codna 0.1.49__tar.gz → 0.2.0__tar.gz

{codna-0.1.49 → codna-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.49
+Version: 0.2.0
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.49 → codna-0.2.0}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.49"
+__version__ = "0.2.0"

{codna-0.1.49 → codna-0.2.0}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/Users/angel/Developer/actions-runner/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/Users/angel/actions-runner-mac/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.1.49 → codna-0.2.0}/codna/testrun.py

@@ -49,12 +49,19 @@ def parse_junit_failures(path: str) -> list[str]:
     return failing
 
 
-def _detect_pytest(repo_dir: str) -> bool:
-    if os.path.isfile(os.path.join(repo_dir, "pytest.ini")):
+# Depth-1 subdirectories never worth scanning for pytest config (never contain the repo's own
+# tests, and some can be large enough to make even a shallow os.listdir a waste).
+_SKIP_SUBDIRS = frozenset({
+    "node_modules", "venv", ".venv", "dist", "build", "vendor", "__pycache__", "site-packages",
+})
+
+
+def _has_pytest_config(d: str) -> bool:
+    if os.path.isfile(os.path.join(d, "pytest.ini")):
         return True
-    if os.path.isdir(os.path.join(repo_dir, "tests")):
+    if os.path.isdir(os.path.join(d, "tests")):
         return True
-    pyproject = os.path.join(repo_dir, "pyproject.toml")
+    pyproject = os.path.join(d, "pyproject.toml")
     if os.path.isfile(pyproject):
         try:
             import tomllib
@@ -64,7 +71,7 @@ def _detect_pytest(repo_dir: str) -> bool:
                     return True
         except Exception:  # noqa: BLE001
             pass
-    cfg = os.path.join(repo_dir, "setup.cfg")
+    cfg = os.path.join(d, "setup.cfg")
     if os.path.isfile(cfg):
         try:
             with open(cfg, encoding="utf-8") as fh:
@@ -75,6 +82,50 @@ def _detect_pytest(repo_dir: str) -> bool:
     return False
 
 
+def _detect_pytest(repo_dir: str) -> str | None:
+    """Return the directory pytest config lives in — ``repo_dir`` itself, or a depth-1
+    subdirectory of it — or ``None`` if neither has any.
+
+    Monorepo-aware: a repo's actual Python package (and its pytest.ini / tests/ / pyproject.toml
+    [tool.pytest]) commonly lives one level down, in a subdirectory like ``cli/`` or ``python/``,
+    rather than at the repo root. A root-only check would conclude "no test runner" despite a
+    real, working pytest setup one level down; only searching depth-1 (not an arbitrary recursive
+    walk) keeps this bounded and avoids false positives from an unrelated pytest config buried in
+    a vendored/example subtree.
+
+    Raises :class:`RuntimeError` when MULTIPLE depth-1 subdirectories each have their own pytest
+    config and the root has none — codna's OWN repo is exactly this shape (``bench/``, ``cli/``,
+    and ``python/`` are all independently valid pytest roots). Silently picking one (e.g. the
+    alphabetically-first) would run an arbitrary subset of the repo's tests and could report
+    "tests pass" while the actual failing suite never ran — a clear, actionable error is safer
+    than a guess here.
+    """
+    if _has_pytest_config(repo_dir):
+        return repo_dir
+    try:
+        entries = sorted(os.listdir(repo_dir))
+    except OSError:
+        return None
+    candidates = [
+        os.path.join(repo_dir, name)
+        for name in entries
+        if not name.startswith(".")
+        and name not in _SKIP_SUBDIRS
+        and os.path.isdir(os.path.join(repo_dir, name))
+        and _has_pytest_config(os.path.join(repo_dir, name))
+    ]
+    if len(candidates) == 1:
+        return candidates[0]
+    if len(candidates) > 1:
+        names = ", ".join(os.path.basename(c) for c in candidates)
+        raise RuntimeError(
+            f"`codna fix --tests` found pytest config in multiple subdirectories ({names}) and "
+            f"none at the repo root -- ambiguous which to run; pass --test-cmd "
+            f"\"<your test command>\" (writing JUnit to $CODNA_JUNIT)."
+        )
+    return None
+
+
 def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeout_seconds: int = 1800):
     """``(issue_text | None, [failing_ids])`` — same contract as :func:`fix_inputs.from_junit`.
 
@@ -95,20 +146,25 @@ def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeou
     env["CODNA_JUNIT"] = junit  # custom test commands can write their report here
     env["PYTHONDONTWRITEBYTECODE"] = "1"  # prevent test runs from dirtying repos with __pycache__
 
+    run_dir = repo_dir  # overridden below only when pytest config is found in a subdirectory
     if test_cmd:
         argv = ["/bin/sh", "-c", test_cmd]
-    elif _detect_pytest(repo_dir):
-        if importlib.util.find_spec("pytest") is None:
+    else:
+        pytest_dir = _detect_pytest(repo_dir)
+        if pytest_dir:
+            if importlib.util.find_spec("pytest") is None:
+                raise RuntimeError(
+                    "`codna fix --tests` detected pytest config but pytest is not installed in this "
+                    "environment; install pytest or pass --test-cmd \"<your test command>\"."
+                )
+            argv = [sys.executable, "-m", "pytest", "-q", f"--junitxml={junit}"]
+            run_dir = pytest_dir  # e.g. cli/ when the repo root itself has no pytest config
+        else:
             raise RuntimeError(
-                "`codna fix --tests` detected pytest config but pytest is not installed in this "
-                "environment; install pytest or pass --test-cmd \"<your test command>\"."
+                "`codna fix --tests` could not detect a test runner (no pytest.ini / tests/ / pyproject "
+                "[tool.pytest]) at the repo root or in a subdirectory; pass --test-cmd "
+                "\"<your test command>\" (writing JUnit to $CODNA_JUNIT)."
             )
-        argv = [sys.executable, "-m", "pytest", "-q", f"--junitxml={junit}"]
-    else:
-        raise RuntimeError(
-            "`codna fix --tests` could not detect a test runner (no pytest.ini / tests/ / pyproject "
-            "[tool.pytest]); pass --test-cmd \"<your test command>\" (writing JUnit to $CODNA_JUNIT)."
-        )
 
     # Actually ENFORCE network denial (bwrap/unshare on Linux CI) — not just record it — so untrusted
     # test code can't exfiltrate. When fail-closed egress is required (privacy.egress) but no kernel
@@ -121,7 +177,7 @@ def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeou
         )
     # pytest exits 1 when tests fail — that is the expected/accepted case here (not an error).
     result = Sandbox(network="deny", timeout_seconds=timeout_seconds, env=env, network_backend=backend).run(
-        argv, cwd=repo_dir, accepted_exit_codes=(0, 1)
+        argv, cwd=run_dir, accepted_exit_codes=(0, 1)
     )
     if result.timed_out:
         raise RuntimeError(f"test run timed out after {timeout_seconds}s")

{codna-0.1.49 → codna-0.2.0}/codna/webhook_metering.py

@@ -1,9 +1,10 @@
 """Per-installation metering for Codna's GitHub App webhook.
 
 Codna's webhook is keyless: it runs the packaged Codna CLI with the encapsulated local
-runtime and injects only the linked org's Codna run credential. The monthly managed-model
-allowance (the changeable "$5/mo"), Stripe plan tier, BYOK-beyond (the org's own provider
-key), and device seats are enforced by the Codna account plane for that org.
+runtime and injects only the linked org's Codna run credential (plus, when the org has
+configured one, their own BYOK provider key — see :func:`resolve_provider_credentials`). The
+monthly managed-model allowance (the changeable "$5/mo"), Stripe plan tier, and device seats
+are enforced by the Codna account plane for that org.
 
 This module resolves that per-installation Codna credential and carries the (changeable)
 included-allowance config. It FAILS CLOSED: with no credential for an installation, the
@@ -14,6 +15,7 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
+from typing import Any
 
 _INCLUDED_MONTHLY_USD_ENV = "CODNA_INCLUDED_MONTHLY_USD"
 _ACCOUNT_LINK_URL_ENV = "CODNA_ACCOUNT_LINK_URL"
@@ -45,23 +47,50 @@ def resolve_engine_key(installation_id: int | None) -> str | None:
     """Return the org Codna run credential for a GitHub installation, or None (fail closed).
 
     Tries the live account-linking bridge first (decision-engine mints a fresh, short-lived
-    credential per call — see :func:`_resolve_engine_key_live`); falls back to a static store
+    credential per call — see :func:`_fetch_live_credentials`); falls back to a static store
     for self-hosted operators who provision one directly instead of pointing at a
     decision-engine (:func:`_resolve_engine_key_from_static_store`).
     """
     if not installation_id:
         return None
-    live = _resolve_engine_key_live(installation_id)
+    live = _fetch_live_credentials(installation_id)
     if live is not None:
-        return live
+        key = live.get("engine_key")
+        if key:
+            return str(key)
     return _resolve_engine_key_from_static_store(installation_id)
 
 
-def _resolve_engine_key_live(installation_id: int) -> str | None:
+def resolve_provider_credentials(installation_id: int | None) -> tuple[str | None, str | None]:
+    """Return ``(provider, provider_key)`` for the org's own BYOK key (whichever of Anthropic /
+    OpenAI / Google they configured), or ``(None, None)`` if none is set / the installation isn't
+    linked / this is a self-hosted static-store install (that path carries no provider concept).
+
+    The local agent-core sidecar always looks for ONE specific provider's raw key -- without
+    this, every fix silently falls back to whatever the sidecar defaults to (Anthropic) even for
+    an org that configured OpenAI or Google, and fails outright for an org with no local key at
+    all. A second, independent bridge call from :func:`resolve_engine_key`'s (each mints its own
+    fresh short-lived credential) -- deliberately not cached: a stale cross-job reuse of another
+    call's response is a correctness bug, not an optimization, since the same installation_id
+    recurs across many separate jobs over a webhook's lifetime.
+    """
+    if not installation_id:
+        return None, None
+    live = _fetch_live_credentials(installation_id)
+    if live is None:
+        return None, None
+    provider = live.get("provider")
+    provider_key = live.get("provider_key")
+    if not provider or not provider_key:
+        return None, None
+    return str(provider), str(provider_key)
+
+
+def _fetch_live_credentials(installation_id: int) -> dict[str, Any] | None:
     """Ask decision-engine, live, whether this installation is linked to a metered Codna
     account. Unconfigured (no engine URL / no shared secret), unreachable, or any non-200
-    response (401 misconfigured secret, 404 not linked) all fall through to None — the static
-    store is still tried after this, and the caller's own fail-closed prompt covers the rest."""
+    response (401 misconfigured secret, 404 not linked) all fall through to None. Always a
+    fresh call, never cached (see :func:`resolve_provider_credentials`)."""
     base_url = os.environ.get(_ENGINE_URL_ENV)
     secret = os.environ.get(_ENGINE_INTERNAL_SECRET_ENV)
     if not base_url or not secret:
@@ -82,10 +111,10 @@ def _resolve_engine_key_live(installation_id: int) -> str | None:
     if resp.status_code != 200:
         return None
     try:
-        key = resp.json().get("engine_key")
+        parsed = resp.json()
     except ValueError:
         return None
-    return str(key) if key else None
+    return parsed if isinstance(parsed, dict) else None
 
 
 def _resolve_engine_key_from_static_store(installation_id: int) -> str | None:

{codna-0.1.49 → codna-0.2.0}/codna/webhook_worker.py

@@ -37,11 +37,22 @@ from .webhook_queue import _MAX_ATTEMPTS, QueuedJob, WebhookQueue
 
 _JOB_TIMEOUT_S = int(os.environ.get("CODNA_WEBHOOK_JOB_TIMEOUT_S", "3600"))
 
-# Raw LLM provider keys are NEVER forwarded — the webhook is keyless and the engine supplies
-# the model (managed allowance or the org's BYOK). Exclude them from the inherited env.
+# Raw LLM provider keys are NEVER INHERITED from the webhook's own ambient host env — the
+# webhook is keyless. Exclude them from the allowlist below; the one job-specific provider key
+# (the linked org's own BYOK key, resolved fresh per job — see webhook_metering.
+# resolve_provider_credentials) is INJECTED explicitly by _job_env instead, exactly like the
+# per-org CODNA_API_KEY already is, so no house/other-org/ambient secret can leak into a job.
 _PROVIDER_API_KEYS = frozenset({
     "ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "GOOGLE_API_KEY", "OPENROUTER_API_KEY",
 })
+# codna's own provider-name -> raw-key env var mapping (cli/codna/keystore.py's PROVIDER_TO_ENV).
+# Google is dual-set (both GEMINI_API_KEY and GOOGLE_API_KEY) since the packaged agent-core
+# sidecar's own SDKs vary in which one they read; the key value is identical either way.
+_PROVIDER_ENV_VARS = {
+    "anthropic": ("ANTHROPIC_API_KEY",),
+    "openai": ("OPENAI_API_KEY",),
+    "google": ("GEMINI_API_KEY", "GOOGLE_API_KEY"),
+}
 # Safe, non-secret system + codna config the job may inherit.
 _SAFE_CONFIG = frozenset({
     "PATH", "HOME", "USER", "LOGNAME", "SHELL", "TERM", "PWD", "TZ",
@@ -113,17 +124,31 @@ def _comment_fix_result_msg(job: WebhookJob, token: str, result: "JobResult", gi
             "test + risk gate, so nothing was pushed (fail-closed). You can apply the fix manually.")
 
 
-def _job_env(token: str | None, engine_key: str | None) -> dict[str, str]:
-    """Minimal allowlisted env + ONLY the scoped GitHub token and per-org Codna key."""
+def _job_env(
+    token: str | None, engine_key: str | None,
+    provider: str | None = None, provider_key: str | None = None,
+) -> dict[str, str]:
+    """Minimal allowlisted env + the scoped GitHub token, per-org Codna key, and (when the
+    linked org has configured one) their own BYOK provider key — set consistently regardless of
+    which of Anthropic/OpenAI/Google the org picked, so the local agent-core sidecar always finds
+    a usable key instead of only ever checking for Anthropic's."""
     env = {k: v for k, v in os.environ.items() if k in _ENV_ALLOWLIST}
     if token:
         env["GITHUB_TOKEN"] = token
     if engine_key:
         env["CODNA_API_KEY"] = engine_key  # per-installation org credential meters THIS org
+    if provider and provider_key:
+        for env_var in _PROVIDER_ENV_VARS.get(provider, ()):
+            env[env_var] = provider_key
+        # ALGENTA_AGENT_PROVIDER/CODNA_AGENT_PROVIDER take precedence over the sidecar's own
+        # default (anthropic) in packaged_agent_runner.py -- without this, an org's OpenAI/Google
+        # key would be present but never selected, and the sidecar would still look for Anthropic.
+        env["ALGENTA_AGENT_PROVIDER"] = provider
     return env
 
 
 def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
+                  provider: str | None = None, provider_key: str | None = None,
                   codna_bin: str = "codna") -> JobResult:
     """Default runner: run packaged codna for the job in an isolated, scrubbed workspace."""
     with tempfile.TemporaryDirectory(prefix="codna-webhook-job-") as tmp:
@@ -148,7 +173,7 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
         argv[0] = codna_bin
         try:
             proc = subprocess.run(
-                argv, env=_job_env(token, engine_key), cwd=tmp,
+                argv, env=_job_env(token, engine_key, provider, provider_key), cwd=tmp,
                 capture_output=True, text=True, timeout=_JOB_TIMEOUT_S,
                 start_new_session=True,  # own process group: isolated from signals, terminable as a unit
             )
@@ -166,6 +191,9 @@ def process_job(
     github: Any = webhook_github,
     runner: Callable[..., JobResult] = run_codna_job,
     resolve_engine_key: Callable[[int | None], str | None] = webhook_metering.resolve_engine_key,
+    resolve_provider_credentials: Callable[
+        [int | None], tuple[str | None, str | None]
+    ] = webhook_metering.resolve_provider_credentials,
 ) -> JobResult:
     """Resolve the org credential (fail closed), mint a GitHub token, open a Check Run, run, report."""
     job = qjob.job
@@ -209,6 +237,14 @@ def process_job(
                                              "metered Codna account. " + webhook_metering.unlinked_summary())
         return JobResult(True, "not linked to a metered Codna account — prompted to link/authorize")
 
+    # The org's own BYOK key (whichever of Anthropic/OpenAI/Google they configured), if any --
+    # a resolution failure here must never block the fix: it just means no local provider key
+    # gets set, same as before this existed (house-metered fixes still worked without one).
+    try:
+        provider, provider_key = resolve_provider_credentials(job.installation_id)
+    except Exception:  # noqa: BLE001 — a BYOK-lookup hiccup must never fail the whole job
+        provider, provider_key = None, None
+
     # Comment-triggered verified fix of a review finding: validate + enrich BEFORE spending. A skip
     # (fork PR / not a Codna finding / no target branch) replies + returns.
     if reply_to and token:
@@ -241,7 +277,7 @@ def process_job(
             summary=f"codna {job.kind} started ({job.reason})",
         )
     try:
-        result = runner(job, token=token, engine_key=engine_key)
+        result = runner(job, token=token, engine_key=engine_key, provider=provider, provider_key=provider_key)
     except Exception as exc:  # noqa: BLE001 — a check-run this function opened must always be
         # completed, even on a crash the runner itself didn't turn into a JobResult (run_codna_job
         # only catches subprocess.TimeoutExpired). Without this, check_id is created above but

{codna-0.1.49 → codna-0.2.0}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.49
+Version: 0.2.0
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.1.49 → codna-0.2.0}/codna.egg-info/SOURCES.txt

@@ -91,15 +91,7 @@ codna/runtime/ports.py
 codna/runtime/processes.py
 memengine/__init__.py
 memengine/_validate.py
-memengine/embedding.py
-memengine/lexical.py
-memengine/mojo_backend.py
 memengine/native_runtime.py
-memengine/partitioned.py
-memengine/runtime.py
-memengine/segment.py
-memengine/tuning_heuristic.py
-memengine/vectorcore.py
 tests/test_agent_core_runtime.py
 tests/test_benchmark_parity_imports.py
 tests/test_benchmark_suite.py
@@ -177,6 +169,7 @@ tests/test_stage_codna_telys_oem_license.py
 tests/test_stage_codna_telys_runtime.py
 tests/test_structured_error.py
 tests/test_supervisor.py
+tests/test_sync_wheel_memengine.py
 tests/test_telys_onboarding.py
 tests/test_telys_runtime_packaging.py
 tests/test_testrun.py

{codna-0.1.49 → codna-0.2.0}/memengine/native_runtime.py

@@ -677,16 +677,6 @@ class NativeRuntime(RuntimeHandle):
         raise NotImplementedError("the lexical (BM25) index is not yet supported on the native runtime; "
                                   "use the local runtime (TELYS_RUNTIME=local) for mode='lexical'")
 
-    # compact serve artifacts — the native index handle has no quantized-export path yet; the engine-side
-    # sealer (PartitionedVectorIndex.save(compact=...)) lives in the local runtime. Fail closed (D-19 style).
-    def export_compact(self, index, path, mode):
-        raise NotImplementedError("compact serve artifacts are not yet supported on the native runtime; "
-                                  "export from the local runtime (TELYS_RUNTIME=local)")
-
-    def open_compact(self, path):
-        raise NotImplementedError("compact serve artifacts are not yet supported on the native runtime; "
-                                  "open with the local runtime (TELYS_RUNTIME=local)")
-
     # ── IVF-within-partition (PR-5; faiss clustering host-side, native exact rerank) ───────────────
     @_write
     def build_partition_ivf(self, index, min_rows, target_recall, max_nprobe=64):

{codna-0.1.49 → codna-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.1.49"
+version = "0.2.0"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.1.49 → codna-0.2.0}/tests/test_packaging.py

@@ -407,6 +407,15 @@ def test_cli_publish_workflow_uses_trusted_publishing_and_contract_verification(
     assert workflow.count("--token-env CODNA_TELYS_OEM_DOWNLOAD_TOKEN") == 2
     assert workflow.count("python scripts/stage_codna_telys_oem_license.py") == 2
     assert workflow.count("--require-staged-runtime") == 2
+    # The wheel's memengine must come from the staged SIGNED bundle (option-B), never the repo's
+    # vendored copy — and each sync must run AFTER its staging step but BEFORE the dist build.
+    assert workflow.count("python scripts/sync_wheel_memengine_from_staged_runtime.py --cli-dir cli") == 2
+    assert "Sync wheel memengine from the staged signed bundle (linux)" in workflow
+    assert "Sync wheel memengine from the staged signed bundle (macos)" in workflow
+    assert workflow.index("Stage Linux Telys runtime") < workflow.index(
+        "Sync wheel memengine from the staged signed bundle (linux)") < workflow.index("Build Linux distribution")
+    assert workflow.index("Stage macOS Telys runtime") < workflow.index(
+        "Sync wheel memengine from the staged signed bundle (macos)") < workflow.index("Build macOS wheel")
     assert "base_wheel_only" not in workflow
     assert "telys runtime install" not in workflow
     assert workflow.count("python scripts/verify_cli_wheel_tags.py --cli-dir cli") == 2