codna 0.1.43__tar.gz → 0.1.45__tar.gz

{codna-0.1.43 → codna-0.1.45}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.43
+Version: 0.1.45
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.43 → codna-0.1.45}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.43"
+__version__ = "0.1.45"

{codna-0.1.43 → codna-0.1.45}/codna/cli.py

@@ -581,7 +581,7 @@ def _run_local_fix(args, *, ingest, engine, policy, manifest) -> int:
     test_cmds = (manifest.build + manifest.tests) if manifest else []
     model = os.environ.get("CODNA_FIX_MODEL")
 
-    print("\ncodna: remediating eligible findings with the agentic Cline SDK (local engine) …")
+    print("\ncodna: remediating eligible findings with the Codna agent (local engine) …")
     report = run_local_fix(
         ingest, engine=engine, patch_generator=ClinePatchGenerator(model=model, keys=_runtime_keys()),
         repo_dir=repo_dir, commit=commit, policy=policy, test_cmds=test_cmds, apply_to_repo=True,
@@ -803,7 +803,12 @@ def build_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="codna", description="Codna — understand, fix & secure your repo.")
     p.add_argument("--version", action="version", version=f"codna {__version__}")
     p.add_argument("--config", help="path to codna.yaml (default: ./codna.yaml or ./.codna.yaml)")
-    sub = p.add_subparsers(dest="cmd")
+    # `webhook` is the hosted GitHub App server (operator-only) — kept functional but hidden from
+    # `--help`, so the public metavar lists only user-facing commands.
+    sub = p.add_subparsers(
+        dest="cmd",
+        metavar="{triage,fix,doctor,secure,secure-open-pr,mcp,review,init,status,login,key}",
+    )
 
     pt = sub.add_parser("triage", help="Understand a repo + locate relevant code (fast, deterministic).")
     pt.add_argument("repo", nargs="?", default=".", help="local path or git URL (default: current dir)")
@@ -868,7 +873,7 @@ def build_parser() -> argparse.ArgumentParser:
     po.add_argument("--base-branch", help="PR base branch (default: main)")
     po.set_defaults(func=cmd_secure_open_pr)
 
-    pw = sub.add_parser("webhook", help="Run Codna's GitHub App webhook (the App channel, owned in Codna).")
+    pw = sub.add_parser("webhook")  # operator-only (hosted App server); omit help= to hide from --help
     pw_sub = pw.add_subparsers(dest="action")
     pw_serve = pw_sub.add_parser("serve", help="Serve the webhook: verify → classify → run codna fix/secure.")
     pw_serve.add_argument("--host", default="0.0.0.0", help="bind host (default: 0.0.0.0)")

{codna-0.1.43 → codna-0.1.45}/codna/cline_agent.py

@@ -60,7 +60,7 @@ def run_cline_fix(
     if not (core / "node_modules").is_dir():
         raise ClineAgentError(f"vendored SDK not built (no node_modules) under {core}")
     if task_kind not in {"fix", "triage", "review"}:
-        raise ClineAgentError(f"unsupported cline task_kind '{task_kind}'")
+        raise ClineAgentError(f"unsupported task_kind '{task_kind}'")
 
     env = dict(os.environ)
     _ensure_cline_data_dir(env)
@@ -78,9 +78,9 @@ def run_cline_fix(
             cwd=str(core), env=env, capture_output=True, text=True, timeout=timeout_s,
         )
     except FileNotFoundError as exc:
-        raise ClineAgentError("`bun` not found on PATH — required to run the Cline agent.") from exc
+        raise ClineAgentError("`bun` not found on PATH — required to run the agent.") from exc
     except subprocess.TimeoutExpired as exc:
-        raise ClineAgentError(f"cline agent timed out after {timeout_s}s") from exc
+        raise ClineAgentError(f"the agent timed out after {timeout_s}s") from exc
 
     for line in proc.stdout.splitlines():
         if line.startswith("RESULT "):

{codna-0.1.43 → codna-0.1.45}/codna/fix_run.py

@@ -290,7 +290,7 @@ def _retry_issue_text(original_issue: str | None, verify_issue: str | None, stil
     return "\n\n".join(sections)
 
 
-def _apply_once(c, rid, snap, plan, *, open_pr, args, issue, summary):
+def _apply_once(c, rid, snap, plan, *, open_pr, args, issue, summary, repo):
     from . import cli as _cli
 
     sim = _cli._dump(c.simulate_repository(rid, {"snapshot_id": snap["snapshot_id"],
@@ -308,13 +308,191 @@ def _apply_once(c, rid, snap, plan, *, open_pr, args, issue, summary):
                                                                        "impacted_symbols": summary.get("impacted_symbols")}, plan),
         }))
         return {"mode": "remote_pr", "pull_request_url": res.get("pull_request_url"), "status": res.get("status")}
-    res = _cli._dump(c.apply_repository(rid, {
-        "mode": "local_branch", "write_permission": True,
-        "decision_plan_id": plan.get("decision_plan_id"), "simulation_id": sid}))
+    try:
+        res = _cli._dump(c.apply_repository(rid, {
+            "mode": "local_branch", "write_permission": True,
+            "decision_plan_id": plan.get("decision_plan_id"), "simulation_id": sid}))
+    except Exception as exc:  # noqa: BLE001
+        recovered = _recover_already_applied_local_branch(repo, plan, exc)
+        if recovered is None:
+            raise
+        return recovered
     return {"mode": "local_branch", "branch_name": res.get("branch_name"),
             "local_checkout_path": res.get("local_checkout_path"), "commit_sha": res.get("commit_sha")}
 
 
+def _recover_already_applied_local_branch(repo: str, plan: dict, exc: BaseException) -> dict | None:
+    """Commit an already-applied agent edit only when it exactly matches plan evidence.
+
+    Some local SDK apply paths call the agent first, then apply the generated diff with
+    git. If the agent already changed the worktree, the second git apply can reject the
+    patch even though the checkout is correct. Recovery is intentionally narrow: the
+    failure must be a git-apply rejection, the dirty tracked paths must exactly match the
+    plan's changed files, and generated patch artifacts are the only ignored untracked files.
+    """
+    if not _is_git_apply_rejection(exc):
+        return None
+    repo_path = os.path.abspath(os.path.expanduser(repo))
+    if not os.path.isdir(repo_path):
+        return None
+    plan_id = plan.get("decision_plan_id")
+    if not isinstance(plan_id, str) or not plan_id:
+        return None
+    patch_path = _generated_apply_patch_path(repo_path)
+    expected = _plan_changed_files(plan)
+    if not expected and patch_path is not None:
+        expected = _patch_changed_files(patch_path.read_text(encoding="utf-8", errors="surrogateescape"))
+    if not expected:
+        return None
+    state = _worktree_recovery_state(repo_path)
+    if state is None:
+        return None
+    tracked_dirty, untracked = state
+    ignored_untracked = {name for name in _GENERATED_APPLY_ARTIFACTS}
+    unexpected_untracked = [path for path in untracked if path not in ignored_untracked]
+    if unexpected_untracked:
+        return None
+    branch = "codna/" + plan_id.removeprefix("plan_")[:16]
+    _git_checked(repo_path, ["checkout", "-B", branch])
+    if tracked_dirty:
+        if sorted(tracked_dirty) != sorted(expected):
+            return None
+    elif patch_path is not None:
+        if not _git_apply_check(repo_path, patch_path):
+            return None
+        _git_checked(repo_path, ["apply", "--whitespace=nowarn", str(patch_path)])
+    else:
+        return None
+    _git_checked(repo_path, ["add", "--", *expected])
+    staged = _git_checked(repo_path, ["diff", "--cached", "--name-only", "-z"]).stdout
+    staged_files = sorted(path for path in staged.split("\0") if path)
+    if staged_files != sorted(expected):
+        return None
+    _git_checked(
+        repo_path,
+        [
+            "-c",
+            "user.name=Codna",
+            "-c",
+            "user.email=codna@example.invalid",
+            "commit",
+            "--no-gpg-sign",
+            "-m",
+            f"codna: apply {plan_id}",
+        ],
+    )
+    for artifact in _GENERATED_APPLY_ARTIFACTS:
+        Path(repo_path, artifact).unlink(missing_ok=True)
+    return {
+        "mode": "local_branch",
+        "branch_name": branch,
+        "local_checkout_path": repo_path,
+        "commit_sha": _git_checked(repo_path, ["rev-parse", "HEAD"]).stdout.strip(),
+        "recovered_after_apply_error": True,
+    }
+
+
+def _is_git_apply_rejection(exc: BaseException) -> bool:
+    text = str(exc).lower()
+    return (
+        "git apply" in text
+        or "patch does not apply" in text
+        or "git_command_failed" in text
+    ) and (
+        ".algenta.patch.diff" in text
+        or ".codna-packaged.patch.diff" in text
+        or "patch does not apply" in text
+    )
+
+
+def _plan_changed_files(plan: dict) -> list[str]:
+    candidates = [
+        plan.get("changed_files"),
+        (plan.get("decision_plan") or {}).get("changed_files"),
+        ((plan.get("decision_plan") or {}).get("repository_analysis") or {}).get("changed_files"),
+    ]
+    for value in candidates:
+        if isinstance(value, list) and value and all(isinstance(item, str) and item for item in value):
+            return sorted(set(value))
+    return []
+
+
+def _generated_apply_patch_path(repo: str) -> Path | None:
+    for artifact in _GENERATED_APPLY_ARTIFACTS:
+        path = Path(repo, artifact)
+        if path.is_file():
+            return path
+    return None
+
+
+def _patch_changed_files(patch_diff: str) -> list[str]:
+    changed: set[str] = set()
+    for line in patch_diff.splitlines():
+        if not line.startswith("+++ "):
+            continue
+        path = line[4:].strip()
+        if path == "/dev/null":
+            continue
+        if path.startswith("b/"):
+            path = path[2:]
+        if path:
+            changed.add(path)
+    return sorted(changed)
+
+
+def _git_apply_check(repo: str, patch_path: Path) -> bool:
+    result = subprocess.run(
+        ["git", "-C", repo, "apply", "--check", "--whitespace=nowarn", str(patch_path)],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=60,
+    )
+    return result.returncode == 0
+
+
+def _worktree_recovery_state(repo: str) -> tuple[list[str], list[str]] | None:
+    status = subprocess.run(
+        ["git", "-C", repo, "status", "--porcelain=v1", "-z", "--untracked-files=all"],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=30,
+    )
+    if status.returncode != 0:
+        return None
+    tracked: list[str] = []
+    untracked: list[str] = []
+    entries = [entry for entry in status.stdout.split("\0") if entry]
+    i = 0
+    while i < len(entries):
+        entry = entries[i]
+        code = entry[:2]
+        path = entry[3:] if len(entry) > 3 else ""
+        if code == "??":
+            untracked.append(path)
+        elif code[:1] in {"R", "C"} or code[1:2] in {"R", "C"}:
+            return None
+        elif path:
+            tracked.append(path)
+        i += 1
+    return sorted(set(tracked)), sorted(set(untracked))
+
+
+def _git_checked(repo: str, args: list[str]) -> subprocess.CompletedProcess:
+    result = subprocess.run(
+        ["git", "-C", repo, *args],
+        capture_output=True,
+        text=True,
+        check=False,
+        timeout=60,
+    )
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout or "").strip()
+        raise RuntimeError(f"git {' '.join(args)} failed during apply recovery: {detail}")
+    return result
+
+
 def run_fix(c, args) -> dict:
     """Run the fix (with optional verification loop) and return a structured result dict.
 
@@ -370,7 +548,7 @@ def run_fix(c, args) -> dict:
         pre_apply_head = _git_head(repo) if apply and not open_pr else None
         apply_artifacts_before = _snapshot_generated_apply_artifacts(repo) if apply and not open_pr else {}
         try:
-            applied = _apply_once(c, rid, snap, plan, open_pr=open_pr, args=args, issue=issue, summary=summary)
+            applied = _apply_once(c, rid, snap, plan, open_pr=open_pr, args=args, issue=issue, summary=summary, repo=repo)
             if applied.get("mode") == "local_branch":
                 _cleanup_generated_apply_artifacts(applied.get("local_checkout_path"), apply_artifacts_before)
         except Exception as exc:  # noqa: BLE001 — mirror the old cmd_fix: ALL apply errors (incl. a

{codna-0.1.43 → codna-0.1.45}/codna/mcp_server.py

@@ -209,10 +209,10 @@ def _build_server():
         repo: str = ".", issue: str = "", ref: str = "", open_pr: bool = False,
         model: str = "repository.verified_agentic_v1",
     ) -> str:
-        """Find and fix a bug. Runs the full codna agent (Cline) + engine + risk simulation.
+        """Find and fix a bug. Runs the full Codna agent + engine + risk simulation.
 
         repo: a local path or a git URL. issue: what's broken (e.g. the failing test).
-        model: optional provider-qualified model such as openai/gpt-5.5.
+        model: optional provider-qualified model such as openai/gpt-5.
         open_pr: when false (default) this is READ-ONLY — returns the plan (root cause, confidence,
           patch reference) and changes nothing. When true, codna pushes a fix branch and OPENS A
           PULL REQUEST — this needs a git URL for `repo` and a GITHUB_TOKEN with write access.

{codna-0.1.43 → codna-0.1.45}/codna/patchgen.py

@@ -138,7 +138,7 @@ class ClinePatchGenerator:
         with _scoped_agent_limits(self.max_iterations, self.timeout_s):
             diff = runner.run(request).patch_diff
         if not diff.strip():
-            raise PatchGenError(f"cline agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
+            raise PatchGenError(f"the agent produced no changes for {finding.rule_id} ({finding.canonical_id})")
         return diff
 
 

{codna-0.1.43 → codna-0.1.45}/codna/runtime/ports.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+import os
 import shutil
 import socket
 import subprocess
@@ -9,7 +10,24 @@ from typing import Iterable
 
 LOOPBACK_HOSTS = {"127.0.0.1", "localhost"}
 LSOF_FALLBACK_PATHS = (Path("/usr/sbin/lsof"), Path("/usr/bin/lsof"))
-PORT_INSPECTION_TIMEOUT_S = 2.0
+
+
+def _port_inspection_timeout_s() -> float:
+    """Timeout for the `lsof` port probe. The old 2s default was too tight on a busy machine (notably
+    macOS, where `lsof` can stall for seconds under load), causing spurious `port_inspection_timeout`
+    failures even when the sidecar was up and listening. Default to 10s; allow override for slow hosts."""
+    raw = os.environ.get("CODNA_PORT_INSPECTION_TIMEOUT_S")
+    if raw:
+        try:
+            value = float(raw)
+        except ValueError:
+            value = 0.0
+        if value > 0:
+            return value
+    return 10.0
+
+
+PORT_INSPECTION_TIMEOUT_S = _port_inspection_timeout_s()
 LOOPBACK_CONNECT_TIMEOUT_S = 0.25
 
 

{codna-0.1.43 → codna-0.1.45}/codna/webhook_github.py

@@ -22,9 +22,9 @@ def token_permissions_for(kind: str) -> dict[str, str]:
     Both may post a Check Run for status.
     """
     if kind == "fix":
-        return {"contents": "write", "pull_requests": "write", "checks": "write"}
+        return {"contents": "write", "pull_requests": "write", "checks": "write", "issues": "write"}
     if kind == "secure":
-        return {"contents": "read", "security_events": "read", "checks": "write"}
+        return {"contents": "read", "security_events": "read", "checks": "write", "issues": "write"}
     if kind == "review":
         # Read code, write PR review comments + a check. No contents:write — review never pushes.
         return {"contents": "read", "pull_requests": "write", "checks": "write"}
@@ -239,6 +239,24 @@ def post_review_comment_reply(repo_full_name: str, token: str, pr_number: int,
     return data.get("html_url") if isinstance(data, dict) else None
 
 
+def post_issue_comment(repo_full_name: str, token: str, issue_number: int, body: str) -> str | None:
+    """Post a normal issue/PR conversation comment. Returns html_url, or None on API failure."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    resp = httpx.post(
+        f"{_API}/repos/{repo_full_name}/issues/{issue_number}/comments",
+        headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+        json={"body": body},
+        timeout=30.0, follow_redirects=True,
+    )
+    if resp.status_code >= 300:
+        return None
+    data = resp.json()
+    return data.get("html_url") if isinstance(data, dict) else None
+
+
 def fetch_code_scanning_sarif(repo_full_name: str, token: str, *, dest_dir: str) -> str:
     """Download the latest code-scanning analysis SARIF to dest_dir; returns the path."""
     try:

{codna-0.1.43 → codna-0.1.45}/codna/webhook_worker.py

@@ -6,7 +6,8 @@ with the encapsulated local runtime and a per-installation Codna account credent
 install is linked. Each job:
 
   1. resolves the org's Codna run credential for the job's installation (webhook_metering);
-     with NONE it FAILS CLOSED — posts a "link your account" Check Run and does NOT spend;
+     with NONE it FAILS CLOSED — posts a "link your account" Check Run when the event has a
+     commit SHA, or an issue comment when the trigger is issue-label based, and does NOT spend;
   2. mints a short-lived, repo-scoped GitHub installation token (for the branch/PR/SARIF,
      NOT for metering);
   3. opens a Check Run, runs the ``codna`` CLI in a FRESH scrubbed temp workspace
@@ -177,6 +178,19 @@ def process_job(
             if cid:
                 github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
                                         summary=webhook_metering.unlinked_summary(), name=f"codna {job.kind}")
+        if token and job.issue_number and not job.ref:
+            issue_comment_url = github.post_issue_comment(
+                job.repo_full_name,
+                token,
+                job.issue_number,
+                "⚠️ Codna can't run this request yet — this org isn't linked to a metered Codna "
+                "account. " + webhook_metering.unlinked_summary(),
+            )
+            if not issue_comment_url:
+                return JobResult(
+                    False,
+                    "not linked to a metered Codna account, but failed to post the link prompt issue comment",
+                )
         # A comment trigger must never go silent: tell the user in-thread why nothing happened.
         if reply_to and token:
             github.post_review_comment_reply(job.repo_full_name, token, job.pr_number, reply_to,

{codna-0.1.43 → codna-0.1.45}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.43
+Version: 0.1.45
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.43 → codna-0.1.45}/codna.egg-info/SOURCES.txt

@@ -88,6 +88,7 @@ codna/runtime/processes.py
 memengine/__init__.py
 memengine/_validate.py
 memengine/embedding.py
+memengine/lexical.py
 memengine/mojo_backend.py
 memengine/native_runtime.py
 memengine/partitioned.py