codna 0.1.4__tar.gz → 0.1.5__tar.gz

{codna-0.1.4 → codna-0.1.5}/MANIFEST.in

@@ -1,6 +1,7 @@
 exclude codna/_telys_runtime/libame_kernel.*
 exclude codna/_telys_runtime/manifest.json
-recursive-exclude codna/_telys_runtime libame_kernel.* manifest.json
+exclude codna/_telys_runtime/oem-license.jwt
+recursive-exclude codna/_telys_runtime libame_kernel.* manifest.json oem-license.jwt
 recursive-exclude .codna *
 recursive-exclude .codna-memory *
 global-exclude keys.txt .keys.txt .env .env.* *.log *.pem *.key *.jwt local-stack.json launcher.state

{codna-0.1.4 → codna-0.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.4
+Version: 0.1.5
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -30,6 +30,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 Requires-Dist: httpx>=0.28.0
+Requires-Dist: keyring>=24
 Requires-Dist: mcp>=1.2.0
 Requires-Dist: pyarrow>=15.0.0
 Provides-Extra: mcp

{codna-0.1.4 → codna-0.1.5}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.4"
+__version__ = "0.1.5"

codna-0.1.5/codna/byok_cli.py

@@ -0,0 +1,94 @@
+"""CLI glue for local BYOK — the on-device LLM provider key used by local `codna fix`.
+
+Thin layer over :mod:`codna.keystore`: the ``codna key {set,list,rm}`` command and the provider-key
+step folded into ``codna login``. The key stays on the device (OS keychain) and is never printed; the
+value is read via a no-echo prompt or ``--stdin`` (never argv, to avoid shell-history leaks). Split out
+of ``cli.py`` to keep that module under the modularity ceiling.
+"""
+from __future__ import annotations
+
+import json
+import sys
+from collections.abc import Mapping
+
+from . import keystore
+
+# LLM provider keys the local fixing agent needs (the engine key CODNA_API_KEY is not a model key).
+_PROVIDER_KEYS = tuple(k for k in keystore.MANAGED_KEYS if k != "CODNA_API_KEY")
+
+
+def provider_key_present(runtime_keys: Mapping[str, object]) -> bool:
+    """True if a NON-EMPTY LLM provider key resolves from env or the runtime key map.
+
+    Checks the resolved value, not mere key presence: a value-less ``keys.txt`` line (``ANTHROPIC_API_KEY=``)
+    is dropped by the engine's child-env builder, so treating it as "present" would skip onboarding and
+    leave the fixing agent with no usable key.
+    """
+    import os
+
+    if any((os.environ.get(name) or "").strip() for name in _PROVIDER_KEYS):
+        return True
+    return any(getattr(runtime_keys.get(name), "value", "").strip() for name in _PROVIDER_KEYS)
+
+
+def ensure_local_provider_key(*, interactive: bool, runtime_keys: Mapping[str, object]) -> str:
+    """Offer to store a provider key in the OS keychain if none is configured. Returns a status string.
+
+    Never prints the key. Interactive callers get a no-echo prompt; others get an actionable hint.
+    """
+    if provider_key_present(runtime_keys):
+        return "present"
+    if not interactive:
+        return "not-configured (run `codna key set <provider>`)"
+    try:
+        answer = input(
+            "\nNo local LLM provider key found. Add one now so `codna fix` runs on-device?\n"
+            "  Enter a provider (anthropic/openai/gemini/…) or press Enter to skip: "
+        ).strip()
+    except EOFError:
+        return "not-configured (run `codna key set <provider>`)"
+    if not answer:
+        return "skipped (run `codna key set <provider>` later)"
+    try:
+        import getpass
+
+        secret = getpass.getpass(f"  Paste the {answer} key (input hidden): ").strip()
+        if not secret:
+            return "skipped"
+        stored = keystore.set_key(answer, secret)
+    except keystore.KeystoreError as exc:
+        print(f"  could not store the key: {exc}", file=sys.stderr)
+        return "not-configured"
+    return f"stored:{stored}"
+
+
+def cmd_key(args) -> int:
+    """Manage the on-device LLM provider key(s) used by local `codna fix` (OS keychain; local BYOK)."""
+    action = getattr(args, "key_action", None)
+    try:
+        if action == "list":
+            print(json.dumps(
+                {"ok": True, "keys": keystore.stored_key_names(), "keychain": keystore.available()},
+                indent=2,
+            ))
+            return 0
+        if action == "rm":
+            existed = keystore.delete_key(args.provider)
+            print(json.dumps({"ok": True, "removed": existed, "provider": args.provider}, indent=2))
+            return 0
+        if action == "set":
+            # Read the secret WITHOUT echo / without argv (no shell-history leak). --stdin for CI.
+            if getattr(args, "stdin", False):
+                secret = sys.stdin.readline().strip()
+            else:
+                import getpass
+
+                secret = getpass.getpass(f"Paste the {args.provider} key (input hidden): ").strip()
+            stored = keystore.set_key(args.provider, secret)
+            print(json.dumps({"ok": True, "stored": stored}, indent=2))  # value never printed
+            return 0
+    except keystore.KeystoreError as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 1
+    print(json.dumps({"ok": False, "error": "usage: codna key {set|list|rm} …"}, indent=2), file=sys.stderr)
+    return 2

{codna-0.1.4 → codna-0.1.5}/codna/cli.py

@@ -62,8 +62,15 @@ def _keys_file_path() -> Path:
 
 
 def _runtime_keys():
+    # Precedence (env wins later at resolution time in runtime.config): keychain over legacy keys.txt,
+    # so `codna key set` takes effect even if a stale keys.txt exists. The keychain read never raises.
+    merged = {}
     path = _keys_file_path().expanduser()
-    return parse_keys_file_values(path) if path.is_file() else {}
+    if path.is_file():
+        merged.update(parse_keys_file_values(path))
+    from . import keystore
+    merged.update(keystore.config_values())
+    return merged
 
 
 def _api_key(keys) -> str | None:
@@ -789,6 +796,46 @@ def cmd_mcp(args) -> None:
     mcp_main()
 
 
+def cmd_login(args) -> int:
+    """Authorize THIS device for Codna memory (Telys device-code onboarding) — one app, per device.
+
+    Free for one device; a device always authorizes. Provisions the protected on-device runtime and a
+    device-scoped offline license so `codna` memory then runs fully offline.
+    """
+    from .telys_onboarding import OnboardingError, run_login
+
+    try:
+        result = run_login(
+            token=getattr(args, "token", None),
+            plan=getattr(args, "plan", "telys_developer"),
+            install=not getattr(args, "no_install", False),
+            open_browser=(False if getattr(args, "no_browser", False) else None),
+        )
+    except OnboardingError as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 1
+
+    # One-app onboarding: after authorizing the device, make sure a local LLM provider key exists so
+    # `codna fix` can run on-device. The key stays on the machine (OS keychain) — never sent to the cloud.
+    from . import byok_cli
+    provider_status = byok_cli.ensure_local_provider_key(
+        interactive=sys.stdin.isatty() and sys.stdout.isatty(),
+        runtime_keys=_runtime_keys(),
+    )
+
+    # Report success without echoing anything derived from the API key — the key (and its prefix) is a
+    # credential; codna never logs it. telys.login already cached it securely under $TELYS_HOME.
+    device_id = result.get("device_id") or ""
+    print(json.dumps({
+        "ok": True,
+        "device": (device_id[:12] + "…") if device_id else None,
+        "installed": bool(result.get("installed")),
+        "tier": result.get("tier"),
+        "provider_key": provider_status,
+    }, indent=2))
+    return 0
+
+
 def cmd_doctor(args) -> int:
     keys = _runtime_keys()
     try:
@@ -897,6 +944,28 @@ def build_parser() -> argparse.ArgumentParser:
 
     pm = sub.add_parser("mcp", help="Run codna as an MCP server (Cursor / Claude Desktop).")
     pm.set_defaults(func=cmd_mcp)
+
+    pl = sub.add_parser("login", help="Authorize this device for Codna memory (free for one device).")
+    pl.add_argument("--token", help="headless access token (or env TELYS_TOKEN) — skips the browser step")
+    pl.add_argument("--plan", default="telys_developer", help="onboarding plan (default: telys_developer)")
+    pl.add_argument("--no-install", dest="no_install", action="store_true",
+                    help="authorize + register only; skip provisioning the on-device runtime")
+    pl.add_argument("--no-browser", dest="no_browser", action="store_true",
+                    help="do not open a browser; print the verification URL + code to authorize elsewhere")
+    pl.set_defaults(func=cmd_login)
+
+    from .byok_cli import cmd_key
+    pk = sub.add_parser("key", help="Manage the on-device LLM provider key for local `codna fix` (OS keychain).")
+    pk_sub = pk.add_subparsers(dest="key_action")
+    pk_set = pk_sub.add_parser("set", help="Store a provider key (read via hidden prompt; never on the command line).")
+    pk_set.add_argument("provider", help="provider name (anthropic/openai/gemini/…) or *_API_KEY variable name")
+    pk_set.add_argument("--stdin", action="store_true", help="read the key from stdin (for CI) instead of prompting")
+    pk_set.set_defaults(func=cmd_key)
+    pk_list = pk_sub.add_parser("list", help="List which provider keys are stored (values never shown).")
+    pk_list.set_defaults(func=cmd_key)
+    pk_rm = pk_sub.add_parser("rm", help="Remove a stored provider key.")
+    pk_rm.add_argument("provider", help="provider name or *_API_KEY variable name")
+    pk_rm.set_defaults(func=cmd_key)
     return p
 
 

codna-0.1.5/codna/keystore.py

@@ -0,0 +1,179 @@
+"""On-device provider-key store for Codna (local BYOK), backed by the OS keychain.
+
+Local Codna keeps the user's LLM provider key (Anthropic/OpenAI/…) — and optionally the Codna engine
+key — ON THE DEVICE. It never travels to the cloud. This is the local counterpart to the website BYOK
+card (Supabase-authed, encrypted server-side): same "add your key" idea, storage chosen by where the
+model call runs. Here the call runs locally, so the key lives in the OS secure store (macOS Keychain,
+Windows Credential Manager, Linux Secret Service) via ``keyring`` — not a plaintext ``.env``.
+
+Resolution (see ``cli._runtime_keys`` + ``runtime.config``): an explicit env var always wins, then the
+keychain, then a legacy ``keys.txt``. The value is write-only from the CLI (``codna key set`` reads it
+via a no-echo prompt / stdin, never argv) and is never printed back.
+
+Every ``keyring`` touch is lazy + defensive: on a headless box with no backend, reads degrade to
+"absent" (the engine falls back to env) and writes raise :class:`KeystoreError` with an actionable hint
+— the fix hot path is never crashed by a missing keychain.
+"""
+from __future__ import annotations
+
+from .runtime.config import ConfigValue
+
+SERVICE = "codna"
+# Index entry: keyring backends can't enumerate stored items, so we keep our own name index under a
+# reserved username. (No secret lives in the index — only key NAMES.)
+_INDEX_USERNAME = "__codna_key_index__"
+
+# Provider/LLM keys the local engine forwards to the fixing agent (mirror of
+# runtime.local_stack.PROVIDER_CHILD_ENV_KEYS) + the Codna engine key. Only these may be stored.
+MANAGED_KEYS: tuple[str, ...] = (
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "GEMINI_API_KEY",
+    "GOOGLE_API_KEY",
+    "GROQ_API_KEY",
+    "MISTRAL_API_KEY",
+    "OPENROUTER_API_KEY",
+    "XAI_API_KEY",
+    "CURSOR_API_KEY",
+    "CODNA_API_KEY",
+)
+
+# Friendly aliases so `codna key set anthropic` works (in addition to the raw env-var name).
+PROVIDER_ALIASES: dict[str, str] = {
+    "anthropic": "ANTHROPIC_API_KEY",
+    "openai": "OPENAI_API_KEY",
+    "gemini": "GEMINI_API_KEY",
+    "google": "GOOGLE_API_KEY",
+    "groq": "GROQ_API_KEY",
+    "mistral": "MISTRAL_API_KEY",
+    "openrouter": "OPENROUTER_API_KEY",
+    "xai": "XAI_API_KEY",
+    "cursor": "CURSOR_API_KEY",
+    "codna": "CODNA_API_KEY",
+    "engine": "CODNA_API_KEY",
+}
+
+
+class KeystoreError(RuntimeError):
+    """A keychain operation the user asked for could not be completed (surfaced with remediation)."""
+
+
+def _keyring():
+    """Import keyring or raise KeystoreError with an install hint. Never imported at module load."""
+    try:
+        import keyring
+    except Exception as exc:  # noqa: BLE001 - any import failure means no usable keychain
+        raise KeystoreError(
+            "the OS keychain is unavailable — install it with `pip install keyring` (bundled with "
+            "codna), or set the provider key as an environment variable instead"
+        ) from exc
+    return keyring
+
+
+def normalize_key_name(name: str) -> str:
+    """Map a provider alias or env-var name to a managed env-var key name (or raise)."""
+    raw = (name or "").strip()
+    if not raw:
+        raise KeystoreError("a provider name or *_API_KEY variable name is required")
+    alias = PROVIDER_ALIASES.get(raw.lower())
+    resolved = alias or raw.upper()
+    if resolved not in MANAGED_KEYS:
+        managed = ", ".join(sorted(set(PROVIDER_ALIASES) | set(MANAGED_KEYS)))
+        raise KeystoreError(f"unknown provider key '{name}'. Known: {managed}")
+    return resolved
+
+
+def available() -> bool:
+    """True if a usable OS keychain backend is present (best-effort, never raises)."""
+    try:
+        kr = _keyring()
+        kr.get_password(SERVICE, _INDEX_USERNAME)  # a real backend returns str|None; fail backend raises
+        return True
+    except Exception:  # noqa: BLE001 - KeystoreError (no keyring) or a backend that refuses reads
+        return False
+
+
+def _read_index() -> list[str]:
+    try:
+        kr = _keyring()
+        raw = kr.get_password(SERVICE, _INDEX_USERNAME)
+        # str() defends against a non-conformant backend returning a non-string (keyring's contract is
+        # Optional[str], but `codna key list/set/rm` must not traceback on a misbehaving third-party store).
+        names = [n.strip() for n in str(raw or "").split(",") if n.strip()]
+    except Exception:  # noqa: BLE001
+        return []
+    # Only surface names we still manage (defends against a hand-edited/legacy index).
+    return [n for n in names if n in MANAGED_KEYS]
+
+
+def _write_index(names: list[str]) -> None:
+    kr = _keyring()
+    unique = sorted({n for n in names if n in MANAGED_KEYS})
+    kr.set_password(SERVICE, _INDEX_USERNAME, ",".join(unique))
+
+
+def set_key(name: str, value: str) -> str:
+    """Store a provider key in the OS keychain. Returns the resolved env-var name."""
+    key = normalize_key_name(name)
+    token = (value or "").strip()
+    if not token:
+        raise KeystoreError("refusing to store an empty key")
+    kr = _keyring()
+    try:
+        kr.set_password(SERVICE, key, token)
+    except Exception as exc:  # noqa: BLE001 - backend write failure
+        raise KeystoreError(f"could not write to the OS keychain: {type(exc).__name__}") from exc
+    index = _read_index()
+    if key not in index:
+        _write_index([*index, key])
+    return key
+
+
+def get_key(name: str) -> str | None:
+    """Read a stored provider key, or None if absent / no keychain. Never raises."""
+    try:
+        key = normalize_key_name(name)
+        kr = _keyring()
+        value = kr.get_password(SERVICE, key)
+    except Exception:  # noqa: BLE001
+        return None
+    return value.strip() if value and value.strip() else None
+
+
+def delete_key(name: str) -> bool:
+    """Remove a stored provider key. Returns True if one existed. Idempotent."""
+    key = normalize_key_name(name)
+    kr = _keyring()
+    existed = False
+    try:
+        if kr.get_password(SERVICE, key):
+            existed = True  # observed present BEFORE delete, so a swallowed PasswordDeleteError can't reset it
+            kr.delete_password(SERVICE, key)
+    except Exception as exc:  # noqa: BLE001
+        # delete_password raises PasswordDeleteError when absent on some backends — treat as "gone".
+        from keyring.errors import PasswordDeleteError  # type: ignore
+
+        if not isinstance(exc, PasswordDeleteError):
+            raise KeystoreError(f"could not delete from the OS keychain: {type(exc).__name__}") from exc
+    index = _read_index()
+    if key in index:
+        _write_index([n for n in index if n != key])
+    return existed
+
+
+def stored_key_names() -> list[str]:
+    """Names of keys currently stored (values never returned). Best-effort; never raises."""
+    return [name for name in _read_index() if get_key(name)]
+
+
+def config_values() -> dict[str, ConfigValue]:
+    """Keychain-sourced keys as ConfigValues for the runtime key map. Never raises (returns {})."""
+    out: dict[str, ConfigValue] = {}
+    try:
+        for name in _read_index():
+            value = get_key(name)
+            if value:
+                out[name] = ConfigValue(key=name, value=value, source="keychain")
+    except Exception:  # noqa: BLE001 - a broken keychain must never break the fix hot path
+        return {}
+    return out

{codna-0.1.4 → codna-0.1.5}/codna/memory.py

@@ -9,9 +9,13 @@ runtime wheel in public PyPI metadata. Codna resolves the native kernel from exp
 it — every telys import here is lazy, so ``from codna.memory import CodeMemory`` works without the extra
 and only fails (with a friendly message) when you actually use it.
 
-OEM license handling is explicit and secret-safe: Codna reads ``CODNA_TELYS_LICENSE_JWT`` or
-``CODNA_TELYS_LICENSE_PATH`` when configured, verifies it offline through Telys, and stores only metadata.
-Set ``CODNA_TELYS_LICENSE_REQUIRED=1`` in production channels that must fail closed without the license.
+OEM license handling is explicit and secret-safe. Codna holds a 100-year OEM Telys entitlement that
+covers every Codna user, so users never obtain their own Telys license. A release wheel may bake that
+license alongside the packaged kernel (``codna/_telys_runtime/oem-license.jwt``, staged at build time,
+never committed) so ``codna[memory]`` activates with zero configuration. An explicit
+``CODNA_TELYS_LICENSE_JWT`` / ``CODNA_TELYS_LICENSE_PATH`` always overrides the bundled default. Either
+way the license is verified offline through Telys and only metadata is retained — the JWT is never
+returned or logged. Set ``CODNA_TELYS_LICENSE_REQUIRED=1`` in channels that must fail closed.
 
 The embedder is resolved in :func:`_embedder`: when an engine URL + API key are configured, recall uses
 the **API-key-gated engine** ``/v1/embeddings`` for REAL semantic vectors (the model auto-tracks the LLM
@@ -40,6 +44,7 @@ import sys
 import time
 
 from .codeunits import FILTER_COLUMNS, UnsupportedLanguageError, extract_repo, resolve_languages
+from .memory_manifest import legacy_manifest_id_belongs_to_repo, manifest_entry, manifest_hash, manifest_scope
 
 COLLECTION = "repo_symbols"
 DEFAULT_DB_DIRNAME = ".codna-memory"
@@ -54,6 +59,10 @@ _CODNA_INSTALL_ROOT_ENV_NAME = "CODNA_TELYS_INSTALL_ROOT"
 _PACKAGE_RUNTIME_DIRNAME = "_telys_runtime"
 _PACKAGE_RUNTIME_MANIFEST = "manifest.json"
 _PACKAGE_RUNTIME_SCHEMA_VERSION = 1
+# Codna holds a 100-year OEM Telys entitlement covering every Codna user, so users never obtain their
+# own Telys license. When a release bakes that OEM license here (a companion to the packaged kernel,
+# staged at build time — never committed), codna[memory] activates with zero user configuration.
+_PACKAGE_LICENSE_FILENAME = "oem-license.jwt"
 _LAST_KERNEL_RESOLUTION: dict | None = None
 
 
@@ -246,18 +255,20 @@ def _kernel_hint() -> str:
     if checked_lines:
         checked_lines = "\nCodna checked:\n" + checked_lines
     return (
-        "the Telys kernel could not be loaded. Run `telys runtime install --file <bundle> "
-        "--license <license.jwt>`, set TELYS_KERNEL=/abs/path/to/libame_kernel, or set "
-        "CODNA_TELYS_INSTALL_ROOT to a Codna-managed install containing kernel/"
-        f"{_kernel_filename()}.{checked_lines}"
+        "the Telys kernel could not be loaded. Run `codna login` to authorize this device and "
+        "provision the on-device runtime (free for one device), or for advanced/offline installs run "
+        "`telys runtime install --file <bundle> --license <license.jwt>`, set "
+        "TELYS_KERNEL=/abs/path/to/libame_kernel, or set CODNA_TELYS_INSTALL_ROOT to a Codna-managed "
+        f"install containing kernel/{_kernel_filename()}.{checked_lines}"
     )
 
 
 def _runtime_install_hint() -> str:
     return (
-        "the Telys runtime is not installed. Install the public SDK with `pip install 'codna[memory]'`, "
-        "then run `telys runtime install --file <bundle> --license <license.jwt>`, use a Codna-packaged "
-        "runtime artifact, or set TELYS_KERNEL/CODNA_TELYS_INSTALL_ROOT to an installed local runtime."
+        "the Telys runtime is not installed. Install the extra with `pip install 'codna[memory]'`, then "
+        "run `codna login` to authorize this device and provision the on-device runtime (free for one "
+        "device). Advanced/offline: `telys runtime install --file <bundle> --license <license.jwt>`, a "
+        "Codna-packaged runtime artifact, or set TELYS_KERNEL/CODNA_TELYS_INSTALL_ROOT."
     )
 
 
@@ -285,6 +296,20 @@ def _truthy_env(name: str) -> bool:
     return (os.environ.get(name) or "").strip().lower() in {"1", "true", "yes", "on"}
 
 
+def _package_license_path() -> Path:
+    """Path to the OEM license baked into the release wheel (may not exist)."""
+    return _package_runtime_dir() / _PACKAGE_LICENSE_FILENAME
+
+
+def _onboarding_license_path() -> Path:
+    """Path where `codna login` (telys.login) writes this device's per-device offline license.
+
+    Mirrors telys.paths.telys_home() ($TELYS_HOME or ~/.telys) without importing telys.
+    """
+    home = os.path.abspath(os.environ.get("TELYS_HOME") or os.path.join(os.path.expanduser("~"), ".telys"))
+    return Path(home) / "login_license.jwt"
+
+
 def _configured_license_token() -> tuple[str | None, str | None]:
     for name in _LICENSE_ENV_NAMES:
         raw = os.environ.get(name)
@@ -311,6 +336,33 @@ def _configured_license_token() -> tuple[str | None, str | None]:
             raise CodeMemoryError(f"Telys license path from {name} is empty: {path}")
         return token, f"path:{name}"
 
+    # Per-device license from `codna login` (telys.login device-code onboarding). This is the primary
+    # entitlement for the standard product: each device authorizes and gets its own device-scoped
+    # license. It wins over the embedded OEM umbrella below so per-device licensing is the default.
+    onboarding = _onboarding_license_path()
+    if onboarding.is_file():
+        try:
+            token = onboarding.read_text(encoding="utf-8").strip()
+        except OSError as exc:
+            raise CodeMemoryError(f"Codna device login license is unreadable: {onboarding}") from exc
+        if token:
+            return token, "codna:onboarding-license"
+
+    # Codna's embedded OEM entitlement: a release wheel may bake the 100-year license alongside the
+    # kernel so every Codna user is covered without configuring or obtaining their own Telys license.
+    # An explicit env/path (above) always wins; this is the zero-config default.
+    bundled = _package_license_path()
+    if bundled.is_file():
+        try:
+            token = bundled.read_text(encoding="utf-8").strip()
+        except OSError as exc:
+            raise CodeMemoryError(
+                f"Codna packaged Telys OEM license is unreadable: {bundled}"
+            ) from exc
+        if not token:
+            raise CodeMemoryError(f"Codna packaged Telys OEM license is empty: {bundled}")
+        return token, "codna:package-license"
+
     return None, None
 
 
@@ -671,9 +723,10 @@ class CodeMemory:
     def index(self, *, languages: tuple[str, ...] | None = None, refresh: bool = True) -> dict:
         """Extract the repo into structural units and upsert them per scope; delete vanished symbols.
 
-        The vanished-diff reads each scope's live ids back from Telys (`col.ids(where=scope)`) — Codna
-        keeps no side id map. The prune is SCOPE-LOCAL, so re-indexing one repo/scope never touches
-        another's rows in a shared collection.
+        The vanished-diff uses Codna's local content-hash manifest as the prune authority. Telys search is
+        still the retrieval engine, but prune must be deterministic and scope-local even if the runtime's
+        id enumeration semantics change. Re-indexing one repo/scope never touches another's rows in a
+        shared collection.
         """
         try:
             resolved_languages = resolve_languages(languages)
@@ -707,25 +760,43 @@ class CodeMemory:
             new_ids.setdefault(scope, set()).add(u.id)
 
         removed = 0
+        vanished: list[str] = []
         if refresh:
             # The scopes this index owns ((repo_id, service) × the scopes written + the requested
-            # languages, so an emptied scope is still pruned). Read each scope's current live ids from
-            # Telys and delete the ones this index no longer produces.
+            # languages, so an emptied scope is still pruned). Delete only ids from those scopes that the
+            # current extraction no longer produces. Older string-only manifests are supported by falling
+            # back to the stable repo-id prefix.
             owned = set(new_ids) | {self._scope_key(self.repo_id, self.service or "", lang)
                                     for lang in resolved_languages}
-            for scope in owned:
-                vanished = sorted(set(col.ids(where={"scope_key": scope})) - new_ids.get(scope, set()))
-                if vanished:
-                    col.delete(vanished)
-                    removed += len(vanished)
+            produced = set().union(*new_ids.values()) if new_ids else set()
+            vanished = sorted(
+                unit_id
+                for unit_id, entry in prev.items()
+                if unit_id not in produced
+                and (
+                    manifest_scope(entry) in owned
+                    or (manifest_scope(entry) is None and legacy_manifest_id_belongs_to_repo(unit_id, self.repo_id))
+                )
+            )
+            if vanished:
+                col.delete(vanished)
+                removed = len(vanished)
 
         written = unchanged = 0
+        new_hashes: dict[str, dict] = {}
         for scope, group in by_scope.items():
             changed = []
             for u in group:
                 h = _uhash(u)
-                new_hashes[u.id] = h
-                if prev.get(u.id) == h:        # unchanged content (same space) -> skip the embed/upsert
+                service_key = self.service or u.service or ""
+                new_hashes[u.id] = manifest_entry(
+                    digest=h,
+                    repo_id=self.repo_id,
+                    service=service_key,
+                    language=u.language,
+                    scope_key=scope,
+                )
+                if manifest_hash(prev.get(u.id)) == h:        # unchanged content (same space) -> skip the embed/upsert
                     unchanged += 1
                 else:
                     changed.append(u)
@@ -741,7 +812,11 @@ class CodeMemory:
 
         col.compact()
         col.save()
-        self._save_hashes(new_hashes)
+        merged_hashes = dict(prev) if refresh else {}
+        for unit_id in vanished:
+            merged_hashes.pop(unit_id, None)
+        merged_hashes.update(new_hashes)
+        self._save_hashes(merged_hashes)
         self._write_meta(commit=commit, branch=branch)
         return {"indexed": written, "unchanged": unchanged, "removed": removed, "scopes": len(by_scope),
                 "files": stats.files, "skipped": stats.skipped, "languages": list(resolved_languages)}
@@ -849,7 +924,7 @@ class CodeMemory:
             "partitions": s.get("partitions"),
             "documents": s.get("external_ids"),
             "delta_rows": s.get("delta_rows"),
-            "embedding_space": s.get("embedding_space"),
+            "embedding_space": s.get("embedding_space") or meta.get("space_id"),
             "last_indexed_commit": meta.get("commit_sha"),
             "last_indexed_at": meta.get("indexed_at"),
             "fallback_rate": None,                         # no query log yet (Telys exports no metrics)

codna-0.1.5/codna/memory_manifest.py

@@ -0,0 +1,32 @@
+"""Local content-hash manifest helpers for Codna memory indexing."""
+from __future__ import annotations
+
+
+def manifest_hash(entry) -> str | None:
+    if isinstance(entry, str):
+        return entry
+    if isinstance(entry, dict):
+        value = entry.get("hash")
+        return value if isinstance(value, str) else None
+    return None
+
+
+def manifest_entry(*, digest: str, repo_id: str, service: str, language: str, scope_key: str) -> dict:
+    return {
+        "hash": digest,
+        "repo_id": repo_id,
+        "service": service,
+        "language": language,
+        "scope_key": scope_key,
+    }
+
+
+def manifest_scope(entry) -> str | None:
+    if isinstance(entry, dict):
+        value = entry.get("scope_key")
+        return value if isinstance(value, str) else None
+    return None
+
+
+def legacy_manifest_id_belongs_to_repo(unit_id: str, repo_id: str) -> bool:
+    return unit_id.startswith(f"{repo_id}:")

{codna-0.1.4 → codna-0.1.5}/codna/runtime/config.py

@@ -50,7 +50,7 @@ class RuntimeConfigError(RuntimeError):
 class ConfigValue:
     key: str
     value: str
-    source: Literal["env", "keys_txt", "default"]
+    source: Literal["env", "keys_txt", "keychain", "default"]
 
 
 @dataclass(frozen=True)