codna 0.2.5__tar.gz → 0.2.7__tar.gz

{codna-0.2.5 → codna-0.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.5
+Version: 0.2.7
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.5 → codna-0.2.7}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.5"
+__version__ = "0.2.7"

{codna-0.2.5 → codna-0.2.7}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/Users/angel/actions-runner-mac-3/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/Users/angel/Developer/actions-runner/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.2.5 → codna-0.2.7}/codna/fix_run.py

@@ -290,6 +290,23 @@ def _retry_issue_text(original_issue: str | None, verify_issue: str | None, stil
     return "\n\n".join(sections)
 
 
+def _fallback_pr_title(issue: str | None, summary: dict) -> str:
+    """PR title when the caller passed no --pr-title.
+
+    Prefers the request's OWN first line (for a webhook fix that is the issue title) over the model's
+    ``root_cause``, because root_cause is free text and models fill it with narrative: a live fix PR
+    shipped titled "codna: fix Here's a summary of every change made:". The webhook now always passes
+    --pr-title, so this is the safety net for every other caller (`codna fix` run by hand, the Action).
+    """
+    from .webhook import pr_title_from_issue_text  # local import: avoids a module-level cycle
+
+    for candidate in (issue, summary.get("root_cause")):
+        title = pr_title_from_issue_text(candidate, limit=60)
+        if title:
+            return f"codna: fix {title}"
+    return "codna: fix bug"
+
+
 def _apply_once(c, rid, snap, plan, *, open_pr, args, issue, summary, repo):
     from . import cli as _cli
 
@@ -303,7 +320,7 @@ def _apply_once(c, rid, snap, plan, *, open_pr, args, issue, summary, repo):
             "mode": "remote_pr", "write_permission": True,
             "decision_plan_id": plan.get("decision_plan_id"), "simulation_id": sid,
             **({"base_branch": args.base_branch} if args.base_branch else {}),
-            "pull_request_title": args.pr_title or f"codna: fix {(summary.get('root_cause') or 'bug')[:60]}",
+            "pull_request_title": args.pr_title or _fallback_pr_title(issue, summary),
             "pull_request_body": args.pr_body or pr_body(issue, {"root_cause": summary.get("root_cause"),
                                                                        "impacted_symbols": summary.get("impacted_symbols")}, plan),
         }))

{codna-0.2.5 → codna-0.2.7}/codna/runtime/local_stack.py

@@ -254,17 +254,13 @@ def _sidecar_spawn(
     _apply_owned_sidecar_runtime_env(env, config)
     _remove_local_database_env(env)
 
-    # Proof-bundle writes go to <AGENT_CORE_ROOT_DIR>/build/proofs/... — point them at a directory
-    # codna OWNS and creates, for EVERY spawn shape. Left unset, run-server falls back to the
-    # resolved repo root, and finalizeSessionArtifacts' mkdir is unguarded and runs AFTER the model
-    # turn, so an unwritable root fails the whole fix *after* paying for it and throws the patch away.
-    # Both shapes hit this: the compiled standalone resolves import.meta under the read-only
-    # `/$bunfs` embedded FS (EROFS), and a packaged deployment resolves it to the image's install
-    # dir, which is typically root-owned while the service runs unprivileged — codna-webhook was
-    # exactly that (`/app` root-owned drwxr-xr-x, service as uid 10001, EACCES on mkdir /app/build),
-    # so every fix run there was guaranteed to fail. This was previously set only on the binary
-    # branch; that asymmetry WAS the bug. `cline_data_dir` is created by codna under its own runtime
-    # root, and the proof READER resolves through the same ROOT_DIR, so reads follow writes.
+    # Proof writes land in <AGENT_CORE_ROOT_DIR>/build/proofs/... — point them at a dir codna owns,
+    # for EVERY spawn shape. Unset, run-server falls back to the resolved repo/install root, and
+    # finalizeSessionArtifacts' mkdir is unguarded and awaited AFTER the model turn: an unwritable
+    # root fails the fix *after* paying for it and discards the patch. Compiled binary hits it via
+    # read-only `/$bunfs` (EROFS); a packaged deploy hits it via a root-owned install dir (codna-
+    # webhook: EACCES on /app/build). Setting this on only one branch WAS the bug. See
+    # test_sidecar_spawn_source_checkout_also_redirects_proofs_to_writable_root.
     env["AGENT_CORE_ROOT_DIR"] = str(config.cline_data_dir)
 
     # Preferred: the self-contained compiled sidecar shipped in the wheel (bun build --compile). It

{codna-0.2.5 → codna-0.2.7}/codna/webhook.py

@@ -237,6 +237,58 @@ def webhook_marker(job: WebhookJob) -> str:
     return f"codna-webhook-id: {job.repo_full_name}#{job.kind}#{key}"
 
 
+# A narrative preamble a model emits when asked for a one-line cause ("Here's a summary of every
+# change made:", "Summary of changes:") -- never a usable title. Deliberately NARROW: an earlier
+# version matched a bare leading `summary`/`the following`/`i have`, which rejected perfectly good
+# human issue titles like "Summary tab shows stale totals after a refund". A "here's/here is" opener
+# is prose on its own; the weaker openers only count as prose when the line also ENDS in a colon,
+# the way a section header does.
+_PROSE_OPENER_RE = re.compile(r"^(here(?:'s|\s+is)\b)", re.IGNORECASE)
+_PROSE_HEADER_RE = re.compile(r"^(summary|the following|changes?|overview|details)\b", re.IGNORECASE)
+
+# A GitHub closing keyword + issue reference. Issue text is ATTACKER-INFLUENCED (anyone who can file
+# an issue controls its title), and the PR title becomes the branch's commit message
+# (packaged_git.py), where GitHub HONORS these on merge. So a title smuggling "Closes #1" could close
+# an unrelated issue -- a maintainer's security tracker, say. Defanged by dropping the reference
+# marker (`#`/`GH-`/issue URL), which keeps the words readable but inert.
+_CLOSING_REF_RE = re.compile(
+    r"\b(clos(?:e|es|ed)|fix(?:e[sd])?|resolv(?:e|es|ed))(\s+)"
+    r"(?:#|GH-|https?://\S*?/issues/)(\d+)",
+    re.IGNORECASE,
+)
+
+
+def pr_title_from_issue_text(issue_text: str | None, *, limit: int = 72) -> str | None:
+    """A concise PR title from the FIRST line of ``issue_text``, or None if it isn't usable.
+
+    ``fetch_issue_text`` formats an issue as "<title>\\n\\n<body>", so line 1 IS the issue title --
+    the same thing a human would name the PR after. Without this, a label-triggered fix passed no
+    ``--pr-title`` at all and fix_run fell back to the model's ``root_cause``, which produced the
+    real title "codna: fix Here's a summary of every change made:" on a live fix PR. The
+    comment-triggered path already passes an explicit title; this closes that asymmetry.
+
+    FIRST LINE ONLY, and None rather than falling through to later lines: the body is never the
+    title, so walking into it just swapped one nonsense title for another (a repro step, a quoted
+    log, an @-mention). Returning None is safe -- ``codna_command`` then omits ``--pr-title`` and
+    fix_run's own fallback applies.
+    """
+    first = next((ln for ln in (issue_text or "").splitlines() if ln.strip()), "")
+    # Strip markdown heading / bullet / quote decoration, then collapse whitespace.
+    line = re.sub(r"^\s*(?:[#>*\-+]+\s*)+", "", first)
+    line = re.sub(r"\s+", " ", line).strip()
+    if not line:
+        return None
+    if _PROSE_OPENER_RE.match(line) or (line.endswith(":") and _PROSE_HEADER_RE.match(line)):
+        return None
+    line = _CLOSING_REF_RE.sub(r"\1\2\3", line).rstrip(":").strip()
+    if not line:
+        return None
+    if len(line) > limit:
+        cut = line[:limit].rsplit(" ", 1)[0].rstrip(",;:.-")
+        line = (cut or line[:limit]).rstrip()
+    return line
+
+
 def _fix_issue_text(ctx: Mapping[str, Any]) -> str:
     """Render a localized fix obligation from an (enriched) review-finding context → `codna fix --issue`.
 
@@ -317,8 +369,24 @@ def codna_command(
                     f"issue-label fix for #{job.issue_number} needs the issue's own text.",
                 )
             args += ["--issue", issue_text]
-        # Embed the idempotency marker in the PR body so a re-run can find + reuse this PR.
-        args += ["--pr-body", f"Automated fix opened by the Codna GitHub App.\n\n{webhook_marker(job)}"]
+            # Name the PR after the issue. Without this the label path passed no --pr-title and
+            # fix_run fell back to the model's `root_cause` prose (a live PR really was titled
+            # "codna: fix Here's a summary of every change made:").
+            issue_title = pr_title_from_issue_text(issue_text)
+            if issue_title:
+                args += ["--pr-title", f"codna: fix {issue_title}"]
+        # Embed the idempotency marker in the PR body so a re-run can find + reuse this PR. For an
+        # issue trigger also REFERENCE the issue (plain `#N`, deliberately not a closing keyword):
+        # the marker is not a GitHub reference, so nothing cross-linked the PR back to the issue and
+        # the issue looked untouched. A bot should make the link visible, not decide to close a
+        # human's issue -- merging is what proves the fix, and the human owns that call.
+        body = f"Automated fix opened by the Codna GitHub App.\n\n{webhook_marker(job)}"
+        if job.issue_number and not ctx:
+            body = (
+                f"Automated fix opened by the Codna GitHub App for #{job.issue_number}.\n\n"
+                f"{webhook_marker(job)}"
+            )
+        args += ["--pr-body", body]
         return args
     raise WebhookError("unknown_job_kind", f"unknown job kind {job.kind!r}")
 

{codna-0.2.5 → codna-0.2.7}/codna/webhook_worker.py

@@ -325,15 +325,44 @@ def process_job(
             conclusion="success" if result.ok else "failure",
             summary=result.summary, name=f"codna {job.kind}",
         )
-    # An issue-label fix has neither a commit (no check_id: job.ref is never set for this
-    # trigger) nor a comment thread (no reply_to) to report through -- without this, a failure
-    # is invisible on GitHub entirely (e.g. run_codna_job's issue-fetch-failure result above, or
-    # any codna CLI failure). A success still speaks for itself via the opened PR.
-    if not check_id and not reply_to and token and job.issue_number and not result.ok:
-        github.post_issue_comment(
-            job.repo_full_name, token, job.issue_number,
-            f"⚠️ Codna couldn't finish this fix: {result.summary}",
-        )
+    # An issue-label fix has neither a commit (no check_id: job.ref is never set for this trigger)
+    # nor a comment thread (no reply_to) to report through, so the issue itself is the ONLY place it
+    # can speak. Report BOTH outcomes here.
+    #
+    # Success used to be silent, on the reasoning that "a success speaks for itself via the opened
+    # PR". It does not: the PR body carried only the `codna-webhook-id:` marker, which is not a
+    # GitHub reference, so nothing ever cross-linked the PR to the issue. Observed live -- codna
+    # opened a correct fix PR and the issue's newest comment was still an OLD failure, so the issue
+    # looked broken while the work was done. Now the issue always gets the outcome, with a link.
+    if not check_id and not reply_to and token and job.issue_number:
+        # `job.kind == "fix"` is required for the SUCCESS half: the `codna-secure` label produces an
+        # issue-triggered job with no ref and no thread too, but it is a READ-ONLY classification pass
+        # that never opens a PR (codna_command builds `codna secure` without --open-pr). Without this
+        # term, a clean secure run posted "✅ ... opened a pull request for it." and sent the user
+        # hunting for a PR that does not exist -- the same kind of false statement this whole change
+        # exists to remove.
+        if result.ok and job.kind == "fix":
+            pr_url = None
+            try:
+                pr_url = github.find_open_pr_by_marker(job.repo_full_name, token, webhook_marker(job))
+            except Exception:  # noqa: BLE001 — never turn a successful fix into a failure over a lookup
+                pr_url = None
+            github.post_issue_comment(
+                job.repo_full_name, token, job.issue_number,
+                (f"✅ Codna opened a fix for this issue: {pr_url}" if pr_url
+                 else "✅ Codna finished this fix and opened a pull request for it."),
+            )
+        elif result.ok:
+            # Non-fix issue trigger (today: `codna-secure`). Say what actually happened.
+            github.post_issue_comment(
+                job.repo_full_name, token, job.issue_number,
+                f"✅ Codna finished the {job.kind} pass for this issue.",
+            )
+        else:
+            github.post_issue_comment(
+                job.repo_full_name, token, job.issue_number,
+                f"⚠️ Codna couldn't finish this fix: {result.summary}",
+            )
     # Reply the outcome ONCE: on success immediately, on failure only when the job is out of retries
     # (else a transient-then-succeeding fix would leave a spurious fail-closed reply, and every failed
     # attempt would spam the thread).

{codna-0.2.5 → codna-0.2.7}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.5
+Version: 0.2.7
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.5 → codna-0.2.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.5"
+version = "0.2.7"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.5 → codna-0.2.7}/tests/test_webhook.py

@@ -613,3 +613,112 @@ def test_malformed_content_length_returns_400(monkeypatch):
     finally:
         httpd.shutdown()
         httpd.server_close()
+
+
+# --- PR title + issue cross-reference for a label-triggered fix -------------------------------
+def test_issue_label_fix_names_the_pr_after_the_issue():
+    """fetch_issue_text formats an issue as "<title>\\n\\n<body>", so line 1 is the issue title.
+
+    Regression: the label path passed NO --pr-title, so fix_run fell back to the model's free-text
+    `root_cause` and a live fix PR shipped titled "codna: fix Here's a summary of every change
+    made:". The comment-fix path always passed an explicit title; this closes that asymmetry."""
+    job = WebhookJob("fix", "acme/app", issue_number=8, reason="labeled_codna_fix")
+    text = "Naive token comparison in src/auth.py allows timing attack\n\nverify_token() uses `==`."
+    cmd = codna_command(job, issue_text=text)
+    assert cmd[cmd.index("--pr-title") + 1] == (
+        "codna: fix Naive token comparison in src/auth.py allows timing attack"
+    )
+
+
+def test_issue_label_fix_pr_body_references_the_issue_without_closing_it():
+    """The codna-webhook-id marker is NOT a GitHub reference, so nothing cross-linked the fix PR to
+    the issue. A plain `#N` reference is used deliberately -- never a closing keyword, because a bot
+    should surface the link, not decide to close a human's issue."""
+    job = WebhookJob("fix", "acme/app", issue_number=8, reason="labeled_codna_fix")
+    cmd = codna_command(job, issue_text="Something is broken\n\ndetails")
+    from codna.webhook import webhook_marker
+
+    body = cmd[cmd.index("--pr-body") + 1]
+    marker = webhook_marker(job)
+    assert marker in body  # idempotency marker still present
+    # Assert on the PROSE half with the marker stripped out. Checking `"#8" in body` alone passes
+    # even with this fix fully reverted, because the marker itself ends in "#8" -- a test that
+    # cannot fail is worse than no test.
+    prose = body.replace(marker, "")
+    assert "#8" in prose, "the issue must be referenced OUTSIDE the idempotency marker to cross-link"
+    for closing in ("closes #8", "fixes #8", "resolves #8"):
+        assert closing not in body.lower(), f"must not auto-close the issue ({closing!r})"
+
+
+def test_issue_label_fix_omits_pr_title_when_the_issue_has_no_usable_first_line():
+    """No title is better than a garbage one -- fix_run's own fallback then applies."""
+    job = WebhookJob("fix", "acme/app", issue_number=8, reason="labeled_codna_fix")
+    cmd = codna_command(job, issue_text="Here's a summary of every change made:")
+    assert "--pr-title" not in cmd
+
+
+def test_pr_title_from_issue_text_rejects_model_prose_and_cleans_decoration():
+    from codna.webhook import pr_title_from_issue_text as t
+
+    assert t("## Bug: crash on empty input\n\nbody") == "Bug: crash on empty input"
+    assert t("- fix the thing:\n\nbody") == "fix the thing"
+    assert t("Here is what I did:") is None
+    assert t("Here's a summary of every change made:") is None  # the prose that shipped live
+    assert t("Summary of changes:") is None                     # section header, not a subject
+    assert t("") is None and t(None) is None
+    assert len(t("word " * 60)) <= 72
+
+
+def test_pr_title_keeps_legitimate_titles_that_merely_start_like_prose():
+    """The prose filter must stay NARROW. A first cut matched a bare leading `summary`/`the
+    following`/`i have` and threw away perfectly good human issue titles."""
+    from codna.webhook import pr_title_from_issue_text as t
+
+    for title in (
+        "Summary tab shows stale totals after a refund",
+        "The following endpoints 500 on empty payload",
+        "I have no access to the audit log as an org owner",
+        "Details panel truncates long names",
+    ):
+        assert t(f"{title}\n\nSteps to reproduce: ...") == title
+
+
+def test_pr_title_never_falls_through_into_the_issue_body():
+    """First line only. Walking into the body just swapped one nonsense title for another -- a repro
+    step, a quoted log, an @-mention -- which is the very defect this helper exists to prevent.
+    None is safe: codna_command then omits --pr-title and fix_run's fallback applies."""
+    from codna.webhook import pr_title_from_issue_text as t
+
+    assert t("Here's a summary:\n\nSteps to reproduce: open Reports, reload.") is None
+    assert t("\n\n") is None
+
+
+def test_pr_title_defangs_smuggled_github_closing_keywords():
+    """Issue text is attacker-influenced and the PR title becomes the branch's COMMIT MESSAGE, where
+    GitHub honours closing keywords on merge -- so a crafted issue title could close an unrelated
+    issue (a maintainer's security tracker, say). The words stay readable; the reference is inert."""
+    from codna.webhook import pr_title_from_issue_text as t
+
+    for hostile, banned in (
+        ("Login crash on empty password. Closes #1", "#1"),
+        ("Broken thing, fixes #42", "#42"),
+        ("Whatever, resolves GH-7", "GH-7"),
+        ("Bug, closes https://github.com/acme/app/issues/99", "#99"),
+    ):
+        out = t(hostile)
+        assert banned not in out, f"{banned!r} still live in {out!r}"
+        assert "issues/" not in out
+
+
+def test_fallback_pr_title_never_uses_model_prose():
+    """fix_run's safety net for callers that pass no --pr-title (a hand-run `codna fix`, the Action)."""
+    from codna.fix_run import _fallback_pr_title
+
+    assert _fallback_pr_title("Login crashes on empty password", {}) == (
+        "codna: fix Login crashes on empty password"
+    )
+    # The exact prose that shipped a broken title, with no issue text to fall back on.
+    assert _fallback_pr_title(None, {"root_cause": "Here's a summary of every change made:"}) == (
+        "codna: fix bug"
+    )
+    assert _fallback_pr_title(None, {}) == "codna: fix bug"

{codna-0.2.5 → codna-0.2.7}/tests/test_webhook_worker.py

@@ -289,13 +289,21 @@ def test_process_job_issue_label_fix_failure_posts_issue_comment():
               for c in gh.calls)
 
 
-def test_process_job_issue_label_fix_success_does_not_post_a_failure_comment():
+def test_process_job_issue_label_fix_success_comments_success_never_a_failure():
+    """This used to assert success posted NO comment, on the theory that "the opened PR speaks for
+    itself". It does not: the PR body carries only the codna-webhook-id marker, which is not a
+    GitHub reference, so the PR and the issue were never cross-linked. Live, that meant a correct
+    fix PR existed while the issue's newest comment was an older failure. Success now comments too
+    -- what must never happen is a FAILURE comment on a successful run."""
     gh = _FakeGitHub()
     result = process_job(_issue_label_qjob(), app_id="a", private_key="p",
                          github=gh, runner=lambda job, **kw: JobResult(True, "pull/9"),
                          resolve_engine_key=lambda iid: "org-key")
     assert result.ok is True
-    assert not any(c[0] == "issue_comment" for c in gh.calls)  # the opened PR speaks for itself
+    comments = [c for c in gh.calls if c[0] == "issue_comment"]
+    assert len(comments) == 1
+    assert "✅" in comments[0][2]
+    assert "⚠️" not in comments[0][2] and "couldn't finish" not in comments[0][2]
 
 
 def test_process_job_still_completes_check_run_when_runner_raises(monkeypatch):
@@ -577,3 +585,95 @@ def test_failing_fix_replies_only_on_the_final_attempt():
                 runner=lambda job, **kw: JobResult(False, "engine 401"),
                 resolve_engine_key=lambda iid: "org-key")
     assert sum("couldn't open a verified fix" in b for (_p, _r, b) in final.replies) == 1
+
+
+# --- issue-label fix: the issue is the ONLY surface, so BOTH outcomes must land there ---------
+def _label_qjob(issue_number=8, installation_id=42):
+    """A label-triggered fix: no ref (so no check run) and no comment context (so no thread)."""
+    return QueuedJob(
+        row_id=1, delivery_id="d-label", attempts=1,
+        job=WebhookJob("fix", "acme/app", ref=None, issue_number=issue_number,
+                       installation_id=installation_id, reason="labeled_codna_fix"),
+    )
+
+
+def test_label_fix_success_comments_the_pr_link_on_the_issue():
+    """Success used to be SILENT here ("a success speaks for itself via the opened PR"), but the PR
+    body carries only the codna-webhook-id marker -- not a GitHub reference -- so nothing ever
+    cross-linked them. Observed live: a correct fix PR was opened while the issue's newest comment
+    was still an older failure, making the issue look broken."""
+    gh = _FakeGitHub()
+    # find_open_pr_by_marker is consulted twice: the idempotency pre-check (must be None so the job
+    # actually runs) and again after success to link the PR.
+    seq = [None, "https://github.com/acme/app/pull/9"]
+    gh.find_open_pr_by_marker = lambda repo, token, marker, *, open_only=False: (
+        gh.calls.append(("find_pr", repo, open_only)) or seq.pop(0)
+    )
+    result = process_job(_label_qjob(), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: JobResult(True, "opened"),
+                         resolve_engine_key=lambda iid: "engine-key")
+    assert result.ok
+    comments = [c for c in gh.calls if c[0] == "issue_comment"]
+    assert len(comments) == 1, f"expected exactly one issue comment, got {comments}"
+    assert comments[0][1] == 8
+    assert "✅" in comments[0][2]
+    assert "https://github.com/acme/app/pull/9" in comments[0][2]
+
+
+def test_label_fix_success_still_comments_when_the_pr_lookup_fails():
+    """A lookup hiccup must not make a successful fix go silent, and must not fail the job."""
+    gh = _FakeGitHub()
+    seq = [None]
+
+    def _find(repo, token, marker, *, open_only=False):
+        gh.calls.append(("find_pr", repo, open_only))
+        if seq:
+            return seq.pop(0)
+        raise RuntimeError("github hiccup")
+
+    gh.find_open_pr_by_marker = _find
+    result = process_job(_label_qjob(), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: JobResult(True, "opened"),
+                         resolve_engine_key=lambda iid: "engine-key")
+    assert result.ok  # the fix succeeded; a comment-link failure never changes that
+    comments = [c for c in gh.calls if c[0] == "issue_comment"]
+    assert len(comments) == 1 and "✅" in comments[0][2]
+    # Pins the FALLBACK arm. Without asserting "None" is absent, deleting the pr_url guard would
+    # still pass while production posted "✅ Codna opened a fix for this issue: None".
+    assert "opened a pull request" in comments[0][2]
+    assert "None" not in comments[0][2]
+
+
+def test_label_fix_failure_still_comments_the_reason_on_the_issue():
+    gh = _FakeGitHub()
+    result = process_job(_label_qjob(), app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: JobResult(False, "boom: something broke"),
+                         resolve_engine_key=lambda iid: "engine-key")
+    assert not result.ok
+    comments = [c for c in gh.calls if c[0] == "issue_comment"]
+    assert len(comments) == 1
+    assert "⚠️" in comments[0][2] and "boom" in comments[0][2]
+    assert "✅" not in comments[0][2]
+
+
+def test_secure_label_success_never_claims_a_pull_request_was_opened():
+    """`codna-secure` on an issue also yields an issue-triggered job with no ref and no thread, but
+    it is a READ-ONLY classification pass that never opens a PR. The first cut of the success comment
+    was kind-agnostic and told those users "opened a pull request for it", sending them hunting for a
+    PR that never existed."""
+    gh = _FakeGitHub()
+    qjob = QueuedJob(
+        row_id=1, delivery_id="d-sec", attempts=1,
+        job=WebhookJob("secure", "acme/app", ref=None, issue_number=8,
+                       installation_id=42, reason="labeled_codna_secure"),
+    )
+    result = process_job(qjob, app_id="a", private_key="p", github=gh,
+                         runner=lambda job, **kw: JobResult(True, "3 findings classified"),
+                         resolve_engine_key=lambda iid: "engine-key")
+    assert result.ok
+    comments = [c for c in gh.calls if c[0] == "issue_comment"]
+    assert len(comments) == 1
+    body = comments[0][2]
+    assert "pull request" not in body, f"secure pass must not claim a PR: {body!r}"
+    assert "opened a fix" not in body
+    assert "secure" in body and "✅" in body