codna 0.2.20__tar.gz → 0.2.22__tar.gz

{codna-0.2.20 → codna-0.2.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.20
+Version: 0.2.22
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.20 → codna-0.2.22}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.20"
+__version__ = "0.2.22"

{codna-0.2.20 → codna-0.2.22}/codna/fix_inputs.py

@@ -5,6 +5,7 @@ extraction and PR-body rendering. Split out of ``cli.py`` to keep it under the m
 from __future__ import annotations
 
 import os
+import re
 import shutil
 import subprocess
 import tempfile
@@ -78,6 +79,8 @@ _REMOTE_GIT_TIMEOUT_S = 120
 # on 2026-09-17, every time, so every CI-failure autofix there died before discovering a single
 # test. Shallow (below) plus five minutes.
 _REMOTE_CLONE_TIMEOUT_S = 300
+# A shallow clone can only fetch what GitHub serves by name; an abbreviated SHA is not that.
+_ABBREVIATED_SHA = re.compile(r"[0-9a-fA-F]{7,39}")
 
 
 def _run_git_for_remote_tests(
@@ -109,17 +112,10 @@ def _checkout_remote_ref(checkout: str, ref: str, *, repository_url: str, token:
 
     clean_ref = _validated_ref(ref)
     env = _git_auth_env(repository_url, token)
-    fetch = subprocess.run(
-        ["git", "fetch", "--depth=1", "origin", clean_ref],
-        cwd=checkout,
-        env=env,
-        capture_output=True,
-        text=True,
-        timeout=120,
-        check=False,
-    )
-    target = "FETCH_HEAD" if fetch.returncode == 0 else clean_ref
-    _run_git_for_remote_tests(["checkout", "--detach", target], cwd=checkout, env=env)
+    # A shallow clone holds nothing but the tip, so `checkout <ref>` after a failed fetch could
+    # never work -- surface the fetch error itself instead of a misleading checkout error.
+    _run_git_for_remote_tests(["fetch", "--depth=1", "origin", clean_ref], cwd=checkout, env=env)
+    _run_git_for_remote_tests(["checkout", "--detach", "FETCH_HEAD"], cwd=checkout, env=env)
     _run_git_for_remote_tests(["reset", "--hard", "HEAD"], cwd=checkout, env=env)
     _run_git_for_remote_tests(["clean", "-fdx"], cwd=checkout, env=env)
 
@@ -144,6 +140,11 @@ def _discover_remote_failing_tests_for_fix(args, github_token: str | None):
         # the timeout (thyn-ai/algenta, 2026-09-17: 120 s, every attempt).
         clone_args = ["clone", "--no-tags", "--depth=1"]
         ref = getattr(args, "ref", None)
+        if ref and _ABBREVIATED_SHA.fullmatch(str(ref)):
+            raise FixInputError(
+                "--ref looks like an abbreviated commit SHA, which a shallow clone cannot resolve; "
+                "pass the full 40-character SHA, a branch, or a tag"
+            )
         base_branch = getattr(args, "base_branch", None)
         if not ref and base_branch:
             clone_args.extend(["--single-branch", "--branch", base_branch])

{codna-0.2.20 → codna-0.2.22}/codna/packaged_git.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import os
 import re
 import subprocess
+from .patch_text import GIT_APPLY_FLAG_SETS, normalize_unified_diff
 from base64 import b64encode
 from dataclasses import dataclass
 from pathlib import Path
@@ -13,6 +14,11 @@ import httpx
 
 
 GIT_TIMEOUT_SECONDS = 120
+# The initial clone is the one git step that scales with repository size. A FULL clone of
+# thyn-ai/algenta (~81 MB packed) hit the flat 120 s bound every time on the 2-vCPU webhook
+# machine (2026-09-17, `@codna fix` -> "git clone ... timed out after 120 seconds"), so the
+# clone is shallow and gets its own bound.
+GIT_CLONE_TIMEOUT_SECONDS = 300
 GITHUB_HTTP_TIMEOUT_SECONDS = 60
 _GITHUB_URL_RE = re.compile(r"^https://github\.com/([^/]+)/([^/.]+)(?:\.git)?/?$")
 _SSH_GITHUB_URL_RE = re.compile(r"^git@github\.com:([^/]+)/([^/.]+)(?:\.git)?$")
@@ -199,13 +205,19 @@ def _github_repository(
     if (checkout / ".git").is_dir():
         _reset_owned_checkout(checkout)
         _run_git(checkout, ["remote", "set-url", "origin", repository_url])
-        _run_git(checkout, ["fetch", "--prune", "origin"], env=_git_auth_env(repository_url, access_token))
+        _run_git(
+            checkout, ["fetch", "--prune", "--depth=1", "origin"],
+            env=_git_auth_env(repository_url, access_token), timeout=GIT_CLONE_TIMEOUT_SECONDS,
+        )
     else:
         checkout.parent.mkdir(parents=True, exist_ok=True)
+        # Shallow: _checkout_requested_ref fetches the exact requested ref at depth 1 right after,
+        # so history beyond the tip was downloaded and never used.
         _run_git(
             None,
-            ["clone", "--no-tags", repository_url, str(checkout)],
+            ["clone", "--no-tags", "--depth=1", repository_url, str(checkout)],
             env=_git_auth_env(repository_url, access_token),
+            timeout=GIT_CLONE_TIMEOUT_SECONDS,
         )
     _checkout_requested_ref(checkout, request, repository_url=repository_url, access_token=access_token)
     return MaterializedRepository(
@@ -243,10 +255,22 @@ def _checkout_requested_ref(
 
 
 def _apply_patch_to_index(repo_root: Path, patch_diff: str) -> None:
-    if not patch_diff.strip():
+    patch = normalize_unified_diff(patch_diff)
+    if not patch.strip():
         raise PackagedGitError("repository_remote_pr_empty_patch", "remote_pr apply requires a non-empty patch.", {})
-    _run_git_stdin(repo_root, ["apply", "--check", "--whitespace=nowarn", "-"], patch_diff)
-    _run_git_stdin(repo_root, ["apply", "--index", "--whitespace=nowarn", "-"], patch_diff)
+    first_error = ""
+    for flags in GIT_APPLY_FLAG_SETS:
+        check = _run_git_stdin(repo_root, ["apply", "--check", "--whitespace=nowarn", *flags, "-"], patch, check=False)
+        if check.returncode == 0:
+            _run_git_stdin(repo_root, ["apply", "--index", "--whitespace=nowarn", *flags, "-"], patch)
+            return
+        first_error = first_error or check.stderr.strip()
+    raise PackagedGitError(
+        "patch_rejected",
+        "The generated patch does not apply to the checkout: "
+        + (first_error.splitlines()[0] if first_error else "git apply --check failed"),
+        {"stderr": first_error[-2000:]},
+    )
 
 
 def _require_git_repo(repo_root: Path) -> None:
@@ -364,6 +388,7 @@ def _run_git(
     *,
     env: dict[str, str] | None = None,
     check: bool = True,
+    timeout: float | None = None,
 ) -> subprocess.CompletedProcess[str]:
     result = subprocess.run(
         ["git", *args],
@@ -372,7 +397,7 @@ def _run_git(
         capture_output=True,
         text=True,
         check=False,
-        timeout=GIT_TIMEOUT_SECONDS,
+        timeout=GIT_TIMEOUT_SECONDS if timeout is None else timeout,
     )
     if check and result.returncode != 0:
         raise PackagedGitError(
@@ -383,7 +408,9 @@ def _run_git(
     return result
 
 
-def _run_git_stdin(repo_root: Path, args: list[str], stdin: str) -> None:
+def _run_git_stdin(
+    repo_root: Path, args: list[str], stdin: str, *, check: bool = True
+) -> subprocess.CompletedProcess[str]:
     result = subprocess.run(
         ["git", *args],
         cwd=str(repo_root),
@@ -393,13 +420,13 @@ def _run_git_stdin(repo_root: Path, args: list[str], stdin: str) -> None:
         check=False,
         timeout=GIT_TIMEOUT_SECONDS,
     )
-    if result.returncode != 0:
+    if check and result.returncode != 0:
         raise PackagedGitError(
             "git_command_failed",
             "Git command failed while applying the packaged local patch.",
             {"args": _redact_args(args), "cwd": str(repo_root), "stderr": result.stderr[-2000:]},
         )
-
+    return result
 
 def _redact_args(args: list[str]) -> list[str]:
     return [_redact_url(value) for value in args]

{codna-0.2.20 → codna-0.2.22}/codna/packaged_repository_advanced.py

@@ -11,6 +11,7 @@ from pathlib import Path
 from typing import Any, Callable, Mapping
 
 from .packaged_git import open_remote_pr
+from .patch_text import GIT_APPLY_FLAG_SETS, normalize_unified_diff
 
 SCHEMA_VERSION = 1
 BACKEND_MODE = "packaged_local_fix"
@@ -90,7 +91,7 @@ class PackagedRepositoryAdvanced:
             snapshot=dict(snapshot),
         )
         result = self._agent_runner(run_request)
-        patch_diff = result.patch_diff.strip()
+        patch_diff = normalize_unified_diff(result.patch_diff).strip()
         if not patch_diff:
             raise PackagedRepositoryAdvancedError(
                 "local_repository_agent_no_patch",
@@ -347,10 +348,10 @@ class PackagedRepositoryAdvanced:
         branch = "codna/" + plan_id.removeprefix("plan_")[:16]
         _run_git(repo_root, ["checkout", "-b", branch])
         patch_path = repo_root / ".codna-packaged.patch.diff"
-        _atomic_write_text(patch_path, patch_diff + "\n")
+        _atomic_write_text(patch_path, normalize_unified_diff(patch_diff))
         try:
-            _run_git(repo_root, ["apply", "--check", str(patch_path)])
-            _run_git(repo_root, ["apply", str(patch_path)])
+            flags = _applicable_apply_flags(repo_root, patch_path)
+            _run_git(repo_root, ["apply", *flags, str(patch_path)])
             _commit_applied_patch(repo_root, plan_id, _changed_files_from_patch(patch_diff))
         finally:
             patch_path.unlink(missing_ok=True)
@@ -532,6 +533,21 @@ def _summary_text(agent_text: str, issue_text: str) -> str:
     return f"Patch generated for reported issue: {issue_text[:420]}"
 
 
+def _applicable_apply_flags(repo_root: Path, patch_path: Path) -> list[str]:
+    first_error = ""
+    for flags in GIT_APPLY_FLAG_SETS:
+        check = _run_git(repo_root, ["apply", "--check", *flags, str(patch_path)], check=False)
+        if check.returncode == 0:
+            return list(flags)
+        first_error = first_error or check.stderr.strip()
+    raise PackagedRepositoryAdvancedError(
+        "repository_patch_rejected",
+        "The generated patch does not apply to the repository: "
+        + (first_error.splitlines()[0] if first_error else "git apply --check failed"),
+        {"repo_root": str(repo_root), "stderr": first_error[-2000:]},
+    )
+
+
 def _changed_files_from_patch(patch_diff: str) -> list[str]:
     files: list[str] = []
     for line in patch_diff.splitlines():

codna-0.2.22/codna/patch_text.py

@@ -0,0 +1,48 @@
+"""Make agent-produced unified diffs applicable before they reach `git apply`.
+
+Model output is not a byte-exact diff: it arrives wrapped in a markdown fence, with CRLF line
+endings, with the single leading space of blank context lines stripped by a trailing-whitespace
+pass ("error: corrupt patch at line N"), or with hunk headers whose line counts are off by a few.
+The first live `@codna fix` to reach this step (thyn-ai/algenta#1003, 2026-09-17) died on exactly
+such a patch. None of these are the patch being wrong about the code, so repair them here and let
+`git apply --recount` absorb the count drift; a patch that still fails is rejected with git's own
+first error line.
+"""
+from __future__ import annotations
+
+import re
+
+_HUNK = re.compile(r"^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@")
+_FENCE = re.compile(r"^```[\w+.-]*\s*$")
+_STRUCTURAL = ("diff --git ", "index ", "--- ", "+++ ", "similarity index", "rename from", "rename to",
+               "new file mode", "deleted file mode", "old mode", "new mode", "Binary files")
+
+# Tried in order by every apply site; the first set whose `--check` passes is used for the real apply.
+GIT_APPLY_FLAG_SETS: tuple[tuple[str, ...], ...] = ((), ("--recount",), ("--recount", "--ignore-whitespace"))
+
+
+def normalize_unified_diff(text: str) -> str:
+    """Return *text* as a diff `git apply` can read; a diff that needs nothing comes back unchanged
+    except for a guaranteed single trailing newline."""
+    if not text or not text.strip():
+        return text or ""
+    lines = text.replace("\r\n", "\n").replace("\r", "\n").split("\n")
+    while lines and not lines[0].strip():
+        lines.pop(0)
+    while lines and not lines[-1].strip():
+        lines.pop()
+    if lines and _FENCE.match(lines[0]):
+        lines.pop(0)
+    if lines and _FENCE.match(lines[-1]):
+        lines.pop()
+    out: list[str] = []
+    in_hunk = False
+    for line in lines:
+        if _HUNK.match(line):
+            in_hunk = True
+        elif line.startswith(_STRUCTURAL):
+            in_hunk = False
+        elif in_hunk and line == "":
+            line = " "  # a context line whose leading space was stripped
+        out.append(line)
+    return "\n".join(out) + "\n"

{codna-0.2.20 → codna-0.2.22}/codna/testrun.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 
 import importlib.util
 import os
+import xml.etree.ElementTree as ElementTree
 import re
 import sys
 import tempfile
@@ -126,6 +127,15 @@ def _detect_pytest(repo_dir: str) -> str | None:
     return None
 
 
+def junit_has_collection_errors(path: str) -> bool:
+    """True when pytest could not even import a test module (``<error message="collection failure">``)."""
+    try:
+        root = ElementTree.parse(path).getroot()
+    except Exception:  # noqa: BLE001
+        return False
+    return any(str(err.get("message", "")).lower().startswith("collection failure") for err in root.iter("error"))
+
+
 def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeout_seconds: int = 1800):
     """``(issue_text | None, [failing_ids])`` — same contract as :func:`fix_inputs.from_junit`.
 
@@ -182,6 +192,14 @@ def discover_failing_tests(repo_dir: str, test_cmd: str | None = None, *, timeou
     if result.timed_out:
         raise RuntimeError(f"test run timed out after {timeout_seconds}s")
 
+    if os.path.isfile(junit) and junit_has_collection_errors(junit):
+        # An import error is not a failing test: "fixing" it would mean editing the repo until its
+        # tests import in THIS environment (the webhook image has pytest and nothing else).
+        raise RuntimeError(
+            "the repository's tests could not be imported in this environment (pytest collection "
+            "errors, usually missing dependencies); refusing to treat import errors as failing tests "
+            "-- install the repo's requirements, pass --test-cmd, or use --from-junit from CI"
+        )
     failing = parse_junit_failures(junit) if os.path.isfile(junit) else []
     if failing:
         return f"{len(failing)} failing test(s): " + "; ".join(failing[:8]), failing

{codna-0.2.20 → codna-0.2.22}/codna/webhook.py

@@ -620,6 +620,9 @@ class _Handler(BaseHTTPRequestHandler):
                 "ok": ready,
                 "checks": {"webhook_secret": secret_ready, "github_app_auth": app_ready,
                            "worker_pool": worker_ready},
+                "worker": None if pool_diag is None else {
+                    k: pool_diag.get(k) for k in ("alive_threads", "busy_threads", "longest_running_s", "wedged")
+                },
             })
             return
         if path == "/debug/queue":

{codna-0.2.20 → codna-0.2.22}/codna/webhook_github.py

@@ -187,7 +187,11 @@ def complete_stale_check_runs(
     if resp.status_code >= 300:
         return 0
     closed = 0
-    for run in (resp.json() or {}).get("check_runs") or []:
+    try:
+        runs = (resp.json() or {}).get("check_runs") or []
+    except Exception:  # noqa: BLE001
+        return 0
+    for run in runs:
         run_id = run.get("id")
         if not run_id:
             continue
@@ -196,8 +200,8 @@ def complete_stale_check_runs(
                 repo_full_name, token, run_id, conclusion="cancelled", summary=summary, name=name
             )
             closed += 1
-        except WebhookError:
-            continue  # someone else's run of the same name, or already completed underneath us
+        except Exception:  # noqa: BLE001 — someone else's run, already completed, or a transport error
+            continue
     return closed
 
 

{codna-0.2.20 → codna-0.2.22}/codna/webhook_queue.py

@@ -17,7 +17,7 @@ import json
 import sqlite3
 from contextlib import contextmanager
 from dataclasses import dataclass
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Iterator, Mapping
 
@@ -91,7 +91,20 @@ class WebhookQueue:
             conn.close()
 
     def enqueue(self, job: WebhookJob, *, delivery_id: str | None) -> bool:
-        """Insert a job. Returns False if this delivery_id was already enqueued (dedup)."""
+        """Insert a job. Returns False if this delivery_id was already enqueued (dedup), or if it
+        is a CI-failure fix for a (repo, ref) that already has one queued, running, or finished in
+        the last 24 h -- every red check_suite on a PR head fires its own delivery, and one fix
+        attempt per head is all that can ever be useful."""
+        if job.reason == "check_suite_failure" and job.ref:
+            cutoff = (datetime.now(timezone.utc) - timedelta(hours=24)).isoformat()
+            with self._conn() as conn:
+                dup = conn.execute(
+                    "SELECT 1 FROM jobs WHERE kind='fix' AND repo=? AND ref=? AND reason=? "
+                    "AND (status IN ('queued','retry','running') OR created_at >= ?) LIMIT 1",
+                    (job.repo_full_name, job.ref, job.reason, cutoff),
+                ).fetchone()
+            if dup is not None:
+                return False
         with self._conn() as conn:
             cur = conn.execute(
                 "INSERT OR IGNORE INTO jobs "
@@ -120,7 +133,10 @@ class WebhookQueue:
             try:
                 row = conn.execute(
                     "SELECT * FROM jobs WHERE status IN ('queued','retry') "
-                    "AND attempts < ? ORDER BY id LIMIT 1",
+                    # Reviews first: they are human-facing and, since the org ruleset, a REQUIRED
+                    # check -- a burst of CI-failure fix jobs must never starve them (2026-09-17:
+                    # 13 red dependabot PRs x N suites x 3 attempts held both threads for minutes).
+                    "AND attempts < ? ORDER BY CASE WHEN kind='review' THEN 0 ELSE 1 END, id LIMIT 1",
                     (_MAX_ATTEMPTS,),
                 ).fetchone()
                 if row is None:
@@ -150,10 +166,13 @@ class WebhookQueue:
             ),
         )
 
-    def complete(self, row_id: int, *, status: str, result: Mapping[str, object] | None = None) -> None:
-        """Mark a claimed job done/failed. A failed job under the attempt cap becomes 'retry'."""
+    def complete(self, row_id: int, *, status: str, result: Mapping[str, object] | None = None,
+                 retry: bool = True) -> None:
+        """Mark a claimed job done/failed. A failed job under the attempt cap becomes 'retry' --
+        unless the caller says the failure is deterministic (retry=False), e.g. the CLI rejected
+        the inputs: re-running it three times just repeats the same error."""
         final = status
-        if status == "failed":
+        if status == "failed" and retry:
             with self._conn() as conn:
                 row = conn.execute("SELECT attempts FROM jobs WHERE id=?", (row_id,)).fetchone()
             if row is not None and row["attempts"] < _MAX_ATTEMPTS: