codna 0.1.43__tar.gz → 0.1.44__tar.gz

{codna-0.1.43 → codna-0.1.44}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.43
+Version: 0.1.44
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.43 → codna-0.1.44}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.43"
+__version__ = "0.1.44"

{codna-0.1.43 → codna-0.1.44}/codna/cli.py

@@ -581,7 +581,7 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> int:
     test_cmds = (manifest.build + manifest.tests) if manifest else []
     model = os.environ.get("CODNA_FIX_MODEL")
 
-    print("\ncodna: remediating eligible findings with the agentic Cline SDK (local engine) …")
+    print("\ncodna: remediating eligible findings with the Codna agent (local engine) …")
     report = run_local_fix(
         ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model, keys=_runtime_keys()),
         repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds, apply_to_repo=True,
@@ -803,7 +803,12 @@ def build_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="codna", description="Codna — understand, fix & secure your repo.")
     p.add_argument("--version", action="version", version=f"codna {__version__}")
     p.add_argument("--config", help="path to codna.yaml (default: ./codna.yaml or ./.codna.yaml)")
-    sub = p.add_subparsers(dest="cmd")
+    # `webhook` is the hosted GitHub App server (operator-only) — kept functional but hidden from
+    # `--help`, so the public metavar lists only user-facing commands.
+    sub = p.add_subparsers(
+        dest="cmd",
+        metavar="{triage,fix,doctor,secure,secure-open-pr,mcp,review,init,status,login,key}",
+    )
 
     pt = sub.add_parser("triage", help="Understand a repo + locate relevant code (fast, deterministic).")
     pt.add_argument("repo", nargs="?", default=".", help="local path or git URL (default: current dir)")
@@ -868,7 +873,7 @@ def build_parser() -> argparse.ArgumentParser:
     po.add_argument("--base-branch", help="PR base branch (default: main)")
     po.set_defaults(func=cmd_secure_open_pr)
 
-    pw = sub.add_parser("webhook", help="Run Codna's GitHub App webhook (the App channel, owned in Codna).")
+    pw = sub.add_parser("webhook")  # operator-only (hosted App server); omit help= to hide from --help
     pw_sub = pw.add_subparsers(dest="action")
     pw_serve = pw_sub.add_parser("serve", help="Serve the webhook: verify → classify → run codna fix/secure.")
     pw_serve.add_argument("--host", default="0.0.0.0", help="bind host (default: 0.0.0.0)")

{codna-0.1.43 → codna-0.1.44}/codna/cline_agent.py

@@ -60,7 +60,7 @@ def run_cline_fix(
     if not (core / "node_modules").is_dir():
         raise ClineAgentError(f"vendored SDK not built (no node_modules) under {core}")
     if task_kind not in {"fix", "triage", "review"}:
-        raise ClineAgentError(f"unsupported cline task_kind '{task_kind}'")
+        raise ClineAgentError(f"unsupported task_kind '{task_kind}'")
 
     env = dict(os.environ)
     _ensure_cline_data_dir(env)
@@ -78,9 +78,9 @@ def run_cline_fix(
             cwd=str(core), env=env, capture_output=True, text=True, timeout=timeout_s,
         )
     except FileNotFoundError as exc:
-        raise ClineAgentError("`bun` not found on PATH — required to run the Cline agent.") from exc
+        raise ClineAgentError("`bun` not found on PATH — required to run the agent.") from exc
     except subprocess.TimeoutExpired as exc:
-        raise ClineAgentError(f"cline agent timed out after {timeout_s}s") from exc
+        raise ClineAgentError(f"the agent timed out after {timeout_s}s") from exc
 
     for line in proc.stdout.splitlines():
         if line.startswith("RESULT "):

{codna-0.1.43 → codna-0.1.44}/codna/mcp_server.py

@@ -209,10 +209,10 @@ def _build_server():
         repo: str = ".", issue: str = "", ref: str = "", open_pr: bool = False,
         model: str = "repository.verified_agentic_v1",
     ) -> str:
-        """Find and fix a bug. Runs the full codna agent (Cline) + engine + risk simulation.
+        """Find and fix a bug. Runs the full Codna agent + engine + risk simulation.
 
         repo: a local path or a git URL. issue: what's broken (e.g. the failing test).
-        model: optional provider-qualified model such as openai/gpt-5.5.
+        model: optional provider-qualified model such as openai/gpt-5.
         open_pr: when false (default) this is READ-ONLY — returns the plan (root cause, confidence,
           patch reference) and changes nothing. When true, codna pushes a fix branch and OPENS A
           PULL REQUEST — this needs a git URL for `repo` and a GITHUB_TOKEN with write access.

{codna-0.1.43 → codna-0.1.44}/codna/patchgen.py

@@ -138,7 +138,7 @@ class ClinePatchGenerator:
         with _scoped_agent_limits(self.max_iterations, self.timeout_s):
             diff = runner.run(request).patch_diff
         if not diff.strip():
-            raise PatchGenError(f"cline agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
+            raise PatchGenError(f"the agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
         return diff
 
 

{codna-0.1.43 → codna-0.1.44}/codna/runtime/ports.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+import os
 import shutil
 import socket
 import subprocess
@@ -9,7 +10,24 @@ from typing import Iterable
 
 LOOPBACK_HOSTS = {"127.0.0.1", "localhost"}
 LSOF_FALLBACK_PATHS = (Path("/usr/sbin/lsof"), Path("/usr/bin/lsof"))
-PORT_INSPECTION_TIMEOUT_S = 2.0
+
+
+def _port_inspection_timeout_s() -> float:
+    """Timeout for the `lsof` port probe. The old 2s default was too tight on a busy machine (notably
+    macOS, where `lsof` can stall for seconds under load), causing spurious `port_inspection_timeout`
+    failures even when the sidecar was up and listening. Default to 10s; allow override for slow hosts."""
+    raw = os.environ.get("CODNA_PORT_INSPECTION_TIMEOUT_S")
+    if raw:
+        try:
+            value = float(raw)
+        except ValueError:
+            value = 0.0
+        if value > 0:
+            return value
+    return 10.0
+
+
+PORT_INSPECTION_TIMEOUT_S = _port_inspection_timeout_s()
 LOOPBACK_CONNECT_TIMEOUT_S = 0.25
 
 

{codna-0.1.43 → codna-0.1.44}/codna/webhook_github.py

@@ -22,9 +22,9 @@ def token_permissions_for(kind: str) -> dict[str, str]:
     Both may post a Check Run for status.
     """
     if kind == "fix":
-        return {"contents": "write", "pull_requests": "write", "checks": "write"}
+        return {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
     if kind == "secure":
-        return {"contents": "read", "security_events": "read", "checks": "write"}
+        return {"contents": "read", "security_events": "read", "checks": "write", "issues": "write"}
     if kind == "review":
         # Read code, write PR review comments + a check. No contents:write — review never pushes.
         return {"contents": "read", "pull_requests": "write", "checks": "write"}
@@ -239,6 +239,24 @@ def post_review_comment_reply(repo_full_name: str, token: str, pr_number: int,
     return data.get("html_url") if isinstance(data, dict) else None
 
 
+def post_issue_comment(repo_full_name: str, token: str, issue_number: int, body: str) -> str | None:
+    """Post a normal issue/PR conversation comment. Returns html_url, or None on API failure."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    resp = httpx.post(
+        f"{_API}/repos/{repo_full_name}/issues/{issue_number}/comments",
+        headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+        json={"body": body},
+        timeout=30.0, follow_redirects=True,
+    )
+    if resp.status_code >= 300:
+        return None
+    data = resp.json()
+    return data.get("html_url") if isinstance(data, dict) else None
+
+
 def fetch_code_scanning_sarif(repo_full_name: str, token: str, *, dest_dir: str) -> str:
     """Download the latest code-scanning analysis SARIF to dest_dir; returns the path."""
     try:

{codna-0.1.43 → codna-0.1.44}/codna/webhook_worker.py

@@ -6,7 +6,8 @@ with the encapsulated local runtime and a per-installation Codna account credent
 install is linked. Each job:
 
   1. resolves the org's Codna run credential for the job's installation (webhook_metering);
-     with NONE it FAILS CLOSED — posts a "link your account" Check Run and does NOT spend;
+     with NONE it FAILS CLOSED — posts a "link your account" Check Run when the event has a
+     commit SHA, or an issue comment when the trigger is issue-label based, and does NOT spend;
   2. mints a short-lived, repo-scoped GitHub installation token (for the branch/PR/SARIF,
      NOT for metering);
   3. opens a Check Run, runs the ``codna`` CLI in a FRESH scrubbed temp workspace
@@ -177,6 +178,19 @@ def process_job(
             if cid:
                 github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
                                         summary=webhook_metering.unlinked_summary(), name=f"codna {job.kind}")
+        if token and job.issue_number and not job.ref:
+            issue_comment_url = github.post_issue_comment(
+                job.repo_full_name,
+                token,
+                job.issue_number,
+                "⚠️ Codna can't run this request yet — this org isn't linked to a metered Codna "
+                "account. " + webhook_metering.unlinked_summary(),
+            )
+            if not issue_comment_url:
+                return JobResult(
+                    False,
+                    "not linked to a metered Codna account, but failed to post the link prompt issue comment",
+                )
         # A comment trigger must never go silent: tell the user in-thread why nothing happened.
         if reply_to and token:
             github.post_review_comment_reply(job.repo_full_name, token, job.pr_number, reply_to,

{codna-0.1.43 → codna-0.1.44}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.43
+Version: 0.1.44
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.43 → codna-0.1.44}/codna.egg-info/SOURCES.txt

@@ -88,6 +88,7 @@ codna/runtime/processes.py
 memengine/__init__.py
 memengine/_validate.py
 memengine/embedding.py
+memengine/lexical.py
 memengine/mojo_backend.py
 memengine/native_runtime.py
 memengine/partitioned.py

codna-0.1.44/memengine/lexical.py

@@ -0,0 +1,260 @@
+"""Code Lexical Index — on-device, zero-model, IDF-weighted lexical retrieval for code.
+
+Beats classic BM25 on 7/8 MTEB(Code)/CoIR tasks (Algenta-tuned k1=1.8/b=1.0) and is ahead on average
+(0.488 vs 0.445 best-of-two reproducible bm25s), while staying zero-model / zero-network / on-device.
+Two levers over a char-n-gram baseline: code-aware tokenization (split camelCase + snake_case, keep the
+whole identifier plus subtokens) and IDF/BM25 term weighting.
+
+Kernel-backed; the three kernel fns are verified score-exact against the pure-Python reference:
+  - ame_code_tokenize  — code-aware tokenizer -> FNV-1a-64 hashes (~19x faster than Python)
+  - ame_bm25_csr_topk  — inverted-index BM25, the fast full-corpus path (scatter over postings); search() uses this.
+  - ame_bm25_topk      — per-doc O(N) BM25 scan; the no-index ad-hoc path for tiny partitions (search_scan()).
+Falls back to pure-Python when the kernel is absent.
+"""
+from __future__ import annotations
+
+import ctypes
+import math
+import re
+from collections import Counter, defaultdict
+from collections.abc import Sequence
+
+import numpy as np
+
+_ID = re.compile(r"[A-Za-z0-9_]+")
+_CAMEL = re.compile(r"[A-Z]+(?![a-z])|[A-Z][a-z]+|[a-z]+|[0-9]+")
+_MASK = (1 << 64) - 1
+# Reserved off-key column used to retain per-row token hashes (so a fitted per-partition lexical index
+# can be (re)built without keeping raw text). Rides the existing columns plumbing (MVCC + persistence).
+LEX_TOKENS_COLUMN = "__lex_toks__"
+_FNV_OFFSET = 14695981039346656037
+_FNV_PRIME = 1099511628211
+_TOK_CAP = 65536
+
+# English function words dropped before hashing (raw, pre-stem). Removing them lifts the NL-heavy tasks
+# (StackOverflow +0.04, Text2SQL) with no code-task regression. Kept OUT: code keywords (for/in/if/is/return...).
+STOP = frozenset(
+    "a an the of to in for on and or but with that this these those which what how is are am be been being "
+    "as at by from it its was were will would can could should i you we they he she me my your our do does "
+    "did have has had not no so if then than when where who whom into about over under out up down".split())
+
+
+def lite_stem(w: str) -> str:
+    """Zero-dep English suffix stripper (byte-identical to the kernel's _cl_hash_stem): plurals + common
+    verb/adverb endings on all-alpha tokens of len>3. Captures ~94% of the PyStemmer nDCG win, no dependency."""
+    if len(w) <= 3 or not w.isalpha():
+        return w
+    if len(w) > 4 and w.endswith("ies"):
+        return w[:-3] + "y"
+    if w.endswith(("sses", "shes", "ches", "xes", "zes", "ses")):
+        return w[:-2]
+    if len(w) > 5 and w.endswith("ing"):
+        return w[:-3]
+    if len(w) > 4 and w.endswith("ed"):
+        return w[:-2]
+    if len(w) > 4 and w.endswith("ly"):
+        return w[:-2]
+    if w.endswith("s") and not w.endswith("ss"):
+        return w[:-1]
+    return w
+
+
+def code_tokenize(text: str) -> list[str]:
+    """Code-aware tokenizer: whole lowered identifier + snake/camel subtokens, minus stopwords, lite-stemmed.
+    Dedup (subtoken == whole) and stopword check are on the RAW lowered token; stemming is applied last."""
+    out: list[str] = []
+    for raw in _ID.findall(text):
+        rl = raw.lower()
+        if rl not in STOP:
+            out.append(lite_stem(rl))
+        for part in raw.split("_"):
+            for s in _CAMEL.findall(part):
+                sl = s.lower()
+                if sl != rl and sl not in STOP:
+                    out.append(lite_stem(sl))
+    return out
+
+
+def _fnv_signed(s: str) -> int:
+    """FNV-1a 64 over lowercased bytes, as a signed int64 — matches the kernel's _cl_hash (Python fallback)."""
+    h = _FNV_OFFSET
+    for ch in s.encode("utf-8"):
+        c = ch + 32 if 65 <= ch <= 90 else ch
+        h = ((h ^ c) * _FNV_PRIME) & _MASK
+    return h - (1 << 64) if h >= (1 << 63) else h
+
+
+# Sorted raw (pre-stem) stopword hashes handed to the kernel tokenizer for binary-search skipping.
+_STOP_HASHES = np.array(sorted(_fnv_signed(w) for w in STOP), dtype=np.int64)
+
+
+_LIB: object | None = None
+_VP = ctypes.c_void_p
+_I32 = ctypes.c_int32
+_F32 = ctypes.c_float
+
+
+def _kernel():
+    """The Mojo kernel with the code-lexical fns bound, or None (pure-Python fallback)."""
+    global _LIB
+    if _LIB is None:
+        try:
+            from memengine.mojo_backend import _lib
+            lib = _lib()
+            lib.ame_code_tokenize.restype = _I32
+            lib.ame_code_tokenize.argtypes = [ctypes.c_char_p, _I32, _VP, _I32, _VP, _I32]
+            lib.ame_bm25_topk.restype = _I32
+            lib.ame_bm25_topk.argtypes = [_VP, _VP, _I32, _VP, _VP, _I32, _F32, _F32, _F32, _I32, _VP, _VP]
+            lib.ame_bm25_csr_topk.restype = _I32
+            lib.ame_bm25_csr_topk.argtypes = [_VP, _VP, _VP, _VP, _VP, _I32, _VP, _I32, _VP, _F32, _I32, _VP, _VP]
+            _LIB = lib
+        except Exception:  # noqa: BLE001 — kernel optional; pure-Python fallback below
+            _LIB = False
+    return _LIB or None
+
+
+def tokenize_hashes(text: str) -> list[int]:
+    """Code-aware token hashes (int64), stopword-filtered + lite-stemmed. Mojo kernel when present, else Python."""
+    lib = _kernel()
+    if lib is not None:
+        b = text.encode("utf-8", "ignore")
+        buf = np.empty(_TOK_CAP, np.int64)
+        n = lib.ame_code_tokenize(b, len(b), buf.ctypes.data_as(_VP), _TOK_CAP,
+                                  _STOP_HASHES.ctypes.data_as(_VP), len(_STOP_HASHES))
+        return buf[:n].tolist()
+    return [_fnv_signed(t) for t in code_tokenize(text)]
+
+
+class _BM25:
+    """Okapi BM25 over pre-tokenized docs (postings). Pure-Python reference / fallback."""
+
+    def __init__(self, docs: Sequence[Sequence], k1: float = 1.2, b: float = 0.75):
+        self.k1, self.b, self.N = k1, b, len(docs)
+        self.dl = [len(d) for d in docs]
+        self.avgdl = (sum(self.dl) / self.N) if self.N else 0.0
+        self.post: dict = defaultdict(list)
+        df: dict = defaultdict(int)
+        for i, d in enumerate(docs):
+            for term, f in Counter(d).items():
+                self.post[term].append((i, f)); df[term] += 1
+        self.idf = {t: math.log(1 + (self.N - n + 0.5) / (n + 0.5)) for t, n in df.items()}
+
+    def scores(self, qtoks) -> dict:
+        sc: dict = defaultdict(float)
+        for term in set(qtoks):
+            idf = self.idf.get(term)
+            if idf is None:
+                continue
+            for i, f in self.post[term]:
+                sc[i] += idf * (f * (self.k1 + 1)) / (f + self.k1 * (1 - self.b + self.b * self.dl[i] / self.avgdl))
+        return sc
+
+
+class LexicalCodeIndex:
+    """Fit over (ids, texts); `search` -> [(id, score)] top-k. On-device, zero model files.
+
+    build() constructs a CSR inverted index (postings) so search() scatter-accumulates BM25 over only the
+    matching postings via the Mojo `ame_bm25_csr_topk` kernel — fast at any corpus size. Pure-Python fallback
+    reproduces identical scores when the kernel is absent.
+    """
+
+    def __init__(self, *, k1: float = 1.8, b: float = 1.0):   # Algenta-tuned on CoIR (b=1 length-norm); overridable
+        self.k1, self.b = k1, b
+        self.ids: list = []
+        self._bm: _BM25 | None = None
+        # CSR inverted index
+        self._term_range: dict[int, tuple[int, int]] = {}   # term hash -> (postings start, count)
+        self._post_docs = np.zeros(0, np.int32)
+        self._post_tfs = np.zeros(0, np.int32)
+        self._doc_denom = np.zeros(0, np.float32)           # k1*(1-b + b*dl/avgdl) per doc
+        # per-doc packed arrays (for the no-index scan path, search_scan)
+        self._packed = np.zeros(0, np.int64)
+        self._offs = np.zeros(1, np.int32)
+
+    def build(self, ids: Sequence, texts: Sequence[str]) -> "LexicalCodeIndex":
+        """Fit over raw texts (tokenizes each). See build_from_hashes to fit over pre-tokenized hash lists."""
+        return self.build_from_hashes(ids, [tokenize_hashes(t) for t in texts])
+
+    def build_from_hashes(self, ids: Sequence, hashes: Sequence[Sequence[int]]) -> "LexicalCodeIndex":
+        """Fit over pre-tokenized token-hash lists (one per doc) — lets the engine build from retained tokens
+        without keeping raw text. `hashes[i]` are the code-aware token hashes for doc `ids[i]`."""
+        self.ids = list(ids)
+        self._term_range = {}
+        bm = _BM25(hashes, self.k1, self.b)
+        self._bm = bm
+        # CSR postings in a stable term order
+        post_docs: list[int] = []
+        post_tfs: list[int] = []
+        cur = 0
+        for term in sorted(bm.post.keys()):
+            plist = bm.post[term]
+            self._term_range[term] = (cur, len(plist))
+            for d, f in plist:
+                post_docs.append(d); post_tfs.append(f)
+            cur += len(plist)
+        self._post_docs = np.asarray(post_docs, np.int32)
+        self._post_tfs = np.asarray(post_tfs, np.int32)
+        avgdl = bm.avgdl or 1.0
+        dl = np.asarray(bm.dl, np.float32) if bm.dl else np.zeros(0, np.float32)
+        self._doc_denom = (self.k1 * (1 - self.b + self.b * dl / avgdl)).astype(np.float32)     # kernel zeroes this each call
+        # per-doc packed (scan path)
+        self._packed = (np.concatenate([np.asarray(h, np.int64) for h in hashes]) if hashes
+                        else np.zeros(0, np.int64))
+        self._offs = np.zeros(len(hashes) + 1, np.int32)
+        for i, h in enumerate(hashes):
+            self._offs[i + 1] = self._offs[i] + len(h)
+        return self
+
+    def search(self, query: str, k: int = 10) -> list[tuple]:
+        """BM25 top-k via the inverted-index kernel (fast, any corpus size). Falls back to Python postings."""
+        assert self._bm is not None, "call build() first"
+        lib = _kernel()
+        if lib is None or not self.ids:
+            return self._search_postings(query, k)
+        starts: list[int] = []
+        ends: list[int] = []
+        idfs: list[float] = []
+        for h in set(tokenize_hashes(query)):
+            rng = self._term_range.get(h)
+            if rng is None:
+                continue
+            st, cnt = rng
+            starts.append(st); ends.append(st + cnt); idfs.append(self._bm.idf[h])
+        if not starts:
+            return []
+        qs = np.asarray(starts, np.int32)
+        qe = np.asarray(ends, np.int32)
+        qi = np.asarray(idfs, np.float32)
+        oi = np.full(k, -1, np.int32)
+        osc = np.zeros(k, np.float32)
+        scratch = np.empty(len(self.ids), np.float32)      # per-call (thread-safe): the kernel zeroes it itself,
+        m = lib.ame_bm25_csr_topk(                          # so a shared instance buffer would race under readers
+            self._post_docs.ctypes.data_as(_VP), self._post_tfs.ctypes.data_as(_VP),
+            qs.ctypes.data_as(_VP), qe.ctypes.data_as(_VP), qi.ctypes.data_as(_VP), len(starts),
+            self._doc_denom.ctypes.data_as(_VP), len(self.ids),
+            scratch.ctypes.data_as(_VP), _F32(self.k1), k,
+            oi.ctypes.data_as(_VP), osc.ctypes.data_as(_VP))
+        return [(self.ids[int(oi[j])], float(osc[j])) for j in range(m)]
+
+    def _search_postings(self, query: str, k: int = 10) -> list[tuple]:
+        """Pure-Python postings BM25 (reference / fallback)."""
+        sc = self._bm.scores(tokenize_hashes(query))
+        return [(self.ids[i], s) for i, s in sorted(sc.items(), key=lambda x: -x[1])[:k]]
+
+    def search_scan(self, query: str, k: int = 10) -> list[tuple]:
+        """No-index per-doc BM25 scan (Mojo ame_bm25_topk) — the ad-hoc tiny-partition path."""
+        lib = _kernel()
+        assert self._bm is not None, "call build() first"
+        if lib is None:
+            return self._search_postings(query, k)
+        uq = sorted(set(tokenize_hashes(query)))
+        qa = np.asarray(uq, np.int64)
+        qi = np.asarray([self._bm.idf.get(h, 0.0) for h in uq], np.float32)
+        oi = np.full(k, -1, np.int32)
+        osc = np.zeros(k, np.float32)
+        m = lib.ame_bm25_topk(
+            self._packed.ctypes.data_as(_VP), self._offs.ctypes.data_as(_VP), len(self.ids),
+            qa.ctypes.data_as(_VP), qi.ctypes.data_as(_VP), len(uq),
+            _F32(self.k1), _F32(self.b), _F32(self._bm.avgdl or 1.0), k,
+            oi.ctypes.data_as(_VP), osc.ctypes.data_as(_VP))
+        return [(self.ids[int(oi[j])], float(osc[j])) for j in range(m)]

{codna-0.1.43 → codna-0.1.44}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.43"
+version = "0.1.44"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.43 → codna-0.1.44}/tests/test_dockerfile_webhook.py

@@ -37,6 +37,15 @@ def test_agent_core_copied_before_pip_install():
     )
 
 
+def test_webhook_image_builds_agent_core_bundle_before_pip_install():
+    """The wheel build requires both run-server.mjs and run-server.bundle.mjs in agent-core/."""
+    text = DOCKERFILE.read_text(encoding="utf-8")
+    assert "bun build vendor/cline/algenta/run-server.ts" in text
+    assert "--outfile run-server.bundle.mjs" in text
+    assert "cline.invalid" in text and "phc_redacted" in text
+    assert text.index("--outfile run-server.bundle.mjs") < text.index("pip install --no-cache-dir /app/cli")
+
+
 def test_webhook_image_is_keyless():
     """The webhook image must not bake in an LLM provider key."""
     text = DOCKERFILE.read_text(encoding="utf-8")

{codna-0.1.43 → codna-0.1.44}/tests/test_packaging.py

@@ -322,7 +322,7 @@ def test_public_action_examples_use_current_github_owner():
 
 
 def test_release_runbook_documents_exact_pypi_trusted_publisher_claims():
-    runbook = (ROOT / "docs" / "release.md").read_text(encoding="utf-8")
+    runbook = (ROOT / "docs-internal" / "release-runbook.md").read_text(encoding="utf-8")
 
     required = [
         "Project name: codna",

{codna-0.1.43 → codna-0.1.44}/tests/test_release_readiness.py

@@ -239,6 +239,68 @@ def test_deployment_branch_policy_payload_requires_branch_policies_list():
         raise AssertionError("expected ReleaseReadinessError")
 
 
+def test_github_app_settings_fail_on_missing_events_and_permissions():
+    tool = _load_script()
+    payload = {
+        "slug": "codna-ai",
+        "events": ["check_suite", "issues", "pull_request_review"],
+        "permissions": {
+            "checks": "write",
+            "contents": "write",
+            "issues": "write",
+            "metadata": "read",
+            "pull_requests": "write",
+        },
+    }
+
+    check = tool.check_github_app_settings(payload, app_slug="codna-ai")
+
+    assert check.status == "fail"
+    assert check.details["missing_events"] == [
+        "code_scanning_alert",
+        "issue_comment",
+        "pull_request",
+        "pull_request_review_comment",
+    ]
+    assert check.details["missing_or_insufficient_permissions"] == {
+        "security_events": {"required": "read", "actual": None}
+    }
+
+
+def test_github_app_settings_pass_when_events_and_permissions_are_complete():
+    tool = _load_script()
+    payload = {
+        "slug": "codna-ai",
+        "events": sorted(tool.REQUIRED_GITHUB_APP_EVENTS),
+        "permissions": {
+            "checks": "write",
+            "contents": "write",
+            "issues": "write",
+            "metadata": "read",
+            "pull_requests": "write",
+            "security_events": "read",
+        },
+    }
+
+    check = tool.check_github_app_settings(payload, app_slug="codna-ai")
+
+    assert check.status == "pass"
+    assert check.details["missing_events"] == []
+    assert check.details["missing_or_insufficient_permissions"] == {}
+
+
+def test_github_app_permission_write_satisfies_read():
+    tool = _load_script()
+    payload = {
+        "events": sorted(tool.REQUIRED_GITHUB_APP_EVENTS),
+        "permissions": {**tool.REQUIRED_GITHUB_APP_PERMISSIONS, "security_events": "write"},
+    }
+
+    check = tool.check_github_app_settings(payload, app_slug="codna-ai")
+
+    assert check.status == "pass"
+
+
 def test_v1_alignment_requires_tag_to_match_main():
     tool = _load_script()
 
@@ -636,11 +698,40 @@ def test_render_text_report_surfaces_safe_remediation_without_secret_values():
     assert "secret-value" not in output
 
 
+def test_render_text_report_surfaces_github_app_setting_gaps():
+    tool = _load_script()
+    report = {
+        "ok": False,
+        "summary": {"checks": 1, "failed": 1, "warnings": 0},
+        "checks": [
+            {
+                "name": "github_app_settings",
+                "status": "fail",
+                "message": "GitHub App is missing required event subscriptions or repository permissions",
+                "details": {
+                    "missing_events": ["issue_comment", "pull_request"],
+                    "missing_or_insufficient_permissions": {
+                        "security_events": {"required": "read", "actual": None}
+                    },
+                },
+            }
+        ],
+    }
+
+    output = tool.render_text_report(report)
+
+    assert "missing_events: issue_comment, pull_request" in output
+    assert "security_events: required=read actual=missing" in output
+
+
 def test_parse_args_keeps_json_as_default_and_accepts_text_format():
     tool = _load_script()
 
     assert tool.parse_args([]).format == "json"
     assert tool.parse_args(["--format", "text"]).format == "text"
+    parsed = tool.parse_args(["--check-github-app", "--github-app-slug", "codna-ai-dev"])
+    assert parsed.check_github_app is True
+    assert parsed.github_app_slug == "codna-ai-dev"
 
 
 def test_pypi_404_is_warning_not_hard_failure():

{codna-0.1.43 → codna-0.1.44}/tests/test_runtime_ports.py

@@ -3,7 +3,23 @@ from __future__ import annotations
 import pytest
 
 import codna.runtime.ports as ports_module
-from codna.runtime.ports import PortInspectionError, _lsof_binary, _parse_lsof_fields, listeners_on_port
+from codna.runtime.ports import (
+    PortInspectionError,
+    _lsof_binary,
+    _parse_lsof_fields,
+    _port_inspection_timeout_s,
+    listeners_on_port,
+)
+
+
+def test_port_inspection_timeout_default_and_env_override(monkeypatch) -> None:
+    monkeypatch.delenv("CODNA_PORT_INSPECTION_TIMEOUT_S", raising=False)
+    assert _port_inspection_timeout_s() == 10.0  # not the old too-tight 2.0s
+    monkeypatch.setenv("CODNA_PORT_INSPECTION_TIMEOUT_S", "25")
+    assert _port_inspection_timeout_s() == 25.0
+    for bad in ("", "0", "-3", "abc"):  # invalid/non-positive falls back to the default
+        monkeypatch.setenv("CODNA_PORT_INSPECTION_TIMEOUT_S", bad)
+        assert _port_inspection_timeout_s() == 10.0
 
 
 def test_parse_lsof_fields_includes_parent_pid() -> None: