codna 0.2.49__tar.gz → 0.2.51__tar.gz

{codna-0.2.49 → codna-0.2.51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.49
+Version: 0.2.51
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -36,6 +36,7 @@ Requires-Dist: pydantic>=2.6
 Requires-Dist: pyarrow>=17.0.0
 Requires-Dist: pyyaml>=6
 Requires-Dist: telys>=0.1.0b1
+Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: tree-sitter>=0.23
 Requires-Dist: tree-sitter-javascript
 Requires-Dist: tree-sitter-typescript

{codna-0.2.49 → codna-0.2.51}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.49"
+__version__ = "0.2.51"

{codna-0.2.49 → codna-0.2.51}/codna/testrun.py

@@ -12,11 +12,14 @@ from __future__ import annotations
 
 import importlib.util
 import os
-import xml.etree.ElementTree as ElementTree
 import re
 import sys
 import tempfile
 
+# JUnit reports come from an untrusted repo's test run, so they are parsed with defusedxml:
+# entity declarations (XXE / billion-laughs) are rejected instead of expanded.
+import defusedxml.ElementTree as ElementTree
+
 from .netjail import default_network_backend
 from .sandbox import Sandbox, scrub_env
 
@@ -37,10 +40,12 @@ def _scrub_secrets(env: dict) -> dict:
 
 
 def parse_junit_failures(path: str) -> list[str]:
-    """Failing/erroring test ids as ``classname::name`` from a JUnit XML report."""
-    import xml.etree.ElementTree as ET
+    """Failing/erroring test ids as ``classname::name`` from a JUnit XML report.
 
-    root = ET.parse(os.path.expanduser(path)).getroot()
+    Raises ``defusedxml.DefusedXmlException`` (a ``ValueError``) for a report that declares
+    entities -- the callers surface that as a bad-input error rather than expanding it.
+    """
+    root = ElementTree.parse(os.path.expanduser(path)).getroot()
     failing: list[str] = []
     for case in root.iter("testcase"):
         if case.find("failure") is not None or case.find("error") is not None:

{codna-0.2.49 → codna-0.2.51}/codna/webhook_github.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import sys
 from typing import Any, Mapping
 
 from .webhook import WebhookError
@@ -193,36 +194,76 @@ def update_check_run(repo_full_name: str, token: str, check_run_id: int, *, conc
         raise WebhookError("check_run_update_failed", f"update check run: {resp.status_code} {resp.text[:200]}")
 
 
+def _warn(event: str, **fields: Any) -> None:
+    """One JSON line on stderr, the worker's log shape, for a condition an operator must see."""
+    payload: dict[str, Any] = {"service": "codna-webhook-worker", "level": "warning", "event": event}
+    payload.update(fields)
+    print(json.dumps(payload, sort_keys=True), file=sys.stderr, flush=True)
+
+
+def _check_run_json(resp: Any) -> dict[str, Any] | None:
+    """The run a 2xx answer carries, else None (error status, or a body that is not the run)."""
+    if resp.status_code >= 300:
+        return None
+    try:
+        data = resp.json()
+    except Exception:  # noqa: BLE001
+        return None
+    return data if isinstance(data, dict) else None
+
+
 def complete_check_run_if_open(repo_full_name: str, token: str, check_run_id: int, *, conclusion: str,
                                summary: str, name: str) -> bool:
     """Complete ONE known Check Run, but only while it is still open. Returns True if it did.
 
     The restart reconciler (webhook_resume) knows the exact id of the run an interrupted job
-    opened. That run may already be completed -- `codna review --post` finishes the job's own
-    run with its findings, and the kill can land right after -- and a PATCH on a completed run
-    would replace those findings with a one-line "interrupted" summary. Read it first; never
-    raises (best-effort hygiene, same contract as complete_stale_check_runs)."""
+    opened. `codna review --post` completes that same run with its findings, and the kill can
+    land right after -- so the run is read first and left alone once it is ``completed``.
+
+    What that guarantee is worth, honestly. GitHub has no conditional update for Check Runs (no
+    If-Match, no status-guarded PATCH), and a PATCH by the owning App on an already-completed run
+    answers 200 and replaces its output. So a completion that lands between the read and the
+    write here is overwritten, and afterwards nothing on the API tells: the run simply carries
+    this summary. The window is kept as small as the API allows -- one request on an already-open
+    connection: read, then write on the same client, nothing in between. A completion that lands
+    right AFTER the write is visible: the run is read back once more and, when its output is not
+    what was written, a ``check_run_clobbered`` warning names the run and its suite so the race is
+    at least on record. Who could be writing at that moment: only a ``codna`` child of the
+    previous process that outlived it (``WorkerPool.stop`` joins its threads but never signals
+    the job's process group), and on the hosted app the machine replacement kills that child
+    before this process boots. Never raises (best-effort hygiene, same contract as
+    complete_stale_check_runs)."""
     try:
         import httpx
     except Exception:  # noqa: BLE001
         return False
     headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}
-    try:
-        resp = httpx.get(f"{_API}/repos/{repo_full_name}/check-runs/{check_run_id}", headers=headers,
-                         timeout=30.0, follow_redirects=True)
-    except Exception:  # noqa: BLE001
-        return False
-    if resp.status_code >= 300:
-        return False
-    try:
-        if (resp.json() or {}).get("status") == "completed":
-            return False
-    except Exception:  # noqa: BLE001
-        return False
-    try:
-        update_check_run(repo_full_name, token, check_run_id, conclusion=conclusion, summary=summary, name=name)
-    except Exception:  # noqa: BLE001 — completed by someone else in between, or a transport error
+    url = f"{_API}/repos/{repo_full_name}/check-runs/{check_run_id}"
+    body = check_run_payload(name, "", status="completed", conclusion=conclusion, summary=summary)
+    try:
+        with httpx.Client(headers=headers, timeout=30.0, follow_redirects=True) as client:
+            before = _check_run_json(client.get(url))
+            if before is None or before.get("status") == "completed":
+                return False  # missing, not ours to read, or already completed: its findings stay
+            if client.patch(url, json=body).status_code >= 300:
+                return False  # completed by someone else in between (a 422), or not ours
+            try:
+                after = _check_run_json(client.get(url))
+            except Exception:  # noqa: BLE001 -- the read-back is diagnostics only
+                after = None
+    except Exception:  # noqa: BLE001 -- transport error at any step
         return False
+    if after is not None and after.get("status") == "completed":
+        output = after.get("output") or {}
+        if (output.get("title"), output.get("summary")) != (name, summary):
+            # Someone completed this run right after this write (its content won, this
+            # cancellation note is gone): the interrupted job's own CLI, still alive somewhere.
+            _warn("check_run_clobbered", repo=repo_full_name, check_run_id=int(check_run_id),
+                  check_suite_id=(after.get("check_suite") or {}).get("id"),
+                  head_sha=after.get("head_sha"), name=name,
+                  observed_title=str(output.get("title") or "")[:200],
+                  observed_summary=str(output.get("summary") or "")[:200],
+                  observed_conclusion=after.get("conclusion"), written_summary=summary[:200])
     return True
 
 

{codna-0.2.49 → codna-0.2.51}/codna/webhook_resume.py

@@ -29,6 +29,7 @@ from __future__ import annotations
 import json
 import os
 import sys
+import tempfile
 import threading
 from dataclasses import asdict, dataclass, replace
 from datetime import datetime, timezone
@@ -86,10 +87,19 @@ class RunningJob:
 
 class RunningJobRegistry:
     """Per-job JSON files in one directory. Every method is best-effort and never raises: the
-    registry exists to make restarts honest, it must never take a live job down."""
+    registry exists to make restarts honest, it must never take a live job down.
+
+    Three threads write it: the worker thread (``start`` on claim, ``record_check_run`` right
+    after ``create_check_run``, ``finish`` when the job ends), the main thread (``mark_interrupted``
+    from ``WorkerPool.stop`` once the drain grace runs out) and the reconcile thread
+    (``mark_resumed``). Every read-modify-write holds one lock, so a stamp landing while the run
+    id is being recorded cannot make either update disappear: the surviving file always carries
+    both. Each write stages through its own unique temp file, so two writers can never share a
+    staging path even outside the lock."""
 
     def __init__(self, root: str | Path) -> None:
         self._root = Path(root)
+        self._lock = threading.Lock()  # serializes every read-modify-write of an entry
         try:
             self._root.mkdir(parents=True, exist_ok=True)
         except OSError as exc:
@@ -103,12 +113,21 @@ class RunningJobRegistry:
         return self._root / f"{int(row_id)}.json"
 
     def _write(self, entry: RunningJob) -> None:
+        """Caller holds ``self._lock``. The staging file is unique per write (``mkstemp``): a
+        fixed ``{row_id}.json.tmp`` let two writers truncate and rename the same file."""
         path = self._path(entry.row_id)
-        tmp = path.with_suffix(".json.tmp")
+        tmp: str | None = None
         try:
-            tmp.write_text(json.dumps(asdict(entry), sort_keys=True), encoding="utf-8")
+            fd, tmp = tempfile.mkstemp(dir=self._root, prefix=f"{int(entry.row_id)}.", suffix=".tmp")
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                handle.write(json.dumps(asdict(entry), sort_keys=True))
             os.replace(tmp, path)  # atomic: a crash mid-write leaves the old entry, never half a file
         except OSError as exc:
+            if tmp is not None:
+                try:
+                    os.unlink(tmp)
+                except OSError:
+                    pass
             _log("registry_write_failed", row_id=entry.row_id, error=f"{type(exc).__name__}: {exc}")
 
     def get(self, row_id: int) -> RunningJob | None:
@@ -133,45 +152,54 @@ class RunningJobRegistry:
     def start(self, qjob: QueuedJob) -> RunningJob:
         """Record a claimed job. The resume count of an earlier entry for the same row (the
         attempt this one replaces) is carried forward, so the cap counts restarts, not attempts."""
-        prior = self.get(qjob.row_id)
         job = qjob.job
-        entry = RunningJob(
-            row_id=qjob.row_id, kind=job.kind, repo=job.repo_full_name, ref=job.ref,
-            pr_number=job.pr_number, installation_id=job.installation_id,
-            issue_number=job.issue_number, reason=job.reason, delivery_id=qjob.delivery_id,
-            attempt=qjob.attempts, started_at=_utc_now(),
-            resumes=prior.resumes if prior is not None else 0,
-        )
-        self._write(entry)
+        with self._lock:
+            prior = self.get(qjob.row_id)
+            entry = RunningJob(
+                row_id=qjob.row_id, kind=job.kind, repo=job.repo_full_name, ref=job.ref,
+                pr_number=job.pr_number, installation_id=job.installation_id,
+                issue_number=job.issue_number, reason=job.reason, delivery_id=qjob.delivery_id,
+                attempt=qjob.attempts, started_at=_utc_now(),
+                resumes=prior.resumes if prior is not None else 0,
+            )
+            self._write(entry)
         return entry
 
     def record_check_run(self, row_id: int, check_run_id: int | None) -> None:
         """The job's Check Run exists now: from here on a restart must complete it."""
-        entry = self.get(row_id)
-        if entry is not None and check_run_id:
-            self._write(replace(entry, check_run_id=int(check_run_id)))
+        if not check_run_id:
+            return
+        with self._lock:
+            entry = self.get(row_id)
+            if entry is not None:
+                self._write(replace(entry, check_run_id=int(check_run_id)))
 
     def finish(self, row_id: int) -> None:
-        try:
-            self._path(row_id).unlink()
-        except FileNotFoundError:
-            pass
-        except OSError as exc:
-            _log("registry_clear_failed", row_id=row_id, error=f"{type(exc).__name__}: {exc}")
+        with self._lock:
+            try:
+                self._path(row_id).unlink()
+            except FileNotFoundError:
+                pass
+            except OSError as exc:
+                _log("registry_clear_failed", row_id=row_id, error=f"{type(exc).__name__}: {exc}")
 
     def mark_resumed(self, row_id: int) -> None:
-        entry = self.get(row_id)
-        if entry is not None:
-            self._write(replace(entry, resumes=entry.resumes + 1, check_run_id=None,
-                                interrupted_by=None, interrupted_at=None))
+        with self._lock:
+            entry = self.get(row_id)
+            if entry is not None:
+                self._write(replace(entry, resumes=entry.resumes + 1, check_run_id=None,
+                                    interrupted_by=None, interrupted_at=None))
 
     def mark_interrupted(self, reason: str) -> int:
         """Stamp every job still registered (the drain grace ran out on it) with why it is about
-        to die. Returns how many. Called from ``WorkerPool.stop`` on SIGTERM."""
+        to die. Returns how many. Called from ``WorkerPool.stop`` on SIGTERM. Holds the lock for
+        the whole pass: a worker recording its run id, or finishing, in the middle of it lands
+        strictly before or strictly after, never inside a stale snapshot."""
         stamped = 0
-        for entry in self.entries():
-            self._write(replace(entry, interrupted_by=reason, interrupted_at=_utc_now()))
-            stamped += 1
+        with self._lock:
+            for entry in self.entries():
+                self._write(replace(entry, interrupted_by=reason, interrupted_at=_utc_now()))
+                stamped += 1
         return stamped
 
 
@@ -194,63 +222,70 @@ def _token_for(entry: RunningJob, *, app_id: str | None, private_key: str | None
     return environ.get("GITHUB_TOKEN") or None
 
 
-def _close(entry: RunningJob, token: str, github: Any, *, conclusion: str, summary: str) -> bool:
-    """Complete the job's own Check Run if it is still open. A run the job (or its CLI) already
-    completed keeps its findings: this never overwrites a completed run."""
+def _close(entry: RunningJob, token: str, github: Any, *, conclusion: str, summary: str) -> int | None:
+    """Complete the job's own Check Run if it is still open. Returns the id of the run this call
+    completed, or None when there was nothing to close (no run recorded, already completed by the
+    job's own CLI -- its findings stay -- or a transport error). The residual race between the
+    read and the write lives in ``webhook_github.complete_check_run_if_open``."""
     if not entry.check_run_id:
-        return False
+        return None
     try:
-        return bool(github.complete_check_run_if_open(
+        closed = bool(github.complete_check_run_if_open(
             entry.repo, token, entry.check_run_id, conclusion=conclusion, summary=summary,
             name=check_run_name(entry.kind),
         ))
     except Exception as exc:  # noqa: BLE001 -- a transport error must not stop the other entries
         _log("job_resume_close_failed", row_id=entry.row_id, error=type(exc).__name__)
-        return False
+        return None
+    return int(entry.check_run_id) if closed else None
 
 
 def _reconcile_one(entry: RunningJob, queue: WebhookQueue, registry: RunningJobRegistry, *,
-                   app_id: str | None, private_key: str | None, github: Any, environ: Any) -> str:
+                   app_id: str | None, private_key: str | None, github: Any,
+                   environ: Any) -> tuple[str, int | None]:
+    """One entry's verdict and the id of the Check Run this boot actually completed (None when
+    none was): ``mark_resumed`` clears the id from the entry, so it is captured here, not read
+    back later."""
     state = queue.row_state(entry.row_id)
     if state is None or state[0] == "done":
         registry.finish(entry.row_id)  # finished right before the kill, or the row is gone
-        return "finished"
+        return "finished", None
     status, attempts = state
     token = _token_for(entry, app_id=app_id, private_key=private_key, github=github, environ=environ)
     if token is None:
-        return "skipped"  # entry kept: the next boot tries again; the retry's own hygiene still applies
+        return "skipped", None  # entry kept: the next boot tries again; the retry's own hygiene still applies
     name = check_run_name(entry.kind)
     cause = "a redeploy" if entry.interrupted_by == "sigterm" else "a service restart"
     hint = _RETRIGGER.get(entry.kind, "Trigger it again to run it.")
     if status == "failed":
         # recover_stale found no attempts left (or the last attempt failed on its own): terminal.
-        _close(entry, token, github, conclusion="cancelled",
-               summary=f"{name}: interrupted by {cause} with no attempts left. {hint}")
+        closed = _close(entry, token, github, conclusion="cancelled",
+                        summary=f"{name}: interrupted by {cause} with no attempts left. {hint}")
         registry.finish(entry.row_id)
-        return "cancelled"
+        return "cancelled", closed
     if entry.resumes >= _MAX_RESUMES:
         queue.complete(entry.row_id, status="failed", retry=False,
                        result={"error": "interrupted_after_resume", "attempt": attempts})
-        _close(entry, token, github, conclusion="cancelled",
-               summary=f"{name}: interrupted by {cause} again after one automatic resume; "
-                       f"not re-run automatically. {hint}")
+        closed = _close(entry, token, github, conclusion="cancelled",
+                        summary=f"{name}: interrupted by {cause} again after one automatic resume; "
+                                f"not re-run automatically. {hint}")
         registry.finish(entry.row_id)
-        return "cancelled"
+        return "cancelled", closed
     if entry.pr_number and entry.ref:
         head = github.pull_request_head_sha(entry.repo, token, entry.pr_number)
         if head and head != entry.ref:
             queue.complete(entry.row_id, status="done", retry=False,
                            result={"summary": f"superseded: PR head moved to {head[:8]} across a restart"})
-            _close(entry, token, github, conclusion="cancelled",
-                   summary=f"{name}: interrupted by {cause}; the pull request head has since moved to "
-                           f"{head[:8]}, which gets its own run. This commit was not re-run.")
+            closed = _close(entry, token, github, conclusion="cancelled",
+                            summary=f"{name}: interrupted by {cause}; the pull request head has since "
+                                    f"moved to {head[:8]}, which gets its own run. This commit was not re-run.")
             registry.finish(entry.row_id)
-            return "superseded"
-    _close(entry, token, github, conclusion="cancelled",
-           summary=f"{name}: interrupted by {cause}; re-queued automatically as attempt {attempts + 1}. "
-                   f"A new `{name}` run replaces this one. If none appears: {hint}")
+            return "superseded", closed
+    closed = _close(entry, token, github, conclusion="cancelled",
+                    summary=f"{name}: interrupted by {cause}; re-queued automatically as attempt {attempts + 1}. "
+                            f"A new `{name}` run replaces this one. If none appears: {hint}")
     registry.mark_resumed(entry.row_id)  # the row is already 'retry' (recover_stale) -- it runs again
-    return "resumed"
+    return "resumed", closed
 
 
 def reconcile_interrupted(queue: WebhookQueue, registry: RunningJobRegistry, *,
@@ -263,16 +298,19 @@ def reconcile_interrupted(queue: WebhookQueue, registry: RunningJobRegistry, *,
     environ = os.environ if environ is None else environ
     outcome = {"resumed": 0, "superseded": 0, "cancelled": 0, "finished": 0, "skipped": 0}
     for entry in registry.entries():
+        closed: int | None = None
         try:
-            verdict = _reconcile_one(entry, queue, registry, app_id=app_id, private_key=private_key,
-                                     github=github, environ=environ)
+            verdict, closed = _reconcile_one(entry, queue, registry, app_id=app_id,
+                                             private_key=private_key, github=github, environ=environ)
         except Exception as exc:  # noqa: BLE001 -- one bad entry must not strand the others
             _log("job_resume_error", row_id=entry.row_id, error=f"{type(exc).__name__}: {str(exc)[:200]}")
             verdict = "skipped"
         outcome[verdict] += 1
+        # check_run_id: the run the job had opened. closed_check_run_id: the one THIS boot completed
+        # (None: none recorded, the job's own CLI had already completed it, or the close failed).
         _log("job_resume", row_id=entry.row_id, kind=entry.kind, repo=entry.repo, ref=entry.ref,
-             check_run_id=entry.check_run_id, interrupted_by=entry.interrupted_by,
-             resumes=entry.resumes, verdict=verdict)
+             check_run_id=entry.check_run_id, closed_check_run_id=closed,
+             interrupted_by=entry.interrupted_by, resumes=entry.resumes, verdict=verdict)
     return outcome
 
 

{codna-0.2.49 → codna-0.2.51}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.49
+Version: 0.2.51
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -36,6 +36,7 @@ Requires-Dist: pydantic>=2.6
 Requires-Dist: pyarrow>=17.0.0
 Requires-Dist: pyyaml>=6
 Requires-Dist: telys>=0.1.0b1
+Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: tree-sitter>=0.23
 Requires-Dist: tree-sitter-javascript
 Requires-Dist: tree-sitter-typescript

{codna-0.2.49 → codna-0.2.51}/codna.egg-info/SOURCES.txt

@@ -102,6 +102,7 @@ memengine/_validate.py
 memengine/native_runtime.py
 tests/test_admission_control.py
 tests/test_agent_core_runtime.py
+tests/test_bench_env.py
 tests/test_benchmark_parity_imports.py
 tests/test_benchmark_suite.py
 tests/test_ci_admission.py

{codna-0.2.49 → codna-0.2.51}/codna.egg-info/requires.txt

@@ -5,6 +5,7 @@ pydantic>=2.6
 pyarrow>=17.0.0
 pyyaml>=6
 telys>=0.1.0b1
+defusedxml>=0.7.1
 tree-sitter>=0.23
 tree-sitter-javascript
 tree-sitter-typescript

{codna-0.2.49 → codna-0.2.51}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.49"
+version = "0.2.51"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -49,6 +49,10 @@ dependencies = [
   "pyarrow>=17.0.0",
   "pyyaml>=6",
   "telys>=0.1.0b1",
+  # defusedxml: `codna fix --tests` / `--from-junit` parse a JUnit report produced by an untrusted
+  # repo's test run; defusedxml rejects entity declarations (XXE / billion laughs) that the
+  # stdlib parser would expand.
+  "defusedxml>=0.7.1",
   # Base `pip install codna` must not degrade local Telys recall to Python-only.
   # These wheels power one generic structural extractor for common code languages.
   "tree-sitter>=0.23",

codna-0.2.51/tests/test_bench_env.py

@@ -0,0 +1,97 @@
+"""The bench scripts pass operator-supplied binaries / paths straight to ``subprocess``; ``bench_env``
+validates them up front (allowlisted name on PATH, or an absolute existing executable) so an env
+override can never smuggle an arbitrary command in, and a mis-set one fails with a clear message."""
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+BENCH_DIR = Path(__file__).resolve().parents[1] / "bench"
+if str(BENCH_DIR) not in sys.path:
+    sys.path.insert(0, str(BENCH_DIR))
+
+import bench_env  # noqa: E402
+
+
+def _make_exe(path: Path) -> Path:
+    path.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
+    path.chmod(0o755)
+    return path
+
+
+def test_resolve_bin_bare_allowlisted_name_resolves_through_path(tmp_path, monkeypatch):
+    exe = _make_exe(tmp_path / "codna")
+    monkeypatch.setenv("PATH", str(tmp_path))
+    monkeypatch.delenv("CODNA_BIN", raising=False)
+    assert bench_env.resolve_bin("CODNA_BIN", "codna", allowed=("codna",)) == str(exe)
+
+
+def test_resolve_bin_rejects_bare_name_outside_allowlist(tmp_path, monkeypatch):
+    _make_exe(tmp_path / "rm")
+    monkeypatch.setenv("PATH", str(tmp_path))
+    monkeypatch.setenv("CODNA_BIN", "rm")
+    with pytest.raises(SystemExit, match="not an allowed command name"):
+        bench_env.resolve_bin("CODNA_BIN", "codna", allowed=("codna",))
+
+
+def test_resolve_bin_rejects_bare_name_missing_from_path(tmp_path, monkeypatch):
+    monkeypatch.setenv("PATH", str(tmp_path))  # empty dir: nothing resolvable
+    monkeypatch.delenv("CODEX_BIN", raising=False)
+    with pytest.raises(SystemExit, match="not found on PATH"):
+        bench_env.resolve_bin("CODEX_BIN", "codex", allowed=("codex",))
+
+
+def test_resolve_bin_accepts_absolute_existing_executable_and_expands_home(tmp_path, monkeypatch):
+    exe = _make_exe(tmp_path / "cursor-agent")
+    monkeypatch.setenv("CURSOR_BIN", str(exe))
+    assert bench_env.resolve_bin("CURSOR_BIN", "cursor-agent", allowed=("cursor-agent",)) == str(exe)
+    monkeypatch.setenv("HOME", str(tmp_path))
+    monkeypatch.delenv("CURSOR_BIN", raising=False)
+    assert bench_env.resolve_bin("CURSOR_BIN", "~/cursor-agent", allowed=("cursor-agent",)) == str(exe)
+
+
+def test_resolve_bin_rejects_relative_missing_and_non_executable_paths(tmp_path, monkeypatch):
+    monkeypatch.setenv("CODNA_BIN", os.path.join("bin", "codna"))
+    with pytest.raises(SystemExit, match="must be absolute"):
+        bench_env.resolve_bin("CODNA_BIN", "codna", allowed=("codna",))
+    monkeypatch.setenv("CODNA_BIN", str(tmp_path / "missing" / "codna"))
+    with pytest.raises(SystemExit, match="not an existing executable file"):
+        bench_env.resolve_bin("CODNA_BIN", "codna", allowed=("codna",))
+    plain = tmp_path / "codna"
+    plain.write_text("not executable", encoding="utf-8")
+    plain.chmod(0o644)
+    monkeypatch.setenv("CODNA_BIN", str(plain))
+    with pytest.raises(SystemExit, match="not an existing executable file"):
+        bench_env.resolve_bin("CODNA_BIN", "codna", allowed=("codna",))
+
+
+def test_model_id_accepts_identifiers_and_rejects_option_like_or_shell_like_values(monkeypatch):
+    monkeypatch.delenv("CODEX_MODEL", raising=False)
+    assert bench_env.model_id("CODEX_MODEL") == ""
+    for ok in ("gpt-5.4", "openai/gpt-5", "claude-sonnet-4-6", "anthropic:claude_3"):
+        monkeypatch.setenv("CODEX_MODEL", ok)
+        assert bench_env.model_id("CODEX_MODEL") == ok
+    for bad in ("--full-auto", "gpt 5", "gpt;rm -rf /", "$(id)", "a" * 129):
+        monkeypatch.setenv("CODEX_MODEL", bad)
+        with pytest.raises(SystemExit, match="not a model identifier"):
+            bench_env.model_id("CODEX_MODEL")
+
+
+def test_resolve_file_requires_an_existing_file(tmp_path, monkeypatch):
+    manifest = tmp_path / "codna-security.yaml"
+    manifest.write_text("version: 1\n", encoding="utf-8")
+    monkeypatch.delenv("SEC_MANIFEST", raising=False)
+    assert bench_env.resolve_file("SEC_MANIFEST", str(manifest)) == str(manifest)
+    monkeypatch.setenv("SEC_MANIFEST", str(tmp_path / "nope.yaml"))
+    with pytest.raises(SystemExit, match="file not found"):
+        bench_env.resolve_file("SEC_MANIFEST", str(manifest))
+
+
+def test_bench_repos_root_uses_first_arg_and_requires_a_directory(tmp_path):
+    assert bench_env.bench_repos_root([str(tmp_path)]) == str(tmp_path)
+    assert bench_env.bench_repos_root([], default=str(tmp_path)) == str(tmp_path)
+    with pytest.raises(SystemExit, match="is not a directory"):
+        bench_env.bench_repos_root([str(tmp_path / "missing")])

{codna-0.2.49 → codna-0.2.51}/tests/test_testrun.py

@@ -22,6 +22,36 @@ def test_parse_junit_failures(tmp_path):
     assert ids == ["pkg.test_mod::test_bad", "pkg.test_mod::test_err"]
 
 
+# A JUnit report is produced by an UNTRUSTED repo's test run: an entity declaration (XXE, or a
+# billion-laughs expansion bomb) must be rejected, never resolved/expanded.
+_JUNIT_XXE = """<?xml version="1.0"?>
+<!DOCTYPE testsuite [
+  <!ENTITY xxe SYSTEM "file:///etc/passwd">
+  <!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+]>
+<testsuite tests="1" failures="1">
+  <testcase classname="pkg.test_mod" name="test_bad"><failure>&xxe;&lol2;</failure></testcase>
+</testsuite>
+"""
+
+
+def test_parse_junit_failures_rejects_entity_declarations(tmp_path):
+    from defusedxml import DefusedXmlException
+
+    p = tmp_path / "report.xml"
+    p.write_text(_JUNIT_XXE, encoding="utf-8")
+    with pytest.raises(DefusedXmlException) as excinfo:
+        testrun.parse_junit_failures(str(p))
+    assert isinstance(excinfo.value, ValueError)
+    # ...and `codna fix --from-junit` turns that into a clean bad-input error, not a traceback.
+    from codna import fix_inputs
+
+    with pytest.raises(fix_inputs.FixInputError, match="could not read JUnit report"):
+        fix_inputs.from_junit(str(p))
+    # The collection-error probe on the same payload is a plain "no" rather than an expansion.
+    assert testrun.junit_has_collection_errors(str(p)) is False
+
+
 # ── monorepo-aware detection: pytest config one level down (codna's OWN repo shape) ───────────
 def test_detect_pytest_finds_config_in_a_depth1_subdirectory(tmp_path):
     (tmp_path / "cli" / "tests").mkdir(parents=True)