codna 0.2.45__tar.gz → 0.2.46__tar.gz

{codna-0.2.45 → codna-0.2.46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.45
+Version: 0.2.46
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.45 → codna-0.2.46}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.45"
+__version__ = "0.2.46"

{codna-0.2.45 → codna-0.2.46}/codna/agent-core/run-server.bundle.mjs

@@ -255509,6 +255509,8 @@ function buildSystemPrompt(args) {
   if (args.injected_context) {
     if (taskKind === "chat") {
       guidance.push("The section below is relevant repository context recalled by Telys memory. Use it to inform your answer WHEN it helps; it is reference material, not a task. Do not treat it as something to fix or edit, and do not act on it unless the user actually asks you to change code.");
+    } else if (taskKind === "review" || taskKind === "triage") {
+      guidance.push("The section below is repository context for reference. Use it to confirm or reject findings; it is not a task. Do not modify files and do not describe edits you would make.");
     } else {
       guidance.push("Treat the injected repository evidence bundle as authoritative. If it names the target file, edit that file directly instead of exploring the repository.");
       guidance.push("If the bundle includes TARGET FILE EXCERPTS, use those exact lines for the edit and do not spend turns re-reading the same file.");
@@ -255522,6 +255524,9 @@ function buildSystemPrompt(args) {
   return guidance.join(" ") + (args.injected_context ? taskKind === "chat" ? `
 
 [RELEVANT REPOSITORY CONTEXT \u2014 recalled by Telys memory; reference only]
+${args.injected_context}` : taskKind === "review" || taskKind === "triage" ? `
+
+[REPOSITORY CONTEXT \u2014 reference only]
 ${args.injected_context}` : `
 
 [REPOSITORY EVIDENCE BUNDLE \u2014 authoritative; prefer it over exploring the repo]
@@ -256257,6 +256262,11 @@ function normalizeLimits(value) {
     ...timeoutMs ? { timeoutMs } : {}
   };
 }
+var VERBATIM_PROMPT_TASK_KINDS = new Set(["review", "triage"]);
+function payloadTaskKind(payload) {
+  const task = asRecord(payload.task_spec);
+  return optionalString(payload.task_kind) || optionalString(task.task_kind);
+}
 function buildPrompt(payload) {
   if (typeof payload.prompt === "string" && payload.prompt.trim()) {
     return payload.prompt.trim();
@@ -256264,6 +256274,9 @@ function buildPrompt(payload) {
   const task = asRecord(payload.task_spec);
   const injectedContext = asRecord(payload.injected_context);
   const issue2 = optionalString(task.issue_text) || "(see the evidence bundle)";
+  if (VERBATIM_PROMPT_TASK_KINDS.has(payloadTaskKind(payload) ?? "")) {
+    return issue2;
+  }
   const targets = promptFileHints(issue2, injectedContext, optionalString(payload.working_dir));
   const lines = ["Fix this repository issue:", issue2];
   if (targets.length > 0) {
@@ -257221,10 +257234,11 @@ function normalizeSessionPayload(payload, owner) {
   const engine = resolveEngineConfig(payload);
   const workingDir = requiredString(payload.working_dir, "working_dir");
   const issueText = optionalString(taskSpec.issue_text);
+  const taskKind = resolveTaskKind(payload, taskSpec);
   const args = {
     working_dir: workingDir,
     prompt: buildPrompt(payload),
-    injected_context: serializeInjectedContext(payload.injected_context, {
+    injected_context: taskKind === "review" ? "" : serializeInjectedContext(payload.injected_context, {
       issueText,
       workingDir
     }),
@@ -257234,7 +257248,7 @@ function normalizeSessionPayload(payload, owner) {
     require_provider_api_key: booleanValue(payload.require_provider_api_key) || booleanValue(asRecord(taskSpec.engine).require_provider_api_key),
     base_url: optionalString(payload.base_url) || optionalString(asRecord(taskSpec.engine).base_url),
     headers: Object.keys(asRecord(payload.headers)).length > 0 ? asRecord(payload.headers) : undefined,
-    task_kind: resolveTaskKind(payload, taskSpec),
+    task_kind: taskKind,
     suppress_exploration: booleanValue(payload.suppress_exploration),
     reasoning_effort: optionalString(payload.reasoning_effort) || optionalString(taskSpec.reasoning_effort),
     tool_profile: optionalString(payload.tool_profile) || optionalString(taskSpec.tool_profile),
@@ -258236,6 +258250,10 @@ async function enrichPayloadWithTelys(payload, rootDir) {
       event: { status: "skipped", reason: !workingDir ? "working_dir_missing" : "issue_text_missing" }
     };
   }
+  const taskKind = optionalString(payload.task_kind) || optionalString(asRecord(payload.task_spec).task_kind);
+  if (taskKind === "review") {
+    return { payload, event: { status: "skipped", reason: "review_task_kind" } };
+  }
   const deterministicTargets = existingLineSpecificTargets(payload, workingDir, issueText);
   const requestForcedTelys = requestEnabledOverride(payload) === true;
   if (shouldSkipTelysForDeterministicLineTarget(payload, workingDir, issueText)) {

{codna-0.2.45 → codna-0.2.46}/codna/agent-core/vendor/cline/algenta/adapter.ts

@@ -288,6 +288,14 @@ export function buildSystemPrompt(args: RunAgentArgs): string {
 			guidance.push(
 				"The section below is relevant repository context recalled by Telys memory. Use it to inform your answer WHEN it helps; it is reference material, not a task. Do not treat it as something to fix or edit, and do not act on it unless the user actually asks you to change code.",
 			);
+		} else if (taskKind === "review" || taskKind === "triage") {
+			// Read-only kinds: context is reference material. The fix wording below ("edit that file
+			// directly", "for the edit") on top of the review contract ("Do not modify files ... FINAL
+			// message MUST be a single JSON object") is what made the review model narrate an edit
+			// instead of returning findings (thyn-ai/test-codna-app-e2e#16, 2026-09-19).
+			guidance.push(
+				"The section below is repository context for reference. Use it to confirm or reject findings; it is not a task. Do not modify files and do not describe edits you would make.",
+			);
 		} else {
 			guidance.push(
 				"Treat the injected repository evidence bundle as authoritative. If it names the target file, edit that file directly instead of exploring the repository.",
@@ -313,7 +321,9 @@ export function buildSystemPrompt(args: RunAgentArgs): string {
 		(args.injected_context
 			? taskKind === "chat"
 				? `\n\n[RELEVANT REPOSITORY CONTEXT — recalled by Telys memory; reference only]\n${args.injected_context}`
-				: `\n\n[REPOSITORY EVIDENCE BUNDLE — authoritative; prefer it over exploring the repo]\n${args.injected_context}`
+				: taskKind === "review" || taskKind === "triage"
+					? `\n\n[REPOSITORY CONTEXT — reference only]\n${args.injected_context}`
+					: `\n\n[REPOSITORY EVIDENCE BUNDLE — authoritative; prefer it over exploring the repo]\n${args.injected_context}`
 			: "")
 	);
 }

codna-0.2.46/codna/agent-core/vendor/cline/algenta/review-policy.test.ts

@@ -0,0 +1,121 @@
+// task_kind:"review" is read-only below the model: writes AND the shell are disabled, and the
+// system prompt carries the structured-findings JSON output contract.
+import { expect, test } from "bun:test";
+import { buildSystemPrompt, buildToolPolicies } from "./adapter";
+
+const reviewArgs = { working_dir: "/work", prompt: "review this diff", task_kind: "review" } as never;
+
+test("review disables write tools AND the shell (read-only, no code execution)", () => {
+	const policies = buildToolPolicies(reviewArgs);
+	expect(policies.editor).toEqual({ enabled: false });
+	expect(policies.apply_patch).toEqual({ enabled: false });
+	expect(policies.run_commands).toEqual({ enabled: false });
+});
+
+test("review keeps read/search tools enabled (may confirm a finding)", () => {
+	const policies = buildToolPolicies(reviewArgs);
+	// no explicit disable entry → covered by the "*" wildcard (enabled)
+	expect(policies.read_files).toBeUndefined();
+	expect(policies.search_codebase).toBeUndefined();
+	expect(policies["*"]).toEqual({ enabled: true, autoApprove: true });
+});
+
+test("review system prompt states the findings JSON output contract", () => {
+	const p = buildSystemPrompt(reviewArgs);
+	expect(p).toContain("code-review agent");
+	expect(p).toContain('{"findings"');
+	expect(p).toContain("confidence");
+	expect(p).toContain("Do not modify files");
+});
+
+test("triage still disables writes but NOT the shell (unchanged)", () => {
+	const triage = buildToolPolicies({ working_dir: "/work", prompt: "x", task_kind: "triage" } as never);
+	expect(triage.editor).toEqual({ enabled: false });
+	expect(triage.run_commands).toBeUndefined();
+});
+
+test("fix leaves write + shell tools enabled (unchanged)", () => {
+	const fix = buildToolPolicies({ working_dir: "/work", prompt: "x", task_kind: "fix" } as never);
+	expect(fix.editor).toBeUndefined();
+	expect(fix.apply_patch).toBeUndefined();
+	expect(fix.run_commands).toBeUndefined();
+});
+
+// ── A review is a review, never a repository issue to fix ─────────────────────────────────────
+// thyn-ai/test-codna-app-e2e#16 (2026-09-19): the review prompt travelled as task_spec.issue_text,
+// buildPrompt wrapped it in the FIX template and the system prompt gained "edit that file directly";
+// the model announced the edit it could not make and ended the turn in prose.
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { normalizeSessionPayload } from "./server/policy";
+import { buildPrompt } from "./server/utils";
+import { enrichPayloadWithTelys } from "./telys-localize";
+
+const REVIEW_TEXT =
+	"Review the following pull-request diff for high-confidence defects.\nChanged files: .github/workflows/ci.yml, README.md\n----- BEGIN DIFF -----\n+      - name: Install deps\n+        run: exit 1\n----- END DIFF -----";
+
+test("buildPrompt hands a review's task text to the model verbatim (no fix framing)", () => {
+	const prompt = buildPrompt({ working_dir: "/work", task_kind: "review", task_spec: { issue_text: REVIEW_TEXT } });
+	expect(prompt).toBe(REVIEW_TEXT);
+	expect(prompt).not.toContain("Fix this repository issue");
+	expect(prompt).not.toContain("file-editing tools");
+	// triage is read-only analysis too
+	expect(buildPrompt({ working_dir: "/work", task_spec: { task_kind: "triage", issue_text: "why is it slow?" } })).toBe("why is it slow?");
+});
+
+test("buildPrompt still frames a fix as a fix (unchanged)", () => {
+	const prompt = buildPrompt({ working_dir: "/work", task_kind: "fix", task_spec: { issue_text: "the button is broken" } });
+	expect(prompt).toContain("Fix this repository issue:");
+	expect(prompt).toContain("Make the minimal correct change with your file-editing tools, then stop.");
+});
+
+test("normalizeSessionPayload gives a review no issue-derived evidence bundle", () => {
+	const dir = mkdtempSync(path.join(tmpdir(), "codna-review-"));
+	try {
+		writeFileSync(path.join(dir, "README.md"), "# hi\n");
+		const session = normalizeSessionPayload(
+			{ working_dir: dir, task_kind: "review", approval_profile: "repository_review", task_spec: { issue_text: REVIEW_TEXT } },
+			"owner",
+		);
+		expect(session.prompt).toBe(REVIEW_TEXT);
+		expect(session.injectedContext).toBe("");
+		const system = buildSystemPrompt({ working_dir: dir, prompt: session.prompt, task_kind: "review", injected_context: session.injectedContext } as never);
+		expect(system).not.toContain("edit that file directly");
+		expect(system).not.toContain("EVIDENCE BUNDLE");
+		expect(system).toContain("Do not modify files");
+		// the same text as a FIX still mines README.md as a target (unchanged behaviour)
+		const fix = normalizeSessionPayload({ working_dir: dir, task_kind: "fix", task_spec: { issue_text: REVIEW_TEXT } }, "owner");
+		expect(fix.injectedContext).toContain("README.md");
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+});
+
+test("review/triage system prompts never carry fix guidance even with injected context", () => {
+	for (const kind of ["review", "triage"] as const) {
+		const p = buildSystemPrompt({ working_dir: "/work", prompt: "x", task_kind: kind, injected_context: "TARGET FILES\n- a.py" } as never);
+		expect(p).not.toContain("edit that file directly");
+		expect(p).not.toContain("for the edit");
+		expect(p).toContain("reference only");
+		expect(p).toContain("not a task");
+	}
+	const fix = buildSystemPrompt({ working_dir: "/work", prompt: "x", task_kind: "fix", injected_context: "TARGET FILES\n- a.py" } as never);
+	expect(fix).toContain("edit that file directly");
+});
+
+test("Telys localization is skipped for a review payload", async () => {
+	const previous = process.env.AGENT_CORE_TELYS_LOCALIZE_ENABLED;
+	process.env.AGENT_CORE_TELYS_LOCALIZE_ENABLED = "1";
+	try {
+		const out = await enrichPayloadWithTelys(
+			{ working_dir: "/work", task_kind: "review", task_spec: { issue_text: REVIEW_TEXT } },
+			"/work",
+		);
+		expect(out.event.status).toBe("skipped");
+		expect(out.event.reason).toBe("review_task_kind");
+	} finally {
+		if (previous === undefined) delete process.env.AGENT_CORE_TELYS_LOCALIZE_ENABLED;
+		else process.env.AGENT_CORE_TELYS_LOCALIZE_ENABLED = previous;
+	}
+});

{codna-0.2.45 → codna-0.2.46}/codna/agent-core/vendor/cline/algenta/server/policy.ts

@@ -271,13 +271,20 @@ export function normalizeSessionPayload(
 	const engine = resolveEngineConfig(payload);
 	const workingDir = requiredString(payload.working_dir, "working_dir");
 	const issueText = optionalString(taskSpec.issue_text);
+	const taskKind = resolveTaskKind(payload, taskSpec);
 	const args: RunAgentArgs = {
 		working_dir: workingDir,
 		prompt: buildPrompt(payload),
-		injected_context: serializeInjectedContext(payload.injected_context, {
-			issueText,
-			workingDir,
-		}),
+		// A review's evidence is the diff in its prompt. The injected context is the FIX path's
+		// evidence bundle (TARGET FILES mined out of the task text, excerpts, Telys ranking), and its
+		// presence makes buildSystemPrompt add fix guidance -- so a review gets none.
+		injected_context:
+			taskKind === "review"
+				? ""
+				: serializeInjectedContext(payload.injected_context, {
+						issueText,
+						workingDir,
+					}),
 		provider:
 			optionalString(payload.provider) ||
 			optionalString(asRecord(taskSpec.engine).provider),
@@ -299,7 +306,7 @@ export function normalizeSessionPayload(
 			Object.keys(asRecord(payload.headers)).length > 0
 				? (asRecord(payload.headers) as Record<string, string>)
 				: undefined,
-		task_kind: resolveTaskKind(payload, taskSpec),
+		task_kind: taskKind,
 		suppress_exploration: booleanValue(payload.suppress_exploration),
 		reasoning_effort:
 			optionalString(payload.reasoning_effort) ||

{codna-0.2.45 → codna-0.2.46}/codna/agent-core/vendor/cline/algenta/server/utils.ts

@@ -433,6 +433,14 @@ export function normalizeLimits(
 	};
 }
 
+/** Task kinds whose user turn is the task text itself: nothing is being fixed. */
+const VERBATIM_PROMPT_TASK_KINDS = new Set(["review", "triage"]);
+
+export function payloadTaskKind(payload: Record<string, unknown>): string | undefined {
+	const task = asRecord(payload.task_spec);
+	return optionalString(payload.task_kind) || optionalString(task.task_kind);
+}
+
 export function buildPrompt(payload: Record<string, unknown>): string {
 	if (typeof payload.prompt === "string" && payload.prompt.trim()) {
 		return payload.prompt.trim();
@@ -440,6 +448,13 @@ export function buildPrompt(payload: Record<string, unknown>): string {
 	const task = asRecord(payload.task_spec);
 	const injectedContext = asRecord(payload.injected_context);
 	const issue = optionalString(task.issue_text) || "(see the evidence bundle)";
+	if (VERBATIM_PROMPT_TASK_KINDS.has(payloadTaskKind(payload) ?? "")) {
+		// A review (or triage) is not a repository issue to fix. Wrapping it below turned every
+		// code review into "Fix this repository issue: <diff> ... Make the minimal correct change
+		// with your file-editing tools, then stop." -- the model then described the edit it could
+		// not make (writes are policy-disabled) instead of returning the findings JSON.
+		return issue;
+	}
 	const targets = promptFileHints(
 		issue,
 		injectedContext,

{codna-0.2.45 → codna-0.2.46}/codna/agent-core/vendor/cline/algenta/telys-localize.ts

@@ -571,6 +571,12 @@ export async function enrichPayloadWithTelys(
 			event: { status: "skipped", reason: !workingDir ? "working_dir_missing" : "issue_text_missing" },
 		};
 	}
+	const taskKind = optionalString(payload.task_kind) || optionalString(asRecord(payload.task_spec).task_kind);
+	if (taskKind === "review") {
+		// Localization ranks files to FIX. A review carries its own diff; ranked suspect files would
+		// only feed the fix-shaped context the review must not receive.
+		return { payload, event: { status: "skipped", reason: "review_task_kind" } };
+	}
 	const deterministicTargets = existingLineSpecificTargets(payload, workingDir, issueText);
 	const requestForcedTelys = requestEnabledOverride(payload) === true;
 	if (shouldSkipTelysForDeterministicLineTarget(payload, workingDir, issueText)) {

{codna-0.2.45 → codna-0.2.46}/codna/cline_agent.py

@@ -23,6 +23,19 @@ class ClineAgentError(Exception):
 
 # Enough of the agent's reply to tell the failure modes apart, bounded so a runaway response
 # cannot flood a check summary.
+
+
+class UnparseableFindingsError(ClineAgentError):
+    """The review agent's final message was not the findings JSON the contract asks for.
+
+    Its own class so callers can tell an output-contract miss (repairable with one bounded re-ask,
+    see review_findings.run_review_agent) from every other agent failure, and so the Check Run
+    carries a specific ``cause_code`` (review.py::_wrapped_details reads ``code``).
+    """
+
+    code = "review_unparseable_output"
+
+
 _RAW_EXCERPT_CHARS = 400
 
 
@@ -187,7 +200,7 @@ def extract_findings_json(text: str) -> list[dict]:
                         break
             start = raw.find(opener, start + 1)
 
-    raise ClineAgentError(
+    raise UnparseableFindingsError(
         "review agent did not return parseable findings JSON",
         _unparseable_output_details(raw),
     )

{codna-0.2.45 → codna-0.2.46}/codna/packaged_agent_runner.py

@@ -146,16 +146,30 @@ def _sidecar_payload(request: PackagedAgentRunRequest, workspace: Path) -> dict[
         "tool_profile": _tool_profile_for_task(task_kind),
         "limits": {"maxIterations": max_turns, "timeoutMs": timeout_ms},
         "task_spec": {
-            "issue_text": _issue_text_with_guidance(request),
             "task_kind": task_kind,
             "engine": {"enabled": False},
         },
-        "injected_context": _injected_context(request),
+        "injected_context": {},
         "allowed_write_paths": [] if task_kind == "review" else _allowed_write_paths(request),
     }
     if task_kind == "review":
+        # A review is delivered VERBATIM as the user turn (`prompt`), never as `task_spec.issue_text`.
+        # The sidecar's issue_text path is the FIX path: buildPrompt (server/utils.ts) wraps it in
+        # "Fix this repository issue: ... Make the minimal correct change with your file-editing
+        # tools, then stop.", mines TARGET FILES out of it, and buildSystemPrompt (adapter.ts) then
+        # tells the model to "edit that file directly" -- on top of the review contract's "Do not
+        # modify files ... FINAL message MUST be a single JSON object". Given both, the model
+        # announced the edit it could not make (writes are filtered out of its tools) and ended the
+        # turn in prose, and `codna review` failed with "did not return parseable findings JSON"
+        # (thyn-ai/algenta-sdk#16 2026-08-27, thyn-ai/test-codna-app-e2e#15/#16 2026-09-19).
+        # No issue_text also means no Telys enrichment and no fix-worded project guidance: the
+        # review prompt already carries the diff and the project guidance (review_findings.py).
+        payload["prompt"] = request.issue_text
         payload["approval_profile"] = "repository_review"
         payload["allowed_write_scope"] = []
+    else:
+        payload["task_spec"]["issue_text"] = _issue_text_with_guidance(request)
+        payload["injected_context"] = _injected_context(request)
     if provider:
         payload["provider"] = provider
     if model:

{codna-0.2.45 → codna-0.2.46}/codna/review_findings.py

@@ -378,6 +378,19 @@ _MAX_DIFF_CHARS = 60_000  # keep the review pass fast + within budget; truncate
 _MAX_FEEDBACK_CHARS = 6_000  # cap the prior-comment context so it can't crowd out the diff
 
 
+# Restated in the user turn, not only in the sidecar's system prompt (adapter.ts): a review that
+# reads like a task to complete got completed -- the model described the change it would make and
+# ended the turn, and the run failed with "did not return parseable findings JSON".
+REVIEW_OUTPUT_CONTRACT = (
+    "You are REVIEWING this diff, not fixing it: do not modify files, do not run commands, and do not "
+    "describe changes you would make. A change that looks deliberate (a probe, a failing step, a "
+    "removed test) is not a finding unless it is a real defect. "
+    'Your FINAL message MUST be a single JSON object and nothing else -- no prose, no code fences: '
+    '{"findings": [...]} using the Finding shape from your instructions; '
+    'if there are no high-confidence issues, return {"findings": []}.'
+)
+
+
 def build_review_prompt(diff_text: str, changed_files: list[str], guidance: str | None,
                         config: ReviewConfig, prior_feedback: str | None = None) -> str:
     """Build the review task prompt: the diff + in-scope categories + the confidence bar + (optionally)
@@ -403,6 +416,7 @@ def build_review_prompt(diff_text: str, changed_files: list[str], guidance: str
             "Comments already on this PR (from human reviewers and prior bot passes). Do NOT repeat a "
             "point that is already raised here; you may build on them:\n" + prior_feedback.strip()[:_MAX_FEEDBACK_CHARS]
         )
+    parts.append(REVIEW_OUTPUT_CONTRACT)
     parts.append("\n----- BEGIN DIFF -----\n" + diff + truncated + "\n----- END DIFF -----")
     return "\n\n".join(parts)
 
@@ -519,7 +533,7 @@ def run_review_agent(
     the model.
     """
     from . import cli as _cli
-    from .cline_agent import extract_findings_json
+    from .cline_agent import UnparseableFindingsError, extract_findings_json
     from .packaged_agent_runner import SidecarPackagedAgentRunner
     from .packaged_repository_advanced import PackagedAgentRunRequest
     from .runtime.config import resolve_runtime_config
@@ -527,24 +541,70 @@ def run_review_agent(
     repo_root = Path(repo_dir).expanduser().resolve()
     keys = _cli._runtime_keys(include_keychain=True)
     config_runtime = resolve_runtime_config(keys=keys)
-    prompt_digest = hashlib.sha256(prompt.encode("utf-8")).hexdigest()[:16]
-    request = PackagedAgentRunRequest(
-        repository_id="review_" + hashlib.sha256(str(repo_root).encode("utf-8")).hexdigest()[:16],
-        snapshot_id="review_" + prompt_digest,
-        repo_root=repo_root,
-        issue_text=prompt,
-        model=_review_model(provider=provider, model=model),
-        signals={"review_timeout_s": timeout_s, "review_max_iterations": max_iterations},
-        evidence_bundle={},
-        snapshot={
-            "snapshot_id": "review_" + prompt_digest,
-            "snapshot_file_count": 0,
-            "raw_repo_token_estimate": max(1, len(prompt) // 4),
-        },
-        task_kind="review",
+    runner = SidecarPackagedAgentRunner(config=config_runtime, keys=keys)
+
+    def _run(text: str):
+        digest = hashlib.sha256(text.encode("utf-8")).hexdigest()[:16]
+        request = PackagedAgentRunRequest(
+            repository_id="review_" + hashlib.sha256(str(repo_root).encode("utf-8")).hexdigest()[:16],
+            snapshot_id="review_" + digest,
+            repo_root=repo_root,
+            issue_text=text,
+            model=_review_model(provider=provider, model=model),
+            signals={"review_timeout_s": timeout_s, "review_max_iterations": max_iterations},
+            evidence_bundle={},
+            snapshot={
+                "snapshot_id": "review_" + digest,
+                "snapshot_file_count": 0,
+                "raw_repo_token_estimate": max(1, len(text) // 4),
+            },
+            task_kind="review",
+        )
+        result = runner.run(request)
+        _assert_review_left_the_tree_alone(result)
+        return result
+
+    result = _run(prompt)
+    agent = _agent_summary(result)
+    try:
+        return extract_findings_json(result.text), agent
+    except UnparseableFindingsError as first:
+        # ONE bounded repair: a fresh single-shot run (sessions are one-shot; there is no turn to
+        # append to) that restates the contract and shows the model what it said instead. Costs one
+        # more model call on the same diff; a second miss fails closed with BOTH replies attached --
+        # never an empty findings list, which would read as a clean review.
+        repaired = _run(build_repair_prompt(prompt, result.text))
+        agent = {**_agent_summary(repaired), "repaired": True, "first_attempt": agent}
+        try:
+            return extract_findings_json(repaired.text), agent
+        except UnparseableFindingsError as second:
+            raise UnparseableFindingsError(
+                "review agent did not return parseable findings JSON (after one repair attempt)",
+                {**second.details, "first_attempt": first.details,
+                 "model": agent.get("model"), "terminal_state": agent.get("terminal_state"),
+                 "agent_run_id": agent.get("agent_run_id"), "attempts": 2},
+            ) from second
+
+
+_REPAIR_EXCERPT_CHARS = 300
+
+
+def build_repair_prompt(original_prompt: str, previous_reply: str) -> str:
+    """The re-ask sent when the first reply was not the findings JSON: the contract first, the
+    model's own (bounded) reply as the counter-example, then the original task verbatim."""
+    excerpt = " ".join((previous_reply or "").split())[:_REPAIR_EXCERPT_CHARS]
+    return (
+        "Your previous reply to the review task below was NOT the required JSON. "
+        f"It began: \u00ab{excerpt}\u00bb. "
+        'Reply now with ONLY the JSON object {"findings": [...]} for that diff -- or {"findings": []} '
+        "if there are no high-confidence issues. No prose, no code fences, no description of changes. "
+        "You are reviewing, not fixing; do not modify files.\n\n"
+        + original_prompt
     )
-    result = SidecarPackagedAgentRunner(config=config_runtime, keys=keys).run(request)
-    agent = {
+
+
+def _agent_summary(result) -> dict:
+    return {
         "status": result.status,
         "terminal_state": result.terminal_state,
         "model": result.telemetry.get("model"),
@@ -552,7 +612,20 @@ def run_review_agent(
         "agent_run_id": result.agent_run_id,
         "session_id": result.session_id,
     }
-    return extract_findings_json(result.text), agent
+
+
+def _assert_review_left_the_tree_alone(result) -> None:
+    """Fail closed if a read-only review run touched the workspace. Writes are disabled below the
+    model, so this cannot happen -- and if it ever does, the findings must not be posted."""
+    from .cline_agent import ClineAgentError
+
+    changed = [f for f in (result.files_changed or []) if str(f).strip()]
+    if changed or (result.patch_diff or "").strip():
+        raise ClineAgentError(
+            "review run modified the workspace; refusing to post its findings",
+            {"files_changed": changed[:20], "patch_chars": len((result.patch_diff or "").strip()),
+             "agent_run_id": result.agent_run_id},
+        )
 
 
 def _review_model(*, provider: str, model: str | None) -> str:

{codna-0.2.45 → codna-0.2.46}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.45
+Version: 0.2.46
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.45 → codna-0.2.46}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.45"
+version = "0.2.46"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.45 → codna-0.2.46}/tests/test_packaged_guidance.py

@@ -113,3 +113,29 @@ def test_prepare_workspace_excludes_repo_local_runtime_root(tmp_path):
         assert not (workspace.path / "runtime").exists()
     finally:
         par._cleanup_workspace(repo, workspace)
+
+
+# --- a review is delivered as a review, never as a repository issue to fix ---------------------
+def test_review_payload_carries_the_prompt_verbatim_and_no_fix_evidence(tmp_path):
+    """The sidecar's `task_spec.issue_text` path is the FIX path (buildPrompt wraps it in 'Fix this
+    repository issue ... with your file-editing tools, then stop', mines TARGET FILES, and the system
+    prompt then says 'edit that file directly'). A review must never travel through it
+    (thyn-ai/test-codna-app-e2e#16, 2026-09-19: the review model narrated an edit instead of
+    returning findings JSON)."""
+    (tmp_path / "AGENTS.md").write_text("Always use tabs.\n", encoding="utf-8")   # would become fix-worded guidance
+    review_prompt = "Review the following pull-request diff ...\n----- BEGIN DIFF -----\n+x\n----- END DIFF -----"
+    payload = par._sidecar_payload(_req(repo_root=tmp_path, issue_text=review_prompt, task_kind="review", signals={}), tmp_path)
+    assert payload["prompt"] == review_prompt                      # verbatim user turn
+    assert "issue_text" not in payload["task_spec"]                # no fix-path input at all
+    assert payload["task_spec"]["task_kind"] == "review"
+    assert payload["injected_context"] == {}
+    assert payload["allowed_write_paths"] == [] and payload["allowed_write_scope"] == []
+    assert payload["approval_profile"] == "repository_review"
+    assert "PROJECT GUIDANCE" not in payload["prompt"]             # review_findings already carries guidance
+
+
+def test_fix_payload_is_unchanged_by_the_review_split(tmp_path):
+    payload = par._sidecar_payload(_req(repo_root=tmp_path, issue_text="Fix the bug in a.py", signals={}), tmp_path)
+    assert "prompt" not in payload
+    assert payload["task_spec"]["issue_text"].startswith("Fix the bug in a.py")
+    assert isinstance(payload["injected_context"], dict)