codna 0.2.35__tar.gz → 0.2.37__tar.gz

{codna-0.2.35 → codna-0.2.37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.35
+Version: 0.2.37
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.35 → codna-0.2.37}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.35"
+__version__ = "0.2.37"

{codna-0.2.35 → codna-0.2.37}/codna/cli.py

@@ -906,11 +906,11 @@ def build_parser() -> argparse.ArgumentParser:
     prv.add_argument("--base", help="diff against this ref (default: HEAD — all uncommitted changes)")
     prv.add_argument("--diff", help="diff range to review, e.g. origin/main...HEAD (overrides --base)")
     prv.add_argument("--pr", help="PR to review/post to: 123, owner/repo#123, or a PR URL")
-    prv.add_argument("--post", action="store_true", help="post the findings to the PR (one review + a 'Codna Review' check); needs --pr + a write token")
+    prv.add_argument("--post", action="store_true", help="post the findings to the PR (one review + a 'codna review' check); needs --pr + a write token")
     prv.add_argument("--github-token", dest="github_token", help="write token for --post (else $GITHUB_TOKEN / $CODNA_GITHUB_TOKEN)")
     prv.add_argument("--min-confidence", dest="min_confidence", type=float, help="only report findings at/above this confidence (default from codna.yaml or 0.75)")
     prv.add_argument("--max-findings", dest="max_findings", type=int, help="cap the number of findings (default from codna.yaml or 10)")
-    prv.add_argument("--blocking", action="store_true", help="make the 'Codna Review' check fail on a blocking-severity finding (default: non-blocking)")
+    prv.add_argument("--blocking", action="store_true", help="make the 'codna review' check fail on a blocking-severity finding (default: non-blocking)")
     prv.add_argument("--effort", choices=("low", "medium", "high"), help="review depth: high = more thorough (more agent iterations), low = cheaper (default: medium)")
     prv.add_argument("--full", action="store_true", help="review the WHOLE PR, not only commits pushed since Codna's last review (default: incremental)")
     prv.add_argument("--model", help="planner/review model (default: provider default)")

{codna-0.2.35 → codna-0.2.37}/codna/review.py

@@ -3,7 +3,7 @@
 Default: a **findings** review — diff the change and run the read-only Cline agent
 (``task_kind="review"``) over it to produce structured, deduped, noise-controlled
 :class:`~codna.review_findings.CodnaReviewFinding` records, optionally posted to a PR as one review
-(inline comments + summary + a "Codna Review" check). ``--triage`` keeps the older engine-backed risk
+(inline comments + summary + a "codna review" check). ``--triage`` keeps the older engine-backed risk
 triage (suspect files/symbols + context reduction).
 """
 from __future__ import annotations
@@ -32,6 +32,13 @@ def _fail(message: str, details: dict[str, object] | None = None) -> None:
     raise ReviewError(message, details)
 
 
+def _env_check_run_id() -> int | None:
+    """``CODNA_CHECK_RUN_ID``: a Check Run the caller (the webhook worker) already opened for this
+    review; ``--post`` completes it instead of creating a second one. Unset or garbage -> None."""
+    raw = os.environ.get("CODNA_CHECK_RUN_ID", "").strip()
+    return int(raw) if raw.isdigit() else None
+
+
 def _wrapped_details(exc: BaseException) -> dict[str, object]:
     """Structured detail carried by a wrapped error, if it has any.
 
@@ -239,7 +246,8 @@ def run_findings_review(args) -> dict:
             if not token:
                 _fail("--post needs a write token: pass --github-token or set GITHUB_TOKEN.")
             try:
-                out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token)
+                out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token,
+                                               check_run_id=_env_check_run_id())
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.35 → codna-0.2.37}/codna/review_findings.py

@@ -1,4 +1,4 @@
-"""Codna Review — turn a diff into validated, deduped, noise-controlled findings.
+"""codna review — turn a diff into validated, deduped, noise-controlled findings.
 
 The review pass runs the read-only Cline agent (``task_kind="review"``) over a diff and normalizes
 its output into :class:`CodnaReviewFinding` records: a stable schema plus a resolved GitHub *diff
@@ -324,7 +324,7 @@ def apply_noise_controls(
 
 
 def check_conclusion(findings: list[CodnaReviewFinding], config: ReviewConfig) -> str:
-    """The "Codna Review" check conclusion. NON-BLOCKING by default: ``failure`` only when blocking is
+    """The "codna review" check conclusion. NON-BLOCKING by default: ``failure`` only when blocking is
     explicitly enabled AND a finding hits a blocking severity; ``success`` = clean; else ``neutral``."""
     if not findings:
         return "success"

{codna-0.2.35 → codna-0.2.37}/codna/review_github.py

@@ -1,4 +1,4 @@
-"""Post a Codna Review to a GitHub PR: ONE review (inline comments + summary) + a check run.
+"""Post a codna review to a GitHub PR: ONE review (inline comments + summary) + a check run.
 
 Pure builders (comment body, review payload, existing-fingerprint scan, summary markdown) are
 unit-tested offline; only :func:`post_review` touches the network. Each inline comment carries a
@@ -17,7 +17,7 @@ import subprocess
 from .review_findings import CATEGORIES, SEVERITIES, CodnaReviewFinding, ReviewResult
 
 _API = "https://api.github.com"
-CHECK_NAME = "Codna Review"
+CHECK_NAME = "codna review"
 _MARKER_RE = re.compile(r"<!--\s*codna:review:fp=([0-9a-f]{6,40})\s*-->")
 # Machine-readable finding payload embedded in every inline comment so the `@codna fix` wedge can
 # reconstruct the finding EXACTLY (path/line/severity/category/title/explanation) — the human markdown
@@ -115,8 +115,8 @@ def summary_body(result: ReviewResult) -> str:
     n = len(result.findings)
     head_mark = reviewed_head_marker(result.head_sha)
     if n == 0:
-        return "**Codna Review** — no high-confidence issues found. ✅\n\n" + fp_marker("none") + "\n" + head_mark
-    lines = [f"**Codna Review** — {n} finding(s): "
+        return "**codna review** — no high-confidence issues found. ✅\n\n" + fp_marker("none") + "\n" + head_mark
+    lines = [f"**codna review** — {n} finding(s): "
              f"{len(result.inline_findings)} inline, {len(result.summary_findings)} in summary.", ""]
     for f in result.summary_findings:
         loc = f"`{f.path}:{f.line}`"
@@ -160,7 +160,7 @@ def build_review_payload(result: ReviewResult, *, skip_fingerprints: set[str] |
 
 
 def fetch_pr(repo_slug: str, pr_number: int, token: str | None) -> dict:
-    """GET the PR metadata Codna Review needs: base ref, head SHA, head ref, fork flag."""
+    """GET the PR metadata codna review needs: base ref, head SHA, head ref, fork flag."""
     import httpx
 
     headers = {"Accept": "application/vnd.github+json"}
@@ -272,12 +272,16 @@ def parse_pr_arg(value: str, repo_dir: str) -> tuple[str | None, int | None]:
 
 
 def post_review(
-    result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True
+    result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
+    check_run_id: int | None = None,
 ) -> dict:
-    """Post ONE review (+ a "Codna Review" check) to the PR. Returns a small status dict.
+    """Post ONE review (+ the "codna review" check) to the PR. Returns a small status dict.
 
     ``dedup`` fetches existing PR review comments and skips fingerprints Codna already posted, so a
-    re-run on the same head does not duplicate threads."""
+    re-run on the same head does not duplicate threads. ``check_run_id`` (the webhook passes it as
+    ``CODNA_CHECK_RUN_ID``) is a Check Run the caller already opened for this review: it is
+    completed with the findings instead of a second run being created, so the PR shows exactly one
+    "codna review" check."""
     try:
         import httpx
     except Exception as exc:  # noqa: BLE001
@@ -309,20 +313,27 @@ def post_review(
         posted_review = True
 
     check = None
-    if result.head_sha:
+    if check_run_id is not None or result.head_sha:
         from . import webhook_github
 
         try:
-            cid = webhook_github.create_check_run(
-                repo_slug, token, name=CHECK_NAME, head_sha=result.head_sha,
-                summary=f"{len(result.findings)} finding(s)",
-            )
-            if cid is not None:
+            if check_run_id is not None:
                 webhook_github.update_check_run(
-                    repo_slug, token, cid, conclusion=result.conclusion,
+                    repo_slug, token, check_run_id, conclusion=result.conclusion,
                     summary=summary_body(result), name=CHECK_NAME,
                 )
-            check = {"id": cid, "conclusion": result.conclusion}
+                check = {"id": check_run_id, "conclusion": result.conclusion, "updated_existing": True}
+            else:
+                cid = webhook_github.create_check_run(
+                    repo_slug, token, name=CHECK_NAME, head_sha=result.head_sha,
+                    summary=f"{len(result.findings)} finding(s)",
+                )
+                if cid is not None:
+                    webhook_github.update_check_run(
+                        repo_slug, token, cid, conclusion=result.conclusion,
+                        summary=summary_body(result), name=CHECK_NAME,
+                    )
+                check = {"id": cid, "conclusion": result.conclusion, "updated_existing": False}
         except Exception:  # noqa: BLE001 — the check is advisory; a failure must not fail the review
             check = None
 

{codna-0.2.35 → codna-0.2.37}/codna/webhook.py

@@ -86,6 +86,15 @@ _FIX_WRITE_ASSOCIATIONS = frozenset({"OWNER", "MEMBER", "COLLABORATOR"})
 # Codna pushes its own fix branches as `codna/<plan-id>` (see packaged_git._validated_branch and
 # fix_run). Recognising that prefix is what stops a CI-failure fix from fixing its own fix PR.
 _CODNA_BRANCH_PREFIX = "codna/"
+# ONE Check Run per job, spelled exactly like the CLI command and the PR trigger (`codna review`,
+# `@codna review`): "codna review" is also the exact name the org ruleset requires. Until
+# 2026-09-19 the worker's wrapper run and the CLI's findings run carried different casings.
+CHECK_RUN_NAMES = {"review": "codna review", "fix": "codna fix", "secure": "codna secure"}
+
+
+def check_run_name(kind: str) -> str:
+    """The Check Run name for a job kind: ``codna review`` / ``codna fix`` / ``codna secure``."""
+    return CHECK_RUN_NAMES.get(kind, f"codna {kind.replace('_', ' ')}")
 # The App's own slug on github.com. A self-hosted install runs under a different slug, so the id in
 # GITHUB_APP_ID is checked too (see _is_own_check_suite).
 _OWN_APP_SLUG = "codna-ai"
@@ -449,7 +458,7 @@ def _fix_issue_text(ctx: Mapping[str, Any]) -> str:
     loc = ctx.get("path") or "(unknown file)"
     if ctx.get("line"):
         loc = f"{loc}:{ctx['line']}"
-    parts = ["Fix the issue Codna Review flagged in this pull request.", f"Location: {loc}"]
+    parts = ["Fix the issue codna review flagged in this pull request.", f"Location: {loc}"]
     if ctx.get("severity") or ctx.get("category"):
         parts.append(f"Severity: {ctx.get('severity') or '?'} ({ctx.get('category') or '?'})")
     if ctx.get("title"):
@@ -475,7 +484,7 @@ def codna_command(
              classification; opening security PRs uses the privilege-separated two-job
              workflow, never a single server process).
     review — ``codna review <url> --pr <n> [--ref <head_sha>] --post --json`` (read-only diff review;
-             posts one review + a non-blocking "Codna Review" check).
+             completes the job's "codna review" check with the findings).
     """
     url = repo_url or f"https://github.com/{job.repo_full_name}.git"
     if job.kind == "review":
@@ -510,7 +519,7 @@ def codna_command(
                 args += ["--ref", ctx["head_sha"]]
             args += ["--base-branch", ctx["head_ref"],
                      "--pr-title", f"codna: fix {(ctx.get('title') or 'review finding')[:60]}",
-                     "--pr-body", f"Verified fix for a Codna Review finding.\n\n{webhook_marker(job)}"]
+                     "--pr-body", f"Verified fix for a codna review finding.\n\n{webhook_marker(job)}"]
             return args
         args = ["codna", "fix", url, "--open-pr"]
         if job.ref:

{codna-0.2.35 → codna-0.2.37}/codna/webhook_github.py

@@ -166,7 +166,7 @@ def create_check_run(repo_full_name: str, token: str, *, name: str, head_sha: st
 
 
 def update_check_run(repo_full_name: str, token: str, check_run_id: int, *, conclusion: str, summary: str,
-                     name: str = "codna") -> None:
+                     name: str = "Codna") -> None:
     try:
         import httpx
     except Exception as exc:  # noqa: BLE001

codna-0.2.37/codna/webhook_summaries.py

@@ -0,0 +1,137 @@
+"""Check Run / reply summaries for webhook jobs: the one-line, markdown-safe text a job leaves
+behind, and the CLI-error parsing that produces it.
+
+Split out of webhook_worker.py on 2026-09-18 (the 1000-line modularity ceiling); pure functions,
+no I/O. Names are the lowercase Check Run names ("codna fix failed (cli_error): ...") -- see
+webhook.check_run_name.
+"""
+from __future__ import annotations
+
+import json
+import re
+
+from .webhook import check_run_name
+
+# Case-insensitive on purpose: summaries were briefly Title Case ("Codna Fix failed (...)") in 2026-09.
+_CLI_SUMMARY = re.compile(r"^codna \w+ failed \(([^)]+)\): (.*)$", re.S | re.IGNORECASE)
+
+
+# CLI error codes whose failure is a property of the inputs, not of the moment.
+_NON_RETRYABLE_CODES = frozenset({"cli_error", "usage_error", "invalid_input", "input_error"})
+
+
+_SUMMARY_CODE = re.compile(r"^codna \w+ failed \(([^)]+)\)", re.IGNORECASE)
+
+
+def _summary_is_retryable(summary: str) -> bool:
+    m = _SUMMARY_CODE.match(summary or "")
+    return not (m and m.group(1) in _NON_RETRYABLE_CODES)
+
+
+def _terse_cli_failure(summary: str) -> str:
+    """One readable clause from the CLI's structured error, minus the operator payload.
+
+    'codna fix failed (cli_error): apply failed: Git command failed ... | code=git_command_failed |
+    details={"args": [...], "cwd": "/tmp/...", "stderr": "error: corrupt patch at line 99"} (patch
+    ref: ...)' -> 'apply failed: Git command failed ... (git: error: corrupt patch at line 99)
+    [git_command_failed]'. Paths and argv stay in the Check Run summary / logs, not in the thread.
+    """
+    m = _CLI_SUMMARY.match(summary or "")
+    if not m:
+        return summary
+    code, rest = m.group(1), m.group(2)
+    rest = re.sub(r"\s*\(patch ref: [^)]*\)?\s*$", "", rest)
+    # The details payload may be TRUNCATED (the summary is capped), so never require a closing
+    # brace: cut at the marker and pull stderr out with a regex that tolerates a missing end quote.
+    details_text = ""
+    dm = re.search(r"\s*\|\s*details=", rest)
+    if dm:
+        details_text, rest = rest[dm.end():], rest[: dm.start()]
+    cm = re.search(r"\s*\|\s*code=([\w.-]+)\s*$", rest)
+    if cm:
+        code, rest = cm.group(1), rest[: cm.start()]
+    hint = ""
+    sm = re.search(r'"stderr":\s*"((?:[^"\\]|\\.)*)"?', details_text, re.S)
+    if sm:
+        stderr = sm.group(1).encode().decode("unicode_escape", errors="replace")
+        lines = [ln.strip() for ln in stderr.splitlines() if ln.strip()]
+        # the reason is usually the LAST informative line ("! [remote rejected] ... (why)"), not
+        # the "To https://..." banner git prints first
+        strong = [ln for ln in lines if re.search(r"rejected|refusing|denied|GH0\d\d", ln, re.I)]
+        weak = [ln for ln in lines if re.search(r"error|fatal", ln, re.I)]
+        pick = (strong or weak or lines)[-1] if lines else ""
+        if pick:
+            hint = f" (git: {pick[:200]})"
+    return f"{rest.strip().rstrip('.')}{hint} [{code}]"
+
+
+def _review_job_summary(stdout: str) -> str | None:
+    """A short, markdown-safe summary for a review job's wrapper Check Run.
+
+    ``codna review ... --json`` (the only command codna_command adds ``--json`` to) prints a
+    findings-review result dict as its ENTIRE stdout -- the same shape
+    ``cli/codna/review.py::render_findings`` renders for a human. That renderer is for a
+    terminal, though: several of its lines are indented 4+ spaces, which GitHub's markdown
+    turns into a code block rather than the intended text, so it is deliberately not reused
+    here. Returns None (never raises) on anything that isn't exactly this shape, so the caller
+    falls back to its existing raw-stdout-tail behavior instead of guessing.
+    """
+    try:
+        result = json.loads(stdout)
+    except (json.JSONDecodeError, TypeError, ValueError):
+        return None
+    if not isinstance(result, dict) or "conclusion" not in result or "findings" not in result:
+        return None
+    findings = result.get("findings") or []
+    if not findings:
+        note = result.get("note")
+        return f"codna review: {note}" if note else "codna review: no high-confidence issues found ✅"
+    posted = result.get("posted") or {}
+    inline = posted.get("inline_posted", 0)
+    summary_n = result.get("summary_count", 0)
+    return (
+        f"codna review: {len(findings)} finding(s) — {inline} inline, {summary_n} in summary "
+        f"(conclusion: {result.get('conclusion', 'unknown')}). See the PR's review comments for details."
+    )
+
+
+def _cli_completed_check(stdout: str, check_run_id: int | None) -> bool:
+    """True when ``codna review --post`` reports it completed THIS job's Check Run itself."""
+    if check_run_id is None:
+        return False
+    try:
+        result = json.loads(stdout)
+    except (json.JSONDecodeError, TypeError, ValueError):
+        return False
+    check = ((result.get("posted") or {}).get("check") or {}) if isinstance(result, dict) else {}
+    return bool(check.get("updated_existing")) and check.get("id") == check_run_id
+
+
+def _error_json_summary(kind: str, *streams: str | None) -> str | None:
+    """Short, markdown-safe summary when the CLI ended with its documented structured error.
+
+    ``codna`` prints ``{"error": {"code": ..., "message": ...}}`` (indent=2) to stderr on every
+    CodnaError (cli.py), and the generic tail-of-output fallback pasted that JSON verbatim into
+    the "codna fix" Check Run summary -- two algenta runs on 2026-09-17 read exactly like that.
+    Finds the LAST such object across the given streams (stderr is searched first by passing it
+    last) and renders its message as one sentence. None when there is no such object.
+    """
+    decoder = json.JSONDecoder()
+    for text in reversed([s or "" for s in streams]):
+        pos = text.rfind('"error"')
+        while pos >= 0:
+            start = text.rfind("{", 0, pos)
+            if start < 0:
+                break
+            try:
+                obj, _ = decoder.raw_decode(text[start:])
+            except ValueError:
+                obj = None
+            err = obj.get("error") if isinstance(obj, dict) else None
+            if isinstance(err, dict) and err.get("message"):
+                code = err.get("code") or "error"
+                # 1500, not 400: the CLI embeds git's stderr at the END of the message, and a
+                # 400-char cap cut every live push/apply failure right before its reason.
+                return f"{check_run_name(kind)} failed ({code}): {str(err['message'])[:1500]}"
+            pos = text.rfind('"error"', 0, pos)
+    return None