codna 0.2.35__tar.gz → 0.2.36__tar.gz

{codna-0.2.35 → codna-0.2.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.35
+Version: 0.2.36
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.35 → codna-0.2.36}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.35"
+__version__ = "0.2.36"

{codna-0.2.35 → codna-0.2.36}/codna/review.py

@@ -32,6 +32,13 @@ def _fail(message: str, details: dict[str, object] | None = None) -> None:
     raise ReviewError(message, details)
 
 
+def _env_check_run_id() -> int | None:
+    """``CODNA_CHECK_RUN_ID``: a Check Run the caller (the webhook worker) already opened for this
+    review; ``--post`` completes it instead of creating a second one. Unset or garbage -> None."""
+    raw = os.environ.get("CODNA_CHECK_RUN_ID", "").strip()
+    return int(raw) if raw.isdigit() else None
+
+
 def _wrapped_details(exc: BaseException) -> dict[str, object]:
     """Structured detail carried by a wrapped error, if it has any.
 
@@ -239,7 +246,8 @@ def run_findings_review(args) -> dict:
             if not token:
                 _fail("--post needs a write token: pass --github-token or set GITHUB_TOKEN.")
             try:
-                out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token)
+                out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token,
+                                               check_run_id=_env_check_run_id())
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.35 → codna-0.2.36}/codna/review_github.py

@@ -272,12 +272,16 @@ def parse_pr_arg(value: str, repo_dir: str) -> tuple[str | None, int | None]:
 
 
 def post_review(
-    result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True
+    result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
+    check_run_id: int | None = None,
 ) -> dict:
-    """Post ONE review (+ a "Codna Review" check) to the PR. Returns a small status dict.
+    """Post ONE review (+ the "Codna Review" check) to the PR. Returns a small status dict.
 
     ``dedup`` fetches existing PR review comments and skips fingerprints Codna already posted, so a
-    re-run on the same head does not duplicate threads."""
+    re-run on the same head does not duplicate threads. ``check_run_id`` (the webhook passes it as
+    ``CODNA_CHECK_RUN_ID``) is a Check Run the caller already opened for this review: it is
+    completed with the findings instead of a second run being created, so the PR shows exactly one
+    "Codna Review" check."""
     try:
         import httpx
     except Exception as exc:  # noqa: BLE001
@@ -309,20 +313,27 @@ def post_review(
         posted_review = True
 
     check = None
-    if result.head_sha:
+    if check_run_id is not None or result.head_sha:
         from . import webhook_github
 
         try:
-            cid = webhook_github.create_check_run(
-                repo_slug, token, name=CHECK_NAME, head_sha=result.head_sha,
-                summary=f"{len(result.findings)} finding(s)",
-            )
-            if cid is not None:
+            if check_run_id is not None:
                 webhook_github.update_check_run(
-                    repo_slug, token, cid, conclusion=result.conclusion,
+                    repo_slug, token, check_run_id, conclusion=result.conclusion,
                     summary=summary_body(result), name=CHECK_NAME,
                 )
-            check = {"id": cid, "conclusion": result.conclusion}
+                check = {"id": check_run_id, "conclusion": result.conclusion, "updated_existing": True}
+            else:
+                cid = webhook_github.create_check_run(
+                    repo_slug, token, name=CHECK_NAME, head_sha=result.head_sha,
+                    summary=f"{len(result.findings)} finding(s)",
+                )
+                if cid is not None:
+                    webhook_github.update_check_run(
+                        repo_slug, token, cid, conclusion=result.conclusion,
+                        summary=summary_body(result), name=CHECK_NAME,
+                    )
+                check = {"id": cid, "conclusion": result.conclusion, "updated_existing": False}
         except Exception:  # noqa: BLE001 — the check is advisory; a failure must not fail the review
             check = None
 

{codna-0.2.35 → codna-0.2.36}/codna/webhook.py

@@ -86,6 +86,15 @@ _FIX_WRITE_ASSOCIATIONS = frozenset({"OWNER", "MEMBER", "COLLABORATOR"})
 # Codna pushes its own fix branches as `codna/<plan-id>` (see packaged_git._validated_branch and
 # fix_run). Recognising that prefix is what stops a CI-failure fix from fixing its own fix PR.
 _CODNA_BRANCH_PREFIX = "codna/"
+# ONE Check Run per job, Title Case, named like a product: "Codna Review" is also the exact name the
+# org ruleset requires. Until 2026-09-18 the worker opened a lowercase "codna review" wrapper run
+# and the CLI added a second, capitalised "Codna Review" run beside it.
+CHECK_RUN_NAMES = {"review": "Codna Review", "fix": "Codna Fix", "secure": "Codna Secure"}
+
+
+def check_run_name(kind: str) -> str:
+    """The Check Run name for a job kind: ``Codna Review`` / ``Codna Fix`` / ``Codna Secure``."""
+    return CHECK_RUN_NAMES.get(kind, f"Codna {kind.replace('_', ' ').title()}")
 # The App's own slug on github.com. A self-hosted install runs under a different slug, so the id in
 # GITHUB_APP_ID is checked too (see _is_own_check_suite).
 _OWN_APP_SLUG = "codna-ai"
@@ -475,7 +484,7 @@ def codna_command(
              classification; opening security PRs uses the privilege-separated two-job
              workflow, never a single server process).
     review — ``codna review <url> --pr <n> [--ref <head_sha>] --post --json`` (read-only diff review;
-             posts one review + a non-blocking "Codna Review" check).
+             completes the job's "Codna Review" check with the findings).
     """
     url = repo_url or f"https://github.com/{job.repo_full_name}.git"
     if job.kind == "review":

{codna-0.2.35 → codna-0.2.36}/codna/webhook_github.py

@@ -166,7 +166,7 @@ def create_check_run(repo_full_name: str, token: str, *, name: str, head_sha: st
 
 
 def update_check_run(repo_full_name: str, token: str, check_run_id: int, *, conclusion: str, summary: str,
-                     name: str = "codna") -> None:
+                     name: str = "Codna") -> None:
     try:
         import httpx
     except Exception as exc:  # noqa: BLE001

codna-0.2.36/codna/webhook_summaries.py

@@ -0,0 +1,137 @@
+"""Check Run / reply summaries for webhook jobs: the one-line, markdown-safe text a job leaves
+behind, and the CLI-error parsing that produces it.
+
+Split out of webhook_worker.py on 2026-09-18 (the 1000-line modularity ceiling); pure functions,
+no I/O. Names are Title Case Check Run names ("Codna Fix failed (cli_error): ...") -- see
+webhook.check_run_name.
+"""
+from __future__ import annotations
+
+import json
+import re
+
+from .webhook import check_run_name
+
+# Summaries are Title Case now ("Codna Fix failed (...)"); lowercase ones may still be in flight.
+_CLI_SUMMARY = re.compile(r"^codna \w+ failed \(([^)]+)\): (.*)$", re.S | re.IGNORECASE)
+
+
+# CLI error codes whose failure is a property of the inputs, not of the moment.
+_NON_RETRYABLE_CODES = frozenset({"cli_error", "usage_error", "invalid_input", "input_error"})
+
+
+_SUMMARY_CODE = re.compile(r"^codna \w+ failed \(([^)]+)\)", re.IGNORECASE)
+
+
+def _summary_is_retryable(summary: str) -> bool:
+    m = _SUMMARY_CODE.match(summary or "")
+    return not (m and m.group(1) in _NON_RETRYABLE_CODES)
+
+
+def _terse_cli_failure(summary: str) -> str:
+    """One readable clause from the CLI's structured error, minus the operator payload.
+
+    'codna fix failed (cli_error): apply failed: Git command failed ... | code=git_command_failed |
+    details={"args": [...], "cwd": "/tmp/...", "stderr": "error: corrupt patch at line 99"} (patch
+    ref: ...)' -> 'apply failed: Git command failed ... (git: error: corrupt patch at line 99)
+    [git_command_failed]'. Paths and argv stay in the Check Run summary / logs, not in the thread.
+    """
+    m = _CLI_SUMMARY.match(summary or "")
+    if not m:
+        return summary
+    code, rest = m.group(1), m.group(2)
+    rest = re.sub(r"\s*\(patch ref: [^)]*\)?\s*$", "", rest)
+    # The details payload may be TRUNCATED (the summary is capped), so never require a closing
+    # brace: cut at the marker and pull stderr out with a regex that tolerates a missing end quote.
+    details_text = ""
+    dm = re.search(r"\s*\|\s*details=", rest)
+    if dm:
+        details_text, rest = rest[dm.end():], rest[: dm.start()]
+    cm = re.search(r"\s*\|\s*code=([\w.-]+)\s*$", rest)
+    if cm:
+        code, rest = cm.group(1), rest[: cm.start()]
+    hint = ""
+    sm = re.search(r'"stderr":\s*"((?:[^"\\]|\\.)*)"?', details_text, re.S)
+    if sm:
+        stderr = sm.group(1).encode().decode("unicode_escape", errors="replace")
+        lines = [ln.strip() for ln in stderr.splitlines() if ln.strip()]
+        # the reason is usually the LAST informative line ("! [remote rejected] ... (why)"), not
+        # the "To https://..." banner git prints first
+        strong = [ln for ln in lines if re.search(r"rejected|refusing|denied|GH0\d\d", ln, re.I)]
+        weak = [ln for ln in lines if re.search(r"error|fatal", ln, re.I)]
+        pick = (strong or weak or lines)[-1] if lines else ""
+        if pick:
+            hint = f" (git: {pick[:200]})"
+    return f"{rest.strip().rstrip('.')}{hint} [{code}]"
+
+
+def _review_job_summary(stdout: str) -> str | None:
+    """A short, markdown-safe summary for a review job's wrapper Check Run.
+
+    ``codna review ... --json`` (the only command codna_command adds ``--json`` to) prints a
+    findings-review result dict as its ENTIRE stdout -- the same shape
+    ``cli/codna/review.py::render_findings`` renders for a human. That renderer is for a
+    terminal, though: several of its lines are indented 4+ spaces, which GitHub's markdown
+    turns into a code block rather than the intended text, so it is deliberately not reused
+    here. Returns None (never raises) on anything that isn't exactly this shape, so the caller
+    falls back to its existing raw-stdout-tail behavior instead of guessing.
+    """
+    try:
+        result = json.loads(stdout)
+    except (json.JSONDecodeError, TypeError, ValueError):
+        return None
+    if not isinstance(result, dict) or "conclusion" not in result or "findings" not in result:
+        return None
+    findings = result.get("findings") or []
+    if not findings:
+        note = result.get("note")
+        return f"Codna Review: {note}" if note else "Codna Review: no high-confidence issues found ✅"
+    posted = result.get("posted") or {}
+    inline = posted.get("inline_posted", 0)
+    summary_n = result.get("summary_count", 0)
+    return (
+        f"Codna Review: {len(findings)} finding(s) — {inline} inline, {summary_n} in summary "
+        f"(conclusion: {result.get('conclusion', 'unknown')}). See the PR's review comments for details."
+    )
+
+
+def _cli_completed_check(stdout: str, check_run_id: int | None) -> bool:
+    """True when ``codna review --post`` reports it completed THIS job's Check Run itself."""
+    if check_run_id is None:
+        return False
+    try:
+        result = json.loads(stdout)
+    except (json.JSONDecodeError, TypeError, ValueError):
+        return False
+    check = ((result.get("posted") or {}).get("check") or {}) if isinstance(result, dict) else {}
+    return bool(check.get("updated_existing")) and check.get("id") == check_run_id
+
+
+def _error_json_summary(kind: str, *streams: str | None) -> str | None:
+    """Short, markdown-safe summary when the CLI ended with its documented structured error.
+
+    ``codna`` prints ``{"error": {"code": ..., "message": ...}}`` (indent=2) to stderr on every
+    CodnaError (cli.py), and the generic tail-of-output fallback pasted that JSON verbatim into
+    the "codna fix" Check Run summary -- two algenta runs on 2026-09-17 read exactly like that.
+    Finds the LAST such object across the given streams (stderr is searched first by passing it
+    last) and renders its message as one sentence. None when there is no such object.
+    """
+    decoder = json.JSONDecoder()
+    for text in reversed([s or "" for s in streams]):
+        pos = text.rfind('"error"')
+        while pos >= 0:
+            start = text.rfind("{", 0, pos)
+            if start < 0:
+                break
+            try:
+                obj, _ = decoder.raw_decode(text[start:])
+            except ValueError:
+                obj = None
+            err = obj.get("error") if isinstance(obj, dict) else None
+            if isinstance(err, dict) and err.get("message"):
+                code = err.get("code") or "error"
+                # 1500, not 400: the CLI embeds git's stderr at the END of the message, and a
+                # 400-char cap cut every live push/apply failure right before its reason.
+                return f"{check_run_name(kind)} failed ({code}): {str(err['message'])[:1500]}"
+            pos = text.rfind('"error"', 0, pos)
+    return None

{codna-0.2.35 → codna-0.2.36}/codna/webhook_worker.py

@@ -22,7 +22,6 @@ from __future__ import annotations
 
 import json
 import os
-import re
 import socket
 import subprocess
 import sys
@@ -37,6 +36,7 @@ from . import webhook_github, webhook_metering
 from .admission_control import get_admitter
 from .agent_core_runtime import PROVIDER_RUNTIME_ENV_KEYS
 from .webhook import (
+    check_run_name,
     _FIX_WRITE_ASSOCIATIONS,
     WebhookError,
     WebhookJob,
@@ -44,6 +44,16 @@ from .webhook import (
     webhook_marker,
 )
 from .webhook_queue import _MAX_ATTEMPTS, QueuedJob, WebhookQueue
+from .webhook_summaries import (  # noqa: F401 -- re-exported: callers and tests address these via this module
+    _CLI_SUMMARY,
+    _NON_RETRYABLE_CODES,
+    _SUMMARY_CODE,
+    _cli_completed_check,
+    _error_json_summary,
+    _review_job_summary,
+    _summary_is_retryable,
+    _terse_cli_failure,
+)
 from .webhook_procs import (  # noqa: F401 -- re-exported: tests and callers address them via this module
     _KILL_DRAIN_S,
     _kill_process_group,
@@ -102,16 +112,7 @@ class JobResult:
     summary: str
     retryable: bool = True  # False = deterministic failure (bad inputs); the queue must not retry it
     retry_after_s: float | None = None  # hold the retry back in the queue this long (no thread sleeps)
-
-
-# CLI error codes whose failure is a property of the inputs, not of the moment.
-_NON_RETRYABLE_CODES = frozenset({"cli_error", "usage_error", "invalid_input", "input_error"})
-_SUMMARY_CODE = re.compile(r"^codna \w+ failed \(([^)]+)\)")
-
-
-def _summary_is_retryable(summary: str) -> bool:
-    m = _SUMMARY_CODE.match(summary or "")
-    return not (m and m.group(1) in _NON_RETRYABLE_CODES)
+    check_completed: bool = False  # the CLI already completed the job's Check Run (a review's findings)
 
 
 _COMMENT_FIX_ACK = ("🔧 On it — analyzing this finding and opening a verified fix PR if the patch "
@@ -151,46 +152,6 @@ def _prepare_comment_fix(job: WebhookJob, *, token: str, app_id: str | None, git
     return None
 
 
-_CLI_SUMMARY = re.compile(r"^codna \w+ failed \(([^)]+)\): (.*)$", re.S)
-
-
-def _terse_cli_failure(summary: str) -> str:
-    """One readable clause from the CLI's structured error, minus the operator payload.
-
-    'codna fix failed (cli_error): apply failed: Git command failed ... | code=git_command_failed |
-    details={"args": [...], "cwd": "/tmp/...", "stderr": "error: corrupt patch at line 99"} (patch
-    ref: ...)' -> 'apply failed: Git command failed ... (git: error: corrupt patch at line 99)
-    [git_command_failed]'. Paths and argv stay in the Check Run summary / logs, not in the thread.
-    """
-    m = _CLI_SUMMARY.match(summary or "")
-    if not m:
-        return summary
-    code, rest = m.group(1), m.group(2)
-    rest = re.sub(r"\s*\(patch ref: [^)]*\)?\s*$", "", rest)
-    # The details payload may be TRUNCATED (the summary is capped), so never require a closing
-    # brace: cut at the marker and pull stderr out with a regex that tolerates a missing end quote.
-    details_text = ""
-    dm = re.search(r"\s*\|\s*details=", rest)
-    if dm:
-        details_text, rest = rest[dm.end():], rest[: dm.start()]
-    cm = re.search(r"\s*\|\s*code=([\w.-]+)\s*$", rest)
-    if cm:
-        code, rest = cm.group(1), rest[: cm.start()]
-    hint = ""
-    sm = re.search(r'"stderr":\s*"((?:[^"\\]|\\.)*)"?', details_text, re.S)
-    if sm:
-        stderr = sm.group(1).encode().decode("unicode_escape", errors="replace")
-        lines = [ln.strip() for ln in stderr.splitlines() if ln.strip()]
-        # the reason is usually the LAST informative line ("! [remote rejected] ... (why)"), not
-        # the "To https://..." banner git prints first
-        strong = [ln for ln in lines if re.search(r"rejected|refusing|denied|GH0\d\d", ln, re.I)]
-        weak = [ln for ln in lines if re.search(r"error|fatal", ln, re.I)]
-        pick = (strong or weak or lines)[-1] if lines else ""
-        if pick:
-            hint = f" (git: {pick[:200]})"
-    return f"{rest.strip().rstrip('.')}{hint} [{code}]"
-
-
 _WRITE_PERMISSIONS = frozenset({"admin", "maintain", "write"})
 
 _WORKFLOWS_REMEDY = (
@@ -237,7 +198,7 @@ def _comment_fix_result_msg(job: WebhookJob, token: str, result: "JobResult", gi
     if result.ok:
         url = github.find_open_pr_by_marker(job.repo_full_name, token, webhook_marker(job))
         return f"✅ Opened a verified fix PR: {url}" if url else "✅ Fix verified and pushed."
-    if result.summary.startswith("codna fix failed ("):
+    if result.summary.lower().startswith("codna fix failed ("):
         # A structured CLI error (clone timeout, bad inputs, ...) is not a rejected patch: say
         # what actually happened instead of blaming the test + risk gate.
         return f"⚠️ Codna couldn't complete this fix — {_terse_cli_failure(result.summary)}. Nothing was pushed."
@@ -292,6 +253,7 @@ def _job_env(
     token: str | None, engine_key: str | None,
     provider: str | None = None, provider_key: str | None = None,
     *, tmp: str | None = None, git_identity: tuple[str, str] | None = None,
+    check_run_id: int | None = None,
 ) -> dict[str, str]:
     """Minimal allowlisted env + the scoped GitHub token, per-org Codna key, and (when the
     linked org has configured one) their own BYOK provider key — set consistently regardless of
@@ -322,73 +284,18 @@ def _job_env(
     if git_identity:
         # the App's bot account -- fix commits then resolve to a real GitHub identity
         env["CODNA_GIT_USER_NAME"], env["CODNA_GIT_USER_EMAIL"] = git_identity
+    if check_run_id is not None:
+        # The Check Run this job opened. `codna review --post` completes THAT run with its findings
+        # instead of opening a second one, so a review shows as ONE "Codna Review" check.
+        env["CODNA_CHECK_RUN_ID"] = str(check_run_id)
     return env
 
 
-def _review_job_summary(stdout: str) -> str | None:
-    """A short, markdown-safe summary for a review job's wrapper Check Run.
-
-    ``codna review ... --json`` (the only command codna_command adds ``--json`` to) prints a
-    findings-review result dict as its ENTIRE stdout -- the same shape
-    ``cli/codna/review.py::render_findings`` renders for a human. That renderer is for a
-    terminal, though: several of its lines are indented 4+ spaces, which GitHub's markdown
-    turns into a code block rather than the intended text, so it is deliberately not reused
-    here. Returns None (never raises) on anything that isn't exactly this shape, so the caller
-    falls back to its existing raw-stdout-tail behavior instead of guessing.
-    """
-    try:
-        result = json.loads(stdout)
-    except (json.JSONDecodeError, TypeError, ValueError):
-        return None
-    if not isinstance(result, dict) or "conclusion" not in result or "findings" not in result:
-        return None
-    findings = result.get("findings") or []
-    if not findings:
-        note = result.get("note")
-        return f"codna review: {note}" if note else "codna review: no high-confidence issues found ✅"
-    posted = result.get("posted") or {}
-    inline = posted.get("inline_posted", 0)
-    summary_n = result.get("summary_count", 0)
-    return (
-        f"codna review: {len(findings)} finding(s) — {inline} inline, {summary_n} in summary "
-        f"(conclusion: {result.get('conclusion', 'unknown')}). See the **Codna Review** check "
-        "and the PR's review comments for details."
-    )
-
-
-def _error_json_summary(kind: str, *streams: str | None) -> str | None:
-    """Short, markdown-safe summary when the CLI ended with its documented structured error.
-
-    ``codna`` prints ``{"error": {"code": ..., "message": ...}}`` (indent=2) to stderr on every
-    CodnaError (cli.py), and the generic tail-of-output fallback pasted that JSON verbatim into
-    the "codna fix" Check Run summary -- two algenta runs on 2026-09-17 read exactly like that.
-    Finds the LAST such object across the given streams (stderr is searched first by passing it
-    last) and renders its message as one sentence. None when there is no such object.
-    """
-    decoder = json.JSONDecoder()
-    for text in reversed([s or "" for s in streams]):
-        pos = text.rfind('"error"')
-        while pos >= 0:
-            start = text.rfind("{", 0, pos)
-            if start < 0:
-                break
-            try:
-                obj, _ = decoder.raw_decode(text[start:])
-            except ValueError:
-                obj = None
-            err = obj.get("error") if isinstance(obj, dict) else None
-            if isinstance(err, dict) and err.get("message"):
-                code = err.get("code") or "error"
-                # 1500, not 400: the CLI embeds git's stderr at the END of the message, and a
-                # 400-char cap cut every live push/apply failure right before its reason.
-                return f"codna {kind} failed ({code}): {str(err['message'])[:1500]}"
-            pos = text.rfind('"error"', 0, pos)
-    return None
-
-
 def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
                   provider: str | None = None, provider_key: str | None = None,
-                  codna_bin: str = "codna", git_identity: tuple[str, str] | None = None) -> JobResult:
+                  codna_bin: str = "codna", git_identity: tuple[str, str] | None = None,
+    check_run_id: int | None = None,
+) -> JobResult:
     """Default runner: run packaged codna for the job in an isolated, scrubbed workspace."""
     ctx = job.context or {}
     if job.kind == "fix" and ctx.get("routing_error"):
@@ -430,33 +337,39 @@ def run_codna_job(job: WebhookJob, *, token: str | None, engine_key: str | None,
         try:
             try:
                 proc = _run_job_process(
-                    argv, env=_job_env(token, engine_key, provider, provider_key, tmp=tmp, git_identity=git_identity),
+                    argv, env=_job_env(token, engine_key, provider, provider_key, tmp=tmp, git_identity=git_identity,
+                                   check_run_id=check_run_id),
                     cwd=tmp, timeout=_JOB_TIMEOUT_S,
                 )
             except subprocess.TimeoutExpired:
-                return JobResult(False, f"codna {job.kind} timed out after {_JOB_TIMEOUT_S}s")
+                return JobResult(False, f"{check_run_name(job.kind)} timed out after {_JOB_TIMEOUT_S}s")
         finally:
             _teardown_job_runtime(tmp)  # on success, failure and timeout alike
+        # Did `codna review --post` complete the job's own Check Run with its findings? Carried on
+        # EVERY return path below, so an unparsable or unexpected stdout can never make process_job
+        # overwrite those findings with a one-line wrapper summary.
+        completed = _cli_completed_check(proc.stdout, check_run_id)
         if job.kind == "review":
             # `codna review ... --json` (codna_command's only caller of --json) prints ONE pure
             # JSON object to stdout for the caller (review_github.py's own posting logic) to
             # consume -- capture_output means it's also sitting right here in proc.stdout. The
-            # generic tail-of-stdout fallback below would dump that raw JSON as THIS wrapper
-            # check-run's summary verbatim: an unreadable wall of braces where a human expects a
-            # sentence. The detailed, well-formatted findings already live on the "Codna Review"
-            # check this same subprocess posts (review_github.py::summary_body) and as inline PR
-            # comments; this wrapper only needs to say the job completed and point there.
+            # generic tail-of-stdout fallback below would dump that raw JSON as the Check Run
+            # summary verbatim: an unreadable wall of braces where a human expects a sentence. The
+            # detailed findings already live on the "Codna Review" run this same subprocess
+            # completes (review_github.py::summary_body) and as inline PR comments; this summary is
+            # only used when the CLI did not complete the run itself.
             summary = _review_job_summary(proc.stdout)
             if summary is not None:
-                return JobResult(proc.returncode == 0, summary)
+                return JobResult(proc.returncode == 0, summary, check_completed=completed)
         if proc.returncode != 0:
             # Every CodnaError leaves the CLI's structured `{"error": {...}}` on stderr; say its
             # message as a sentence instead of pasting the braces into the Check Run summary.
             summary = _error_json_summary(job.kind, proc.stdout, proc.stderr)
             if summary is not None:
-                return JobResult(False, summary, retryable=_summary_is_retryable(summary))
+                return JobResult(False, summary, retryable=_summary_is_retryable(summary), check_completed=completed)
         tail = (proc.stdout or "")[-1500:] + (("\n" + proc.stderr[-500:]) if proc.stderr else "")
-        return JobResult(proc.returncode == 0, tail.strip() or f"codna {job.kind} exit {proc.returncode}")
+        return JobResult(proc.returncode == 0, tail.strip() or f"{check_run_name(job.kind)} exit {proc.returncode}",
+                         check_completed=completed)
 
 
 def process_job(
@@ -497,21 +410,21 @@ def process_job(
                              retry_after_s=webhook_metering.BRIDGE_RETRY_WAIT_S)
         text = webhook_metering.unreachable_summary(job.kind, str(exc))
         if token and job.ref:
-            cid = github.create_check_run(job.repo_full_name, token, name=f"codna {job.kind}",
+            cid = github.create_check_run(job.repo_full_name, token, name=check_run_name(job.kind),
                                           head_sha=job.ref, summary="codna: account service unreachable")
             if cid:
                 github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
-                                        summary=text, name=f"codna {job.kind}")
+                                        summary=text, name=check_run_name(job.kind))
         if token and job.issue_number and not job.ref:
             github.post_issue_comment(job.repo_full_name, token, job.issue_number, "⚠️ " + text)
         return JobResult(False, summary + " -- gave up after retries", retryable=False)
     if not engine_key:
         if token and job.ref:
-            cid = github.create_check_run(job.repo_full_name, token, name=f"codna {job.kind}",
+            cid = github.create_check_run(job.repo_full_name, token, name=check_run_name(job.kind),
                                           head_sha=job.ref, summary="codna: account not linked")
             if cid:
                 github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
-                                        summary=webhook_metering.unlinked_summary(), name=f"codna {job.kind}")
+                                        summary=webhook_metering.unlinked_summary(), name=check_run_name(job.kind))
         if token and job.issue_number and not job.ref:
             issue_comment_url = github.post_issue_comment(
                 job.repo_full_name,
@@ -542,11 +455,11 @@ def process_job(
             "them back on from the account page (Security -> Codna automation)."
         )
         if token and job.ref:
-            cid = github.create_check_run(job.repo_full_name, token, name=f"codna {job.kind}",
+            cid = github.create_check_run(job.repo_full_name, token, name=check_run_name(job.kind),
                                           head_sha=job.ref, summary="codna: automation disabled")
             if cid:
                 github.update_check_run(job.repo_full_name, token, cid, conclusion="neutral",
-                                        summary=fix_disabled_summary, name=f"codna {job.kind}")
+                                        summary=fix_disabled_summary, name=check_run_name(job.kind))
         if token and job.issue_number and not job.ref:
             issue_comment_url = github.post_issue_comment(
                 job.repo_full_name,
@@ -655,35 +568,37 @@ def process_job(
             # run of this name on the commit would be a concurrent sibling job's LIVE one.
             try:
                 complete_stale(
-                    job.repo_full_name, token, head_sha=job.ref, name=f"codna {job.kind}",
-                    summary=f"codna {job.kind}: an earlier attempt was interrupted (worker restart); "
+                    job.repo_full_name, token, head_sha=job.ref, name=check_run_name(job.kind),
+                    summary=f"{check_run_name(job.kind)}: an earlier attempt was interrupted (worker restart); "
                             f"superseded by a new run ({job.reason}).",
                 )
             except Exception:  # noqa: BLE001 — hygiene must never block creating this job's own run
                 pass
         check_id = github.create_check_run(
-            job.repo_full_name, token, name=f"codna {job.kind}", head_sha=job.ref,
-            summary=f"codna {job.kind} started ({job.reason})",
+            job.repo_full_name, token, name=check_run_name(job.kind), head_sha=job.ref,
+            summary=f"{check_run_name(job.kind)} started ({job.reason})",
         )
     _log_worker_phase(qjob, "runner_start")  # everything before this is token/metering/prepare/ack
     try:
         identity_fn = getattr(github, "app_bot_identity", None)
         git_identity = identity_fn(app_id, private_key) if callable(identity_fn) else None
         result = runner(job, token=token, engine_key=engine_key, provider=provider, provider_key=provider_key,
-                        git_identity=git_identity)
+                        git_identity=git_identity, check_run_id=check_id)
     except Exception as exc:  # noqa: BLE001 — a check-run this function opened must always be
         # completed, even on a crash the runner itself didn't turn into a JobResult (run_codna_job
         # only catches subprocess.TimeoutExpired). Without this, check_id is created above but
         # never reaches update_check_run below, leaving it permanently "queued" on the PR/commit —
         # the exact bug behind codna-app-smoke's check-suite, stuck since 2026-07-08. Never surface
         # the raw exception text here (could embed argv/path/token content); the class name is safe.
-        result = JobResult(False, f"codna {job.kind} crashed unexpectedly ({type(exc).__name__})")
+        result = JobResult(False, f"{check_run_name(job.kind)} crashed unexpectedly ({type(exc).__name__})")
     _log_worker_phase(qjob, "runner_done")
-    if check_id and token:
+    if check_id and token and not result.check_completed:
+        # A review's CLI already completed this run with its findings (see _job_env): overwriting it
+        # here would replace the findings with a one-line wrapper summary.
         github.update_check_run(
             job.repo_full_name, token, check_id,
             conclusion="success" if result.ok else "failure",
-            summary=result.summary, name=f"codna {job.kind}",
+            summary=result.summary, name=check_run_name(job.kind),
         )
     # An issue-label fix has neither a commit (no check_id: job.ref is never set for this trigger)
     # nor a comment thread (no reply_to) to report through, so the issue itself is the ONLY place it

{codna-0.2.35 → codna-0.2.36}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.35
+Version: 0.2.36
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.35 → codna-0.2.36}/codna.egg-info/SOURCES.txt

@@ -78,6 +78,7 @@ codna/webhook_github.py
 codna/webhook_metering.py
 codna/webhook_procs.py
 codna/webhook_queue.py
+codna/webhook_summaries.py
 codna/webhook_worker.py
 codna/worker.py
 codna/worktree.py

{codna-0.2.35 → codna-0.2.36}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.35"
+version = "0.2.36"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"