codna 0.2.82__tar.gz → 0.2.84__tar.gz

{codna-0.2.82 → codna-0.2.84}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.82
+Version: 0.2.84
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -71,6 +71,8 @@ Requires-Dist: tree-sitter-ruby; extra == "memory-languages"
 
 # Codna
 
+<!-- mcp-name: io.github.thyn-ai/codna -->
+
 **Understand. Fix. Evolve.**
 
 Agents read your code. Codna understands it.
@@ -119,16 +121,39 @@ Full reference: [docs.codna.ai/reference/cli](https://docs.codna.ai/reference/cl
 
 ## MCP server
 
+Run Codna as a [Model Context Protocol](https://modelcontextprotocol.io) server over stdio —
+the same engine the CLI uses, inside Cursor, Claude Desktop, or your own agent:
+
 ```bash
-pip install "codna[mcp]"
-codna mcp install --client cursor     # or --client claude
+pipx install "codna[mcp]"       # or: pip install "codna[mcp]"
+codna mcp                       # serve over stdio
+codna mcp install --client cursor     # optional: write the client config for you (or --client claude)
 ```
 
-Tools: `codna_triage`, `codna_fix`, `codna_secure`, `codna_recall`, `codna_report_bug`.
+Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
+crashes the server:
+
+| Tool | What it does | Key needed |
+| --- | --- | --- |
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
+community login (`codna login` — one-time device authorization that installs the on-device
+runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
+`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
+provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
+returns a pre-filled issue URL. Full reference:
+[docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
-Code memory and recall run on your machine with no login and no extra install. The optional
+Code memory and recall run on your machine after a one-time free `codna login` (device
+authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
 ## What leaves your machine

{codna-0.2.82 → codna-0.2.84}/README.md

@@ -1,5 +1,7 @@
 # Codna
 
+<!-- mcp-name: io.github.thyn-ai/codna -->
+
 **Understand. Fix. Evolve.**
 
 Agents read your code. Codna understands it.
@@ -48,16 +50,39 @@ Full reference: [docs.codna.ai/reference/cli](https://docs.codna.ai/reference/cl
 
 ## MCP server
 
+Run Codna as a [Model Context Protocol](https://modelcontextprotocol.io) server over stdio —
+the same engine the CLI uses, inside Cursor, Claude Desktop, or your own agent:
+
 ```bash
-pip install "codna[mcp]"
-codna mcp install --client cursor     # or --client claude
+pipx install "codna[mcp]"       # or: pip install "codna[mcp]"
+codna mcp                       # serve over stdio
+codna mcp install --client cursor     # optional: write the client config for you (or --client claude)
 ```
 
-Tools: `codna_triage`, `codna_fix`, `codna_secure`, `codna_recall`, `codna_report_bug`.
+Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
+crashes the server:
+
+| Tool | What it does | Key needed |
+| --- | --- | --- |
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
+community login (`codna login` — one-time device authorization that installs the on-device
+runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
+`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
+provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
+returns a pre-filled issue URL. Full reference:
+[docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
-Code memory and recall run on your machine with no login and no extra install. The optional
+Code memory and recall run on your machine after a one-time free `codna login` (device
+authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
 ## What leaves your machine

{codna-0.2.82 → codna-0.2.84}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.82"
+__version__ = "0.2.84"

{codna-0.2.82 → codna-0.2.84}/codna/mcp_server.py

@@ -289,7 +289,9 @@ def _build_server():
         Use when you need the code behind a concept ("where is SARIF provenance validated?")
         rather than a whole-repo map (codna_triage) — and when you want it offline. The index
         is built on first use (an empty index auto-indexes the repo, once) and is stored
-        outside the git checkout.
+        outside the git checkout. On a fresh machine, first use requires the one-time free
+        `codna login` device authorization (it provisions the on-device memory runtime);
+        after that, recall is fully offline with no key and no network calls.
 
         repo: a local path or git URL (default: current directory, or the server default set
           by `codna mcp start --repo`).

{codna-0.2.82 → codna-0.2.84}/codna/packaged_agent_runner.py

@@ -583,6 +583,30 @@ def _terminal_states_meaning_success(task_kind: str) -> set[str]:
     return {"succeeded"}
 
 
+_MISSING_PROVIDER_KEY_RE = re.compile(r"no API key in env for '([^']+)' \(tried: ([^)]+)\)")
+
+
+def _run_failed_message(error: object, *, task_kind: str) -> str:
+    """Message for `agent_core_run_failed` — actionable when the cause is known.
+
+    The common fresh-machine failure is a missing BYOK provider key: agent-core's provider
+    adapter aborts the run and the final frame carries
+    "no API key in env for '<provider>' (tried: <ENV_NAMES>)". Name the fix instead of hiding
+    it behind the generic line. The code and details payload are unchanged either way, and any
+    other failure keeps the original message verbatim.
+    """
+    if isinstance(error, str):
+        missing_key = _MISSING_PROVIDER_KEY_RE.search(error)
+        if missing_key:
+            provider, env_names = missing_key.group(1), missing_key.group(2)
+            return (
+                f"codna {task_kind} needs a provider key — set {env_names} (or store one with "
+                f"`codna key set {provider}`, or configure another provider). The local engine "
+                "itself needs no login."
+            )
+    return "Local agent-core did not complete the packaged fix run successfully."
+
+
 def _parse_final_frame(body: str, *, sidecar_url: str, task_kind: str = "fix") -> dict[str, Any]:
     final: dict[str, Any] | None = None
     for line in body.splitlines():
@@ -610,7 +634,7 @@ def _parse_final_frame(body: str, *, sidecar_url: str, task_kind: str = "fix") -
     if terminal_state not in accepted and status not in {"succeeded", "success", "completed"}:
         raise PackagedRepositoryAdvancedError(
             "agent_core_run_failed",
-            "Local agent-core did not complete the packaged fix run successfully.",
+            _run_failed_message(final.get("error"), task_kind=task_kind),
             {
                 "sidecar_url": sidecar_url,
                 "status": status,

{codna-0.2.82 → codna-0.2.84}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.82
+Version: 0.2.84
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -71,6 +71,8 @@ Requires-Dist: tree-sitter-ruby; extra == "memory-languages"
 
 # Codna
 
+<!-- mcp-name: io.github.thyn-ai/codna -->
+
 **Understand. Fix. Evolve.**
 
 Agents read your code. Codna understands it.
@@ -119,16 +121,39 @@ Full reference: [docs.codna.ai/reference/cli](https://docs.codna.ai/reference/cl
 
 ## MCP server
 
+Run Codna as a [Model Context Protocol](https://modelcontextprotocol.io) server over stdio —
+the same engine the CLI uses, inside Cursor, Claude Desktop, or your own agent:
+
 ```bash
-pip install "codna[mcp]"
-codna mcp install --client cursor     # or --client claude
+pipx install "codna[mcp]"       # or: pip install "codna[mcp]"
+codna mcp                       # serve over stdio
+codna mcp install --client cursor     # optional: write the client config for you (or --client claude)
 ```
 
-Tools: `codna_triage`, `codna_fix`, `codna_secure`, `codna_recall`, `codna_report_bug`.
+Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
+crashes the server:
+
+| Tool | What it does | Key needed |
+| --- | --- | --- |
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
+community login (`codna login` — one-time device authorization that installs the on-device
+runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
+`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
+provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
+returns a pre-filled issue URL. Full reference:
+[docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
-Code memory and recall run on your machine with no login and no extra install. The optional
+Code memory and recall run on your machine after a one-time free `codna login` (device
+authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
 ## What leaves your machine

{codna-0.2.82 → codna-0.2.84}/codna.egg-info/SOURCES.txt

@@ -182,6 +182,7 @@ tests/test_packaged_confidence.py
 tests/test_packaged_git_clone.py
 tests/test_packaged_guidance.py
 tests/test_packaged_remote_pr.py
+tests/test_packaged_runner_provider_key_message.py
 tests/test_packaged_runner_review_terminal_state.py
 tests/test_packaged_test_fix_scope.py
 tests/test_packaging.py

{codna-0.2.82 → codna-0.2.84}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.82"
+version = "0.2.84"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"

codna-0.2.84/tests/test_packaged_runner_provider_key_message.py

@@ -0,0 +1,59 @@
+"""A run that failed for a missing provider key must say so — and how to fix it.
+
+agent-core's provider adapter aborts the run when no BYOK key is reachable; the final frame
+carries "no API key in env for '<provider>' (tried: <ENV_NAMES>)" as its error. The MCP tool
+surface renders only the exception message (`codna_fix error: <message>`), so the message
+itself must name the fix. Verified end-to-end in a scrubbed environment (fresh HOME, keychain
+disabled, no keys): the run terminates `runtime_invalid` with exactly that engine error while
+the MCP surface showed only the generic line.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from codna.packaged_agent_runner import _parse_final_frame  # noqa: SLF001
+from codna.packaged_repository_advanced import PackagedRepositoryAdvancedError
+
+_MISSING_KEY_FRAME = json.dumps(
+    {
+        "type": "final",
+        "status": "failed",
+        "terminal_state": "runtime_invalid",
+        "error": "Error: no API key in env for 'anthropic' (tried: ANTHROPIC_API_KEY)",
+    }
+)
+
+
+def test_a_missing_provider_key_names_the_key_and_the_fix():
+    with pytest.raises(PackagedRepositoryAdvancedError) as excinfo:
+        _parse_final_frame(_MISSING_KEY_FRAME, sidecar_url="http://127.0.0.1:1", task_kind="fix")
+    assert excinfo.value.code == "agent_core_run_failed"
+    assert str(excinfo.value) == (
+        "codna fix needs a provider key — set ANTHROPIC_API_KEY (or store one with "
+        "`codna key set anthropic`, or configure another provider). The local engine "
+        "itself needs no login."
+    )
+    # The structured shape is preserved: same code, and the raw engine frame stays in details.
+    assert excinfo.value.details["terminal_state"] == "runtime_invalid"
+    assert (
+        excinfo.value.details["error"]
+        == "Error: no API key in env for 'anthropic' (tried: ANTHROPIC_API_KEY)"
+    )
+
+
+def test_other_failures_keep_the_generic_message():
+    frame = json.dumps(
+        {"type": "final", "status": "failed", "terminal_state": "failed", "error": "boom"}
+    )
+    with pytest.raises(PackagedRepositoryAdvancedError) as excinfo:
+        _parse_final_frame(frame, sidecar_url="http://127.0.0.1:1", task_kind="fix")
+    assert str(excinfo.value) == "Local agent-core did not complete the packaged fix run successfully."
+
+
+def test_the_message_names_the_task_kind():
+    with pytest.raises(PackagedRepositoryAdvancedError) as excinfo:
+        _parse_final_frame(_MISSING_KEY_FRAME, sidecar_url="http://127.0.0.1:1", task_kind="review")
+    assert str(excinfo.value).startswith("codna review needs a provider key")

{codna-0.2.82 → codna-0.2.84}/tests/test_packaging.py

@@ -83,7 +83,7 @@ def test_cli_readme_documents_base_codna_telys_install_contract():
 
     assert 'pip install "codna[memory]"' not in readme
     assert "pip install codna" in readme
-    assert "no login and no extra install" in readme
+    assert "one-time free `codna login`" in readme
     assert "Code memory and recall run on your machine" in readme