codna 0.1.42__tar.gz → 0.1.44__tar.gz

{codna-0.1.42 → codna-0.1.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.42
+Version: 0.1.44
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.42 → codna-0.1.44}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.42"
+__version__ = "0.1.44"

{codna-0.1.42 → codna-0.1.44}/codna/cli.py

@@ -581,7 +581,7 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> int:
     test_cmds = (manifest.build + manifest.tests) if manifest else []
     model = os.environ.get("CODNA_FIX_MODEL")
 
-    print("\ncodna: remediating eligible findings with the agentic Cline SDK (local engine) …")
+    print("\ncodna: remediating eligible findings with the Codna agent (local engine) …")
     report = run_local_fix(
         ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model, keys=_runtime_keys()),
         repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds, apply_to_repo=True,
@@ -803,7 +803,12 @@ def build_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="codna", description="Codna — understand, fix & secure your repo.")
     p.add_argument("--version", action="version", version=f"codna {__version__}")
     p.add_argument("--config", help="path to codna.yaml (default: ./codna.yaml or ./.codna.yaml)")
-    sub = p.add_subparsers(dest="cmd")
+    # `webhook` is the hosted GitHub App server (operator-only) — kept functional but hidden from
+    # `--help`, so the public metavar lists only user-facing commands.
+    sub = p.add_subparsers(
+        dest="cmd",
+        metavar="{triage,fix,doctor,secure,secure-open-pr,mcp,review,init,status,login,key}",
+    )
 
     pt = sub.add_parser("triage", help="Understand a repo + locate relevant code (fast, deterministic).")
     pt.add_argument("repo", nargs="?", default=".", help="local path or git URL (default: current dir)")
@@ -846,8 +851,8 @@ def build_parser() -> argparse.ArgumentParser:
     ps.add_argument("--from-sarif", dest="from_sarif", required=True,
                     help="path to the scanner's SARIF output (CodeQL/Semgrep/Snyk/Trivy)")
     ps.add_argument("--ref", help="branch/tag/commit")
-    ps.add_argument("--engine", choices=["remote", "local"], default="remote",
-                    help="reachability engine: 'remote' (decision-engine) or 'local' (bounded self-host reference)")
+    ps.add_argument("--engine", choices=["remote", "local"], default="local",
+                    help="reachability engine: 'local' (bounded self-host reference) or explicit 'remote'")
     ps.add_argument("--verification", help="codna-security.yaml manifest (required for --open-pr)")
     ps.add_argument("--open-pr", dest="open_pr", action="store_true",
                     help="open a fix PR per reachable finding (requires a resolved manifest)")
@@ -868,7 +873,7 @@ def build_parser() -> argparse.ArgumentParser:
     po.add_argument("--base-branch", help="PR base branch (default: main)")
     po.set_defaults(func=cmd_secure_open_pr)
 
-    pw = sub.add_parser("webhook", help="Run Codna's GitHub App webhook (the App channel, owned in Codna).")
+    pw = sub.add_parser("webhook")  # operator-only (hosted App server); omit help= to hide from --help
     pw_sub = pw.add_subparsers(dest="action")
     pw_serve = pw_sub.add_parser("serve", help="Serve the webhook: verify → classify → run codna fix/secure.")
     pw_serve.add_argument("--host", default="0.0.0.0", help="bind host (default: 0.0.0.0)")

{codna-0.1.42 → codna-0.1.44}/codna/cline_agent.py

@@ -60,7 +60,7 @@ def run_cline_fix(
     if not (core / "node_modules").is_dir():
         raise ClineAgentError(f"vendored SDK not built (no node_modules) under {core}")
     if task_kind not in {"fix", "triage", "review"}:
-        raise ClineAgentError(f"unsupported cline task_kind '{task_kind}'")
+        raise ClineAgentError(f"unsupported task_kind '{task_kind}'")
 
     env = dict(os.environ)
     _ensure_cline_data_dir(env)
@@ -78,9 +78,9 @@ def run_cline_fix(
             cwd=str(core), env=env, capture_output=True, text=True, timeout=timeout_s,
         )
     except FileNotFoundError as exc:
-        raise ClineAgentError("`bun` not found on PATH — required to run the Cline agent.") from exc
+        raise ClineAgentError("`bun` not found on PATH — required to run the agent.") from exc
     except subprocess.TimeoutExpired as exc:
-        raise ClineAgentError(f"cline agent timed out after {timeout_s}s") from exc
+        raise ClineAgentError(f"the agent timed out after {timeout_s}s") from exc
 
     for line in proc.stdout.splitlines():
         if line.startswith("RESULT "):

{codna-0.1.42 → codna-0.1.44}/codna/mcp_server.py

@@ -209,10 +209,10 @@ def _build_server():
         repo: str = ".", issue: str = "", ref: str = "", open_pr: bool = False,
         model: str = "repository.verified_agentic_v1",
     ) -> str:
-        """Find and fix a bug. Runs the full codna agent (Cline) + engine + risk simulation.
+        """Find and fix a bug. Runs the full Codna agent + engine + risk simulation.
 
         repo: a local path or a git URL. issue: what's broken (e.g. the failing test).
-        model: optional provider-qualified model such as openai/gpt-5.5.
+        model: optional provider-qualified model such as openai/gpt-5.
         open_pr: when false (default) this is READ-ONLY — returns the plan (root cause, confidence,
           patch reference) and changes nothing. When true, codna pushes a fix branch and OPENS A
           PULL REQUEST — this needs a git URL for `repo` and a GITHUB_TOKEN with write access.

{codna-0.1.42 → codna-0.1.44}/codna/patchgen.py

@@ -138,7 +138,7 @@ class ClinePatchGenerator:
         with _scoped_agent_limits(self.max_iterations, self.timeout_s):
             diff = runner.run(request).patch_diff
         if not diff.strip():
-            raise PatchGenError(f"cline agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
+            raise PatchGenError(f"the agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
         return diff
 
 

{codna-0.1.42 → codna-0.1.44}/codna/runtime/ports.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+import os
 import shutil
 import socket
 import subprocess
@@ -9,7 +10,24 @@ from typing import Iterable
 
 LOOPBACK_HOSTS = {"127.0.0.1", "localhost"}
 LSOF_FALLBACK_PATHS = (Path("/usr/sbin/lsof"), Path("/usr/bin/lsof"))
-PORT_INSPECTION_TIMEOUT_S = 2.0
+
+
+def _port_inspection_timeout_s() -> float:
+    """Timeout for the `lsof` port probe. The old 2s default was too tight on a busy machine (notably
+    macOS, where `lsof` can stall for seconds under load), causing spurious `port_inspection_timeout`
+    failures even when the sidecar was up and listening. Default to 10s; allow override for slow hosts."""
+    raw = os.environ.get("CODNA_PORT_INSPECTION_TIMEOUT_S")
+    if raw:
+        try:
+            value = float(raw)
+        except ValueError:
+            value = 0.0
+        if value > 0:
+            return value
+    return 10.0
+
+
+PORT_INSPECTION_TIMEOUT_S = _port_inspection_timeout_s()
 LOOPBACK_CONNECT_TIMEOUT_S = 0.25
 
 

{codna-0.1.42 → codna-0.1.44}/codna/webhook.py

@@ -35,6 +35,12 @@ SECURE_LABEL = "codna-secure"
 _FAILING_CONCLUSIONS = {"failure", "timed_out", "startup_failure", "action_required"}
 _WEBHOOK_SECRET_ENV = "CODNA_GITHUB_WEBHOOK_SECRET"
 _MAX_BODY_BYTES = 25 * 1024 * 1024  # GitHub caps webhook payloads at ~25 MB; reject anything larger
+_SENSITIVE_TEXT_RE = re.compile(
+    r"(gh[opsu]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]+|"
+    r"sk-[A-Za-z0-9_-]{20,}|pypi-[A-Za-z0-9_-]{20,}|"
+    r"-----BEGIN [A-Z ]+PRIVATE KEY-----.*?-----END [A-Z ]+PRIVATE KEY-----)",
+    re.DOTALL,
+)
 
 
 class WebhookError(RuntimeError):
@@ -300,6 +306,33 @@ def codna_command(job: WebhookJob, *, repo_url: str | None = None, sarif_path: s
     raise WebhookError("unknown_job_kind", f"unknown job kind {job.kind!r}")
 
 
+def _redact_debug_value(value: Any) -> Any:
+    if isinstance(value, str):
+        return _SENSITIVE_TEXT_RE.sub("<redacted>", value)[:500]
+    if isinstance(value, dict):
+        return {str(k): _redact_debug_value(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_redact_debug_value(v) for v in value[:20]]
+    return value
+
+
+def _queue_debug_payload(server: Any) -> dict[str, Any]:
+    queue = getattr(server, "queue", None)
+    pool = getattr(server, "worker_pool", None)
+    payload: dict[str, Any] = {
+        "service": "codna-webhook",
+        "queue": {"configured": queue is not None},
+        "worker_pool": pool.diagnostics() if pool is not None else {"configured": False},
+    }
+    if queue is not None:
+        payload["queue"] = {
+            "configured": True,
+            "counts": queue.counts(),
+            "recent": _redact_debug_value(queue.recent(limit=10)),
+        }
+    return payload
+
+
 def default_queue_path() -> str:
     """Where the durable job queue lives (override with CODNA_WEBHOOK_QUEUE, e.g. a Fly volume)."""
     override = os.environ.get("CODNA_WEBHOOK_QUEUE")
@@ -330,10 +363,38 @@ class _Handler(BaseHTTPRequestHandler):
 
     def do_GET(self) -> None:  # noqa: N802 (stdlib naming)
         # Liveness/readiness for load balancers + Fly health checks. Never leaks config.
-        if self.path.rstrip("/") in ("/health", "/healthz", "/ready", ""):
+        path = self.path.rstrip("/")
+        if path in ("/health", "/healthz", ""):
             configured = bool(os.environ.get(_WEBHOOK_SECRET_ENV))
             self._reply(200 if configured else 503, {"service": "codna-webhook", "ok": configured})
             return
+        if path == "/ready":
+            secret_ready = bool(os.environ.get(_WEBHOOK_SECRET_ENV))
+            if os.environ.get("GITHUB_TOKEN"):
+                app_ready = True
+            else:
+                from .webhook_github import app_auth_config_ready
+
+                app_ready = app_auth_config_ready(os.environ.get("GITHUB_APP_ID"), os.environ.get("GITHUB_APP_PRIVATE_KEY"))
+            pool = getattr(self.server, "worker_pool", None)
+            pool_diag = pool.diagnostics() if pool is not None else None
+            worker_ready = True if pool_diag is None else bool(pool_diag.get("ready"))
+            ready = secret_ready and app_ready and worker_ready
+            self._reply(200 if ready else 503, {
+                "service": "codna-webhook",
+                "ok": ready,
+                "checks": {"webhook_secret": secret_ready, "github_app_auth": app_ready,
+                           "worker_pool": worker_ready},
+            })
+            return
+        if path == "/debug/queue":
+            secret = os.environ.get(_WEBHOOK_SECRET_ENV, "")
+            token = self.headers.get("X-Codna-Debug-Token", "")
+            if not secret or not hmac.compare_digest(secret, token):
+                self._reply(401, {"error": "unauthorized"})
+                return
+            self._reply(200, _queue_debug_payload(self.server))
+            return
         self._reply(404, {"error": "not_found"})
 
     def do_POST(self) -> None:  # noqa: N802 (stdlib naming)
@@ -398,10 +459,9 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
 
     Requires ``CODNA_GITHUB_WEBHOOK_SECRET``. App auth is ``GITHUB_APP_ID`` /
     ``GITHUB_APP_PRIVATE_KEY`` (a plain ``GITHUB_TOKEN`` also works for single-repo
-    self-hosting). The fix agent needs a provider LLM key set under its own env var
-    (``ANTHROPIC_API_KEY`` / ``OPENAI_API_KEY`` / ``GEMINI_API_KEY`` / ...) and, for the
-    engine-behind path, ``CODNA_ENGINE_URL`` (or ``ALGENTA_ENGINE_URL``) + ``CODNA_API_KEY`` —
-    the worker forwards exactly those into each job's scrubbed env.
+    self-hosting). The worker runs the packaged Codna CLI in a scrubbed workspace and forwards
+    only the scoped GitHub token plus an optional per-installation ``CODNA_API_KEY`` when the
+    install is linked to a Codna account.
     """
     require_webhook_secret()
     import signal
@@ -420,6 +480,7 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
     pool.start()
     httpd = ThreadingHTTPServer((host, port), _Handler)
     httpd.queue = queue  # type: ignore[attr-defined]
+    httpd.worker_pool = pool  # type: ignore[attr-defined]
     print(f"codna webhook: listening on {host}:{port}/webhooks/github", file=sys.stderr)
 
     def _graceful(_sig: int, _frame: Any) -> None:

{codna-0.1.42 → codna-0.1.44}/codna/webhook_github.py

@@ -22,9 +22,9 @@ def token_permissions_for(kind: str) -> dict[str, str]:
     Both may post a Check Run for status.
     """
     if kind == "fix":
-        return {"contents": "write", "pull_requests": "write", "checks": "write"}
+        return {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
     if kind == "secure":
-        return {"contents": "read", "security_events": "read", "checks": "write"}
+        return {"contents": "read", "security_events": "read", "checks": "write", "issues": "write"}
     if kind == "review":
         # Read code, write PR review comments + a check. No contents:write — review never pushes.
         return {"contents": "read", "pull_requests": "write", "checks": "write"}
@@ -37,6 +37,18 @@ def scoped_token_request(repo_full_name: str, kind: str) -> dict[str, Any]:
     return {"repositories": [repo_name], "permissions": token_permissions_for(kind)}
 
 
+def normalize_private_key_pem(private_key_pem: str) -> str:
+    """Normalize PEM values from secret stores.
+
+    Some secret import paths preserve multiline PEMs, while dotenv-style import paths store
+    escaped ``\n`` sequences. GitHub App auth must accept both without weakening validation.
+    """
+    value = private_key_pem.strip().strip('"').strip("'")
+    if "\\n" in value and "\n" not in value:
+        value = value.replace("\\n", "\n")
+    return value.strip()
+
+
 def _app_jwt(app_id: str, private_key_pem: str, *, now: int) -> str:
     import base64
 
@@ -49,11 +61,22 @@ def _app_jwt(app_id: str, private_key_pem: str, *, now: int) -> str:
     header = _b64url(json.dumps({"alg": "RS256", "typ": "JWT"}).encode())
     claims = _b64url(json.dumps({"iat": now - 60, "exp": now + 540, "iss": str(app_id)}).encode())
     signing_input = f"{header}.{claims}".encode()
-    key = serialization.load_pem_private_key(private_key_pem.encode(), password=None)
+    key = serialization.load_pem_private_key(normalize_private_key_pem(private_key_pem).encode(), password=None)
     signature = key.sign(signing_input, padding.PKCS1v15(), hashes.SHA256())
     return f"{header}.{claims}.{_b64url(signature)}"
 
 
+def app_auth_config_ready(app_id: str | None, private_key_pem: str | None) -> bool:
+    """Return True only when App auth config is present and can sign a JWT locally."""
+    if not (app_id and private_key_pem):
+        return False
+    try:
+        _app_jwt(app_id, private_key_pem, now=1_700_000_000)
+    except Exception:  # noqa: BLE001 - readiness reports false, not secret-bearing details
+        return False
+    return True
+
+
 def installation_token(
     app_id: str,
     private_key_pem: str,
@@ -100,11 +123,11 @@ def check_run_payload(name: str, head_sha: str, *, status: str, conclusion: str
 
 
 def create_check_run(repo_full_name: str, token: str, *, name: str, head_sha: str, summary: str) -> int | None:
-    """Create an in_progress Check Run so status shows in the PR UI. Returns its id (or None)."""
+    """Create an in_progress Check Run so status shows in the PR UI. Returns its id."""
     try:
         import httpx
-    except Exception:  # noqa: BLE001
-        return None
+    except Exception as exc:  # noqa: BLE001
+        raise WebhookError("check_run_unavailable", f"Check Run creation needs httpx: {exc}") from exc
     resp = httpx.post(
         f"{_API}/repos/{repo_full_name}/check-runs",
         headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
@@ -112,22 +135,27 @@ def create_check_run(repo_full_name: str, token: str, *, name: str, head_sha: st
         timeout=30.0, follow_redirects=True,
     )
     if resp.status_code >= 300:
-        return None
-    return resp.json().get("id")
+        raise WebhookError("check_run_create_failed", f"create check run: {resp.status_code} {resp.text[:200]}")
+    check_run_id = resp.json().get("id")
+    if not check_run_id:
+        raise WebhookError("check_run_create_failed", "create check run: GitHub returned no check_run id")
+    return check_run_id
 
 
 def update_check_run(repo_full_name: str, token: str, check_run_id: int, *, conclusion: str, summary: str,
                      name: str = "codna") -> None:
     try:
         import httpx
-    except Exception:  # noqa: BLE001
-        return
-    httpx.patch(
+    except Exception as exc:  # noqa: BLE001
+        raise WebhookError("check_run_unavailable", f"Check Run update needs httpx: {exc}") from exc
+    resp = httpx.patch(
         f"{_API}/repos/{repo_full_name}/check-runs/{check_run_id}",
         headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
         json=check_run_payload(name, "", status="completed", conclusion=conclusion, summary=summary),
         timeout=30.0, follow_redirects=True,
     )
+    if resp.status_code >= 300:
+        raise WebhookError("check_run_update_failed", f"update check run: {resp.status_code} {resp.text[:200]}")
 
 
 def find_open_pr_by_marker(repo_full_name: str, token: str, marker: str, *, max_pages: int = 3,
@@ -211,6 +239,24 @@ def post_review_comment_reply(repo_full_name: str, token: str, pr_number: int,
     return data.get("html_url") if isinstance(data, dict) else None
 
 
+def post_issue_comment(repo_full_name: str, token: str, issue_number: int, body: str) -> str | None:
+    """Post a normal issue/PR conversation comment. Returns html_url, or None on API failure."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    resp = httpx.post(
+        f"{_API}/repos/{repo_full_name}/issues/{issue_number}/comments",
+        headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+        json={"body": body},
+        timeout=30.0, follow_redirects=True,
+    )
+    if resp.status_code >= 300:
+        return None
+    data = resp.json()
+    return data.get("html_url") if isinstance(data, dict) else None
+
+
 def fetch_code_scanning_sarif(repo_full_name: str, token: str, *, dest_dir: str) -> str:
     """Download the latest code-scanning analysis SARIF to dest_dir; returns the path."""
     try:

{codna-0.1.42 → codna-0.1.44}/codna/webhook_metering.py

@@ -1,13 +1,11 @@
 """Per-installation metering for Codna's GitHub App webhook.
 
-Codna's webhook is keyless and runs engine-behind: the ENGINE meters every cloud fix per
-ORG — the monthly managed-model allowance (the changeable "$5/mo"), Stripe plan tier,
-BYOK-beyond (the org's own provider key), and device seats are all enforced server-side,
-keyed on the org's engine API key. `installation_id -> org` is already bound in the engine
-(the verified GitHub App install), so a fix run with the RIGHT org's engine key is metered
-to the right account automatically.
+Codna's webhook is keyless: it runs the packaged Codna CLI with the encapsulated local
+runtime and injects only the linked org's Codna run credential. The monthly managed-model
+allowance (the changeable "$5/mo"), Stripe plan tier, BYOK-beyond (the org's own provider
+key), and device seats are enforced by the Codna account plane for that org.
 
-This module resolves that per-installation engine credential and carries the (changeable)
+This module resolves that per-installation Codna credential and carries the (changeable)
 included-allowance config. It FAILS CLOSED: with no credential for an installation, the
 webhook must NOT run a fix on a shared house key — it prompts the user to link/authorize.
 """
@@ -37,14 +35,13 @@ def account_link_url() -> str:
 
 
 def resolve_engine_key(installation_id: int | None) -> str | None:
-    """Return the org engine API key for a GitHub installation, or None (fail closed).
+    """Return the org Codna run credential for a GitHub installation, or None (fail closed).
 
     Provisioning seam (the one piece populated OUTSIDE codna): the mapping
-    ``installation_id -> org engine key`` is written when a user links their GitHub install
+    ``installation_id -> org Codna run credential`` is written when a user links their GitHub install
     to their Codna account at :data:`ACCOUNT_LINK_URL`. The webhook reads it from either a
     JSON file on its volume (``CODNA_WEBHOOK_INSTALL_KEYS_PATH``) or inline JSON
-    (``CODNA_WEBHOOK_INSTALL_KEYS``). Swap this body for a live engine call once the engine
-    exposes an installation->org run-credential exchange; callers don't change.
+    (``CODNA_WEBHOOK_INSTALL_KEYS``).
     """
     if not installation_id:
         return None

{codna-0.1.42 → codna-0.1.44}/codna/webhook_queue.py

@@ -19,7 +19,7 @@ from contextlib import contextmanager
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import Iterator, Mapping
+from typing import Any, Iterator, Mapping
 
 from .webhook import WebhookJob
 
@@ -187,3 +187,40 @@ class WebhookQueue:
         with self._conn() as conn:
             rows = conn.execute("SELECT status, COUNT(*) c FROM jobs GROUP BY status").fetchall()
         return {r["status"]: r["c"] for r in rows}
+
+    def recent(self, *, limit: int = 10) -> list[dict[str, Any]]:
+        """Return newest queue rows for authenticated operator diagnostics only."""
+        safe_limit = max(1, min(int(limit), 50))
+        with self._conn() as conn:
+            rows = conn.execute(
+                "SELECT id, delivery_id, kind, repo, ref, installation_id, reason, status, attempts, "
+                "created_at, claimed_at, finished_at, result FROM jobs ORDER BY id DESC LIMIT ?",
+                (safe_limit,),
+            ).fetchall()
+        out: list[dict[str, Any]] = []
+        for row in rows:
+            result: dict[str, Any] = {}
+            if row["result"]:
+                try:
+                    loaded = json.loads(row["result"])
+                    result = loaded if isinstance(loaded, dict) else {"value": str(loaded)}
+                except ValueError:
+                    result = {"value": str(row["result"])}
+            out.append(
+                {
+                    "id": row["id"],
+                    "delivery_id": row["delivery_id"],
+                    "kind": row["kind"],
+                    "repo": row["repo"],
+                    "ref": row["ref"],
+                    "installation_id": row["installation_id"],
+                    "reason": row["reason"],
+                    "status": row["status"],
+                    "attempts": row["attempts"],
+                    "created_at": row["created_at"],
+                    "claimed_at": row["claimed_at"],
+                    "finished_at": row["finished_at"],
+                    "result": result,
+                }
+            )
+        return out

{codna-0.1.42 → codna-0.1.44}/codna/webhook_worker.py

@@ -1,16 +1,17 @@
-"""Worker pool for Codna's GitHub App webhook — decoupled from the ingress.
+"""Worker pool for Codna's GitHub App webhook - decoupled from the ingress.
 
 Codna is local; the App is the only hosted surface — so workers are in-process threads in
-that single app (not a machine fleet). The webhook is KEYLESS and runs engine-behind: the
-ENGINE meters every cloud fix per ORG (managed-model allowance / Stripe plan / BYOK / device
-seats). Each job:
+that single app (not a machine fleet). The webhook is KEYLESS: it runs the packaged Codna CLI
+with the encapsulated local runtime and a per-installation Codna account credential when the
+install is linked. Each job:
 
-  1. resolves the org's engine credential for the job's installation (webhook_metering);
-     with NONE it FAILS CLOSED — posts a "link your account" Check Run and does NOT spend;
+  1. resolves the org's Codna run credential for the job's installation (webhook_metering);
+     with NONE it FAILS CLOSED — posts a "link your account" Check Run when the event has a
+     commit SHA, or an issue comment when the trigger is issue-label based, and does NOT spend;
   2. mints a short-lived, repo-scoped GitHub installation token (for the branch/PR/SARIF,
      NOT for metering);
-  3. opens a Check Run, runs the ``codna`` CLI engine-behind in a FRESH scrubbed temp
-     workspace (only the scoped GitHub token + the per-org engine key are injected — no raw
+  3. opens a Check Run, runs the ``codna`` CLI in a FRESH scrubbed temp workspace
+     (only the scoped GitHub token + the per-org Codna key are injected — no raw
      provider key, and the host's other secrets never leak);
   4. reports on the Check Run and marks the queue row done/failed.
 
@@ -24,12 +25,13 @@ import subprocess
 import tempfile
 import threading
 import time
+import sys
+import json
 from dataclasses import dataclass
 from typing import Any, Callable
 
 from . import webhook_github, webhook_metering
 from .agent_core_runtime import PROVIDER_RUNTIME_ENV_KEYS
-from .runtime.config import ENGINE_URL_KEYS
 from .webhook import WebhookError, WebhookJob, codna_command, webhook_marker
 from .webhook_queue import _MAX_ATTEMPTS, QueuedJob, WebhookQueue
 
@@ -50,13 +52,12 @@ _SAFE_CONFIG = frozenset({
     "CODNA_FIX_SLA_S", "CODNA_FIX_CEILING", "CODNA_TIMEOUT_S",
 })
 # ALLOWLIST (not denylist): the job runs untrusted repo code, so it inherits ONLY safe config
-# + the engine URL + Telys pointers/tuning. It does NOT inherit any raw LLM provider key or an
-# ambient engine API key — the per-ORG engine credential is INJECTED explicitly per job, so
-# each fix meters to the right account and no house/other-org secret can leak.
+# + Telys pointers/tuning. It does NOT inherit engine URL overrides, raw LLM provider keys, or
+# an ambient API key. The per-ORG Codna credential is INJECTED explicitly per job, so each fix
+# meters to the right account and no house/other-org secret can leak.
 _ENV_ALLOWLIST = (
     _SAFE_CONFIG
     | (set(PROVIDER_RUNTIME_ENV_KEYS) - _PROVIDER_API_KEYS)  # Telys pointers/tuning, NOT provider keys
-    | set(ENGINE_URL_KEYS)                                   # CODNA_ENGINE_URL / ALGENTA_ENGINE_URL (non-secret)
 )
 
 
@@ -113,18 +114,18 @@ def _comment_fix_result_msg(job: WebhookJob, token: str, result: "JobResult", gi
 
 
 def _job_env(token: str | None, engine_key: str | None) -> dict[str, str]:
-    """Minimal allowlisted env + ONLY the scoped GitHub token and the per-org engine key."""
+    """Minimal allowlisted env + ONLY the scoped GitHub token and per-org Codna key."""
     env = {k: v for k, v in os.environ.items() if k in _ENV_ALLOWLIST}
     if token:
         env["GITHUB_TOKEN"] = token
     if engine_key:
-        env["CODNA_API_KEY"] = engine_key  # per-installation org credential → engine meters THIS org
+        env["CODNA_API_KEY"] = engine_key  # per-installation org credential meters THIS org
     return env
 
 
 def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                   codna_bin: str = "codna") -> JobResult:
-    """Default runner: run codna engine-behind for the job in an isolated, scrubbed workspace."""
+    """Default runner: run packaged codna for the job in an isolated, scrubbed workspace."""
     with tempfile.TemporaryDirectory(prefix="codna-webhook-job-") as tmp:
         if job.kind == "secure":
             if not token:
@@ -177,6 +178,19 @@ def process_job(
             if cid:
                 github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
                                         summary=webhook_metering.unlinked_summary(), name=f"codna {job.kind}")
+        if token and job.issue_number and not job.ref:
+            issue_comment_url = github.post_issue_comment(
+                job.repo_full_name,
+                token,
+                job.issue_number,
+                "⚠️ Codna can't run this request yet — this org isn't linked to a metered Codna "
+                "account. " + webhook_metering.unlinked_summary(),
+            )
+            if not issue_comment_url:
+                return JobResult(
+                    False,
+                    "not linked to a metered Codna account, but failed to post the link prompt issue comment",
+                )
         # A comment trigger must never go silent: tell the user in-thread why nothing happened.
         if reply_to and token:
             github.post_review_comment_reply(job.repo_full_name, token, job.pr_number, reply_to,
@@ -231,6 +245,29 @@ def process_job(
     return result
 
 
+def _job_log_context(qjob: QueuedJob) -> dict[str, object]:
+    job = qjob.job
+    return {
+        "service": "codna-webhook-worker",
+        "event": "job_failed",
+        "row_id": qjob.row_id,
+        "delivery_id": qjob.delivery_id,
+        "attempt": qjob.attempts,
+        "kind": job.kind,
+        "repo": job.repo_full_name,
+        "ref": job.ref,
+        "installation_id": job.installation_id,
+        "reason": job.reason,
+    }
+
+
+def _log_worker_failure(qjob: QueuedJob, *, code: str, message: str) -> None:
+    payload = _job_log_context(qjob)
+    payload["code"] = code
+    payload["message"] = message[:500]
+    print(json.dumps(payload, sort_keys=True), file=sys.stderr, flush=True)
+
+
 class WorkerPool:
     def __init__(self, queue: WebhookQueue, *, concurrency: int = 2, poll_interval: float = 1.0,
                  app_id: str | None = None, private_key: str | None = None,
@@ -258,11 +295,15 @@ class WorkerPool:
                 continue
             try:
                 result = self._process(qjob)
+                if not result.ok:
+                    _log_worker_failure(qjob, code="job_failed", message=result.summary)
                 self._queue.complete(qjob.row_id, status="done" if result.ok else "failed",
                                      result={"summary": result.summary, "attempt": qjob.attempts})
             except WebhookError as exc:
+                _log_worker_failure(qjob, code=exc.code, message=str(exc))
                 self._queue.complete(qjob.row_id, status="failed", result={"error": exc.code, "message": str(exc)})
             except Exception as exc:  # noqa: BLE001 — a worker must never die on one bad job
+                _log_worker_failure(qjob, code="job_crashed", message=str(exc))
                 self._queue.complete(qjob.row_id, status="failed", result={"error": "job_crashed", "message": str(exc)[:500]})
 
     def start(self) -> None:
@@ -272,6 +313,15 @@ class WorkerPool:
             t.start()
             self._threads.append(t)
 
+    def diagnostics(self) -> dict[str, int | bool]:
+        alive = sum(1 for thread in self._threads if thread.is_alive())
+        return {
+            "configured_threads": self._concurrency,
+            "started_threads": len(self._threads),
+            "alive_threads": alive,
+            "ready": alive >= self._concurrency,
+        }
+
     def stop(self, timeout: float | None = None) -> None:
         """Signal stop and DRAIN: wait (up to the drain grace) for the in-flight job to complete
         and mark itself done, so a routine redeploy doesn't abandon + re-run it (duplicate PRs).

{codna-0.1.42 → codna-0.1.44}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.42
+Version: 0.1.44
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.42 → codna-0.1.44}/codna.egg-info/SOURCES.txt

@@ -88,6 +88,7 @@ codna/runtime/processes.py
 memengine/__init__.py
 memengine/_validate.py
 memengine/embedding.py
+memengine/lexical.py
 memengine/mojo_backend.py
 memengine/native_runtime.py
 memengine/partitioned.py