codna 0.2.76__tar.gz → 0.2.78__tar.gz

{codna-0.2.76 → codna-0.2.78}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.76
-Summary: Local-first repo intelligence and agent fixing for Codna.
+Version: 0.2.78
+Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
 License: Apache-2.0
@@ -71,84 +71,77 @@ Requires-Dist: tree-sitter-c-sharp; extra == "memory-languages"
 Requires-Dist: tree-sitter-php; extra == "memory-languages"
 Requires-Dist: tree-sitter-ruby; extra == "memory-languages"
 
-# Codna CLI
+# Codna
 
-Codna is a local-first code intelligence and fixing CLI. It maps a repository,
-builds focused evidence for the agent, applies patches through the local Codna
-runtime, and reports verification evidence without requiring users to manage a
-separate local database or engine stack.
+**Understand. Fix. Evolve.**
 
-## Install
+Agents read your code. Codna understands it.
 
-```bash
-pip install codna
-```
+Codna maps a repository before it spends a token. It then reviews pull requests, fixes bugs and
+proves which scanner findings are reachable. The same `codna` command runs on your machine, in the
+GitHub Action and behind the GitHub App.
 
-Codna supports Python 3.10 and newer on macOS and Linux.
+Runs on your machine or your cloud. Your code never leaves without your key.
 
-## Common Commands
+## Install
 
 ```bash
-codna doctor
-codna doctor --start-stack
-codna triage .
-codna fix . --issue "describe the failing test or production bug"
-codna mcp
+pip install codna          # or: pipx install codna · uv tool install codna
+codna --version
 ```
 
-`codna doctor` is read-only by default. `codna doctor --start-stack` starts the
-owned local runtime when you explicitly ask for it. Normal fix and benchmark
-paths use the same runtime contract.
-
-## What Codna Runs Locally
+Python 3.10–3.13. Wheels for macOS on Apple silicon and Linux x86_64. `git` on your `PATH`.
+Nothing else to install: no Node, Bun, Docker or server. The agent runtime ships inside the wheel.
 
-The base install includes the local Arrow/Parquet artifact dependency required
-for repository-intelligence step history. Clean installs include a packaged
-local repository backend for snapshot, triage, sidecar-backed fix planning,
-deterministic patch simulation, and explicit local-branch apply.
+Local commands need no Codna key. `fix` and `review` use your own model provider key, stored in
+the OS keychain and never printed:
 
-Codna's normal local product path uses the local Algenta SDK/core in process for
-repository intelligence. No local Postgres is required. Local runtime state is
-kept under the user's Codna runtime directory, and the agent sidecar is started
-only when needed.
-
-## MCP
+```bash
+codna key set anthropic    # also: openai, gemini, google, groq, mistral, openrouter, xai, cursor
+```
 
-Codna can run as a local MCP server for editors and agents that support MCP:
+## Commands
 
 ```bash
-codna mcp
+codna triage . --issue "checkout total is wrong"     # suspect files. Deterministic. 0 LLM tokens.
+codna review . --pr 123 --post                        # findings with a verdict on the pull request
+codna fix . --tests --apply --max-iterations 3        # patch, re-run your tests, re-fix until green
+codna fix <git url> --ref <sha> --issue "…" --open-pr # push a branch and open a pull request
+codna secure . --from-sarif results.sarif             # which scanner findings are reachable. 0 LLM tokens.
 ```
 
-Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
-repo understanding as a local tool.
+`codna fix` prints the root cause, the impacted symbols, the blast radius, its confidence and a
+regression risk. `--open-pr` needs a git URL and a GitHub write token. `codna review` posts one
+inline comment per finding with severity, category and a suggestion block, and an Approve when the
+diff is clean at medium and high. `codna secure` reads SARIF 2.1.0 from CodeQL, Semgrep, Snyk,
+Trivy or any other scanner.
 
-## Local Memory And Telys
+Other commands: `init`, `status`, `doctor`, `login`, `key`, `impact`, `memory export`, `report`.
+Full reference: [docs.codna.ai/reference/cli](https://docs.codna.ai/reference/cli).
 
-The base Codna install includes local code-memory support and the packaged
-Telys SDK/runtime/license:
+## MCP server
 
 ```bash
-pip install codna
+pip install "codna[mcp]"
+codna mcp install --client cursor     # or --client claude
 ```
 
-Users install Codna once. There is no separate user-facing Telys publishing,
-download, license, or install step. The optional `codna[memory]` extra only
-adds heavier retrieval/rerank/language packages for experiments; it is not
-required for the default Codna + Telys runtime path. Source distributions
-intentionally exclude bundled native runtime artifacts; source checkout and
-unsupported-platform development can point Codna at an explicit runtime with
-`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+Tools: `codna_triage`, `codna_fix`, `codna_secure`, `codna_recall`, `codna_report_bug`.
+
+## Code memory
 
-## Security And Local Files
+Code memory and recall run on your machine with no login and no extra install. The optional
+`codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
-Codna is designed for local-first operation:
+## What leaves your machine
 
-- Secrets are never required in source control.
-- Local runtime state and logs stay on the user's machine.
-- Generated release artifacts are not included in source distributions.
-- Secrets, local runtime state, logs, `.env` files, key files, and bundled
-  native runtime artifacts are excluded from source distributions.
+- Repository mapping, triage, recall and `impact` run offline. No model is involved.
+- `fix` and `review` send one issue-specific evidence bundle to the provider you chose, under your
+  key. Not the repository.
+- Secret redaction is always on and cannot be turned off.
+- `privacy.egress: fail-closed` in `codna.yaml` refuses to run tests without network denial and
+  skips registry lookups during review.
+- Source distributions exclude runtime binaries, keys, `.env` files and logs.
 
 ## Links
 

codna-0.2.78/README.md

@@ -0,0 +1,78 @@
+# Codna
+
+**Understand. Fix. Evolve.**
+
+Agents read your code. Codna understands it.
+
+Codna maps a repository before it spends a token. It then reviews pull requests, fixes bugs and
+proves which scanner findings are reachable. The same `codna` command runs on your machine, in the
+GitHub Action and behind the GitHub App.
+
+Runs on your machine or your cloud. Your code never leaves without your key.
+
+## Install
+
+```bash
+pip install codna          # or: pipx install codna · uv tool install codna
+codna --version
+```
+
+Python 3.10–3.13. Wheels for macOS on Apple silicon and Linux x86_64. `git` on your `PATH`.
+Nothing else to install: no Node, Bun, Docker or server. The agent runtime ships inside the wheel.
+
+Local commands need no Codna key. `fix` and `review` use your own model provider key, stored in
+the OS keychain and never printed:
+
+```bash
+codna key set anthropic    # also: openai, gemini, google, groq, mistral, openrouter, xai, cursor
+```
+
+## Commands
+
+```bash
+codna triage . --issue "checkout total is wrong"     # suspect files. Deterministic. 0 LLM tokens.
+codna review . --pr 123 --post                        # findings with a verdict on the pull request
+codna fix . --tests --apply --max-iterations 3        # patch, re-run your tests, re-fix until green
+codna fix <git url> --ref <sha> --issue "…" --open-pr # push a branch and open a pull request
+codna secure . --from-sarif results.sarif             # which scanner findings are reachable. 0 LLM tokens.
+```
+
+`codna fix` prints the root cause, the impacted symbols, the blast radius, its confidence and a
+regression risk. `--open-pr` needs a git URL and a GitHub write token. `codna review` posts one
+inline comment per finding with severity, category and a suggestion block, and an Approve when the
+diff is clean at medium and high. `codna secure` reads SARIF 2.1.0 from CodeQL, Semgrep, Snyk,
+Trivy or any other scanner.
+
+Other commands: `init`, `status`, `doctor`, `login`, `key`, `impact`, `memory export`, `report`.
+Full reference: [docs.codna.ai/reference/cli](https://docs.codna.ai/reference/cli).
+
+## MCP server
+
+```bash
+pip install "codna[mcp]"
+codna mcp install --client cursor     # or --client claude
+```
+
+Tools: `codna_triage`, `codna_fix`, `codna_secure`, `codna_recall`, `codna_report_bug`.
+
+## Code memory
+
+Code memory and recall run on your machine with no login and no extra install. The optional
+`codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
+
+## What leaves your machine
+
+- Repository mapping, triage, recall and `impact` run offline. No model is involved.
+- `fix` and `review` send one issue-specific evidence bundle to the provider you chose, under your
+  key. Not the repository.
+- Secret redaction is always on and cannot be turned off.
+- `privacy.egress: fail-closed` in `codna.yaml` refuses to run tests without network denial and
+  skips registry lookups during review.
+- Source distributions exclude runtime binaries, keys, `.env` files and logs.
+
+## Links
+
+- Homepage: https://codna.ai
+- Documentation: https://docs.codna.ai
+- Source: https://github.com/thyn-ai/codna
+- Security: https://codna.ai/security

{codna-0.2.76 → codna-0.2.78}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.76"
+__version__ = "0.2.78"

{codna-0.2.76 → codna-0.2.78}/codna/agent-core/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "type": "module",
   "version": "0.0.0",
-  "description": "Algenta Repositories agent-core sidecar — the vendored Cline runtime with proof-hardened session and compatibility surfaces.",
+  "description": "Codna agent runtime.",
   "license": "Apache-2.0",
   "engines": { "node": ">=22" },
   "scripts": {

{codna-0.2.76 → codna-0.2.78}/codna.egg-info/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.76
-Summary: Local-first repo intelligence and agent fixing for Codna.
+Version: 0.2.78
+Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
 License: Apache-2.0
@@ -71,84 +71,77 @@ Requires-Dist: tree-sitter-c-sharp; extra == "memory-languages"
 Requires-Dist: tree-sitter-php; extra == "memory-languages"
 Requires-Dist: tree-sitter-ruby; extra == "memory-languages"
 
-# Codna CLI
+# Codna
 
-Codna is a local-first code intelligence and fixing CLI. It maps a repository,
-builds focused evidence for the agent, applies patches through the local Codna
-runtime, and reports verification evidence without requiring users to manage a
-separate local database or engine stack.
+**Understand. Fix. Evolve.**
 
-## Install
+Agents read your code. Codna understands it.
 
-```bash
-pip install codna
-```
+Codna maps a repository before it spends a token. It then reviews pull requests, fixes bugs and
+proves which scanner findings are reachable. The same `codna` command runs on your machine, in the
+GitHub Action and behind the GitHub App.
 
-Codna supports Python 3.10 and newer on macOS and Linux.
+Runs on your machine or your cloud. Your code never leaves without your key.
 
-## Common Commands
+## Install
 
 ```bash
-codna doctor
-codna doctor --start-stack
-codna triage .
-codna fix . --issue "describe the failing test or production bug"
-codna mcp
+pip install codna          # or: pipx install codna · uv tool install codna
+codna --version
 ```
 
-`codna doctor` is read-only by default. `codna doctor --start-stack` starts the
-owned local runtime when you explicitly ask for it. Normal fix and benchmark
-paths use the same runtime contract.
-
-## What Codna Runs Locally
+Python 3.10–3.13. Wheels for macOS on Apple silicon and Linux x86_64. `git` on your `PATH`.
+Nothing else to install: no Node, Bun, Docker or server. The agent runtime ships inside the wheel.
 
-The base install includes the local Arrow/Parquet artifact dependency required
-for repository-intelligence step history. Clean installs include a packaged
-local repository backend for snapshot, triage, sidecar-backed fix planning,
-deterministic patch simulation, and explicit local-branch apply.
+Local commands need no Codna key. `fix` and `review` use your own model provider key, stored in
+the OS keychain and never printed:
 
-Codna's normal local product path uses the local Algenta SDK/core in process for
-repository intelligence. No local Postgres is required. Local runtime state is
-kept under the user's Codna runtime directory, and the agent sidecar is started
-only when needed.
-
-## MCP
+```bash
+codna key set anthropic    # also: openai, gemini, google, groq, mistral, openrouter, xai, cursor
+```
 
-Codna can run as a local MCP server for editors and agents that support MCP:
+## Commands
 
 ```bash
-codna mcp
+codna triage . --issue "checkout total is wrong"     # suspect files. Deterministic. 0 LLM tokens.
+codna review . --pr 123 --post                        # findings with a verdict on the pull request
+codna fix . --tests --apply --max-iterations 3        # patch, re-run your tests, re-fix until green
+codna fix <git url> --ref <sha> --issue "…" --open-pr # push a branch and open a pull request
+codna secure . --from-sarif results.sarif             # which scanner findings are reachable. 0 LLM tokens.
 ```
 
-Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
-repo understanding as a local tool.
+`codna fix` prints the root cause, the impacted symbols, the blast radius, its confidence and a
+regression risk. `--open-pr` needs a git URL and a GitHub write token. `codna review` posts one
+inline comment per finding with severity, category and a suggestion block, and an Approve when the
+diff is clean at medium and high. `codna secure` reads SARIF 2.1.0 from CodeQL, Semgrep, Snyk,
+Trivy or any other scanner.
 
-## Local Memory And Telys
+Other commands: `init`, `status`, `doctor`, `login`, `key`, `impact`, `memory export`, `report`.
+Full reference: [docs.codna.ai/reference/cli](https://docs.codna.ai/reference/cli).
 
-The base Codna install includes local code-memory support and the packaged
-Telys SDK/runtime/license:
+## MCP server
 
 ```bash
-pip install codna
+pip install "codna[mcp]"
+codna mcp install --client cursor     # or --client claude
 ```
 
-Users install Codna once. There is no separate user-facing Telys publishing,
-download, license, or install step. The optional `codna[memory]` extra only
-adds heavier retrieval/rerank/language packages for experiments; it is not
-required for the default Codna + Telys runtime path. Source distributions
-intentionally exclude bundled native runtime artifacts; source checkout and
-unsupported-platform development can point Codna at an explicit runtime with
-`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
+Tools: `codna_triage`, `codna_fix`, `codna_secure`, `codna_recall`, `codna_report_bug`.
+
+## Code memory
 
-## Security And Local Files
+Code memory and recall run on your machine with no login and no extra install. The optional
+`codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
-Codna is designed for local-first operation:
+## What leaves your machine
 
-- Secrets are never required in source control.
-- Local runtime state and logs stay on the user's machine.
-- Generated release artifacts are not included in source distributions.
-- Secrets, local runtime state, logs, `.env` files, key files, and bundled
-  native runtime artifacts are excluded from source distributions.
+- Repository mapping, triage, recall and `impact` run offline. No model is involved.
+- `fix` and `review` send one issue-specific evidence bundle to the provider you chose, under your
+  key. Not the repository.
+- Secret redaction is always on and cannot be turned off.
+- `privacy.egress: fail-closed` in `codna.yaml` refuses to run tests without network denial and
+  skips registry lookups during review.
+- Source distributions exclude runtime binaries, keys, `.env` files and logs.
 
 ## Links
 

{codna-0.2.76 → codna-0.2.78}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "codna"
-version = "0.2.76"
-description = "Local-first repo intelligence and agent fixing for Codna."
+version = "0.2.78"
+description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "Apache-2.0" }
@@ -74,10 +74,8 @@ dependencies = [
 # `pip install codna` doesn't need and that can clash with a user's existing
 # starlette/fastapi. `codna mcp` prints an install hint if this extra is missing.
 mcp = ["mcp>=1.2.0,<2"]
-# The hosted GitHub App webhook's shared job queue (CODNA_WEBHOOK_QUEUE_BACKEND=postgres|shadow,
-# cli/codna/webhook_pg_queue.py). Kept OUT of the base install: `pip install codna` never talks to
-# Postgres; only the webhook image (infra/docker/Dockerfile.webhook) installs this extra. The
-# default `sqlite` backend needs nothing beyond the stdlib.
+# Operator-only extra for the hosted GitHub App server. Kept OUT of the base install:
+# `pip install codna` never needs it.
 webhook = ["psycopg[binary]>=3.2", "psycopg_pool>=3.2"]
 # Local, in-process code memory & recall via Telys. Base `codna` includes the
 # public SDK, Codna's vendored local runtime package, the OEM license, and the
@@ -131,11 +129,11 @@ codna = [
   "_telys_runtime/lib*.so",
   "_telys_runtime/*.dll",
   "_telys_runtime/manifest.json",
-  # Codna's 100-year OEM Telys entitlement, baked in at release time (never committed) so
-  # base codna activates with zero user configuration — users never obtain their own license.
+  # Telys license, staged at release time (never committed): code memory works with no user setup.
   "_telys_runtime/oem-license.jwt",
-  # The self-contained agent-core sidecar (bun build --compile), staged per-platform at release
-  # time so `pip install codna` runs `codna fix` with NO Node/Bun/node_modules on the user's box.
+  # The bundled agent runtime, staged per platform at release time: `pip install codna` needs no
+  # Node, Bun or node_modules on the user's machine. Wheels ship for macOS (Apple silicon) and
+  # Linux (x86-64) only -- the platforms the bundled Mojo runtime supports -- so there is no
+  # Windows binary to stage.
   "_agent_core_runtime/codna-sidecar",
-  "_agent_core_runtime/codna-sidecar.exe",
 ]

{codna-0.2.76 → codna-0.2.78}/tests/test_packaging.py

@@ -87,8 +87,8 @@ def test_cli_readme_documents_base_codna_telys_install_contract():
 
     assert 'pip install "codna[memory]"' not in readme
     assert "pip install codna" in readme
-    assert "Users install Codna once" in readme
-    assert "no separate user-facing Telys" in readme
+    assert "no login and no extra install" in readme
+    assert "Code memory and recall run on your machine" in readme
 
 
 def test_core_install_uses_public_dependencies_only():
@@ -108,7 +108,10 @@ def test_core_install_uses_public_dependencies_only():
 def test_package_declares_local_readme_metadata():
     data = _data()["project"]
     assert data["readme"] == "README.md"
-    assert data["description"] == "Local-first repo intelligence and agent fixing for Codna."
+    assert data["description"] == (
+        "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull "
+        "requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
+    )
     assert data["license"] == {"text": "Apache-2.0"}
     assert data["authors"] == [{"name": "Thyn"}]
     assert data["maintainers"] == [{"name": "Thyn"}]
@@ -123,10 +126,10 @@ def test_package_declares_local_readme_metadata():
     assert data["urls"]["Security"] == "https://codna.ai/security"
     readme = (ROOT / "cli" / "README.md").read_text(encoding="utf-8")
     assert "pip install codna" in readme
-    assert "codna doctor --start-stack" in readme
-    assert "No local Postgres is required" in readme
+    assert "`doctor`" in readme
+    assert "Nothing else to install: no Node, Bun, Docker or server" in readme
     assert "codna mcp" in readme
-    assert "Secrets, local runtime state, logs" in readme
+    assert "Source distributions exclude runtime binaries, keys" in readme
 
 
 def test_package_version_matches_runtime_version():
@@ -200,7 +203,6 @@ def test_telys_package_data_is_manifest_scoped():
         "_telys_runtime/oem-license.jwt",
         # The self-contained agent-core sidecar (bun build --compile), staged per-platform at release.
         "_agent_core_runtime/codna-sidecar",
-        "_agent_core_runtime/codna-sidecar.exe",
     ]
     assert "_telys_runtime/*" not in package_data
     assert "_agent_core_runtime/*" not in package_data
@@ -248,7 +250,11 @@ def test_github_action_preserves_codna_failure_status_without_forcing_remote_eng
     assert 'exit "$status"' in action
     # fix mode parses the PR URL from the --json result's top-level field (with a regex fallback),
     # not by scraping human output; runtime logs are kept on stderr so stdout is clean JSON.
-    assert 'echo "pull_request_url=$url" >> "$GITHUB_OUTPUT"' in action
+    # ...and the output is written as exactly one line: an embedded newline in the value can never
+    # become a second GITHUB_OUTPUT key.
+    assert 'url="$(printf \'%s\' "$url" | tr -d \'\\r\\n\')"' in action
+    assert 'printf \'pull_request_url=%s\\n\' "$url" >> "$GITHUB_OUTPUT"' in action
+    assert 'echo "pull_request_url=$url"' not in action
     assert '2>/tmp/codna.err' in action
 
 

codna-0.2.76/README.md

@@ -1,85 +0,0 @@
-# Codna CLI
-
-Codna is a local-first code intelligence and fixing CLI. It maps a repository,
-builds focused evidence for the agent, applies patches through the local Codna
-runtime, and reports verification evidence without requiring users to manage a
-separate local database or engine stack.
-
-## Install
-
-```bash
-pip install codna
-```
-
-Codna supports Python 3.10 and newer on macOS and Linux.
-
-## Common Commands
-
-```bash
-codna doctor
-codna doctor --start-stack
-codna triage .
-codna fix . --issue "describe the failing test or production bug"
-codna mcp
-```
-
-`codna doctor` is read-only by default. `codna doctor --start-stack` starts the
-owned local runtime when you explicitly ask for it. Normal fix and benchmark
-paths use the same runtime contract.
-
-## What Codna Runs Locally
-
-The base install includes the local Arrow/Parquet artifact dependency required
-for repository-intelligence step history. Clean installs include a packaged
-local repository backend for snapshot, triage, sidecar-backed fix planning,
-deterministic patch simulation, and explicit local-branch apply.
-
-Codna's normal local product path uses the local Algenta SDK/core in process for
-repository intelligence. No local Postgres is required. Local runtime state is
-kept under the user's Codna runtime directory, and the agent sidecar is started
-only when needed.
-
-## MCP
-
-Codna can run as a local MCP server for editors and agents that support MCP:
-
-```bash
-codna mcp
-```
-
-Use this when Cursor, Claude, or another MCP-compatible client needs Codna's
-repo understanding as a local tool.
-
-## Local Memory And Telys
-
-The base Codna install includes local code-memory support and the packaged
-Telys SDK/runtime/license:
-
-```bash
-pip install codna
-```
-
-Users install Codna once. There is no separate user-facing Telys publishing,
-download, license, or install step. The optional `codna[memory]` extra only
-adds heavier retrieval/rerank/language packages for experiments; it is not
-required for the default Codna + Telys runtime path. Source distributions
-intentionally exclude bundled native runtime artifacts; source checkout and
-unsupported-platform development can point Codna at an explicit runtime with
-`TELYS_KERNEL` or `CODNA_TELYS_INSTALL_ROOT`.
-
-## Security And Local Files
-
-Codna is designed for local-first operation:
-
-- Secrets are never required in source control.
-- Local runtime state and logs stay on the user's machine.
-- Generated release artifacts are not included in source distributions.
-- Secrets, local runtime state, logs, `.env` files, key files, and bundled
-  native runtime artifacts are excluded from source distributions.
-
-## Links
-
-- Homepage: https://codna.ai
-- Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
-- Security: https://codna.ai/security