codna 0.2.56__tar.gz → 0.2.58__tar.gz

{codna-0.2.56 → codna-0.2.58}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.56
+Version: 0.2.58
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn
@@ -50,6 +50,9 @@ Requires-Dist: tree-sitter-php
 Requires-Dist: tree-sitter-ruby
 Provides-Extra: mcp
 Requires-Dist: mcp<2,>=1.2.0; extra == "mcp"
+Provides-Extra: webhook
+Requires-Dist: psycopg[binary]>=3.2; extra == "webhook"
+Requires-Dist: psycopg_pool>=3.2; extra == "webhook"
 Provides-Extra: memory
 Requires-Dist: faiss-cpu>=1.7; extra == "memory"
 Requires-Dist: wordllama>=0.3; extra == "memory"

{codna-0.2.56 → codna-0.2.58}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.56"
+__version__ = "0.2.58"

{codna-0.2.56 → codna-0.2.58}/codna/agent-core/CLINE_SDK_AZ_INTEGRATION_PLAN.md

@@ -2,7 +2,7 @@
 
 > Status: **proposal for review** (no code yet). Principle: drive the agent loop with the
 > vendored Apache-2.0 Cline SDK end to end; plug the Algenta engine (250-language repo
-> intelligence + the Mojo decision engine + the capability plane) **behind** it as tools,
+> intelligence + the Mojo runtime + the capability plane) **behind** it as tools,
 > hooks, and MCP — not a re-implementation. Boundary stays self-hosted HTTP
 > (see `project_sdk_transport_boundary`): Cline (Node head) calls the Algenta engine over
 > the local `/v1/repositories` + capability-plane API; no cloud.

{codna-0.2.56 → codna-0.2.58}/codna/cli.py

@@ -889,7 +889,12 @@ def build_parser() -> argparse.ArgumentParser:
     pw_serve = pw_sub.add_parser("serve", help="Serve the webhook: verify → classify → run codna fix/secure.")
     pw_serve.add_argument("--host", default="0.0.0.0", help="bind host (default: 0.0.0.0)")
     pw_serve.add_argument("--port", type=int, default=8080, help="bind port (default: 8080)")
+    pw_serve.add_argument("--role", choices=["all", "ingress", "worker"], default=None,
+                          help="process role (default: $CODNA_WEBHOOK_ROLE or all)")
     pw_serve.set_defaults(func=cmd_webhook, action="serve")
+    from .webhook_ops import add_ops_parser
+
+    add_ops_parser(pw_sub)  # `codna webhook ops|migrate|queue` (Postgres queue backend)
     pw.set_defaults(func=cmd_webhook, action="serve")
 
     pm = sub.add_parser("mcp", help="Run codna as an MCP server, or install it into a client (Cursor / Claude).")

{codna-0.2.56 → codna-0.2.58}/codna/review.py

@@ -9,6 +9,7 @@ triage (suspect files/symbols + context reduction).
 from __future__ import annotations
 
 import os
+import re
 import shutil
 import subprocess
 
@@ -55,6 +56,37 @@ def _env_check_run_id() -> int | None:
     return int(raw) if raw.isdigit() else None
 
 
+_SHA_RE = re.compile(r"[0-9a-f]{7,40}")
+
+
+def _env_check_run_head_sha() -> str | None:
+    """``CODNA_CHECK_RUN_HEAD_SHA``: the commit the caller anchored that Check Run to, reported back
+    in ``--json`` (``posted.check_head_sha``) next to the head this review actually read, so a
+    caller can see the two disagree (thyn-ai/codna#569). Unset or not a SHA -> None."""
+    raw = os.environ.get("CODNA_CHECK_RUN_HEAD_SHA", "").strip().lower()
+    return raw if _SHA_RE.fullmatch(raw) else None
+
+
+def _pr_head_now(repo_slug: str | None, pr_number: int | None, token: str | None) -> str | None:
+    """The pull request's head at this moment, or None when it cannot be read. Read right before
+    posting: a head that moved while the review ran must not receive the review's approval."""
+    if not (repo_slug and pr_number):
+        return None
+    from . import review_github as rg
+
+    try:
+        return rg.fetch_pr(repo_slug, pr_number, token).get("head_sha") or None
+    except Exception:  # noqa: BLE001 -- best-effort; an unreadable head is reported as unknown, never as moved
+        return None
+
+
+def _env_review_run_id() -> str | None:
+    """``CODNA_REVIEW_RUN_ID``: the webhook job this review runs for; stamped into the review body
+    so the same job running twice posts once (review_github.post_review). Unset -> None."""
+    raw = os.environ.get("CODNA_REVIEW_RUN_ID", "").strip()
+    return raw if raw and len(raw) <= 64 and all(c.isalnum() or c in "_.:-" for c in raw) else None
+
+
 def _wrapped_details(exc: BaseException) -> dict[str, object]:
     """Structured detail carried by a wrapped error, if it has any.
 
@@ -294,7 +326,10 @@ def run_findings_review(args) -> dict:
                 _fail("--post needs a write token: pass --github-token or set GITHUB_TOKEN.")
             try:
                 out["posted"] = rg.post_review(result, repo_slug=repo_slug, pr_number=pr_number, token=token,
-                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean)
+                                               check_run_id=_env_check_run_id(), approve=cfg.approve_clean,
+                                               check_head_sha=_env_check_run_head_sha(),
+                                               pr_head_sha=_pr_head_now(repo_slug, pr_number, token),
+                                               run_id=_env_review_run_id())
             except Exception as exc:  # noqa: BLE001
                 _fail(f"posting the review failed: {exc}")
         return out

{codna-0.2.56 → codna-0.2.58}/codna/review_github.py

@@ -28,6 +28,11 @@ _MARKER_RE = re.compile(r"<!--\s*codna:review:fp=([0-9a-f]{6,40})\s*-->")
 _FINDING_MARKER_RE = re.compile(r"<!--\s*codna:finding\s+([A-Za-z0-9_=-]+)\s*-->")
 # Stamped in each review body so the NEXT review can diff only the commits pushed since (incremental).
 _REVIEWED_HEAD_RE = re.compile(r"<!--\s*codna:reviewed-head=([0-9a-f]{7,40})\s*-->")
+# Stamped in each review body the GitHub App posts: the queue row id of the job that produced it
+# (``CODNA_REVIEW_RUN_ID``). A second run of the SAME job -- a lease handed to another worker while
+# the first is still finishing, a retry after the post but before the row was marked done -- finds
+# its own stamp on the PR and does not post a second review. Inert (never emitted) for the CLI.
+_RUN_MARKER_RE = re.compile(r"<!--\s*codna:review:run=([A-Za-z0-9_.:-]{1,64})\s*-->")
 
 _SEV_EMOJI = {"high": "🔴", "medium": "🟡", "low": "⚪"}
 
@@ -126,6 +131,20 @@ def reviewed_head_marker(head_sha: str | None) -> str:
     return f"<!-- codna:reviewed-head={head_sha} -->" if head_sha else ""
 
 
+def run_marker(run_id: str | None) -> str:
+    """The hidden per-job stamp (see ``_RUN_MARKER_RE``); empty when no run id is known."""
+    return f"<!-- codna:review:run={run_id} -->" if run_id else ""
+
+
+def existing_run_ids(reviews: list[dict]) -> set[str]:
+    """Run ids already stamped on this PR's reviews (scanned from review bodies)."""
+    ids: set[str] = set()
+    for rv in reviews or []:
+        for m in _RUN_MARKER_RE.finditer(str(rv.get("body") or "")):
+            ids.add(m.group(1))
+    return ids
+
+
 def finding_marker(f: CodnaReviewFinding) -> str:
     """A hidden marker carrying the full finding (base64url JSON), so the fix wedge reconstructs it
     losslessly regardless of what characters the explanation contains."""
@@ -197,11 +216,14 @@ def _looks_like_suggestion(patch: str) -> bool:
     return not any(ln[:1] in ("+", "-", "@") for ln in patch.splitlines())
 
 
-def summary_body(result: ReviewResult, approval: str | None = None) -> str:
+def summary_body(result: ReviewResult, approval: str | None = None, *, run_id: str | None = None) -> str:
     """The review's top-level body: headline + any findings that could not be anchored inline
-    (+ the approval line, when the caller decided one)."""
+    (+ the approval line, when the caller decided one; + the per-job run stamp when the App runs
+    it -- see :func:`run_marker`)."""
     n = len(result.findings)
     head_mark = reviewed_head_marker(result.head_sha)
+    if run_id:
+        head_mark = (head_mark + "\n" + run_marker(run_id)) if head_mark else run_marker(run_id)
     tail = (approval + "\n\n") if approval else ""
     if n == 0:
         return "**codna review** — no high-confidence issues found. ✅\n\n" + tail + fp_marker("none") + "\n" + head_mark
@@ -262,7 +284,7 @@ def demote_to_summary(result: ReviewResult, *, keep_paths: set[str] | frozenset[
 
 def build_review_payload(result: ReviewResult, *, skip_fingerprints: set[str] | None = None,
                          event: str = "COMMENT", approval: str | None = None,
-                         pr_files: set[str] | None = None) -> dict:
+                         pr_files: set[str] | None = None, run_id: str | None = None) -> dict:
     """Build the ``POST …/reviews`` body: ``event`` (COMMENT, or APPROVE per :func:`review_event`),
     summary body, inline comments for anchored findings whose fingerprint has not already been
     posted. Never REQUEST_CHANGES — the check conclusion is the gate, the review stays non-blocking.
@@ -276,7 +298,7 @@ def build_review_payload(result: ReviewResult, *, skip_fingerprints: set[str] |
     if pr_files is not None:
         result = demote_to_summary(result, keep_paths=pr_files, drop_fingerprints=skip)
     comments = [inline_comment_payload(f) for f in result.inline_findings if f.fingerprint not in skip]
-    payload: dict = {"event": event, "body": summary_body(result, approval), "comments": comments}
+    payload: dict = {"event": event, "body": summary_body(result, approval, run_id=run_id), "comments": comments}
     if result.head_sha:
         payload["commit_id"] = result.head_sha
     return payload
@@ -398,6 +420,51 @@ def fetch_review_context(repo_slug: str, pr_number: int, token: str | None, *, m
     return {"last_reviewed_head": last_head, "prior_feedback": "\n".join(feedback[:40]) or None}
 
 
+_LAST_PAGE_RE = re.compile(r'<([^>]*[?&]page=(\d+)[^>]*)>;\s*rel="last"')
+
+
+_STAMP_TAIL_PAGES = 4  # the newest ~400 reviews; a same-job re-run is minutes to an hour behind its first run
+
+
+def list_pr_reviews(repo_slug: str, pr_number: int, token: str | None) -> list[dict]:
+    """The reviews that can carry a duplicate-run stamp: the first page and the LAST
+    ``_STAMP_TAIL_PAGES`` pages as the ``Link: rel="last"`` header names them -- at most five
+    requests however long the PR's history, each bounded at 15 s, because this sits on every App
+    review's critical path. A stamp from the same job is among the newest reviews: a second run of
+    one job follows its first by a retry backoff (minutes) or a lease expiry, never by weeks, and
+    ~400 reviews is far more than a PR accrues in that window. Best-effort: an error returns what
+    was read, and a missing stamp means "not seen", the fallback the fingerprint dedup provides."""
+    try:
+        import httpx
+    except Exception:  # noqa: BLE001
+        return []
+    headers = {"Accept": "application/vnd.github+json"}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    url = f"{_API}/repos/{repo_slug}/pulls/{pr_number}/reviews"
+
+    def _page(number: int) -> tuple[list[dict], str]:
+        r = httpx.get(url, headers=headers, params={"per_page": 100, "page": number}, timeout=15.0, follow_redirects=True)
+        if r.status_code >= 300:
+            return [], ""
+        batch = r.json()
+        rows = [b for b in batch if isinstance(b, dict)] if isinstance(batch, list) else []
+        return rows, str(r.headers.get("link", "") if hasattr(r, "headers") else "")
+
+    reviews: list[dict] = []
+    try:
+        first, link = _page(1)
+        reviews.extend(first)
+        m = _LAST_PAGE_RE.search(link)
+        last = int(m.group(2)) if m else 1
+        for number in range(max(2, last - _STAMP_TAIL_PAGES + 1), last + 1):
+            rows, _ = _page(number)
+            reviews.extend(rows)
+    except Exception:  # noqa: BLE001 -- best-effort listing
+        pass
+    return reviews
+
+
 def repo_slug_from_url(url: str) -> str | None:
     """Derive ``owner/repo`` from a GitHub repo URL (ssh or https, with/without .git)."""
     m = re.search(r"github\.com[:/]+([^/\s]+/[^/\s]+?)(?:\.git)?/?$", (url or "").strip())
@@ -431,9 +498,16 @@ def parse_pr_arg(value: str, repo_dir: str) -> tuple[str | None, int | None]:
     return repo_slug_from_git(repo_dir), None
 
 
+def head_moved_note(reviewed: str, current: str) -> str:
+    """The approval line when the pull request's head is no longer the one this review read."""
+    return (f"⏸ Not approved: the pull request head moved from {reviewed[:8]} to {current[:8]} while this "
+            f"review ran; the current head gets a review of its own.")
+
+
 def post_review(
     result: ReviewResult, *, repo_slug: str, pr_number: int, token: str, dedup: bool = True,
     check_run_id: int | None = None, approve: bool = True,
+    check_head_sha: str | None = None, pr_head_sha: str | None = None, run_id: str | None = None,
 ) -> dict:
     """Post ONE review (+ the "codna review" check) to the PR. Returns a small status dict.
 
@@ -441,6 +515,14 @@ def post_review(
     APPROVE -- see :func:`review_event` for exactly when. A PR the App itself authored cannot be
     approved by the App (GitHub answers 422); that case falls back to a COMMENT.
 
+    ``pr_head_sha`` is the pull request's head as the caller read it right before posting. When it
+    differs from ``result.head_sha`` the head moved while the review ran: the review is still posted
+    against the commit it read, but never as an APPROVE -- a pull request approval counts for the
+    whole pull request, and nobody reviewed the new head (thyn-ai/codna#569). ``check_head_sha`` is
+    the commit the caller's ``check_run_id`` is anchored to. Both are returned as they are (None =
+    unknown), next to the reviewed head, so a caller of ``codna review --json`` can see the three
+    disagree; when this function creates the check itself, it is anchored to the reviewed head.
+
     ``dedup`` fetches existing PR review comments and skips fingerprints Codna already posted, so a
     re-run on the same head does not duplicate threads. ``check_run_id`` (the webhook passes it as
     ``CODNA_CHECK_RUN_ID``) is a Check Run the caller already opened for this review: it is
@@ -459,13 +541,23 @@ def post_review(
 
     The returned counters partition the inline findings this pass found: every one is exactly one of
     ``inline_posted``, ``demoted_to_summary`` (said in the body) or ``skipped_duplicates`` (already
-    threaded on the PR, wherever it would otherwise have gone)."""
+    threaded on the PR, wherever it would otherwise have gone).
+
+    ``run_id`` (the webhook passes the queue row id as ``CODNA_REVIEW_RUN_ID``) is stamped into
+    the review body. When the PR ALREADY carries a review with this stamp -- the same job ran
+    twice -- no review is created (``posted_review`` False, ``duplicate_run`` True); the check
+    run is still completed, because the caller opened it and nothing else will."""
     try:
         import httpx
     except Exception as exc:  # noqa: BLE001
         raise RuntimeError(f"posting a review needs httpx: {exc}") from exc
 
     headers = {"Authorization": f"Bearer {token}", "Accept": "application/vnd.github+json"}
+    duplicate_run = False
+    if run_id:
+        # Every page of reviews (a long-lived PR can carry hundreds): a stamp on an old review must
+        # still be seen, or the guard would silently pass a second review through.
+        duplicate_run = str(run_id) in existing_run_ids(list_pr_reviews(repo_slug, pr_number, token))
     skip: set[str] = set()
     if dedup:
         try:
@@ -484,6 +576,15 @@ def post_review(
     # body is still a finding of this pass.
     event = review_event(result, unresolved_blocking=unresolved, approve=approve)
     note = approval_note(event, result, unresolved, approve=approve)
+    head_moved = bool(pr_head_sha and result.head_sha and pr_head_sha != result.head_sha)
+    if head_moved:
+        # The verdict is about the commit this review read; the pull request's head is another one.
+        # Findings still go up (they are anchored to the reviewed commit), an approval does not.
+        moved = head_moved_note(str(result.head_sha), str(pr_head_sha))
+        if event == "APPROVE":
+            event, note = "COMMENT", moved
+        else:
+            note = f"{note} {moved}"
 
     inline_found = len(result.inline_findings)
     demoted = 0
@@ -495,7 +596,7 @@ def post_review(
             anchored = demote_to_summary(result, keep_paths=pr_files, drop_fingerprints=skip)
             demoted += len(anchored.summary_findings) - len(result.summary_findings)
             result = anchored
-    payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note)
+    payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note, run_id=run_id)
     posted_review = False
 
     def _create_review(body: dict):
@@ -504,15 +605,16 @@ def post_review(
 
     # Post the review if there is something new to say (new inline comments), findings exist, or the
     # review is an approval -- an approval with nothing else to say is exactly the review a clean PR
-    # needs (a clean review used to post nothing, so no PR ever carried an approval).
-    if payload["comments"] or result.findings or event == "APPROVE":
+    # needs (a clean review used to post nothing, so no PR ever carried an approval). Never when
+    # this very job already posted one (duplicate_run): the PR carries that review.
+    if not duplicate_run and (payload["comments"] or result.findings or event == "APPROVE"):
         resp = _create_review(payload)
         if resp.status_code == 422 and event == "APPROVE":
             # The App cannot approve a PR it authored (its own fix PRs). Say the same thing as a
             # comment, when there is anything to say.
             event = "COMMENT"
             note = approval_note(event, result, unresolved, approve=approve) + " (the App cannot approve its own pull request)"
-            payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note)
+            payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note, run_id=run_id)
             resp = _create_review(payload) if (payload["comments"] or result.findings) else None
         if resp is not None and resp.status_code == 422 and payload["comments"]:
             # GitHub refused an anchor this payload carried -- a path or line outside the PR's diff
@@ -524,7 +626,7 @@ def post_review(
             in_body = demote_to_summary(result, drop_fingerprints=skip)
             demoted += len(in_body.summary_findings) - len(result.summary_findings)
             result = in_body
-            payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note)
+            payload = build_review_payload(result, skip_fingerprints=skip, event=event, approval=note, run_id=run_id)
             resp = _create_review(payload)
         if resp is not None and resp.status_code >= 300:
             raise RuntimeError(f"create review failed: {resp.status_code} {resp.text[:300]}")
@@ -538,7 +640,7 @@ def post_review(
             if check_run_id is not None:
                 webhook_github.update_check_run(
                     repo_slug, token, check_run_id, conclusion=result.conclusion,
-                    summary=summary_body(result, note), name=CHECK_NAME,
+                    summary=summary_body(result, note, run_id=run_id), name=CHECK_NAME,
                 )
                 check = {"id": check_run_id, "conclusion": result.conclusion, "updated_existing": True}
             else:
@@ -557,6 +659,7 @@ def post_review(
 
     return {
         "posted_review": posted_review,
+        "duplicate_run": duplicate_run,
         "event": event,
         "unresolved_blocking": unresolved,
         "inline_posted": len(payload["comments"]),
@@ -565,4 +668,8 @@ def post_review(
         "skipped_duplicates": inline_found - len(payload["comments"]) - demoted,
         "demoted_to_summary": demoted,
         "check": check,
+        # The three commits a caller needs to compare: what the check is on, what was reviewed
+        # (``head_sha`` in the enclosing result) and where the pull request stands now.
+        "check_head_sha": check_head_sha if check_run_id is not None else result.head_sha,
+        "pr_head_sha": pr_head_sha,
     }