codna 0.1.5__tar.gz → 0.1.7__tar.gz

{codna-0.1.5 → codna-0.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.1.5
+Version: 0.1.7
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -33,6 +33,7 @@ Requires-Dist: httpx>=0.28.0
 Requires-Dist: keyring>=24
 Requires-Dist: mcp>=1.2.0
 Requires-Dist: pyarrow>=15.0.0
+Requires-Dist: pyyaml>=6
 Provides-Extra: mcp
 Provides-Extra: memory
 Requires-Dist: telys>=0.1.0b1; extra == "memory"

{codna-0.1.5 → codna-0.1.7}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.1.5"
+__version__ = "0.1.7"

{codna-0.1.5 → codna-0.1.7}/codna/cli.py

@@ -12,8 +12,6 @@ from itertools import count
 import json
 import os
 from pathlib import Path
-from pathlib import PurePosixPath
-import re
 import subprocess
 import sys
 import time
@@ -22,17 +20,13 @@ from typing import Any
 import httpx
 
 from . import __version__
+from .focus_paths import _issue_focus_paths  # focus-path extraction (split out to keep cli.py small)
 from .agent_core_runtime import ensure_agent_core_running, inspect_agent_core_runtime, stop_agent_core_runtime
-from .cli_errors import format_cli_error
 from .local_mojo_pool import legacy_global_mojo_worker_diagnostics, mojo_worker_diagnostics
 from .runtime import LocalRuntimeError, ensure_running
 from .runtime.config import API_KEY_KEYS, RuntimeConfigError, parse_keys_file_values, resolve_runtime_config
 
 _CONNECTOR_NAME_COUNTER = count()
-_FOCUS_PATH_PATTERNS = (
-    re.compile(r'File\s+"([^"]+)"(?:,\s*line\s*\d+)?', re.I),
-    re.compile(r"\b(?:Target file|Path):\s*`?([^`\s]+)`?", re.I),
-)
 
 
 class CodnaError(Exception):
@@ -57,17 +51,33 @@ def _structured_error(exc: BaseException) -> dict[str, object] | None:
     }
 
 
-def _keys_file_path() -> Path:
-    return Path(os.environ.get("CODNA_KEYS_FILE") or (Path(__file__).resolve().parents[2] / "keys.txt"))
+def _keys_file_path() -> Path | None:
+    """The legacy DEV ``keys.txt`` (repo-root config for dev/CI), or ``None`` for an installed package.
+
+    keys.txt is purely a source-checkout convenience. An END USER installs a wheel and must never see
+    codna hunting for a ``keys.txt`` inside ``site-packages`` — so for an installed package we return
+    ``None`` (no path computed, no stat, nothing surfaced in diagnostics). An explicit ``CODNA_KEYS_FILE``
+    always wins (dev/CI); otherwise the default is used only from a source checkout.
+    """
+    override = os.environ.get("CODNA_KEYS_FILE")
+    if override:
+        return Path(override)
+    here = Path(__file__).resolve()
+    if any(part in ("site-packages", "dist-packages") for part in here.parts):
+        return None  # installed wheel — keys.txt is a dev-only artifact, never looked for here
+    return here.parents[2] / "keys.txt"
 
 
 def _runtime_keys():
     # Precedence (env wins later at resolution time in runtime.config): keychain over legacy keys.txt,
-    # so `codna key set` takes effect even if a stale keys.txt exists. The keychain read never raises.
+    # so `codna key set` takes effect even if a stale keys.txt exists. keys.txt is DEV-only and is never
+    # looked for in an installed package (see _keys_file_path). The keychain read never raises.
     merged = {}
-    path = _keys_file_path().expanduser()
-    if path.is_file():
-        merged.update(parse_keys_file_values(path))
+    path = _keys_file_path()
+    if path is not None:
+        path = path.expanduser()
+        if path.is_file():
+            merged.update(parse_keys_file_values(path))
     from . import keystore
     merged.update(keystore.config_values())
     return merged
@@ -313,49 +323,6 @@ def _local_repo_connector_config(local_path: str) -> dict[str, object]:
     return config
 
 
-def _normalize_focus_path(local_path: str, raw_path: str) -> str | None:
-    repo_root = Path(local_path).expanduser().resolve()
-    candidate = raw_path.strip().strip("`'\"")
-    candidate = candidate.lstrip("<([{")
-    candidate = candidate.rstrip(">)]},:;")
-    candidate = candidate.replace("\\", "/")
-    if not candidate:
-        return None
-    candidate_path = Path(candidate)
-    if candidate_path.is_absolute():
-        try:
-            relative = candidate_path.resolve().relative_to(repo_root)
-        except ValueError:
-            return None
-    else:
-        relative = Path(PurePosixPath(candidate))
-        if ".." in relative.parts or relative.is_absolute():
-            return None
-    normalized = PurePosixPath(relative.as_posix())
-    if normalized.as_posix() in {"", "."}:
-        return None
-    if not (repo_root / normalized.as_posix()).is_file():
-        return None
-    return normalized.as_posix()
-
-
-def _issue_focus_paths(local_path: str, issue: str | None) -> list[str]:
-    if not issue:
-        return []
-    output: list[str] = []
-    seen: set[str] = set()
-    for pattern in _FOCUS_PATH_PATTERNS:
-        for match in pattern.finditer(issue):
-            normalized = _normalize_focus_path(local_path, match.group(1))
-            if normalized is None or normalized in seen:
-                continue
-            seen.add(normalized)
-            output.append(normalized)
-            if len(output) >= 8:
-                return output
-    return output
-
-
 def _register(
     c,
     repo: str,
@@ -386,8 +353,10 @@ def _register(
 
 
 def cmd_triage(args) -> None:
+    as_json = getattr(args, "as_json", False)
     c = _client()
-    print(f"codna: understanding {args.repo} …")
+    if not as_json:
+        print(f"codna: understanding {args.repo} …")
     t = time.perf_counter()
     local = os.path.abspath(os.path.expanduser(args.repo))
     issue = args.issue or "Map this repository and locate its most relevant code."
@@ -402,162 +371,47 @@ def cmd_triage(args) -> None:
     raw = tri.get("raw_repo_token_estimate") or 0
     bundle = tri.get("evidence_bundle_token_count") or 0
     rr = tri.get("reduction_ratio")
+    if as_json:
+        # Stable machine-readable triage result (stdout stays pure JSON; errors go to stderr in main()).
+        print(json.dumps({
+            "repository_id": rid,
+            "snapshot_id": snap.get("snapshot_id"),
+            "snapshot_file_count": files,
+            "suspect_files": tri.get("suspect_files") or [],
+            "suspect_symbols": tri.get("suspect_symbols") or [],
+            "raw_repo_token_estimate": raw,
+            "evidence_bundle_token_count": bundle,
+            "reduction_ratio": rr,
+            "workspace_evidence_bundle_ref": tri.get("workspace_evidence_bundle_ref"),
+            "elapsed_s": round(dt, 3),
+        }, indent=2))
+        return
     print(f"\n✓ codna understood {files} files in {dt:.1f}s")
     print(f"  suspect files : {', '.join(tri.get('suspect_files') or []) or '(none)'}")
     if rr:
         print(f"  context        : {raw:,} → {bundle:,} tokens  ({rr:.0f}× smaller for the agent)")
 
 
-def _from_junit(path: str):
-    """Turn a JUnit/pytest XML report into (issue_text, [failing_test_ids])."""
-    import xml.etree.ElementTree as ET
-    try:
-        root = ET.parse(os.path.expanduser(path)).getroot()
-    except Exception as exc:  # noqa: BLE001
-        _die(f"could not read JUnit report {path}: {exc}")
-    failing = []
-    for case in root.iter("testcase"):
-        if case.find("failure") is not None or case.find("error") is not None:
-            name = case.get("name", "")
-            cls = case.get("classname", "")
-            failing.append(f"{cls}::{name}" if cls else name)
-    if not failing:
-        return None, []
-    return f"{len(failing)} failing test(s): " + "; ".join(failing[:8]), failing
-
-
-def _resolve_issue(args):
-    if args.from_junit:
-        issue, failing = _from_junit(args.from_junit)
-        if args.issue:
-            issue = args.issue
-        return issue, failing
-    return args.issue, (args.failing_test or [])
-
-
-def _sim_id(sim: dict):
-    # /simulate returns a DecisionEnvelope; the simulation id is surfaced in
-    # validated_inputs.simulation_id (see engine execution_workflow ~L499).
-    vi = sim.get("validated_inputs") or {}
-    if vi.get("simulation_id"):
-        return vi["simulation_id"]
-    for k in ("simulation_id", "id"):
-        if sim.get(k):
-            return sim[k]
-    for nest in ("envelope", "decision_plan", "result"):
-        v = (sim.get(nest) or {})
-        if isinstance(v, dict) and v.get("simulation_id"):
-            return v["simulation_id"]
-    return None
-
-
-def _pr_body(issue, ra, plan):
-    dp = plan.get("decision_plan") or {}
-    lines = ["Automated fix by **codna**.", "", f"**Issue:** {issue}"]
-    if ra.get("root_cause"):
-        lines.append(f"**Root cause:** {ra['root_cause']}")
-    if ra.get("impacted_symbols"):
-        lines.append(f"**Symbols:** {', '.join(ra['impacted_symbols'])}")
-    if dp.get("confidence") is not None:
-        lines.append(f"**Confidence:** {int(dp['confidence'] * 100)}%")
-    lines += ["", "_Review before merging._"]
-    return "\n".join(lines)
+# Fix-input helpers (from_junit / resolve_issue / sim_id / pr_body) live in fix_inputs.py to keep
+# cli.py under the modularity ceiling. Aliased to the historical private names so cmd_fix call
+# sites and tests are unchanged.
 
 
-def cmd_fix(args) -> None:
+def cmd_fix(args) -> int:
+    """Find + fix a bug. With --apply runs the risk gate + applies to a local branch; with --tests it
+    then re-runs the repo's tests and, up to --max-iterations, re-fixes until green. --json for scripts."""
+    from . import fix_run
     c = _client()
-    issue, failing = _resolve_issue(args)
-    if not issue:
-        _die("`codna fix` needs --issue (or --from-junit) describing what's broken.")
-    gh_token = (args.github_token or os.environ.get("CODNA_GITHUB_TOKEN")
-                or os.environ.get("GITHUB_TOKEN"))
-    if args.open_pr:
-        if os.path.isdir(os.path.abspath(os.path.expanduser(args.repo))):
-            _die("--open-pr needs a git URL (a local path has no remote to push to).")
-        if not gh_token:
-            _die("--open-pr needs a write token: pass --github-token or set GITHUB_TOKEN.")
-    print(f"codna: fixing {args.repo} …")
-    t = time.perf_counter()
-    local = os.path.abspath(os.path.expanduser(args.repo))
-    focus_paths = _issue_focus_paths(local, issue) if os.path.isdir(local) else []
-    rid, snap = _register(
-        c,
-        args.repo,
-        args.ref,
-        github_token=gh_token if args.open_pr else None,
-        focus_paths=focus_paths,
-    )
-    sig = {"issue_text": issue, "failing_tests": failing}
-    if focus_paths:
-        sig["changed_files"] = focus_paths
-    try:
-        tri = _dump(c.triage_repository(rid, {"snapshot_id": snap["snapshot_id"], "signals": sig}))
-        plan = _dump(c.create_repository_decision_plan(rid, {
-            "snapshot_id": snap["snapshot_id"],
-            "workspace_evidence_bundle_ref": tri.get("workspace_evidence_bundle_ref"),
-            "signals": sig,
-            "model": args.model,
-        }))
-    except CodnaError:
-        raise
-    except Exception as exc:  # noqa: BLE001
-        if exc.__class__.__module__.startswith("codna."):
-            raise
-        raise CodnaError(f"fix failed: {format_cli_error(exc)}") from exc
-    dt = time.perf_counter() - t
-    dp = plan.get("decision_plan") or {}
-    ra = dp.get("repository_analysis") or {}
-    usage = plan.get("planner_usage") or {}
-    tr = ra.get("token_reduction_metrics") or {}
-    risk = dp.get("risk") or {}
-    cost = usage.get("cost_usd")
-    print(f"\n✓ codna fixed {args.repo} in {dt:.0f}s")
-    print(f"  root cause   : {ra.get('root_cause','?')}")
-    if ra.get("impacted_symbols"):
-        print(f"  symbol       : {', '.join(ra['impacted_symbols'])}  (blast radius: {ra.get('blast_radius','?')})")
-    print(f"  confidence   : {int((dp.get('confidence') or 0)*100)}%"
-          + (f"  ·  regression risk: {int((risk.get('probability_of_loss') or 0)*100)}%" if risk else ""))
-    if tr.get("reduction_ratio"):
-        print(f"  context      : {int(tr.get('raw_repo_token_estimate',0)):,} → "
-              f"{int(tr.get('evidence_bundle_token_count',0)):,} tokens  ({tr['reduction_ratio']:.0f}× smaller)")
-    out_tok, in_tok = usage.get("output_tokens"), usage.get("input_tokens")
-    have_tokens = isinstance(out_tok, (int, float)) and isinstance(in_tok, (int, float))
-    print(f"  agent        : {plan.get('runtime_model','?')} via codna"
-          + (f"  ·  tokens: {int(in_tok):,} in / {int(out_tok):,} out" if have_tokens else "")
-          + (f"  ·  cost: ${cost:.3f}" if cost is not None else ""))
-    pref = ra.get("generated_patch_ref")
-    if not (args.open_pr or args.apply):
-        print(f"  patch        : {pref}   (--apply for a local branch · --open-pr to open a PR)")
-        return
-    # apply requires a simulation id — run the deterministic risk gate first
-    try:
-        sim = _dump(c.simulate_repository(rid, {"snapshot_id": snap["snapshot_id"],
-                                                "decision_plan_id": plan.get("decision_plan_id")}))
-        sid = _sim_id(sim)
-        if not sid:
-            _die(f"no simulation id in simulate() response (keys: {list(sim)[:8]})")
-        if args.open_pr:
-            res = _dump(c.apply_repository(rid, {
-                "mode": "remote_pr", "write_permission": True,
-                "decision_plan_id": plan.get("decision_plan_id"), "simulation_id": sid,
-                **({"base_branch": args.base_branch} if args.base_branch else {}),
-                "pull_request_title": args.pr_title or f"codna: fix {(ra.get('root_cause') or 'bug')[:60]}",
-                "pull_request_body": args.pr_body or _pr_body(issue, ra, plan),
-            }))
-            url = res.get("pull_request_url")
-            print(f"\n✓ opened pull request: {url}" if url
-                  else f"  applied (no PR url): {res.get('status', res)}")
-        else:
-            res = _dump(c.apply_repository(rid, {
-                "mode": "local_branch", "write_permission": True,
-                "decision_plan_id": plan.get("decision_plan_id"), "simulation_id": sid}))
-            print(f"  applied      : branch {res.get('branch_name')} "
-                  f"@ {res.get('local_checkout_path') or res.get('commit_sha')}")
-    except Exception as exc:  # noqa: BLE001
-        raise CodnaError(
-            f"apply failed: {format_cli_error(exc)}"
-            + (f"  (patch ref: {pref})" if pref else "")
-        ) from exc
+    as_json = getattr(args, "as_json", False)
+    if not as_json:
+        print(f"codna: fixing {args.repo} …")
+    result = fix_run.run_fix(c, args)
+    if as_json:
+        print(json.dumps(result, indent=2))
+    else:
+        print("\n".join(fix_run.render_human(result)))
+    # non-zero exit when verification ran and did not reach green (scriptable signal)
+    return 1 if result.get("verified") is False else 0
 
 
 def cmd_secure(args) -> None:
@@ -600,7 +454,8 @@ def cmd_secure(args) -> None:
         engine = LocalReferenceEngine()
     else:
         c = _client()
-        print(f"codna: understanding {args.repo} for security analysis …")
+        if not getattr(args, "as_json", False):
+            print(f"codna: understanding {args.repo} for security analysis …")
         rid, snap = _register(c, args.repo, args.ref)
         url, key = _engine_url_key()
         model_pack = os.environ.get("CODNA_MODEL_PACK_DIGEST", "sha256:" + "0" * 64)
@@ -613,6 +468,18 @@ def cmd_secure(args) -> None:
 
     from .secure import classify_only
     report = classify_only(ingest, engine=engine, policy=policy)
+    if getattr(args, "as_json", False):
+        # Structured Tier-1 reachability result (read-only; --fix/--open-pr remediation stays human).
+        print(json.dumps({
+            "repository": args.repo,
+            "sarif": args.from_sarif,
+            "findings": [{"classification": str(r.classification), "rule_id": r.rule_id,
+                          "finding_kind": r.finding_kind, "eligible": bool(r.eligible),
+                          "reason": None if r.eligible else r.reason} for r in report.rows],
+            "summary": report.counts(),
+            "autofix_eligible": report.eligible,
+        }, indent=2))
+        return
     print(f"\n✓ analyzed {len(report.rows)} finding(s) from {args.from_sarif}")
     for r in report.rows:
         mark = "→" if r.eligible else "·"
@@ -791,9 +658,90 @@ def cmd_secure_open_pr(args) -> None:
     print(f"✓ opened draft PR: {url}")
 
 
-def cmd_mcp(args) -> None:
+def cmd_webhook(args):
+    """Run Codna's GitHub App webhook — the App channel, owned in Codna.
+
+    Verifies each delivery's signature, classifies the event into a Codna job
+    (fix on failing CI / `codna-fix`; security-autofix on `codna-secure` /
+    code-scanning alerts), and dispatches by invoking the `codna` CLI. All of
+    this is Codna-specific product wiring and lives in Codna, never in the
+    Algenta SDK/engine (which ships generic to other users).
+    """
+    from .webhook import WebhookError, serve
+
+    action = getattr(args, "action", "serve") or "serve"
+    if action != "serve":
+        _die(f"unknown `codna webhook` action: {action}")
+    host = getattr(args, "host", "0.0.0.0")
+    port = int(getattr(args, "port", 8080))
+    try:
+        print(f"codna webhook: listening on {host}:{port}/webhooks/github", file=sys.stderr)
+        serve(host=host, port=port)
+    except WebhookError as exc:
+        _die(str(exc))
+    except KeyboardInterrupt:
+        return 0
+    return 0
+
+
+def cmd_mcp(args):
+    action = getattr(args, "action", "start") or "start"
+    if action == "install":
+        from .mcp_install import McpInstallError, install
+        client = getattr(args, "client", None)
+        if not client:
+            _die("`codna mcp install` needs --client cursor|claude.")
+        try:
+            summary = install(client, project=getattr(args, "project", False), repo=getattr(args, "repo", None))
+        except McpInstallError as exc:
+            print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+            return 1
+        print(json.dumps({"ok": True, **summary}, indent=2))
+        return 0
+    # start (default): `codna mcp start --repo X` sets the default repo the MCP tools use when a client
+    # passes "." — FastMCP tool functions get their args from the client, so the default is carried via env.
+    repo = getattr(args, "repo", None)
+    if repo:
+        local = os.path.abspath(os.path.expanduser(repo))
+        os.environ["CODNA_MCP_DEFAULT_REPO"] = local if os.path.isdir(local) else repo
     from .mcp_server import main as mcp_main
     mcp_main()
+    return 0
+
+
+def cmd_review(args) -> int:
+    """Read-only risk review of a change: diff the working tree (or vs --base) + triage the changes."""
+    from . import review
+    c = _client()
+    result = review.run_review(c, args)
+    if getattr(args, "as_json", False):
+        print(json.dumps(result, indent=2))
+        return 0
+    if not result.get("changed_files"):
+        print(f"codna: {result.get('note', 'no changes to review')}")
+        return 0
+    files = result["changed_files"]
+    print(f"✓ reviewed {len(files)} changed file(s) vs {result['base']}")
+    print(f"  changed      : {', '.join(files[:8])}" + (" …" if len(files) > 8 else ""))
+    print(f"  suspect files: {', '.join(result['suspect_files']) or '(none)'}")
+    if result.get("suspect_symbols"):
+        print(f"  suspect syms : {', '.join(result['suspect_symbols'][:8])}")
+    return 0
+
+
+def cmd_init(args) -> int:
+    from .scaffold import init_project
+    result = init_project(force=getattr(args, "force", False), with_agents=not getattr(args, "no_agents", False))
+    print(json.dumps({"ok": True, "files": result}, indent=2))
+    return 0
+
+
+def cmd_status(args) -> int:
+    """Concise health: engine · telys runtime · license · keys. Degrades gracefully (no spawn)."""
+    from .status import build_status_lines
+    keys = _runtime_keys()
+    print("\n".join(build_status_lines(keys, api_key_present=bool(_api_key(keys)))))
+    return 0
 
 
 def cmd_login(args) -> int:
@@ -889,19 +837,25 @@ def _doctor_mojo_worker_diagnostics(keys) -> dict[str, object]:
 def build_parser() -> argparse.ArgumentParser:
     p = argparse.ArgumentParser(prog="codna", description="Codna — understand, fix & secure your repo.")
     p.add_argument("--version", action="version", version=f"codna {__version__}")
+    p.add_argument("--config", help="path to codna.yaml (default: ./codna.yaml or ./.codna.yaml)")
     sub = p.add_subparsers(dest="cmd")
 
     pt = sub.add_parser("triage", help="Understand a repo + locate relevant code (fast, deterministic).")
     pt.add_argument("repo", nargs="?", default=".", help="local path or git URL (default: current dir)")
     pt.add_argument("--ref", help="branch/tag/commit")
     pt.add_argument("--issue", help="optional: what you're looking for")
-    pt.set_defaults(func=cmd_triage)
+    pt.add_argument("--json", dest="as_json", action="store_true", help="emit the triage result as JSON")
+    pt.set_defaults(func=cmd_triage, uses_config=True)
 
     pf = sub.add_parser("fix", help="Find and fix a bug in a repo.")
     pf.add_argument("repo", nargs="?", default=".", help="local path or git URL (default: current dir)")
     pf.add_argument("--issue", required=False, help="what's broken (e.g. the failing test)")
     pf.add_argument("--failing-test", action="append", help="failing test id (repeatable)")
     pf.add_argument("--from-junit", help="read failing tests from a JUnit/pytest XML report")
+    pf.add_argument("--tests", action="store_true",
+                    help="auto-discover failing tests by running the repo's tests (sandboxed) and fix them")
+    pf.add_argument("--test-cmd", dest="test_cmd",
+                    help="custom test command for --tests (writes JUnit to $CODNA_JUNIT); default is pytest")
     pf.add_argument("--ref", help="branch/tag/commit")
     pf.add_argument("--model", default="repository.verified_agentic_v1",
                     help="planner model (default: the codna agent planner)")
@@ -912,7 +866,10 @@ def build_parser() -> argparse.ArgumentParser:
     pf.add_argument("--base-branch", help="PR base branch (default: repo default)")
     pf.add_argument("--pr-title", help="pull request title")
     pf.add_argument("--pr-body", help="pull request body")
-    pf.set_defaults(func=cmd_fix)
+    pf.add_argument("--json", dest="as_json", action="store_true", help="emit the fix result as JSON")
+    pf.add_argument("--max-iterations", dest="max_iterations", type=int, default=1,
+                    help="with --tests --apply: re-fix up to N times until the tests pass (default: 1)")
+    pf.set_defaults(func=cmd_fix, uses_config=True)
 
     pd = sub.add_parser("doctor", help="Inspect the owned local Codna runtime and optionally start agent-core.")
     pd.add_argument("--start-stack", action="store_true", help="Ensure the fixed local agent-core runtime is running.")
@@ -933,7 +890,9 @@ def build_parser() -> argparse.ArgumentParser:
     ps.add_argument("--github-token", help="write token for --open-pr (or env GITHUB_TOKEN)")
     ps.add_argument("--base-branch", help="PR base branch (default: repo default)")
     ps.add_argument("--repo-slug", dest="repo_slug", help="owner/repo for --open-pr (else derived from the git remote)")
-    ps.set_defaults(func=cmd_secure)
+    ps.add_argument("--json", dest="as_json", action="store_true",
+                    help="emit the Tier-1 reachability result as JSON (read-only)")
+    ps.set_defaults(func=cmd_secure, uses_config=True)
 
     po = sub.add_parser("secure-open-pr", help="Writer domain: verify a signed evidence bundle and open the draft PR.")
     po.add_argument("--evidence", required=True, help="evidence dir (attestation.json + patch.diff + finding.json)")
@@ -942,9 +901,39 @@ def build_parser() -> argparse.ArgumentParser:
     po.add_argument("--base-branch", help="PR base branch (default: main)")
     po.set_defaults(func=cmd_secure_open_pr)
 
-    pm = sub.add_parser("mcp", help="Run codna as an MCP server (Cursor / Claude Desktop).")
+    pw = sub.add_parser("webhook", help="Run Codna's GitHub App webhook (the App channel, owned in Codna).")
+    pw_sub = pw.add_subparsers(dest="action")
+    pw_serve = pw_sub.add_parser("serve", help="Serve the webhook: verify → classify → run codna fix/secure.")
+    pw_serve.add_argument("--host", default="0.0.0.0", help="bind host (default: 0.0.0.0)")
+    pw_serve.add_argument("--port", type=int, default=8080, help="bind port (default: 8080)")
+    pw_serve.set_defaults(func=cmd_webhook, action="serve")
+    pw.set_defaults(func=cmd_webhook, action="serve")
+
+    pm = sub.add_parser("mcp", help="Run codna as an MCP server, or install it into a client (Cursor / Claude).")
+    pm.add_argument("action", nargs="?", choices=["start", "install"], default="start",
+                    help="start the MCP server (default), or install it into a client config")
+    pm.add_argument("--repo", help="default repo for MCP tools that accept one (local path or git URL)")
+    pm.add_argument("--client", choices=["cursor", "claude"], help="for `install`: which MCP client to configure")
+    pm.add_argument("--project", action="store_true",
+                    help="for `install`: write the project-local config (Cursor) instead of the user config")
     pm.set_defaults(func=cmd_mcp)
 
+    prv = sub.add_parser("review", help="Read-only risk review of a change (diff → triage the changed files).")
+    prv.add_argument("repo", nargs="?", default=".", help="local repo path (default: current dir)")
+    prv.add_argument("--base", help="diff against this ref (default: HEAD — all uncommitted changes)")
+    prv.add_argument("--issue", help="focus the review (e.g. 'check the auth refactor')")
+    prv.add_argument("--ref", help="branch/tag/commit to register")
+    prv.add_argument("--json", dest="as_json", action="store_true", help="emit the review result as JSON")
+    prv.set_defaults(func=cmd_review, uses_config=True)
+
+    pin = sub.add_parser("init", help="Scaffold codna.yaml (+ AGENTS.md) in the current directory.")
+    pin.add_argument("--force", action="store_true", help="overwrite existing files")
+    pin.add_argument("--no-agents", dest="no_agents", action="store_true", help="do not write AGENTS.md")
+    pin.set_defaults(func=cmd_init)
+
+    pstat = sub.add_parser("status", help="Concise health: engine · telys · keys (vs the verbose `doctor`).")
+    pstat.set_defaults(func=cmd_status)
+
     pl = sub.add_parser("login", help="Authorize this device for Codna memory (free for one device).")
     pl.add_argument("--token", help="headless access token (or env TELYS_TOKEN) — skips the browser step")
     pl.add_argument("--plan", default="telys_developer", help="onboarding plan (default: telys_developer)")
@@ -975,6 +964,16 @@ def main(argv=None) -> int:
     if not getattr(args, "func", None):
         p.print_help()
         return 0
+    # Apply codna.yaml (model/privacy) — but ONLY for commands that consume it (fix/triage/secure), so a
+    # stray/broken ./codna.yaml can't fail-close unrelated commands (doctor/key/login/mcp). Explicit
+    # codna.yaml config is authoritative and overwrites the corresponding shell env vars before dispatch.
+    if getattr(args, "uses_config", False) or getattr(args, "config", None):
+        from .config_file import ConfigError, load_and_apply
+        try:
+            load_and_apply(getattr(args, "config", None))
+        except ConfigError as exc:
+            print(json.dumps({"error": {"code": "config_error", "message": str(exc)}}, indent=2), file=sys.stderr)
+            return 1
     try:
         result = args.func(args)
     except Exception as exc:  # noqa: BLE001