codna 0.1.48__tar.gz → 0.2.0__tar.gz

{codna-0.1.48 → codna-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.48
+Version: 0.2.0
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.48 → codna-0.2.0}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.48"
+__version__ = "0.2.0"

{codna-0.1.48 → codna-0.2.0}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/Users/angel/Developer/actions-runner/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/Users/angel/actions-runner-mac/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.1.48 → codna-0.2.0}/codna/codeunits.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 
 import ast
 import os
+import re
 from dataclasses import dataclass
 from typing import Iterator, Protocol
 
@@ -80,6 +81,34 @@ def _is_test(relpath: str, name: str) -> bool:
     return base.startswith("test_") or base.endswith("_test.py") or name.startswith("test_")
 
 
+# The stdlib's ast.get_source_segment re-splits the WHOLE source on every call (it calls
+# _splitlines_no_ff(source, maxlines=node.end_lineno) internally). That made segment extraction
+# O(symbols x lines) per file — ~98% of Python-extraction wall time on real repos. Instead we split
+# once per file and slice the pre-split lines per node. _LINE_SPLIT mirrors ast._line_pattern
+# EXACTLY (same alternatives, same DOTALL) and _segment mirrors get_source_segment's slicing rules
+# (byte-offset columns, unpadded), so the emitted unit text is byte-identical to before — a
+# regression here would silently change embeddings and content hashes for every indexed symbol.
+_LINE_SPLIT = re.compile(r"(.*?(?:\r\n|\n|\r|$))", re.DOTALL)
+
+
+def _segment(lines: list[str], node) -> str:
+    """The source slice for ``node`` from pre-split ``lines`` (== ast.get_source_segment, unpadded)."""
+    try:
+        if node.end_lineno is None or node.end_col_offset is None:
+            return ""
+        lineno = node.lineno - 1
+        end_lineno = node.end_lineno - 1
+        col_offset = node.col_offset
+        end_col_offset = node.end_col_offset
+    except AttributeError:
+        return ""
+    if end_lineno == lineno:
+        return lines[lineno].encode()[col_offset:end_col_offset].decode()
+    first = lines[lineno].encode()[col_offset:].decode()
+    last = lines[end_lineno].encode()[:end_col_offset].decode()
+    return first + "".join(lines[lineno + 1:end_lineno]) + last
+
+
 class PythonExtractor:
     """Python structural units via stdlib ``ast`` — no third-party parser."""
 
@@ -89,11 +118,12 @@ class PythonExtractor:
     def extract(self, repo_id: str, relpath: str, source: str) -> Iterator[CodeUnit]:
         tree = ast.parse(source)   # may raise SyntaxError; extract_repo counts the skip (non-fatal)
         doc = ast.get_docstring(tree)
+        lines = _LINE_SPLIT.findall(source)   # split ONCE; every symbol slice reuses this
         if doc:
             yield self._unit(repo_id, relpath, relpath, f"{relpath}\n{doc}", "module")
-        yield from self._walk(repo_id, relpath, source, tree.body, prefix="")
+        yield from self._walk(repo_id, relpath, lines, tree.body, prefix="")
 
-    def _walk(self, repo_id, relpath, source, body, prefix) -> Iterator[CodeUnit]:
+    def _walk(self, repo_id, relpath, lines, body, prefix) -> Iterator[CodeUnit]:
         for node in body:
             if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
                 qual = f"{prefix}{node.name}"
@@ -103,20 +133,20 @@ class PythonExtractor:
                     sym = "method"
                 else:
                     sym = "function"
-                yield self._unit(repo_id, relpath, qual, self._body_text(source, node, qual), sym)
+                yield self._unit(repo_id, relpath, qual, self._body_text(lines, node, qual), sym)
             elif isinstance(node, ast.ClassDef):
                 qual = f"{prefix}{node.name}"
-                yield self._unit(repo_id, relpath, qual, self._header_text(source, node, qual), "class")
-                yield from self._walk(repo_id, relpath, source, node.body, prefix=f"{qual}.")
+                yield self._unit(repo_id, relpath, qual, self._header_text(lines, node, qual), "class")
+                yield from self._walk(repo_id, relpath, lines, node.body, prefix=f"{qual}.")
 
-    def _body_text(self, source, node, qual) -> str:
-        seg = ast.get_source_segment(source, node) or ""
+    def _body_text(self, lines, node, qual) -> str:
+        seg = _segment(lines, node)
         doc = ast.get_docstring(node) or ""
         return f"{qual}\n{doc}\n{seg}".strip()[:_MAX_UNIT_CHARS]
 
-    def _header_text(self, source, node, qual) -> str:
+    def _header_text(self, lines, node, qual) -> str:
         # for a class, prefer the signature line + docstring over the whole body
-        seg = ast.get_source_segment(source, node) or ""
+        seg = _segment(lines, node)
         first = seg.splitlines()[0] if seg else ""
         doc = ast.get_docstring(node) or ""
         return f"{qual}\n{first}\n{doc}".strip()[:_MAX_UNIT_CHARS]

{codna-0.1.48 → codna-0.2.0}/codna/testrun.py

@@ -49,12 +49,19 @@ def parse_junit_failures(path: str) -> list[str]:
     return failing
 
 
-def _detect_pytest(repo_dir: str) -> bool:
-    if os.path.isfile(os.path.join(repo_dir, "pytest.ini")):
+# Depth-1 subdirectories never worth scanning for pytest config (never contain the repo's own
+# tests, and some can be large enough to make even a shallow os.listdir a waste).
+_SKIP_SUBDIRS = frozenset({
+    "node_modules", "venv", ".venv", "dist", "build", "vendor", "__pycache__", "site-packages",
+})
+
+
+def _has_pytest_config(d: str) -> bool:
+    if os.path.isfile(os.path.join(d, "pytest.ini")):
         return True
-    if os.path.isdir(os.path.join(repo_dir, "tests")):
+    if os.path.isdir(os.path.join(d, "tests")):
         return True
-    pyproject = os.path.join(repo_dir, "pyproject.toml")
+    pyproject = os.path.join(d, "pyproject.toml")
     if os.path.isfile(pyproject):
         try:
             import tomllib
@@ -64,7 +71,7 @@ def _detect_pytest(repo_dir: str) -> bool:
                     return True
         except Exception:  # noqa: BLE001
             pass
-    cfg = os.path.join(repo_dir, "setup.cfg")
+    cfg = os.path.join(d, "setup.cfg")
     if os.path.isfile(cfg):
         try:
             with open(cfg, encoding="utf-8") as fh:
@@ -75,6 +82,50 @@ def _detect_pytest(repo_dir: str) -> bool:
     return False
 
 
+def _detect_pytest(repo_dir: str) -> str | None:
+    """Return the directory pytest config lives in — ``repo_dir`` itself, or a depth-1
+    subdirectory of it — or ``None`` if neither has any.
+
+    Monorepo-aware: a repo's actual Python package (and its pytest.ini / tests/ / pyproject.toml
+    [tool.pytest]) commonly lives one level down, in a subdirectory like ``cli/`` or ``python/``,
+    rather than at the repo root. A root-only check would conclude "no test runner" despite a
+    real, working pytest setup one level down; only searching depth-1 (not an arbitrary recursive
+    walk) keeps this bounded and avoids false positives from an unrelated pytest config buried in
+    a vendored/example subtree.
+
+    Raises :class:`RuntimeError` when MULTIPLE depth-1 subdirectories each have their own pytest
+    config and the root has none — codna's OWN repo is exactly this shape (``bench/``, ``cli/``,
+    and ``python/`` are all independently valid pytest roots). Silently picking one (e.g. the
+    alphabetically-first) would run an arbitrary subset of the repo's tests and could report
+    "tests pass" while the actual failing suite never ran — a clear, actionable error is safer
+    than a guess here.
+    """
+    if _has_pytest_config(repo_dir):
+        return repo_dir
+    try:
+        entries = sorted(os.listdir(repo_dir))
+    except OSError:
+        return None
+    candidates = [
+        os.path.join(repo_dir, name)
+        for name in entries
+        if not name.startswith(".")
+        and name not in _SKIP_SUBDIRS
+        and os.path.isdir(os.path.join(repo_dir, name))
+        and _has_pytest_config(os.path.join(repo_dir, name))
+    ]
+    if len(candidates) == 1:
+        return candidates[0]
+    if len(candidates) > 1:
+        names = ", ".join(os.path.basename(c) for c in candidates)
+        raise RuntimeError(
+            f"`codna fix --tests` found pytest config in multiple subdirectories ({names}) and "
+            f"none at the repo root -- ambiguous which to run; pass --test-cmd "
+            f"\"<your test command>\" (writing JUnit to $CODNA_JUNIT)."
+        )
+    return None
+
+
 def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeout_seconds: int = 1800):
     """``(issue_text | None, [failing_ids])`` — same contract as :func:`fix_inputs.from_junit`.
 
@@ -95,20 +146,25 @@ def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeou
     env["CODNA_JUNIT"] = junit  # custom test commands can write their report here
     env["PYTHONDONTWRITEBYTECODE"] = "1"  # prevent test runs from dirtying repos with __pycache__
 
+    run_dir = repo_dir  # overridden below only when pytest config is found in a subdirectory
     if test_cmd:
         argv = ["/bin/sh", "-c", test_cmd]
-    elif _detect_pytest(repo_dir):
-        if importlib.util.find_spec("pytest") is None:
+    else:
+        pytest_dir = _detect_pytest(repo_dir)
+        if pytest_dir:
+            if importlib.util.find_spec("pytest") is None:
+                raise RuntimeError(
+                    "`codna fix --tests` detected pytest config but pytest is not installed in this "
+                    "environment; install pytest or pass --test-cmd \"<your test command>\"."
+                )
+            argv = [sys.executable, "-m", "pytest", "-q", f"--junitxml={junit}"]
+            run_dir = pytest_dir  # e.g. cli/ when the repo root itself has no pytest config
+        else:
             raise RuntimeError(
-                "`codna fix --tests` detected pytest config but pytest is not installed in this "
-                "environment; install pytest or pass --test-cmd \"<your test command>\"."
+                "`codna fix --tests` could not detect a test runner (no pytest.ini / tests/ / pyproject "
+                "[tool.pytest]) at the repo root or in a subdirectory; pass --test-cmd "
+                "\"<your test command>\" (writing JUnit to $CODNA_JUNIT)."
             )
-        argv = [sys.executable, "-m", "pytest", "-q", f"--junitxml={junit}"]
-    else:
-        raise RuntimeError(
-            "`codna fix --tests` could not detect a test runner (no pytest.ini / tests/ / pyproject "
-            "[tool.pytest]); pass --test-cmd \"<your test command>\" (writing JUnit to $CODNA_JUNIT)."
-        )
 
     # Actually ENFORCE network denial (bwrap/unshare on Linux CI) — not just record it — so untrusted
     # test code can't exfiltrate. When fail-closed egress is required (privacy.egress) but no kernel
@@ -121,7 +177,7 @@ def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeou
         )
     # pytest exits 1 when tests fail — that is the expected/accepted case here (not an error).
     result = Sandbox(network="deny", timeout_seconds=timeout_seconds, env=env, network_backend=backend).run(
-        argv, cwd=repo_dir, accepted_exit_codes=(0, 1)
+        argv, cwd=run_dir, accepted_exit_codes=(0, 1)
     )
     if result.timed_out:
         raise RuntimeError(f"test run timed out after {timeout_seconds}s")

{codna-0.1.48 → codna-0.2.0}/codna/webhook.py

@@ -258,10 +258,16 @@ def _fix_issue_text(ctx: Mapping[str, Any]) -> str:
     return "\n".join(parts)
 
 
-def codna_command(job: WebhookJob, *, repo_url: str | None = None, sarif_path: str | None = None) -> list[str]:
+def codna_command(
+    job: WebhookJob, *, repo_url: str | None = None, sarif_path: str | None = None,
+    issue_text: str | None = None,
+) -> list[str]:
     """Build the ``codna`` argv for a classified job.
 
-    fix    — ``codna fix <url> [--ref] --open-pr`` (CI/label), or the comment-triggered variant below.
+    fix    — a CI-triggered fix auto-discovers its failing tests (``--tests``); an issue-label
+             fix needs the issue's own text (``issue_text``, fetched by the caller — see
+             ``run_codna_job``) since there is no commit to run tests against. Or the
+             comment-triggered variant below.
     secure — ``codna secure <url> [--ref] --from-sarif <sarif>`` (read-only Tier-1
              classification; opening security PRs uses the privilege-separated two-job
              workflow, never a single server process).
@@ -299,7 +305,19 @@ def codna_command(job: WebhookJob, *, repo_url: str | None = None, sarif_path: s
             return args
         args = ["codna", "fix", url, "--open-pr"]
         if job.ref:
-            args += ["--ref", job.ref]
+            # CI-triggered (ci_check_suite_failed): no issue text exists, so let codna discover
+            # what's actually failing by running the repo's own tests against this commit.
+            args += ["--ref", job.ref, "--tests"]
+        elif job.issue_number:
+            # Label-triggered (labeled_codna_fix): no commit/tests to run -- `codna fix` requires
+            # one of --issue/--tests/--from-junit or it dies immediately (fix_run.py), so the
+            # caller (run_codna_job) must have already fetched the issue body.
+            if not issue_text:
+                raise WebhookError(
+                    "fix_requires_issue_text",
+                    f"issue-label fix for #{job.issue_number} needs the issue's own text.",
+                )
+            args += ["--issue", issue_text]
         # Embed the idempotency marker in the PR body so a re-run can find + reuse this PR.
         args += ["--pr-body", f"Automated fix opened by the Codna GitHub App.\n\n{webhook_marker(job)}"]
         return args

{codna-0.1.48 → codna-0.2.0}/codna/webhook_github.py

@@ -239,6 +239,29 @@ def post_review_comment_reply(repo_full_name: str, token: str, pr_number: int,
     return data.get("html_url") if isinstance(data, dict) else None
 
 
+def fetch_issue_text(repo_full_name: str, token: str, issue_number: int) -> str | None:
+    """GET an issue's title + body, formatted for `codna fix --issue`. None on any failure or an
+    empty/whitespace-only body+title (nothing to describe the fix with)."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return None
+    resp = httpx.get(
+        f"{_API}/repos/{repo_full_name}/issues/{issue_number}",
+        headers={"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"},
+        timeout=30.0, follow_redirects=True,
+    )
+    if resp.status_code >= 300:
+        return None
+    data = resp.json()
+    if not isinstance(data, dict):
+        return None
+    title = str(data.get("title") or "").strip()
+    body = str(data.get("body") or "").strip()
+    text = f"{title}\n\n{body}".strip() if body else title
+    return text or None
+
+
 def post_issue_comment(repo_full_name: str, token: str, issue_number: int, body: str) -> str | None:
     """Post a normal issue/PR conversation comment. Returns html_url, or None on API failure."""
     try:

{codna-0.1.48 → codna-0.2.0}/codna/webhook_metering.py

@@ -1,9 +1,10 @@
 """Per-installation metering for Codna's GitHub App webhook.
 
 Codna's webhook is keyless: it runs the packaged Codna CLI with the encapsulated local
-runtime and injects only the linked org's Codna run credential. The monthly managed-model
-allowance (the changeable "$5/mo"), Stripe plan tier, BYOK-beyond (the org's own provider
-key), and device seats are enforced by the Codna account plane for that org.
+runtime and injects only the linked org's Codna run credential (plus, when the org has
+configured one, their own BYOK provider key — see :func:`resolve_provider_credentials`). The
+monthly managed-model allowance (the changeable "$5/mo"), Stripe plan tier, and device seats
+are enforced by the Codna account plane for that org.
 
 This module resolves that per-installation Codna credential and carries the (changeable)
 included-allowance config. It FAILS CLOSED: with no credential for an installation, the
@@ -14,6 +15,7 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
+from typing import Any
 
 _INCLUDED_MONTHLY_USD_ENV = "CODNA_INCLUDED_MONTHLY_USD"
 _ACCOUNT_LINK_URL_ENV = "CODNA_ACCOUNT_LINK_URL"
@@ -45,23 +47,50 @@ def resolve_engine_key(installation_id: int | None) -> str | None:
     """Return the org Codna run credential for a GitHub installation, or None (fail closed).
 
     Tries the live account-linking bridge first (decision-engine mints a fresh, short-lived
-    credential per call — see :func:`_resolve_engine_key_live`); falls back to a static store
+    credential per call — see :func:`_fetch_live_credentials`); falls back to a static store
     for self-hosted operators who provision one directly instead of pointing at a
     decision-engine (:func:`_resolve_engine_key_from_static_store`).
     """
     if not installation_id:
         return None
-    live = _resolve_engine_key_live(installation_id)
+    live = _fetch_live_credentials(installation_id)
     if live is not None:
-        return live
+        key = live.get("engine_key")
+        if key:
+            return str(key)
     return _resolve_engine_key_from_static_store(installation_id)
 
 
-def _resolve_engine_key_live(installation_id: int) -> str | None:
+def resolve_provider_credentials(installation_id: int | None) -> tuple[str | None, str | None]:
+    """Return ``(provider, provider_key)`` for the org's own BYOK key (whichever of Anthropic /
+    OpenAI / Google they configured), or ``(None, None)`` if none is set / the installation isn't
+    linked / this is a self-hosted static-store install (that path carries no provider concept).
+
+    The local agent-core sidecar always looks for ONE specific provider's raw key -- without
+    this, every fix silently falls back to whatever the sidecar defaults to (Anthropic) even for
+    an org that configured OpenAI or Google, and fails outright for an org with no local key at
+    all. A second, independent bridge call from :func:`resolve_engine_key`'s (each mints its own
+    fresh short-lived credential) -- deliberately not cached: a stale cross-job reuse of another
+    call's response is a correctness bug, not an optimization, since the same installation_id
+    recurs across many separate jobs over a webhook's lifetime.
+    """
+    if not installation_id:
+        return None, None
+    live = _fetch_live_credentials(installation_id)
+    if live is None:
+        return None, None
+    provider = live.get("provider")
+    provider_key = live.get("provider_key")
+    if not provider or not provider_key:
+        return None, None
+    return str(provider), str(provider_key)
+
+
+def _fetch_live_credentials(installation_id: int) -> dict[str, Any] | None:
     """Ask decision-engine, live, whether this installation is linked to a metered Codna
     account. Unconfigured (no engine URL / no shared secret), unreachable, or any non-200
-    response (401 misconfigured secret, 404 not linked) all fall through to None — the static
-    store is still tried after this, and the caller's own fail-closed prompt covers the rest."""
+    response (401 misconfigured secret, 404 not linked) all fall through to None. Always a
+    fresh call, never cached (see :func:`resolve_provider_credentials`)."""
     base_url = os.environ.get(_ENGINE_URL_ENV)
     secret = os.environ.get(_ENGINE_INTERNAL_SECRET_ENV)
     if not base_url or not secret:
@@ -82,10 +111,10 @@ def _resolve_engine_key_live(installation_id: int) -> str | None:
     if resp.status_code != 200:
         return None
     try:
-        key = resp.json().get("engine_key")
+        parsed = resp.json()
     except ValueError:
         return None
-    return str(key) if key else None
+    return parsed if isinstance(parsed, dict) else None
 
 
 def _resolve_engine_key_from_static_store(installation_id: int) -> str | None:

{codna-0.1.48 → codna-0.2.0}/codna/webhook_worker.py

@@ -37,11 +37,22 @@ from .webhook_queue import _MAX_ATTEMPTS, QueuedJob, WebhookQueue
 
 _JOB_TIMEOUT_S = int(os.environ.get("CODNA_WEBHOOK_JOB_TIMEOUT_S", "3600"))
 
-# Raw LLM provider keys are NEVER forwarded — the webhook is keyless and the engine supplies
-# the model (managed allowance or the org's BYOK). Exclude them from the inherited env.
+# Raw LLM provider keys are NEVER INHERITED from the webhook's own ambient host env — the
+# webhook is keyless. Exclude them from the allowlist below; the one job-specific provider key
+# (the linked org's own BYOK key, resolved fresh per job — see webhook_metering.
+# resolve_provider_credentials) is INJECTED explicitly by _job_env instead, exactly like the
+# per-org CODNA_API_KEY already is, so no house/other-org/ambient secret can leak into a job.
 _PROVIDER_API_KEYS = frozenset({
     "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY", "OPENROUTER_API_KEY",
 })
+# codna's own provider-name -> raw-key env var mapping (cli/codna/keystore.py's PROVIDER_TO_ENV).
+# Google is dual-set (both GEMINI_API_KEY and GOOGLE_API_KEY) since the packaged agent-core
+# sidecar's own SDKs vary in which one they read; the key value is identical either way.
+_PROVIDER_ENV_VARS = {
+    "anthropic": ("ANTHROPIC_API_KEY",),
+    "openai": ("OPENAI_API_KEY",),
+    "google": ("GEMINI_API_KEY", "GOOGLE_API_KEY"),
+}
 # Safe, non-secret system + codna config the job may inherit.
 _SAFE_CONFIG = frozenset({
     "PATH", "HOME", "USER", "LOGNAME", "SHELL", "TERM", "PWD", "TZ",
@@ -113,17 +124,31 @@ def _comment_fix_result_msg(job: WebhookJob, token: str, result: "JobResult", gi
             "test + risk gate, so nothing was pushed (fail-closed). You can apply the fix manually.")
 
 
-def _job_env(token: str | None, engine_key: str | None) -> dict[str, str]:
-    """Minimal allowlisted env + ONLY the scoped GitHub token and per-org Codna key."""
+def _job_env(
+    token: str | None, engine_key: str | None,
+    provider: str | None = None, provider_key: str | None = None,
+) -> dict[str, str]:
+    """Minimal allowlisted env + the scoped GitHub token, per-org Codna key, and (when the
+    linked org has configured one) their own BYOK provider key — set consistently regardless of
+    which of Anthropic/OpenAI/Google the org picked, so the local agent-core sidecar always finds
+    a usable key instead of only ever checking for Anthropic's."""
     env = {k: v for k, v in os.environ.items() if k in _ENV_ALLOWLIST}
     if token:
         env["GITHUB_TOKEN"] = token
     if engine_key:
         env["CODNA_API_KEY"] = engine_key  # per-installation org credential meters THIS org
+    if provider and provider_key:
+        for env_var in _PROVIDER_ENV_VARS.get(provider, ()):
+            env[env_var] = provider_key
+        # ALGENTA_AGENT_PROVIDER/CODNA_AGENT_PROVIDER take precedence over the sidecar's own
+        # default (anthropic) in packaged_agent_runner.py -- without this, an org's OpenAI/Google
+        # key would be present but never selected, and the sidecar would still look for Anthropic.
+        env["ALGENTA_AGENT_PROVIDER"] = provider
     return env
 
 
 def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
+                  provider: str | None = None, provider_key: str | None = None,
                   codna_bin: str = "codna") -> JobResult:
     """Default runner: run packaged codna for the job in an isolated, scrubbed workspace."""
     with tempfile.TemporaryDirectory(prefix="codna-webhook-job-") as tmp:
@@ -132,12 +157,23 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                 return JobResult(False, "secure job needs an installation token to fetch SARIF")
             sarif_path = webhook_github.fetch_code_scanning_sarif(job.repo_full_name, token, dest_dir=tmp)
             argv = codna_command(job, sarif_path=sarif_path)
+        elif job.kind == "fix" and job.issue_number and not (job.context or {}):
+            # Label-triggered fix (no ref, no comment context): `codna fix` needs the issue's own
+            # text to know what to fix -- fetch it now, the one thing codna_command can't do itself
+            # (it has no token). A fetch failure/empty issue must not silently no-op: report it the
+            # same way process_job reports every other fix outcome for an issue-label trigger.
+            if not token:
+                return JobResult(False, "issue-label fix needs an installation token to fetch the issue")
+            issue_text = webhook_github.fetch_issue_text(job.repo_full_name, token, job.issue_number)
+            if not issue_text:
+                return JobResult(False, f"could not fetch issue #{job.issue_number} text to describe the fix")
+            argv = codna_command(job, issue_text=issue_text)
         else:
             argv = codna_command(job)
         argv[0] = codna_bin
         try:
             proc = subprocess.run(
-                argv, env=_job_env(token, engine_key), cwd=tmp,
+                argv, env=_job_env(token, engine_key, provider, provider_key), cwd=tmp,
                 capture_output=True, text=True, timeout=_JOB_TIMEOUT_S,
                 start_new_session=True,  # own process group: isolated from signals, terminable as a unit
             )
@@ -155,6 +191,9 @@ def process_job(
     github: Any = webhook_github,
     runner: Callable[..., JobResult] = run_codna_job,
     resolve_engine_key: Callable[[int | None], str | None] = webhook_metering.resolve_engine_key,
+    resolve_provider_credentials: Callable[
+        [int | None], tuple[str | None, str | None]
+    ] = webhook_metering.resolve_provider_credentials,
 ) -> JobResult:
     """Resolve the org credential (fail closed), mint a GitHub token, open a Check Run, run, report."""
     job = qjob.job
@@ -198,6 +237,14 @@ def process_job(
                                              "metered Codna account. " + webhook_metering.unlinked_summary())
         return JobResult(True, "not linked to a metered Codna account — prompted to link/authorize")
 
+    # The org's own BYOK key (whichever of Anthropic/OpenAI/Google they configured), if any --
+    # a resolution failure here must never block the fix: it just means no local provider key
+    # gets set, same as before this existed (house-metered fixes still worked without one).
+    try:
+        provider, provider_key = resolve_provider_credentials(job.installation_id)
+    except Exception:  # noqa: BLE001 — a BYOK-lookup hiccup must never fail the whole job
+        provider, provider_key = None, None
+
     # Comment-triggered verified fix of a review finding: validate + enrich BEFORE spending. A skip
     # (fork PR / not a Codna finding / no target branch) replies + returns.
     if reply_to and token:
@@ -230,7 +277,7 @@ def process_job(
             summary=f"codna {job.kind} started ({job.reason})",
         )
     try:
-        result = runner(job, token=token, engine_key=engine_key)
+        result = runner(job, token=token, engine_key=engine_key, provider=provider, provider_key=provider_key)
     except Exception as exc:  # noqa: BLE001 — a check-run this function opened must always be
         # completed, even on a crash the runner itself didn't turn into a JobResult (run_codna_job
         # only catches subprocess.TimeoutExpired). Without this, check_id is created above but
@@ -244,6 +291,15 @@ def process_job(
             conclusion="success" if result.ok else "failure",
             summary=result.summary, name=f"codna {job.kind}",
         )
+    # An issue-label fix has neither a commit (no check_id: job.ref is never set for this
+    # trigger) nor a comment thread (no reply_to) to report through -- without this, a failure
+    # is invisible on GitHub entirely (e.g. run_codna_job's issue-fetch-failure result above, or
+    # any codna CLI failure). A success still speaks for itself via the opened PR.
+    if not check_id and not reply_to and token and job.issue_number and not result.ok:
+        github.post_issue_comment(
+            job.repo_full_name, token, job.issue_number,
+            f"⚠️ Codna couldn't finish this fix: {result.summary}",
+        )
     # Reply the outcome ONCE: on success immediately, on failure only when the job is out of retries
     # (else a transient-then-succeeding fix would leave a spurious fail-closed reply, and every failed
     # attempt would spam the thread).

{codna-0.1.48 → codna-0.2.0}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.48
+Version: 0.2.0
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.48 → codna-0.2.0}/codna.egg-info/SOURCES.txt

@@ -91,15 +91,7 @@ codna/runtime/ports.py
 codna/runtime/processes.py
 memengine/__init__.py
 memengine/_validate.py
-memengine/embedding.py
-memengine/lexical.py
-memengine/mojo_backend.py
 memengine/native_runtime.py
-memengine/partitioned.py
-memengine/runtime.py
-memengine/segment.py
-memengine/tuning_heuristic.py
-memengine/vectorcore.py
 tests/test_agent_core_runtime.py
 tests/test_benchmark_parity_imports.py
 tests/test_benchmark_suite.py
@@ -177,6 +169,7 @@ tests/test_stage_codna_telys_oem_license.py
 tests/test_stage_codna_telys_runtime.py
 tests/test_structured_error.py
 tests/test_supervisor.py
+tests/test_sync_wheel_memengine.py
 tests/test_telys_onboarding.py
 tests/test_telys_runtime_packaging.py
 tests/test_testrun.py

codna-0.2.0/memengine/__init__.py

@@ -0,0 +1,2 @@
+"""Algenta Memory Engine (AME) Python SDK. SCAFFOLD STUB. See internal/MEMORY-SEMANTICS.md."""
+__version__ = "0.0.1"