("check_run_update_failed", f"update check run: {resp.status_code} {resp.text[:200]}")
 
 
 def find_open_pr_by_marker(repo_full_name: str, token: str, marker: str, *, max_pages: int = 3,

{codna-0.1.41 → codna-0.1.43}/codna/webhook_metering.py

@@ -1,13 +1,11 @@
 """Per-installation metering for Codna's GitHub App webhook.
 
-Codna's webhook is keyless and runs engine-behind: the ENGINE meters every cloud fix per
-ORG — the monthly managed-model allowance (the changeable "$5/mo"), Stripe plan tier,
-BYOK-beyond (the org's own provider key), and device seats are all enforced server-side,
-keyed on the org's engine API key. `installation_id -> org` is already bound in the engine
-(the verified GitHub App install), so a fix run with the RIGHT org's engine key is metered
-to the right account automatically.
+Codna's webhook is keyless: it runs the packaged Codna CLI with the encapsulated local
+runtime and injects only the linked org's Codna run credential. The monthly managed-model
+allowance (the changeable "$5/mo"), Stripe plan tier, BYOK-beyond (the org's own provider
+key), and device seats are enforced by the Codna account plane for that org.
 
-This module resolves that per-installation engine credential and carries the (changeable)
+This module resolves that per-installation Codna credential and carries the (changeable)
 included-allowance config. It FAILS CLOSED: with no credential for an installation, the
 webhook must NOT run a fix on a shared house key — it prompts the user to link/authorize.
 """
@@ -37,14 +35,13 @@ def account_link_url() -> str:
 
 
 def resolve_engine_key(installation_id: int | None) -> str | None:
-    """Return the org engine API key for a GitHub installation, or None (fail closed).
+    """Return the org Codna run credential for a GitHub installation, or None (fail closed).
 
     Provisioning seam (the one piece populated OUTSIDE codna): the mapping
-    ``installation_id -> org engine key`` is written when a user links their GitHub install
+    ``installation_id -> org Codna run credential`` is written when a user links their GitHub install
     to their Codna account at :data:`ACCOUNT_LINK_URL`. The webhook reads it from either a
     JSON file on its volume (``CODNA_WEBHOOK_INSTALL_KEYS_PATH``) or inline JSON
-    (``CODNA_WEBHOOK_INSTALL_KEYS``). Swap this body for a live engine call once the engine
-    exposes an installation->org run-credential exchange; callers don't change.
+    (``CODNA_WEBHOOK_INSTALL_KEYS``).
     """
     if not installation_id:
         return None

{codna-0.1.41 → codna-0.1.43}/codna/webhook_queue.py

@@ -19,7 +19,7 @@ from contextlib import contextmanager
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Iterator, Mapping
+from typing import Any, Iterator, Mapping
 
 from .webhook import WebhookJob
 
@@ -187,3 +187,40 @@ class WebhookQueue:
         with self._conn() as conn:
             rows = conn.execute("SELECT status, COUNT(*) c FROM jobs GROUP BY status").fetchall()
         return {r["status"]: r["c"] for r in rows}
+
+    def recent(self, *, limit: int = 10) -> list[dict[str, Any]]:
+        """Return newest queue rows for authenticated operator diagnostics only."""
+        safe_limit = max(1, min(int(limit), 50))
+        with self._conn() as conn:
+            rows = conn.execute(
+                "SELECT id, delivery_id, kind, repo, ref, installation_id, reason, status, attempts, "
+                "created_at, claimed_at, finished_at, result FROM jobs ORDER BY id DESC LIMIT ?",
+                (safe_limit,),
+            ).fetchall()
+        out: list[dict[str, Any]] = []
+        for row in rows:
+            result: dict[str, Any] = {}
+            if row["result"]:
+                try:
+                    loaded = json.loads(row["result"])
+                    result = loaded if isinstance(loaded, dict) else {"value": str(loaded)}
+                except ValueError:
+                    result = {"value": str(row["result"])}
+            out.append(
+                {
+                    "id": row["id"],
+                    "delivery_id": row["delivery_id"],
+                    "kind": row["kind"],
+                    "repo": row["repo"],
+                    "ref": row["ref"],
+                    "installation_id": row["installation_id"],
+                    "reason": row["reason"],
+                    "status": row["status"],
+                    "attempts": row["attempts"],
+                    "created_at": row["created_at"],
+                    "claimed_at": row["claimed_at"],
+                    "finished_at": row["finished_at"],
+                    "result": result,
+                }
+            )
+        return out

{codna-0.1.41 → codna-0.1.43}/codna/webhook_worker.py

@@ -1,16 +1,16 @@
-"""Worker pool for Codna's GitHub App webhook — decoupled from the ingress.
+"""Worker pool for Codna's GitHub App webhook - decoupled from the ingress.
 
 Codna is local; the App is the only hosted surface — so workers are in-process threads in
-that single app (not a machine fleet). The webhook is KEYLESS and runs engine-behind: the
-ENGINE meters every cloud fix per ORG (managed-model allowance / Stripe plan / BYOK / device
-seats). Each job:
+that single app (not a machine fleet). The webhook is KEYLESS: it runs the packaged Codna CLI
+with the encapsulated local runtime and a per-installation Codna account credential when the
+install is linked. Each job:
 
-  1. resolves the org's engine credential for the job's installation (webhook_metering);
+  1. resolves the org's Codna run credential for the job's installation (webhook_metering);
      with NONE it FAILS CLOSED — posts a "link your account" Check Run and does NOT spend;
   2. mints a short-lived, repo-scoped GitHub installation token (for the branch/PR/SARIF,
      NOT for metering);
-  3. opens a Check Run, runs the ``codna`` CLI engine-behind in a FRESH scrubbed temp
-     workspace (only the scoped GitHub token + the per-org engine key are injected — no raw
+  3. opens a Check Run, runs the ``codna`` CLI in a FRESH scrubbed temp workspace
+     (only the scoped GitHub token + the per-org Codna key are injected — no raw
      provider key, and the host's other secrets never leak);
   4. reports on the Check Run and marks the queue row done/failed.
 
@@ -24,12 +24,13 @@ import subprocess
 import tempfile
 import threading
 import time
+import sys
+import json
 from dataclasses import dataclass
 from typing import Any, Callable
 
 from . import webhook_github, webhook_metering
 from .agent_core_runtime import PROVIDER_RUNTIME_ENV_KEYS
-from .runtime.config import ENGINE_URL_KEYS
 from .webhook import WebhookError, WebhookJob, codna_command, webhook_marker
 from .webhook_queue import _MAX_ATTEMPTS, QueuedJob, WebhookQueue
 
@@ -50,13 +51,12 @@ _SAFE_CONFIG = frozenset({
     "CODNA_FIX_SLA_S", "CODNA_FIX_CEILING", "CODNA_TIMEOUT_S",
 })
 # ALLOWLIST (not denylist): the job runs untrusted repo code, so it inherits ONLY safe config
-# + the engine URL + Telys pointers/tuning. It does NOT inherit any raw LLM provider key or an
-# ambient engine API key — the per-ORG engine credential is INJECTED explicitly per job, so
-# each fix meters to the right account and no house/other-org secret can leak.
+# + Telys pointers/tuning. It does NOT inherit engine URL overrides, raw LLM provider keys, or
+# an ambient API key. The per-ORG Codna credential is INJECTED explicitly per job, so each fix
+# meters to the right account and no house/other-org secret can leak.
 _ENV_ALLOWLIST = (
     _SAFE_CONFIG
     | (set(PROVIDER_RUNTIME_ENV_KEYS) - _PROVIDER_API_KEYS)  # Telys pointers/tuning, NOT provider keys
-    | set(ENGINE_URL_KEYS)                                   # CODNA_ENGINE_URL / ALGENTA_ENGINE_URL (non-secret)
 )
 
 
@@ -113,18 +113,18 @@ def _comment_fix_result_msg(job: WebhookJob, token: str, result: "JobResult", gi
 
 
 def _job_env(token: str | None, engine_key: str | None) -> dict[str, str]:
-    """Minimal allowlisted env + ONLY the scoped GitHub token and the per-org engine key."""
+    """Minimal allowlisted env + ONLY the scoped GitHub token and per-org Codna key."""
     env = {k: v for k, v in os.environ.items() if k in _ENV_ALLOWLIST}
     if token:
         env["GITHUB_TOKEN"] = token
     if engine_key:
-        env["CODNA_API_KEY"] = engine_key  # per-installation org credential → engine meters THIS org
+        env["CODNA_API_KEY"] = engine_key  # per-installation org credential meters THIS org
     return env
 
 
 def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                   codna_bin: str = "codna") -> JobResult:
-    """Default runner: run codna engine-behind for the job in an isolated, scrubbed workspace."""
+    """Default runner: run packaged codna for the job in an isolated, scrubbed workspace."""
     with tempfile.TemporaryDirectory(prefix="codna-webhook-job-") as tmp:
         if job.kind == "secure":
             if not token:
@@ -231,6 +231,29 @@ def process_job(
     return result
 
 
+def _job_log_context(qjob: QueuedJob) -> dict[str, object]:
+    job = qjob.job
+    return {
+        "service": "codna-webhook-worker",
+        "event": "job_failed",
+        "row_id": qjob.row_id,
+        "delivery_id": qjob.delivery_id,
+        "attempt": qjob.attempts,
+        "kind": job.kind,
+        "repo": job.repo_full_name,
+        "ref": job.ref,
+        "installation_id": job.installation_id,
+        "reason": job.reason,
+    }
+
+
+def _log_worker_failure(qjob: QueuedJob, *, code: str, message: str) -> None:
+    payload = _job_log_context(qjob)
+    payload["code"] = code
+    payload["message"] = message[:500]
+    print(json.dumps(payload, sort_keys=True), file=sys.stderr, flush=True)
+
+
 class WorkerPool:
     def __init__(self, queue: WebhookQueue, *, concurrency: int = 2, poll_interval: float = 1.0,
                  app_id: str | None = None, private_key: str | None = None,
@@ -258,11 +281,15 @@ class WorkerPool:
                 continue
             try:
                 result = self._process(qjob)
+                if not result.ok:
+                    _log_worker_failure(qjob, code="job_failed", message=result.summary)
                 self._queue.complete(qjob.row_id, status="done" if result.ok else "failed",
                                      result={"summary": result.summary, "attempt": qjob.attempts})
             except WebhookError as exc:
+                _log_worker_failure(qjob, code=exc.code, message=str(exc))
                 self._queue.complete(qjob.row_id, status="failed", result={"error": exc.code, "message": str(exc)})
             except Exception as exc:  # noqa: BLE001 — a worker must never die on one bad job
+                _log_worker_failure(qjob, code="job_crashed", message=str(exc))
                 self._queue.complete(qjob.row_id, status="failed", result={"error": "job_crashed", "message": str(exc)[:500]})
 
     def start(self) -> None:
@@ -272,6 +299,15 @@ class WorkerPool:
             t.start()
             self._threads.append(t)
 
+    def diagnostics(self) -> dict[str, int | bool]:
+        alive = sum(1 for thread in self._threads if thread.is_alive())
+        return {
+            "configured_threads": self._concurrency,
+            "started_threads": len(self._threads),
+            "alive_threads": alive,
+            "ready": alive >= self._concurrency,
+        }
+
     def stop(self, timeout: float | None = None) -> None:
         """Signal stop and DRAIN: wait (up to the drain grace) for the in-flight job to complete
         and mark itself done, so a routine redeploy doesn't abandon + re-run it (duplicate PRs).

{codna-0.1.41 → codna-0.1.43}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.41
+Version: 0.1.43
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.41 → codna-0.1.43}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.41"
+version = "0.1.43"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.41 → codna-0.1.43}/tests/test_cli_parser.py

@@ -24,6 +24,7 @@ def test_secure_subcommand_wired():
     assert args.func is cmd_secure
     assert args.repo == "myrepo"
     assert args.from_sarif == "results.sarif"
+    assert args.engine == "local"
     assert args.open_pr is False and args.fix is False
 
 
@@ -145,7 +146,7 @@ def test_github_action_uses_cli_without_forcing_remote_engine_or_hiding_failures
     assert "bash algenta/postbuild.sh" not in text
     assert "CODNA_SIDECAR_DIR" not in text
     assert 'CODNA_AGENT_CORE_READY_TIMEOUT_SECONDS: "120"' in text
-    assert "export CODNA_ENGINE_URL" in text
+    assert "export CODNA_ENGINE_URL" not in text
     assert "CODNA_ENGINE_URL: ${{ inputs.engine-url }}" not in text
     assert 'out="$(codna "${args[@]}" 2>&1)" || true' not in text
     assert 'exit "$status"' in text

codna-0.1.43/tests/test_dockerfile_webhook.py

@@ -0,0 +1,99 @@
+"""Regression guards for the webhook image build.
+
+The codna wheel build (cli/setup.py) bundles the agent-core sidecar INTO the wheel and fails
+closed ("agent-core runtime source is missing run-server.mjs") unless the sibling agent-core/ is
+present at build time. So in Dockerfile.webhook the agent-core COPY must land BEFORE
+`pip install /app/cli`. This ordering broke once and failed the Fly build; lock it in.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+DOCKERFILE = ROOT / "infra" / "docker" / "Dockerfile.webhook"
+DOCKERIGNORE = ROOT / ".dockerignore"
+
+
+def test_dockerfile_webhook_exists():
+    assert DOCKERFILE.is_file(), "infra/docker/Dockerfile.webhook is required for the App-channel image"
+
+
+def test_agent_core_copied_before_pip_install():
+    """agent-core must be COPYed in before `pip install /app/cli`, or the wheel build fails closed."""
+    lines = DOCKERFILE.read_text(encoding="utf-8").splitlines()
+    copy_idx = next(
+        (i for i, line in enumerate(lines) if "agent-core" in line and line.strip().startswith("COPY")),
+        None,
+    )
+    pip_idx = next(
+        (i for i, line in enumerate(lines) if "pip install" in line and "/app/cli" in line),
+        None,
+    )
+    assert copy_idx is not None, "expected a `COPY ... agent-core ...` line"
+    assert pip_idx is not None, "expected a `pip install ... /app/cli` line"
+    assert copy_idx < pip_idx, (
+        "agent-core must be copied BEFORE `pip install /app/cli` — the codna wheel build bundles it "
+        "and fails closed without the sibling agent-core/ present (this ordering broke the Fly build once)"
+    )
+
+
+def test_webhook_image_is_keyless():
+    """The webhook image must not bake in an LLM provider key."""
+    text = DOCKERFILE.read_text(encoding="utf-8")
+    for banned in ("ANTHROPIC_API_KEY", "OPENAI_API_KEY"):
+        assert f"ENV {banned}" not in text and f"{banned}=" not in text, (
+            f"{banned} must not be set in the webhook image — it stays keyless"
+        )
+
+
+def test_webhook_image_installs_runtime_port_inspection_tool():
+    """codna doctor/start-stack needs lsof to enforce fixed local runtime ownership in-container."""
+    text = DOCKERFILE.read_text(encoding="utf-8")
+    install_lines = " ".join(line.strip() for line in text.splitlines() if "apt-get install" in line or "lsof" in line)
+    assert "lsof" in install_lines, (
+        "Dockerfile.webhook must install lsof; without it `codna doctor --start-stack` fails "
+        "with port_inspection_unavailable inside the deployed container"
+    )
+
+
+def test_webhook_image_installs_node_for_sidecar_supervisor():
+    """run-server.mjs is launched with node and supervises the Bun sidecar child."""
+    text = DOCKERFILE.read_text(encoding="utf-8")
+    install_lines = " ".join(
+        line.strip()
+        for line in text.splitlines()
+        if "apt-get install" in line or "nodejs" in line
+    )
+    assert "nodejs" in install_lines, (
+        "Dockerfile.webhook must install nodejs; without node, `codna doctor --start-stack` "
+        "fails with node_runtime_not_found before the bundled Bun sidecar can start"
+    )
+
+
+def test_webhook_image_strips_generated_cli_build_artifacts_before_install():
+    """A dirty local cli/build must not be repackaged into the Linux webhook image."""
+    text = DOCKERFILE.read_text(encoding="utf-8")
+    assert "rm -rf /app/cli/build" in text
+    assert "/app/cli/*.egg-info" in text
+    assert "pip install --no-cache-dir /app/cli" in text
+
+
+def test_root_dockerignore_excludes_local_deploy_cruft():
+    """Fly deploys from the repo root; local-only stores must never enter that context."""
+    patterns = {
+        line.strip()
+        for line in DOCKERIGNORE.read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.lstrip().startswith("#")
+    }
+    required = {
+        ".codex-worktrees",
+        ".pnpm-store",
+        ".venv",
+        "**/node_modules",
+        ".env",
+        "*.pem",
+        "**/build",
+        "**/*.egg-info",
+    }
+    missing = sorted(required.difference(patterns))
+    assert not missing, f".dockerignore is missing root-context exclusions: {missing}"