codna 0.2.55__tar.gz → 0.2.57__tar.gz

{codna-0.2.55 → codna-0.2.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.55
+Version: 0.2.57
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.55 → codna-0.2.57}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.55"
+__version__ = "0.2.57"

{codna-0.2.55 → codna-0.2.57}/codna/agent-core/CLINE_SDK_AZ_INTEGRATION_PLAN.md

@@ -2,7 +2,7 @@
 
 > Status: **proposal for review** (no code yet). Principle: drive the agent loop with the
 > vendored Apache-2.0 Cline SDK end to end; plug the Algenta engine (250-language repo
-> intelligence + the Mojo decision engine + the capability plane) **behind** it as tools,
+> intelligence + the Mojo runtime + the capability plane) **behind** it as tools,
 > hooks, and MCP — not a re-implementation. Boundary stays self-hosted HTTP
 > (see `project_sdk_transport_boundary`): Cline (Node head) calls the Algenta engine over
 > the local `/v1/repositories` + capability-plane API; no cloud.

{codna-0.2.55 → codna-0.2.57}/codna/review.py

@@ -9,6 +9,7 @@ triage (suspect files/symbols + context reduction).
 from __future__ import annotations
 
 import os
+import re
 import shutil
 import subprocess
 
@@ -55,6 +56,30 @@ def _env_check_run_id() -> int | None:
     return int(raw) if raw.isdigit() else None
 
 
+_SHA_RE = re.compile(r"[0-9a-f]{7,40}")
+
+
+def _env_check_run_head_sha() -> str | None:
+    """``CODNA_CHECK_RUN_HEAD_SHA``: the commit the caller anchored that Check Run to, reported back
+    in ``--json`` (``posted.check_head_sha``) next to the head this review actually read, so a
+    caller can see the two disagree (thyn-ai/codna#569). Unset or not a SHA -> None."""
+    raw = os.environ.get("CODNA_CHECK_RUN_HEAD_SHA", "").strip().lower()
+    return raw if _SHA_RE.fullmatch(raw) else None
+
+
+def _pr_head_now(repo_slug: str | None, pr_number: int | None, token: str | None) -> str | None:
+    """The pull request's head at this moment, or None when it cannot be read. Read right before
+    posting: a head that moved while the review ran must not receive the review's approval."""
+    if not (repo_slug and pr_number):
+        return None
+    from . import review_github as rg
+
+    try:
+        return rg.fetch_pr(repo_slug, pr_number, token).get("head_sha") or None
+    except Exception:  # noqa: BLE001 -- best-effort; an unreadable head is reported as unknown, never as moved
+        return None
+
+
 def _wrapped_details(exc: BaseException) -> dict[str, object]:
     """Structured detail carried by a wrapped error, if it has any.
 
@@ -294,7 +319,9 @@ def run_findings_review(args) -> dict:
                 _fail("--post needs a write token: pass --github-token or set GITHUB_TOKEN.")
             try:
                 out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token,
-                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean)
+                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean,
+                                               check_head_sha=_env_check_run_head_sha(),
+                                               pr_head_sha=_pr_head_now(repo_slug, pr_number, token))
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.55 → codna-0.2.57}/codna/review_github.py

@@ -431,9 +431,16 @@ def parse_pr_arg(value: str, repo_dir: str) -> tuple[str | None, int | None]:
     return repo_slug_from_git(repo_dir), None
 
 
+def head_moved_note(reviewed: str, current: str) -> str:
+    """The approval line when the pull request's head is no longer the one this review read."""
+    return (f"⏸ Not approved: the pull request head moved from {reviewed[:8]} to {current[:8]} while this "
+            f"review ran; the current head gets a review of its own.")
+
+
 def post_review(
     result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
     check_run_id: int | None = None, approve: bool = True,
+    check_head_sha: str | None = None, pr_head_sha: str | None = None,
 ) -> dict:
     """Post ONE review (+ the "codna review" check) to the PR. Returns a small status dict.
 
@@ -441,6 +448,14 @@ def post_review(
     APPROVE -- see :func:`review_event` for exactly when. A PR the App itself authored cannot be
     approved by the App (GitHub answers 422); that case falls back to a COMMENT.
 
+    ``pr_head_sha`` is the pull request's head as the caller read it right before posting. When it
+    differs from ``result.head_sha`` the head moved while the review ran: the review is still posted
+    against the commit it read, but never as an APPROVE -- a pull request approval counts for the
+    whole pull request, and nobody reviewed the new head (thyn-ai/codna#569). ``check_head_sha`` is
+    the commit the caller's ``check_run_id`` is anchored to. Both are returned as they are (None =
+    unknown), next to the reviewed head, so a caller of ``codna review --json`` can see the three
+    disagree; when this function creates the check itself, it is anchored to the reviewed head.
+
     ``dedup`` fetches existing PR review comments and skips fingerprints Codna already posted, so a
     re-run on the same head does not duplicate threads. ``check_run_id`` (the webhook passes it as
     ``CODNA_CHECK_RUN_ID``) is a Check Run the caller already opened for this review: it is
@@ -484,6 +499,15 @@ def post_review(
     # body is still a finding of this pass.
     event = review_event(result, unresolved_blocking=unresolved, approve=approve)
     note = approval_note(event, result, unresolved, approve=approve)
+    head_moved = bool(pr_head_sha and result.head_sha and pr_head_sha != result.head_sha)
+    if head_moved:
+        # The verdict is about the commit this review read; the pull request's head is another one.
+        # Findings still go up (they are anchored to the reviewed commit), an approval does not.
+        moved = head_moved_note(str(result.head_sha), str(pr_head_sha))
+        if event == "APPROVE":
+            event, note = "COMMENT", moved
+        else:
+            note = f"{note} {moved}"
 
     inline_found = len(result.inline_findings)
     demoted = 0
@@ -565,4 +589,8 @@ def post_review(
         "skipped_duplicates": inline_found - len(payload["comments"]) - demoted,
         "demoted_to_summary": demoted,
         "check": check,
+        # The three commits a caller needs to compare: what the check is on, what was reviewed
+        # (``head_sha`` in the enclosing result) and where the pull request stands now.
+        "check_head_sha": check_head_sha if check_run_id is not None else result.head_sha,
+        "pr_head_sha": pr_head_sha,
     }

{codna-0.2.55 → codna-0.2.57}/codna/webhook.py

@@ -10,8 +10,13 @@ Architecture (thin ingress → durable queue → worker pool), all inside the on
     :func:`codna_command`) + a stdlib ``http.server`` ingress that VERIFIES and ENQUEUES only
     (fast ack — GitHub times out at 10s);
   * :mod:`codna.webhook_queue` is a durable, dedup'd, local SQLite queue;
-  * :mod:`codna.webhook_worker` is the in-process worker pool that runs the codna CLI in an
-    isolated, scrubbed workspace with a scoped installation token and reports via a Check Run.
+  * :mod:`codna.webhook_worker` runs one job -- the codna CLI in an isolated, scrubbed workspace
+    with a scoped installation token, reported via a Check Run;
+  * :mod:`codna.webhook_pool` decides which job runs next and for how long (merge-gating classes
+    first, a thread reserved for them, a deadline for the whole job);
+  * :mod:`codna.webhook_control` is the live registry of what is running, the only thing that can
+    cancel it (a superseding head, the job deadline), and where the pool's size and /healthz's
+    saturation report come from.
 
 Fail-closed: an unsigned/mis-signed delivery → 401; an event Codna doesn't act on → 204; a
 recognized event → 202 (accepted, enqueued); a duplicate delivery → 200 (already queued).
@@ -29,6 +34,10 @@ from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any, Mapping
 
+# Import-light by construction (stdlib only at module level), so the ingress can reach the live
+# job registry without dragging the worker's dependencies into this module.
+from . import webhook_control
+
 # --- Codna-specific policy (labels that trigger a job) -------------------------------
 FIX_LABEL = "codna-fix"
 SECURE_LABEL = "codna-secure"
@@ -701,7 +710,8 @@ class _Handler(BaseHTTPRequestHandler):
         path = self.path.rstrip("/")
         if path in ("/health", "/healthz", ""):
             configured = bool(os.environ.get(_WEBHOOK_SECRET_ENV))
-            self._reply(200 if configured else 503, {"service": "codna-webhook", "ok": configured})
+            self._reply(200 if configured else 503,
+                        webhook_control.health_payload(self.server, ok=configured))
             return
         if path == "/ready":
             secret_ready = bool(os.environ.get(_WEBHOOK_SECRET_ENV))
@@ -788,11 +798,22 @@ class _Handler(BaseHTTPRequestHandler):
             self._reply(202, {"status": "accepted", "kind": job.kind, "repo": job.repo_full_name})
             return
         fresh = queue.enqueue(job, delivery_id=delivery_id)
+        # A new head retires the work the old one left behind. enqueue() already collapsed the
+        # WAITING rows; this stops the ones already RUNNING, whose verdict would land on a commit
+        # that no longer exists (thyn-ai/mojo-kernels#32, 2026-09-19: two reviews ran to completion
+        # on ba252b20 and 04e3c8a5 after the head had moved to 21e3610) -- or, for a `codna fix`,
+        # would open a pull request built on a base that has moved.
+        superseded = 0
+        if fresh:
+            try:
+                superseded = webhook_control.supersede_running(job, queue=queue)
+            except Exception:  # noqa: BLE001 -- a delivery must be accepted even if cancelling fails
+                superseded = 0
         _log_delivery(event, payload, delivery_id, "accepted" if fresh else "duplicate", job)
         self._reply(
             202 if fresh else 200,
             {"status": "accepted" if fresh else "duplicate", "kind": job.kind,
-             "repo": job.repo_full_name, "reason": job.reason},
+             "repo": job.repo_full_name, "reason": job.reason, "superseded_running": superseded},
         )
 
 
@@ -821,7 +842,7 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
     from .webhook_procs import prepare_scratch_root
     from .webhook_queue import WebhookQueue
     from .webhook_resume import RunningJobRegistry, registry_dir_for
-    from .webhook_worker import WorkerPool
+    from .webhook_pool import WorkerPool
 
     prepare_scratch_root()  # before anything touches tempfile: job scratch lives on the volume
 
@@ -829,7 +850,7 @@ def serve(host: str = "0.0.0.0", port: int = 8080) -> None:
     queue = WebhookQueue(queue_path)
     pool = WorkerPool(
         queue,
-        concurrency=int(os.environ.get("CODNA_WEBHOOK_CONCURRENCY", "2")),
+        concurrency=webhook_control.default_concurrency(),
         app_id=os.environ.get("GITHUB_APP_ID"),
         private_key=os.environ.get("GITHUB_APP_PRIVATE_KEY"),
         # Jobs in flight, beside the queue on the same volume: a redeploy mid-job is resumed once on