codna 0.2.75__tar.gz → 0.2.76__tar.gz

{codna-0.2.75 → codna-0.2.76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.75
+Version: 0.2.76
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.75 → codna-0.2.76}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.75"
+__version__ = "0.2.76"

{codna-0.2.75 → codna-0.2.76}/codna/webhook_ops.py

@@ -6,7 +6,13 @@ One implementation of every verb (:func:`run_verb`) behind three fronts:
 * HTTP on the ingress, ``Authorization: Bearer $CODNA_WEBHOOK_OPS_TOKEN`` (its own secret,
   compared in constant time; the webhook HMAC secret is NOT reused -- ``/debug/queue`` used to,
   and stops here);
-* the CLI, run inside a machine with ``DATABASE_URL`` (``fly ssh console -C "codna webhook ops …"``);
+* the CLI, run inside a machine with ``DATABASE_URL`` (``fly ssh console -C "codna webhook ops …"``).
+  A verb whose answer is the SERVING process's state rather than a table (:data:`LIVE_VERBS`:
+  ``scaler``) is asked of the running server over its own loopback ``/ops/<verb>``, with the
+  machine's ``CODNA_WEBHOOK_OPS_TOKEN`` -- a separate CLI process builds no Scaler, so its own
+  view could only ever say "not configured" (it did, 2026-09-20, while the token was set). The
+  answer carries ``"view": "live"``; when that call cannot be made the CLI's own view is printed
+  with ``"view": "cli-rebuild"`` and the reason;
 * ``webhook-ops.yml`` (``workflow_dispatch``), which wraps the CLI so nobody needs a Fly login.
 
 Every mutation records its ``actor`` in ``job_events``. Nothing here is reachable on the
@@ -29,6 +35,10 @@ from .webhook_pg_queue import PostgresQueue
 OPS_TOKEN_ENV = "CODNA_WEBHOOK_OPS_TOKEN"
 VERBS = ("jobs", "job", "cancel", "retry-now", "reprioritize", "tenant", "tenants", "workers", "drain", "undrain",
          "scaler", "slo", "dead", "metrics", "redeliver-sweep", "events")
+# Verbs whose answer is the state of the serving process (its Scaler thread), not a row in the
+# shared table: a separate CLI process has none of it, so the CLI asks the live server instead.
+LIVE_VERBS = ("scaler",)
+LIVE_PORT_ENV = "CODNA_WEBHOOK_PORT"
 
 
 def ops_authorized(headers: Mapping[str, str], environ: Mapping[str, str] | None = None) -> bool:
@@ -185,6 +195,46 @@ def handle_ops_get(path: str, headers: Mapping[str, str], *, queue: Any, actor_e
 
 
 # --- the CLI front (webhook_cli.cmd_webhook dispatches here) ----------------------------------------
+def _live_client() -> Any:
+    import httpx
+
+    return httpx.Client(timeout=5.0)
+
+
+def live_verb(verb: str, args: Mapping[str, Any], *, actor: str,
+              environ: Mapping[str, str] | None = None) -> tuple[dict[str, Any] | None, str]:
+    """The RUNNING server's answer to ``verb``: its own loopback ``/ops/<verb>``, authenticated with
+    the ``CODNA_WEBHOOK_OPS_TOKEN`` of this environment (the ingress machine holds it for its HTTP
+    front). Returns ``(payload + {"view": "live"}, "")``, or ``(None, reason)`` when the call cannot
+    be made -- no ops token here, nothing listening on the port, a non-200 -- where the reason names
+    an exception class or a status code and never the token."""
+    import httpx
+
+    e = os.environ if environ is None else environ
+    token = (e.get(OPS_TOKEN_ENV) or "").strip()
+    if not token:
+        return None, f"{OPS_TOKEN_ENV} is not set in this process's environment"
+    port = (e.get(LIVE_PORT_ENV) or "8080").strip()
+    params = {k: str(v) for k, v in args.items() if v not in (None, "")}
+    params["actor"] = actor
+    try:
+        with _live_client() as client:
+            resp = client.get(f"http://127.0.0.1:{port}/ops/{verb}", params=params,
+                              headers={"Authorization": f"Bearer {token}"})
+    except (httpx.HTTPError, httpx.InvalidURL) as exc:
+        # InvalidURL is not an HTTPError: a CODNA_WEBHOOK_PORT that is not a port lands here too.
+        return None, f"loopback /ops/{verb} unreachable: {type(exc).__name__}"
+    if resp.status_code != 200:
+        return None, f"loopback /ops/{verb} answered HTTP {resp.status_code}"
+    try:
+        payload = resp.json()
+    except ValueError:
+        return None, f"loopback /ops/{verb} answered a non-JSON body"
+    if not isinstance(payload, dict):
+        return None, f"loopback /ops/{verb} answered a non-object body"
+    return {**payload, "view": "live"}, ""
+
+
 def add_ops_parser(pw_sub: argparse._SubParsersAction) -> None:
     """``codna webhook ops <verb> [options]`` + ``migrate`` + ``queue export|import``."""
     po = pw_sub.add_parser("ops", help="Operate the hosted webhook queue (Postgres backend; needs DATABASE_URL).")
@@ -215,16 +265,27 @@ def add_ops_parser(pw_sub: argparse._SubParsersAction) -> None:
 def cli_ops(args: argparse.Namespace) -> int:
     from .webhook_pg_schema import database_url
 
+    params = {k: getattr(args, k) for k in ("id", "priority", "status", "kind", "repo", "installation", "action",
+                                              "value", "owner", "reason", "limit") if getattr(args, k, None) is not None}
+    who = args.actor or os.environ.get("USER") or "operator"
+    live_unavailable = ""
+    if args.verb in LIVE_VERBS:
+        live, live_unavailable = live_verb(args.verb, params, actor=who)
+        if live is not None:
+            print(json.dumps(live, indent=2, sort_keys=True, default=str))
+            return 0
     url = database_url()
     if not url:
         print("codna: `codna webhook ops` needs DATABASE_URL (or CODNA_WEBHOOK_DATABASE_URL)", file=sys.stderr)
         return 2
     queue = PostgresQueue(url, heartbeat_s=0, pool_max=2)
     try:
-        params = {k: getattr(args, k) for k in ("id", "priority", "status", "kind", "repo", "installation", "action",
-                                                  "value", "owner", "reason", "limit") if getattr(args, k, None) is not None}
-        actor = f"ops-cli:{args.actor or os.environ.get('USER') or 'operator'}"
+        actor = f"ops-cli:{who}"
         out = run_verb(queue, args.verb, params, actor=actor)
+        if args.verb in LIVE_VERBS:
+            # This process built no Scaler, so its own answer says nothing about the serving one.
+            out = {**out, "view": "cli-rebuild", "live_unavailable": live_unavailable,
+                   "hint": "the serving process answers GET /ops/scaler on the ingress; this CLI process has no Scaler of its own"}
         if args.verb == "metrics":
             sys.stdout.write(str(out["text"]))
         else:

{codna-0.2.75 → codna-0.2.76}/codna/webhook_scaler.py

@@ -391,11 +391,28 @@ class Scaler:
             pass
 
 
+# The autoscaler's Machines API credential: a deploy token scoped to the WORKER app (`fly tokens
+# create deploy -a codna-webhook-worker`), set as a secret on the ingress. The service's own name
+# is read first; FLY_API_TOKEN -- flyctl's login variable and the name Fly's Machines API docs use
+# -- stays a fallback so an ingress configured under that name keeps its scaler.
+FLY_TOKEN_ENVS = ("CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN")
+
+
+def fly_token_from_env(environ: Any = None) -> str | None:
+    """The first non-blank value among :data:`FLY_TOKEN_ENVS`, or None when neither is set."""
+    e = os.environ if environ is None else environ
+    for name in FLY_TOKEN_ENVS:
+        value = (e.get(name) or "").strip()
+        if value:
+            return value
+    return None
+
+
 def machines_client_from_env(environ: Any = None) -> FlyMachinesClient | None:
-    """None when no ``FLY_API_TOKEN`` is configured -- the scaler then does not run at all, and the
-    floor machines serve alone (exactly today's shape)."""
+    """None when no Fly token is configured under either name in :data:`FLY_TOKEN_ENVS` -- the
+    scaler then does not run at all, and the floor machines serve alone (exactly today's shape)."""
     e = os.environ if environ is None else environ
-    token = e.get("FLY_API_TOKEN")
+    token = fly_token_from_env(e)
     if not token:
         return None
     return FlyMachinesClient(e.get("CODNA_WEBHOOK_WORKER_APP", "codna-webhook-worker"), token,

{codna-0.2.75 → codna-0.2.76}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.75
+Version: 0.2.76
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.75 → codna-0.2.76}/codna.egg-info/SOURCES.txt

@@ -225,6 +225,7 @@ tests/test_webhook_github_ci.py
 tests/test_webhook_lease.py
 tests/test_webhook_metering.py
 tests/test_webhook_ops.py
+tests/test_webhook_ops_cli.py
 tests/test_webhook_pg_queue.py
 tests/test_webhook_queue.py
 tests/test_webhook_queued_check.py

{codna-0.2.75 → codna-0.2.76}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.75"
+version = "0.2.76"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

codna-0.2.76/tests/test_webhook_ops_cli.py

@@ -0,0 +1,143 @@
+"""The CLI front of the operator surface, without a database: the autoscaler's token precedence
+(``CODNA_WEBHOOK_FLY_TOKEN`` first, ``FLY_API_TOKEN`` as the fallback) and ``codna webhook ops
+scaler`` answering for the SERVING process through its loopback ``/ops/scaler`` (``"view": "live"``),
+falling back to its own view marked ``"view": "cli-rebuild"`` with the reason. The live path never
+opens the queue and the fallback runs against a stand-in, so none of this needs Postgres."""
+from __future__ import annotations
+
+import argparse
+import json
+
+import httpx
+import pytest
+
+from codna import webhook_ops
+from codna.webhook_ops import LIVE_VERBS, cli_ops, live_verb
+from codna.webhook_scaler import FLY_TOKEN_ENVS, fly_token_from_env, machines_client_from_env
+
+TOKEN = "ops-bearer-for-tests"
+
+
+# --- the Machines API credential -------------------------------------------------------------------------
+
+def test_fly_token_precedence_is_the_services_own_name_then_flyctls():
+    assert FLY_TOKEN_ENVS == ("CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN")
+    assert fly_token_from_env({}) is None
+    assert fly_token_from_env({"FLY_API_TOKEN": "legacy"}) == "legacy"                                   # the fallback still works
+    assert fly_token_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "ours", "FLY_API_TOKEN": "legacy"}) == "ours"
+    assert fly_token_from_env({"CODNA_WEBHOOK_FLY_TOKEN": " \n", "FLY_API_TOKEN": "legacy"}) == "legacy"  # blank = unset
+    assert machines_client_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "", "FLY_API_TOKEN": ""}) is None
+    client = machines_client_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "ours", "FLY_API_TOKEN": "legacy", "CODNA_WEBHOOK_WORKER_APP": "w"})
+    assert client is not None and (client._token, client._app) == ("ours", "w")
+
+
+# --- the live view ---------------------------------------------------------------------------------------
+
+def _client(handler):
+    return lambda: httpx.Client(transport=httpx.MockTransport(handler), timeout=5.0)
+
+
+def _refuse(request):
+    raise httpx.ConnectError("connection refused", request=request)
+
+
+def _never(request):
+    raise AssertionError("no request may be made here")
+
+
+def test_live_verb_asks_the_serving_process_with_the_ops_bearer_and_marks_the_view(monkeypatch):
+    seen = {}
+
+    def handler(request):
+        seen["url"] = httpx.URL(str(request.url))
+        seen["auth"] = request.headers.get("authorization")
+        return httpx.Response(200, json={"configured": True, "paused": False, "scaler_leader": 1})
+
+    monkeypatch.setattr(webhook_ops, "_live_client", _client(handler))
+    env = {"CODNA_WEBHOOK_OPS_TOKEN": TOKEN, "CODNA_WEBHOOK_PORT": "8181"}
+    out, why = live_verb("scaler", {"action": "status", "limit": 50, "value": None}, actor="github-actions:octocat", environ=env)
+    assert why == "" and out == {"configured": True, "paused": False, "scaler_leader": 1, "view": "live"}
+    assert seen["auth"] == f"Bearer {TOKEN}"
+    assert (seen["url"].host, seen["url"].port, seen["url"].path) == ("127.0.0.1", 8181, "/ops/scaler")
+    assert dict(seen["url"].params) == {"action": "status", "limit": "50", "actor": "github-actions:octocat"}  # None dropped
+
+
+@pytest.mark.parametrize("env, handler, expect", [
+    ({}, _never, "CODNA_WEBHOOK_OPS_TOKEN is not set"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, _refuse, "loopback /ops/scaler unreachable: ConnectError"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN, "CODNA_WEBHOOK_PORT": "eighty"}, _never, "unreachable: InvalidURL"),  # not an HTTPError
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, lambda r: httpx.Response(401, json={"error": "unauthorized"}), "answered HTTP 401"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, lambda r: httpx.Response(200, text="not json"), "non-JSON body"),
+    ({"CODNA_WEBHOOK_OPS_TOKEN": TOKEN}, lambda r: httpx.Response(200, json=[1, 2]), "non-object body"),
+])
+def test_live_verb_says_why_it_could_not_ask_and_never_the_token(monkeypatch, env, handler, expect):
+    monkeypatch.setattr(webhook_ops, "_live_client", _client(handler))
+    out, why = live_verb("scaler", {}, actor="t", environ=env)
+    assert out is None and expect in why
+    assert TOKEN not in why
+
+
+# --- `codna webhook ops` -------------------------------------------------------------------------------
+
+def _ns(verb, **overrides):
+    ns = dict(verb=verb, id=None, priority=None, status=None, kind=None, repo=None, installation=None,
+              action=None, value=None, owner=None, reason="operator", limit=50, actor="github-actions:octocat")
+    ns.update(overrides)
+    return argparse.Namespace(**ns)
+
+
+class _NeverBuilt:
+    def __init__(self, *args, **kwargs):
+        raise AssertionError("the live view must not open the queue")
+
+
+class _StandIn:
+    """Stands in for the PostgresQueue the CLI opens; the verbs exercised here never touch it."""
+
+    def __init__(self, *args, **kwargs):
+        pass
+
+    def close(self):
+        pass
+
+
+def test_cli_ops_scaler_prints_the_live_view_without_a_database(monkeypatch, capsys):
+    monkeypatch.setenv("CODNA_WEBHOOK_OPS_TOKEN", TOKEN)
+    monkeypatch.delenv("DATABASE_URL", raising=False)
+    monkeypatch.delenv("CODNA_WEBHOOK_DATABASE_URL", raising=False)
+    monkeypatch.setattr(webhook_ops, "_live_client",
+                        _client(lambda r: httpx.Response(200, json={"configured": True, "cap": 4, "paused": False})))
+    monkeypatch.setattr(webhook_ops, "PostgresQueue", _NeverBuilt)
+    assert cli_ops(_ns("scaler", action="status")) == 0
+    assert json.loads(capsys.readouterr().out) == {"cap": 4, "configured": True, "paused": False, "view": "live"}
+
+
+def test_cli_ops_scaler_falls_back_to_its_own_view_marked_cli_rebuild(monkeypatch, capsys):
+    monkeypatch.setenv("CODNA_WEBHOOK_OPS_TOKEN", TOKEN)
+    monkeypatch.setenv("DATABASE_URL", "postgresql://stand-in/db")
+    monkeypatch.setattr(webhook_ops, "_live_client", _client(_refuse))
+    monkeypatch.setattr(webhook_ops, "PostgresQueue", _StandIn)
+    assert cli_ops(_ns("scaler")) == 0
+    out = json.loads(capsys.readouterr().out)
+    assert out["view"] == "cli-rebuild" and out["configured"] is False
+    assert out["live_unavailable"] == "loopback /ops/scaler unreachable: ConnectError"
+    assert "GET /ops/scaler" in out["hint"]
+    assert TOKEN not in json.dumps(out)
+
+
+def _no_loopback():
+    raise AssertionError("a table read must not go to loopback")
+
+
+def test_cli_ops_table_verbs_never_go_to_loopback(monkeypatch, capsys):
+    assert LIVE_VERBS == ("scaler",)
+    monkeypatch.setenv("CODNA_WEBHOOK_OPS_TOKEN", TOKEN)
+    monkeypatch.setenv("DATABASE_URL", "postgresql://stand-in/db")
+    monkeypatch.setattr(webhook_ops, "_live_client", _no_loopback)
+    monkeypatch.setattr(webhook_ops, "PostgresQueue", _StandIn)
+    seen = []
+    monkeypatch.setattr(webhook_ops, "run_verb",
+                        lambda queue, verb, params, **kw: seen.append((verb, params, kw["actor"])) or {"jobs": []})
+    assert cli_ops(_ns("jobs", status="dead")) == 0
+    assert seen == [("jobs", {"status": "dead", "reason": "operator", "limit": 50}, "ops-cli:github-actions:octocat")]
+    assert json.loads(capsys.readouterr().out) == {"jobs": []}                       # no view marker on a table read

{codna-0.2.75 → codna-0.2.76}/tests/test_webhook_scaler.py

@@ -49,6 +49,8 @@ def test_no_fly_token_means_no_machines_client():
     assert machines_client_from_env({}) is None
     client = machines_client_from_env({"FLY_API_TOKEN": "t", "CODNA_WEBHOOK_WORKER_APP": "w"})
     assert client is not None and client._app == "w"
+    ours = machines_client_from_env({"CODNA_WEBHOOK_FLY_TOKEN": "ours", "FLY_API_TOKEN": "t"})
+    assert ours is not None and ours._token == "ours"           # the service's own name wins
 
 
 class _Held:

{codna-0.2.75 → codna-0.2.76}/tests/test_webhook_service.py

@@ -52,7 +52,8 @@ def test_default_flag_builds_todays_shape(tmp_path, monkeypatch):
     monkeypatch.setenv("CODNA_WEBHOOK_QUEUE", str(tmp_path / "queue.db"))
     monkeypatch.setenv("CODNA_RUNTIME_ROOT", str(tmp_path / "rt"))
     monkeypatch.setenv("TMPDIR", str(tmp_path / "tmp"))
-    for var in ("CODNA_WEBHOOK_QUEUE_BACKEND", "CODNA_WEBHOOK_ROLE", "DATABASE_URL", "FLY_API_TOKEN", "CODNA_WEBHOOK_REDELIVER"):
+    for var in ("CODNA_WEBHOOK_QUEUE_BACKEND", "CODNA_WEBHOOK_ROLE", "DATABASE_URL", "CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN",
+                "CODNA_WEBHOOK_REDELIVER"):
         monkeypatch.delenv(var, raising=False)
     svc = build_service(pool_factory=_Pool)
     assert (svc.backend, svc.role) == ("sqlite", "all")
@@ -256,6 +257,7 @@ def test_a_lost_lease_cancels_the_job_this_process_runs(make_pg_queue, tmp_path,
     monkeypatch.setenv("TMPDIR", str(tmp_path / "tmp"))
     monkeypatch.setenv("CODNA_WEBHOOK_QUEUE_BACKEND", "postgres")
     monkeypatch.setenv("CODNA_WEBHOOK_ROLE", "worker")
+    monkeypatch.delenv("CODNA_WEBHOOK_FLY_TOKEN", raising=False)
     monkeypatch.delenv("FLY_API_TOKEN", raising=False)
     build_service(queue=pg, pool_factory=_Pool)                     # the injected queue gets the handler too
     assert pg.enqueue(WebhookJob("review", "acme/app", ref="old", pr_number=7, installation_id=42, reason="t"), delivery_id="d1")

{codna-0.2.75 → codna-0.2.76}/tests/test_workflows.py

@@ -151,11 +151,22 @@ def test_webhook_ops_worker_secrets_refuses_a_partial_set_and_copies_exactly_the
     names = re.search(r'names="([^"]+)"', run).group(1).split()
     assert set(names) == {"GITHUB_APP_ID", "GITHUB_APP_PRIVATE_KEY", "CODNA_ENGINE_URL", "CODNA_WEBHOOK_INTERNAL_SECRET"}
     assert all(f"`{n}`" in runbook for n in names)
-    for forbidden in ("FLY_API_TOKEN", "CODNA_GITHUB_WEBHOOK_SECRET", "CODNA_WEBHOOK_OPS_TOKEN"):
+    for forbidden in ("CODNA_WEBHOOK_FLY_TOKEN", "FLY_API_TOKEN", "CODNA_GITHUB_WEBHOOK_SECRET", "CODNA_WEBHOOK_OPS_TOKEN"):
         assert forbidden not in names
     assert "refusing to configure" in run and run.index("refusing to configure") < run.index("flyctl secrets set")
 
 
+def test_webhook_ops_worker_token_sets_the_name_the_scaler_reads_first():
+    from codna.webhook_scaler import FLY_TOKEN_ENVS
+
+    run = _ops_step("worker-token")["run"]
+    assert FLY_TOKEN_ENVS[0] == "CODNA_WEBHOOK_FLY_TOKEN"
+    assert 'flyctl secrets set -a "$APP" "CODNA_WEBHOOK_FLY_TOKEN=$token"' in run
+    assert "FLY_API_TOKEN=$token" not in run                    # the flyctl login name is only a fallback the service reads
+    runbook = (ROOT / "infra" / "README-webhook-deploy.md").read_text(encoding="utf-8")
+    assert "CODNA_WEBHOOK_FLY_TOKEN=$(fly tokens create deploy -a codna-webhook-worker)" in runbook
+
+
 def test_webhook_ops_mpg_steps_redact_the_connection_string_flyctl_prints():
     for action in ("mpg-create", "mpg-attach"):
         run = _ops_step(action)["run"].replace("\\\n", " ")  # join shell continuation lines