codna 0.2.100__tar.gz → 0.2.101__tar.gz

{codna-0.2.100 → codna-0.2.101}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.100
+Version: 0.2.101
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.100 → codna-0.2.101}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.100"
+__version__ = "0.2.101"

{codna-0.2.100 → codna-0.2.101}/codna/config_file.py

@@ -13,8 +13,9 @@ Mapping to real controls:
     provider.
   - ``model.base_url`` → ``CODNA_AGENT_BASE_URL``, the provider ENDPOINT override forwarded to the sidecar.
     A base URL decides where the provider credential is sent, so it is validated here (http/https, no
-    embedded credentials, no query/fragment) and it may come from THIS file or the environment only — never
-    from a repository-scoped settings file. ``env:NAME`` resolves the same way as ``model.key``.
+    embedded credentials, no query/fragment, plain HTTP only on loopback) and it may come from THIS
+    file or the environment only — never from a repository-scoped settings file. ``env:NAME`` resolves
+    the same way as ``model.key``.
   - ``privacy.egress: fail-closed`` → sets ``CODNA_REQUIRE_EGRESS_DENY=1`` (the real enforcement is the
     sandbox network-deny policy + the PR manifest gate; there is no global egress env otherwise).
   - ``privacy.redact_secrets`` → accept-and-warn: ``true`` is the posture; ``false`` is *ignored with a
@@ -28,6 +29,7 @@ import sys
 from urllib.parse import urlsplit
 
 from .keystore import PROVIDER_ALIASES
+from .provider_url import is_loopback_host
 
 _SEARCH = ("codna.yaml", ".codna.yaml")
 
@@ -116,8 +118,11 @@ def _validated_base_url(value: object, *, field: str) -> str:
     Fail-closed on every shape that could smuggle something past the consumer: a non-http(s) scheme, an
     embedded credential (``https://user:pass@host`` puts secrets in logs and in every request), a query or
     fragment (silently dropped by every consumer, so the config would lie about itself), and whitespace.
-    The trailing slash is removed so the consumer's ``${base}/v1`` cannot become ``//v1``.
+    Plain HTTP is restricted to loopback so a provider key cannot cross the network in cleartext. The
+    trailing slash is removed so the consumer's ``${base}/v1`` cannot become ``//v1``.
     """
+    if value is not None and not isinstance(value, str):
+        raise ConfigError(f"{field} must be a string URL")
     text = str(value or "").strip()
     if not text:
         raise ConfigError(f"{field} must not be blank")
@@ -128,10 +133,14 @@ def _validated_base_url(value: object, *, field: str) -> str:
         raise ConfigError(f"{field} must be an http(s) URL, got {parts.scheme or 'no scheme'!r}")
     if not parts.hostname:
         raise ConfigError(f"{field} must name a host")
-    if parts.username or parts.password:
+    if parts.username is not None or parts.password is not None:
         raise ConfigError(f"{field} must not embed credentials")
     if parts.query or parts.fragment:
         raise ConfigError(f"{field} must not carry a query string or fragment")
+    if parts.scheme == "http" and not is_loopback_host(parts.hostname):
+        raise ConfigError(
+            f"{field} over plain http must point at loopback; a remote endpoint must use https"
+        )
     path = parts.path.rstrip("/")
     netloc = parts.netloc
     return f"{parts.scheme}://{netloc}{path}"

{codna-0.2.100 → codna-0.2.101}/codna/durable/__init__.py

@@ -19,6 +19,7 @@ from __future__ import annotations
 
 import importlib
 import importlib.util
+import re
 import types
 from dataclasses import dataclass
 from typing import Final
@@ -55,8 +56,15 @@ class Requirement:
     minimum: tuple[int, ...]
     maximum: tuple[int, ...]
 
-    def accepts(self, version: tuple[int, ...]) -> bool:
-        return self.minimum <= version < self.maximum
+    def accepts(self, version: tuple[tuple[int, ...], bool]) -> bool:
+        release, prerelease = version
+        width = max(len(release), len(self.minimum), len(self.maximum))
+        release = release + (0,) * (width - len(release))
+        minimum = self.minimum + (0,) * (width - len(self.minimum))
+        maximum = self.maximum + (0,) * (width - len(self.maximum))
+        if prerelease:
+            return minimum < release <= maximum
+        return minimum <= release < maximum
 
 
 # The checkpoint package is pinned as well as declared in the extra because it carries the
@@ -154,14 +162,11 @@ class DurableStack:
     versions: dict[str, str]
 
 
-def _parse_version(raw: str) -> tuple[int, ...]:
-    """Parse the leading numeric release of a version string (``1.34.0b2`` → ``(1, 34, 0)``).
-
-    Deliberately tiny: this must not add a ``packaging`` dependency to a base install. Only the
-    release segment matters for the compatibility window; a pre-release sorts inside its range.
-    """
+def _parse_version(raw: str) -> tuple[tuple[int, ...], bool]:
+    """Return the numeric release and whether it is a prerelease, without a packaging dependency."""
+    base = raw.split("+", 1)[0]
     release: list[int] = []
-    for part in raw.split("+", 1)[0].split("-", 1)[0].split("."):
+    for part in base.split("-", 1)[0].split("."):
         digits = ""
         for char in part:
             if not char.isdigit():
@@ -172,7 +177,8 @@ def _parse_version(raw: str) -> tuple[int, ...]:
         release.append(int(digits))
     if not release:
         raise ValueError(f"unparseable version {raw!r}")
-    return tuple(release)
+    prerelease = re.search(r"(?i)(dev|a|alpha|b|beta|rc|c|pre|preview)[.-]?\d*$", base) is not None
+    return tuple(release), prerelease
 
 
 def _installed_version(distribution: str) -> str | None:

{codna-0.2.100 → codna-0.2.101}/codna/durable/activity_steps.py

@@ -307,7 +307,7 @@ def checkpoint_turn(request: CheckpointRequest) -> CheckpointOutcome:
     # the task's own checkout dirty and its branch pointing at a commit the worktree never saw.
     tree = ensure_checkout(active, context)
 
-    existing = _existing_commit(active, tree, message=message)
+    existing = _existing_commit(active, tree, branch=context.branch, message=message)
     if existing is not None:
         sha, created = existing, False
     else:
@@ -365,20 +365,18 @@ def _ledger_has_checkpoint(ledger: RunLedger, task_id: str, turn_seq: int) -> bo
     return False
 
 
-def _existing_commit(runtime: ActivityRuntime, tree: str, *, message: str) -> str | None:
+def _existing_commit(runtime: ActivityRuntime, tree: str, *, branch: str, message: str) -> str | None:
     """The commit a previous attempt of THIS turn already made, matched by its exact message.
 
-    Searched with ``--all`` in the tree the commit would be made in: a worktree shares the parent's
-    object store, so a commit another attempt left on this task's branch is visible from here. Scoped
-    to the tree rather than the repository so the search cannot be satisfied by a same-message commit
-    on some other branch — the message carries the run, task and turn, but a stale checkout of the same
-    task (an earlier run with a reused id) would match, and this is the check that would then wrongly
-    report "already done".
+    Searched only on this task's branch in the tree the commit would be made in: a worktree shares
+    the parent's object store, so a previous attempt's branch tip is visible from here. Restricting
+    the walk to that branch avoids scanning every ref on each cold checkpoint and cannot be satisfied
+    by a same-message commit on an unrelated branch.
     """
     out = git_ok(
         runtime,
         tree,
-        ["log", "--all", "--fixed-strings", "--format=%H", f"--grep={message}", "-n", "1"],
+        ["log", f"refs/heads/{branch}", "--fixed-strings", "--format=%H", f"--grep={message}", "-n", "1"],
     )
     if not out or not out.strip():
         return None

{codna-0.2.100 → codna-0.2.101}/codna/durable/cli.py

@@ -881,7 +881,7 @@ def _register_decide(actions: Any, name: str, help_text: str) -> None:
 def _register_control(actions: Any) -> None:
     control = actions.add_parser("control", help="Pause, resume or stop a run.")
     control.add_argument("--run", required=True, help="run id")
-    control.add_argument("action", choices=("pause", "resume", "stop"))
+    control.add_argument("control_action", choices=("pause", "resume", "stop"))
     control.set_defaults(func=cmd_durable, durable_action="control")
 
 

{codna-0.2.100 → codna-0.2.101}/codna/durable/provider.py

@@ -29,12 +29,12 @@ It lives in its own file because `contracts.py` crossed the repository's 1000-li
 """
 from __future__ import annotations
 
-import ipaddress
 import re
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Final, Mapping
 from urllib.parse import urlsplit
 
+from ..provider_url import is_loopback_host as _is_loopback_host
 from .contract_primitives import ContractError
 from .state import find_secret_like_strings
 
@@ -389,7 +389,7 @@ def _require_provider_base_url(value: Any) -> str:
         raise ContractError(
             "base_url must name a host", code="contract_invalid", details={"field": "base_url"}
         )
-    if parts.username or parts.password:
+    if parts.username is not None or parts.password is not None:
         raise ContractError(
             "base_url must not embed credentials",
             code="contract_invalid",
@@ -411,24 +411,6 @@ def _require_provider_base_url(value: Any) -> str:
     return text
 
 
-def _is_loopback_host(hostname: str) -> bool:
-    """Loopback by name or by address, including the whole 127/8 range.
-
-    Deliberately explicit rather than ``ipaddress.is_loopback`` alone: ``localhost`` is not an address,
-    and a host must be recognised without a DNS lookup (this runs inside a contract validator, which
-    must be deterministic and offline).
-    """
-    host = hostname.strip().lower().strip("[]")
-    if host == "localhost" or host.endswith(".localhost"):
-        return True
-    if host == "::1":
-        return True
-    try:
-        return ipaddress.ip_address(host).is_loopback
-    except ValueError:
-        return False
-
-
 def provider_session_spec(context: "TaskContext", *, key: str | None) -> dict[str, Any]:
     """The provider part of a create-session body, for a task context.
 

codna-0.2.101/codna/provider_url.py

@@ -0,0 +1,17 @@
+"""Provider endpoint validation shared by the CLI and durable contracts."""
+from __future__ import annotations
+
+import ipaddress
+
+__all__ = ["is_loopback_host"]
+
+
+def is_loopback_host(hostname: str) -> bool:
+    """Recognize loopback names and addresses deterministically, without DNS."""
+    host = hostname.strip().lower().strip("[]")
+    if host == "localhost" or host.endswith(".localhost") or host == "::1":
+        return True
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False

{codna-0.2.100 → codna-0.2.101}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.100
+Version: 0.2.101
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.100 → codna-0.2.101}/codna.egg-info/SOURCES.txt

@@ -55,6 +55,7 @@ codna/policy.py
 codna/policy_cli.py
 codna/policy_document.py
 codna/project_rules.py
+codna/provider_url.py
 codna/python_import_paths.py
 codna/refengine.py
 codna/remote_http.py

{codna-0.2.100 → codna-0.2.101}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.100"
+version = "0.2.101"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"

{codna-0.2.100 → codna-0.2.101}/tests/test_config_file.py

@@ -163,6 +163,7 @@ def test_base_url_accepts_an_env_ref_and_fails_closed_when_unset(tmp_path, monke
         ("ftp://host/v1", "must be an http(s) URL"),
         ("file:///etc/passwd", "must be an http(s) URL"),
         ("https://user:pass@host/v1", "must not embed credentials"),
+        ("https://:@host/v1", "must not embed credentials"),
         ("https://host/v1?key=abc", "must not carry a query string"),
         ("https://host/v1#frag", "must not carry a query string"),
         ("host-without-scheme/v1", "must be an http(s) URL"),
@@ -177,6 +178,31 @@ def test_base_url_validation_is_fail_closed(tmp_path, bad, expected):
     assert expected in str(exc.value)
 
 
+def test_base_url_rejects_remote_plain_http(tmp_path):
+    p = _write(tmp_path, "codna.yaml", "model:\n  provider: openai\n  base_url: http://example.com/v1\n")
+    with pytest.raises(ConfigError, match="plain http must point at loopback"):
+        config_file.apply_config(str(p))
+
+
+@pytest.mark.parametrize("value", [0, False, []])
+def test_base_url_rejects_non_string_values(value):
+    with pytest.raises(ConfigError, match="must be a string URL"):
+        config_file._validated_base_url(value, field="model.base_url")
+
+
+@pytest.mark.parametrize(
+    "url",
+    [
+        "http://localhost:11434/v1",
+        "http://127.0.0.2:11434/v1",
+        "http://[::1]:11434/v1",
+        "https://llm.example.com/v1",
+    ],
+)
+def test_base_url_allows_https_and_loopback_http(url):
+    assert config_file._validated_base_url(url, field="model.base_url") == url
+
+
 def test_absent_base_url_leaves_the_provider_default_alone(tmp_path, monkeypatch):
     monkeypatch.delenv(config_file.BASE_URL_ENV, raising=False)
     p = _write(tmp_path, "codna.yaml", "model:\n  provider: openai\n")