codna 0.2.84__tar.gz → 0.2.85__tar.gz

{codna-0.2.84 → codna-0.2.85}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.84
+Version: 0.2.85
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -133,26 +133,27 @@ codna mcp install --client cursor     # optional: write the client config for yo
 Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
 crashes the server:
 
-| Tool | What it does | Key needed |
+| Tool | What it does | Needs |
 | --- | --- | --- |
-| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
-| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
-| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
-| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
-
-Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
-community login (`codna login` — one-time device authorization that installs the on-device
-runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
-`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
-provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
-returns a pre-filled issue URL. Full reference:
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (+ on-device runtime from the login-gated install) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of the five tools
+requires the one-time free community login (`codna login` — device authorization, free community
+license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
+`ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
+URL; `codna_recall` additionally uses the on-device memory runtime from the login-gated install.
+Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+authorization); the signed on-device runtime arrives via the login-gated install. From then on,
+recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 

{codna-0.2.84 → codna-0.2.85}/README.md

@@ -62,26 +62,27 @@ codna mcp install --client cursor     # optional: write the client config for yo
 Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
 crashes the server:
 
-| Tool | What it does | Key needed |
+| Tool | What it does | Needs |
 | --- | --- | --- |
-| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
-| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
-| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
-| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
-
-Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
-community login (`codna login` — one-time device authorization that installs the on-device
-runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
-`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
-provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
-returns a pre-filled issue URL. Full reference:
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (+ on-device runtime from the login-gated install) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of the five tools
+requires the one-time free community login (`codna login` — device authorization, free community
+license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
+`ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
+URL; `codna_recall` additionally uses the on-device memory runtime from the login-gated install.
+Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+authorization); the signed on-device runtime arrives via the login-gated install. From then on,
+recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 

{codna-0.2.84 → codna-0.2.85}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.84"
+__version__ = "0.2.85"

{codna-0.2.84 → codna-0.2.85}/codna/mcp_server.py

@@ -14,7 +14,28 @@ import json
 import os
 from pathlib import Path
 
-from .cli import _client, _dump, _register
+from .cli import _api_key, _client, _dump, _register, _runtime_keys
+
+LOGIN_REQUIRED_MESSAGE = (
+    "requires the one-time free `codna login` device authorization (free community license); "
+    "run `codna login` once — fully offline thereafter"
+)
+
+
+def _login_required_error(tool: str) -> str | None:
+    """Uniform execution gate: every MCP tool call requires the free community login.
+
+    All codna tools execute under the same licensing model (algenta house pattern — sqai returns
+    `login_required`, algenta-mcp an auth error; introspection stays credential-free, execution
+    needs the login). The `codna login` artifact is the codna account key, resolved through the
+    same key layer the CLI/status paths use: env first, then the OS keychain via the non-secret
+    name index (a clean machine is never prompted), never the network — offline after the one
+    login. The key's presence proves the login state; it is not validated against the control
+    plane (offline by design). Returns the structured error line, or None when authorized.
+    """
+    if _api_key(_runtime_keys(include_keychain=True)):
+        return None
+    return f"{tool} error: {LOGIN_REQUIRED_MESSAGE}"
 
 
 def _default_repo(repo: str) -> str:
@@ -44,6 +65,9 @@ def _mcp_memory_db_path(repo: str) -> str:
 def recall_json(repo: str = ".", query: str = "", service: str = "", language: str = "",
                 final_k: int = 8) -> str:
     """Return local Telys memory recall as JSON without crashing the MCP server."""
+    gate = _login_required_error("codna_recall")
+    if gate:
+        return gate
     if not query:
         return "codna_recall error: query is required"
     repo = _default_repo(repo)
@@ -69,6 +93,9 @@ def report_bug_json(
     """File a report to thyn-ai/feedback and return the result as JSON, without crashing the MCP
     server. Same submission path `codna report` (the CLI) uses, so an agent and a human land in
     the same place with the same fields."""
+    gate = _login_required_error("codna_report_bug")
+    if gate:
+        return gate
     if not title:
         return "codna_report_bug error: title is required"
     try:
@@ -90,6 +117,9 @@ def secure_json(repo: str = ".", sarif_path: str = "", ref: str = "") -> str:
 
     MCP secure is read-only and local by default: it must not start or depend on the agent sidecar.
     """
+    gate = _login_required_error("codna_secure")
+    if gate:
+        return gate
     del ref  # local reference classification is SARIF-only; repo is included for caller traceability.
     repo = _default_repo(repo)
     try:
@@ -134,6 +164,9 @@ def fix_json(
     runs it in a worker thread so local repository-intelligence calls can safely use their own
     event loop internally.
     """
+    gate = _login_required_error("codna_fix")
+    if gate:
+        return gate
     repo = _default_repo(repo)
     try:
         c = _client(include_keychain=True)
@@ -212,10 +245,16 @@ def _build_server():
     def codna_triage(repo: str = ".", issue: str = "") -> str:
         """Understand a repository and locate the code relevant to an issue.
 
+        Requires the one-time free `codna login` device authorization (free community
+        license); fully offline thereafter.
+
         repo: a local path or a git URL (default: current directory).
         issue: optional description of what you're looking for.
         Returns suspect files + the context-reduction the engine achieved (0 LLM tokens).
         """
+        gate = _login_required_error("codna_triage")
+        if gate:
+            return gate
         repo = _default_repo(repo)
         try:
             c = _client()
@@ -246,6 +285,10 @@ def _build_server():
     ) -> str:
         """Find and fix a bug. Runs the full Codna agent + engine + risk simulation.
 
+        Requires the one-time free `codna login` device authorization (free community
+        license) plus a provider key (BYOK — e.g. ANTHROPIC_API_KEY or `codna key set
+        anthropic`); fully offline thereafter.
+
         repo: a local path or a git URL. issue: what's broken (e.g. the failing test).
         model: optional provider-qualified model such as openai/gpt-5.
         open_pr: when false (default) this is READ-ONLY — returns the plan (root cause, confidence,
@@ -268,6 +311,9 @@ def _build_server():
         Semgrep / Snyk / Trivy), classifies each finding (exploitable / production-reachable /
         unreachable / unknown) via the engine, and reports which are autofix-eligible.
         Read-only and 0 LLM tokens. `sarif_path` is required.
+
+        Requires the one-time free `codna login` device authorization (free community
+        license); fully offline thereafter.
         """
         return secure_json(repo, sarif_path, ref)
 
@@ -290,8 +336,9 @@ def _build_server():
         rather than a whole-repo map (codna_triage) — and when you want it offline. The index
         is built on first use (an empty index auto-indexes the repo, once) and is stored
         outside the git checkout. On a fresh machine, first use requires the one-time free
-        `codna login` device authorization (it provisions the on-device memory runtime);
-        after that, recall is fully offline with no key and no network calls.
+        `codna login` device authorization (free community license); the on-device memory
+        runtime arrives via the login-gated runtime install. After that, recall is fully
+        offline with no key and no network calls.
 
         repo: a local path or git URL (default: current directory, or the server default set
           by `codna mcp start --repo`).
@@ -322,6 +369,9 @@ def _build_server():
         """File a report to thyn-ai/feedback — the public front door for algenta, codna, telys,
         and sqai. Files the same shape of issue `codna report` (the CLI) does.
 
+        Requires the one-time free `codna login` device authorization (free community
+        license); auto-filing additionally needs a GitHub token (else a pre-filled URL).
+
         title: a short summary, e.g. "codna fix hangs on a monorepo".
         body: what happened, or what you want — as much detail as you have.
         product: one of algenta, codna, telys, sqai, accounts, docs (default: codna).

{codna-0.2.84 → codna-0.2.85}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.84
+Version: 0.2.85
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -133,26 +133,27 @@ codna mcp install --client cursor     # optional: write the client config for yo
 Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
 crashes the server:
 
-| Tool | What it does | Key needed |
+| Tool | What it does | Needs |
 | --- | --- | --- |
-| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
-| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
-| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
-| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
-
-Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
-community login (`codna login` — one-time device authorization that installs the on-device
-runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
-`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
-provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
-returns a pre-filled issue URL. Full reference:
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (+ on-device runtime from the login-gated install) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of the five tools
+requires the one-time free community login (`codna login` — device authorization, free community
+license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
+`ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
+URL; `codna_recall` additionally uses the on-device memory runtime from the login-gated install.
+Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+authorization); the signed on-device runtime arrives via the login-gated install. From then on,
+recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 

{codna-0.2.84 → codna-0.2.85}/codna.egg-info/SOURCES.txt

@@ -166,6 +166,7 @@ tests/test_manifest.py
 tests/test_mcp_default_repo.py
 tests/test_mcp_enrich.py
 tests/test_mcp_install.py
+tests/test_mcp_login_gate.py
 tests/test_mcp_recall.py
 tests/test_mcp_report_bug.py
 tests/test_mcp_secure.py

{codna-0.2.84 → codna-0.2.85}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.84"
+version = "0.2.85"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"

{codna-0.2.84 → codna-0.2.85}/tests/test_mcp_enrich.py

@@ -12,6 +12,12 @@ pytest.importorskip("mcp.server.fastmcp")
 from codna.mcp_server import _build_server  # noqa: E402
 
 
+@pytest.fixture(autouse=True)
+def _authorized_device(monkeypatch):
+    """The uniform execution gate requires the free `codna login`; run these tests authorized."""
+    monkeypatch.setenv("CODNA_API_KEY", "test-device-login")
+
+
 def test_readonly_annotations():
     s = _build_server()
     tools = {t.name: t for t in asyncio.run(s.list_tools())}

codna-0.2.85/tests/test_mcp_login_gate.py

@@ -0,0 +1,164 @@
+"""Uniform execution gate: every MCP tool call requires the free community login.
+
+Owner rule: all codna MCP tools execute under one licensing model — introspection
+(initialize/tools/list) stays credential-free, but no tool executes without the one-time free
+`codna login` device authorization. The gate reuses codna's existing key layer (env → OS
+keychain via the non-secret name index → dev keys.txt); it never touches the network, matching
+the offline-after-first-login model and sqai's `login_required` / algenta-mcp's auth gate.
+
+CI fixture: the scrubbed state clears CODNA_API_KEY/ALGENTA_API_KEY/DE_API_KEY, disables the
+keychain (codna's own CODNA_DISABLE_KEYCHAIN kill-switch) and removes the dev keys.txt path;
+the authorized state is a plain CODNA_API_KEY env var — the same artifact `codna login` stores.
+No network login is ever performed in tests.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+
+import pytest
+
+from codna import cli, mcp_server
+
+LOGIN_SUFFIX = mcp_server.LOGIN_REQUIRED_MESSAGE
+
+
+def _mcp_available() -> bool:
+    try:
+        import mcp.server.fastmcp  # noqa: F401
+        return True
+    except ImportError:
+        return False
+
+
+mcp_required = pytest.mark.skipif(not _mcp_available(), reason="mcp extra not installed")
+
+
+@pytest.fixture
+def scrubbed_device(monkeypatch):
+    """A zero-credential device: no codna/algenta key env, no keychain, no dev keys.txt."""
+    for name in ("CODNA_API_KEY", "ALGENTA_API_KEY", "DE_API_KEY"):
+        monkeypatch.delenv(name, raising=False)
+    monkeypatch.setenv("CODNA_DISABLE_KEYCHAIN", "1")
+    monkeypatch.setattr(cli, "_keys_file_path", lambda: None)
+
+
+@pytest.fixture
+def authorized_device(scrubbed_device, monkeypatch):
+    """The post-`codna login` state: the account key present in the environment."""
+    monkeypatch.setenv("CODNA_API_KEY", "ci-device-login-fixture")
+
+
+# ── tool bodies (no mcp dependency — these run in the minimal-dep CI job too) ─────────────────────
+def test_module_level_tool_bodies_all_gate(scrubbed_device):
+    """fix/secure/recall/report_bug return the structured error — never raise, never exit."""
+    assert mcp_server.fix_json(repo=".", issue="x") == f"codna_fix error: {LOGIN_SUFFIX}"
+    assert mcp_server.secure_json(repo=".", sarif_path="x.sarif") == f"codna_secure error: {LOGIN_SUFFIX}"
+    assert mcp_server.recall_json(repo=".", query="x") == f"codna_recall error: {LOGIN_SUFFIX}"
+    assert mcp_server.report_bug_json(title="x") == f"codna_report_bug error: {LOGIN_SUFFIX}"
+
+
+def test_gate_never_raises_and_needs_no_network(scrubbed_device):
+    """The check is a local key-layer read: no engine, no sidecar, no keychain prompt."""
+    assert mcp_server._login_required_error("codna_triage") == (  # noqa: SLF001
+        f"codna_triage error: {LOGIN_SUFFIX}"
+    )
+
+
+def test_codna_api_key_opens_the_gate(authorized_device):
+    assert mcp_server._login_required_error("codna_triage") is None  # noqa: SLF001
+
+
+def test_secure_executes_normally_when_authorized(authorized_device, tmp_path):
+    sarif = tmp_path / "result.sarif"
+    sarif.write_text(json.dumps({
+        "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [{
+            "tool": {"driver": {"name": "CodeQL", "version": "2.15.0",
+                                "rules": [{"id": "js/eval"}]}},
+            "versionControlProvenance": [{"revisionId": "a" * 40,
+                                          "repositoryUri": "https://example.test/o/r"}],
+            "results": [{
+                "ruleId": "js/eval",
+                "message": {"text": "eval"},
+                "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/app.js"},
+                                                    "region": {"startLine": 1}}}],
+            }],
+        }],
+    }), encoding="utf-8")
+    payload = json.loads(mcp_server.secure_json(str(tmp_path), str(sarif)))
+    assert payload["counts"] == {"production-reachable": 1}
+
+
+def test_recall_gets_past_the_gate_to_its_own_runtime_check(authorized_device, tmp_path):
+    """With the login fixture, recall runs (or fails on its own runtime requirement) — never the gate."""
+    out = mcp_server.recall_json(repo=str(tmp_path), query="anything")
+    assert out != f"codna_recall error: {LOGIN_SUFFIX}"
+
+
+def test_report_bug_gets_past_the_gate_when_authorized(authorized_device, monkeypatch):
+    from codna import report_cli
+
+    monkeypatch.setattr(report_cli, "submit_report", lambda **_kw: report_cli.ReportResult(
+        ok=True, submitted=False, url="https://github.com/x/new", local_path=None))
+    payload = json.loads(mcp_server.report_bug_json("a title"))
+    assert payload["submitted"] is False
+
+
+# ── full server path (needs the mcp extra): introspection free, all 5 executions gated ────────────
+def _result_text(content) -> str:
+    return content[0].text if isinstance(content, (list, tuple)) else content
+
+
+@mcp_required
+def test_introspection_stays_credential_free(scrubbed_device):
+    server = mcp_server._build_server()  # noqa: SLF001
+    tools = asyncio.run(server.list_tools())
+    assert sorted(t.name for t in tools) == [
+        "codna_fix", "codna_recall", "codna_report_bug", "codna_secure", "codna_triage",
+    ]
+
+
+@mcp_required
+def test_all_five_tools_gate_end_to_end(scrubbed_device):
+    server = mcp_server._build_server()  # noqa: SLF001
+    calls = {
+        "codna_triage": {"repo": ".", "issue": "x"},
+        "codna_fix": {"repo": ".", "issue": "x"},
+        "codna_secure": {"repo": ".", "sarif_path": "x.sarif"},
+        "codna_recall": {"repo": ".", "query": "x"},
+        "codna_report_bug": {"title": "x"},
+    }
+    for name, arguments in calls.items():
+        content, _structured = asyncio.run(server.call_tool(name, arguments))
+        assert _result_text(content) == f"{name} error: {LOGIN_SUFFIX}", name
+
+
+@mcp_required
+def test_triage_executes_when_authorized(authorized_device, monkeypatch, tmp_path):
+    class FakeEngine:
+        def triage_repository(self, rid, payload):
+            return {
+                "suspect_files": ["a.py"],
+                "reduction_ratio": 10.0,
+                "raw_repo_token_estimate": 100,
+                "evidence_bundle_token_count": 10,
+            }
+
+    monkeypatch.setattr(mcp_server, "_client", lambda: FakeEngine())
+    monkeypatch.setattr(mcp_server, "_register", lambda c, repo, ref: ("rid", {"snapshot_id": "s"}))
+    monkeypatch.setattr(mcp_server, "_dump", lambda payload: payload)
+    server = mcp_server._build_server()  # noqa: SLF001
+    content, _structured = asyncio.run(server.call_tool("codna_triage", {"repo": str(tmp_path)}))
+    payload = json.loads(_result_text(content))
+    assert payload["suspect_files"] == ["a.py"]
+
+
+@mcp_required
+def test_tool_descriptions_disclose_the_login_requirement(scrubbed_device):
+    server = mcp_server._build_server()  # noqa: SLF001
+    tools = {t.name: t for t in asyncio.run(server.list_tools())}
+    for name in ("codna_triage", "codna_secure", "codna_recall", "codna_fix", "codna_report_bug"):
+        assert "codna login" in tools[name].description, name

{codna-0.2.84 → codna-0.2.85}/tests/test_mcp_recall.py

@@ -9,6 +9,12 @@ import pytest
 from codna.mcp_server import recall_json   # import does NOT pull in `mcp` or `telys`
 
 
+@pytest.fixture(autouse=True)
+def _authorized_device(monkeypatch):
+    """The uniform execution gate requires the free `codna login`; run these tests authorized."""
+    monkeypatch.setenv("CODNA_API_KEY", "test-device-login")
+
+
 # ── offline: the guard + friendly failure (no mcp, no telys needed) ───────────────────────────────
 def test_recall_requires_query():
     assert recall_json(query="") == "codna_recall error: query is required"

{codna-0.2.84 → codna-0.2.85}/tests/test_mcp_report_bug.py

@@ -8,6 +8,12 @@ import pytest
 from codna import mcp_server, report_cli
 
 
+@pytest.fixture(autouse=True)
+def _authorized_device(monkeypatch):
+    """The uniform execution gate requires the free `codna login`; run these tests authorized."""
+    monkeypatch.setenv("CODNA_API_KEY", "test-device-login")
+
+
 def _mcp_available() -> bool:
     try:
         import mcp.server.fastmcp  # noqa: F401

{codna-0.2.84 → codna-0.2.85}/tests/test_mcp_secure.py

@@ -2,9 +2,17 @@ from __future__ import annotations
 
 import json
 
+import pytest
+
 from codna import cli, mcp_server
 
 
+@pytest.fixture(autouse=True)
+def _authorized_device(monkeypatch):
+    """The uniform execution gate requires the free `codna login`; run these tests authorized."""
+    monkeypatch.setenv("CODNA_API_KEY", "test-device-login")
+
+
 def _write_sarif(path):
     doc = {
         "$schema": "https://json.schemastore.org/sarif-2.1.0.json",

{codna-0.2.84 → codna-0.2.85}/tests/test_packaging.py

@@ -83,7 +83,7 @@ def test_cli_readme_documents_base_codna_telys_install_contract():
 
     assert 'pip install "codna[memory]"' not in readme
     assert "pip install codna" in readme
-    assert "one-time free `codna login`" in readme
+    assert "requires the one-time free community login" in readme
     assert "Code memory and recall run on your machine" in readme