codna 0.2.84__tar.gz → 0.2.86__tar.gz

{codna-0.2.84 → codna-0.2.86}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.84
+Version: 0.2.86
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -133,26 +133,27 @@ codna mcp install --client cursor     # optional: write the client config for yo
 Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
 crashes the server:
 
-| Tool | What it does | Key needed |
+| Tool | What it does | Needs |
 | --- | --- | --- |
-| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
-| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
-| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
-| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
-
-Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
-community login (`codna login` — one-time device authorization that installs the on-device
-runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
-`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
-provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
-returns a pre-filled issue URL. Full reference:
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (which also installs the on-device runtime) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of the five tools
+requires the one-time free community login (`codna login` — device authorization, free community
+license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
+`ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
+URL; `codna_recall` additionally uses the on-device memory runtime that the same `codna login`
+installs.
+Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+authorization), which also installs the signed on-device runtime. From then on, recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
@@ -170,5 +171,5 @@ offline: no key, no network calls. The optional
 
 - Homepage: https://codna.ai
 - Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
+- Source (public mirror): https://github.com/thyn-ai/codna-cli
 - Security: https://codna.ai/security

{codna-0.2.84 → codna-0.2.86}/README.md

@@ -62,26 +62,27 @@ codna mcp install --client cursor     # optional: write the client config for yo
 Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
 crashes the server:
 
-| Tool | What it does | Key needed |
+| Tool | What it does | Needs |
 | --- | --- | --- |
-| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
-| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
-| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
-| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
-
-Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
-community login (`codna login` — one-time device authorization that installs the on-device
-runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
-`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
-provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
-returns a pre-filled issue URL. Full reference:
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (which also installs the on-device runtime) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of the five tools
+requires the one-time free community login (`codna login` — device authorization, free community
+license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
+`ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
+URL; `codna_recall` additionally uses the on-device memory runtime that the same `codna login`
+installs.
+Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+authorization), which also installs the signed on-device runtime. From then on, recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
@@ -99,5 +100,5 @@ offline: no key, no network calls. The optional
 
 - Homepage: https://codna.ai
 - Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
+- Source (public mirror): https://github.com/thyn-ai/codna-cli
 - Security: https://codna.ai/security

{codna-0.2.84 → codna-0.2.86}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.84"
+__version__ = "0.2.86"

{codna-0.2.84 → codna-0.2.86}/codna/cli.py

@@ -720,44 +720,14 @@ def cmd_status(args) -> int:
 
 
 def cmd_login(args) -> int:
-    """Sign this machine into a Codna account (device-code login) — consistent with telys/algenta.
+    """One-time device authorization that also installs the on-device runtime — one command.
 
-    Device-code auth via the accounts portal → self-serve free-tier onboard → the first Codna API key
-    (stored in the OS keychain as CODNA_API_KEY). Then ensures a local LLM provider key so `codna fix`
-    runs on-device. Codna's Telys memory runtime is bundled in the wheel (+ embedded OEM license), so no
-    separate per-device provisioning is needed.
+    The body lives in ``codna.login.run`` (cli.py is at the module-size ceiling). Exit codes:
+    0 = signed in AND provisioned (or already provisioned); 1 = sign-in failed; 2 = signed in but
+    runtime provisioning incomplete (needs network on first run — re-run).
     """
-    from .login import LoginError, login as codna_login
-
-    try:
-        # Call for effect: stores the account key in the keychain, raises LoginError on failure. The
-        # return (which touches the API-key dataflow) is intentionally NOT bound/logged.
-        codna_login(
-            access_token=getattr(args, "token", None),
-            open_browser=not getattr(args, "no_browser", False),
-        )
-    except LoginError as exc:
-        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
-        return 1
-
-    # After sign-in, make sure a local LLM provider key exists so `codna fix` can run on-device. The
-    # provider key stays on the machine (OS keychain) — never sent to the cloud (distinct from the account
-    # API key just minted). See `codna key`.
-    from . import byok_cli
-    provider_status = byok_cli.ensure_local_provider_key(
-        interactive=sys.stdin.isatty() and sys.stdout.isatty(),
-        runtime_keys=_runtime_keys(include_keychain=False),
-    )
-
-    # login() raised on failure, so reaching here means signed-in. Report ONLY sign-in + BYOK status —
-    # never anything on the account-key dataflow (login() already stored the key in the keychain; its
-    # return is deliberately not logged, so no credential-tainted value reaches this sink). CodeQL:
-    # clear-text logging of sensitive information.
-    print(json.dumps({
-        "ok": True,
-        "provider_key": provider_status,
-    }, indent=2))
-    return 0
+    from .login import run as login_run
+    return login_run(args, runtime_keys=_runtime_keys)
 
 
 def cmd_doctor(args) -> int:
@@ -936,7 +906,7 @@ def build_parser() -> argparse.ArgumentParser:
     _register_ci(sub)
     _register_report(sub)
 
-    pl = sub.add_parser("login", help="Sign this machine into a Codna account (device-code login).")
+    pl = sub.add_parser("login", help="Authorize this device and install the on-device runtime (one-time, free).")
     pl.add_argument("--token", help="headless access token (or env CODNA_TOKEN) — skips the browser step")
     pl.add_argument("--no-browser", dest="no_browser", action="store_true",
                     help="do not open a browser; print the verification URL + code to authorize elsewhere")

{codna-0.2.84 → codna-0.2.86}/codna/login.py

@@ -5,10 +5,12 @@ authorization grant), then self-serve onboards the free tier and mints the first
 generic product-onboard route (`POST /v1/products/codna/onboard`). The key is stored in the OS keychain
 as ``CODNA_API_KEY`` (codna.keystore) for control-plane calls.
 
-Unlike telys/algenta, codna's runtime license is **HS256** and its Telys memory runtime is already
-bundled in the wheel (+ the embedded OEM umbrella license), so login does NOT register an RS256
-per-device license or download a runtime — it is purely codna account auth + the API key. BYOK provider
-keys stay local and are handled separately (`codna key`).
+The runtime-provisioning half of `codna login` is deliberately NOT in :func:`login`: that stays
+purely codna account auth + the API key. :func:`run` below (the `codna login` command body) chains
+it with ``telys_onboarding`` (per-device RS256 license + signed runtime install), reusing this
+flow's Supabase access token so the user authorizes ONCE — the uniform fleet model
+(`telys login` / `algenta login` / `sqai login`). BYOK provider keys stay local and are handled
+separately (`codna key`).
 
 Hosts are env-overridable (``CODNA_ACCOUNTS_URL`` / ``CODNA_API_URL``) for staging or a local mock; the
 defaults are the shared accounts portal and codna's public API.
@@ -123,7 +125,12 @@ def onboard(*, api: str, access_token: str) -> str:
 
 # ── orchestration: the whole `codna login` in one call ───────────────────────────────────────────────────
 def login(*, access_token: str | None = None, open_browser: bool = True) -> dict:
-    """Device-login → onboard → store CODNA_API_KEY. Returns a status dict (never echoes the key)."""
+    """Device-login → onboard → store CODNA_API_KEY. Returns a status dict (never echoes the key).
+
+    The dict also carries the device flow's Supabase ``access_token``: ``cmd_login`` reuses it for
+    the same-command runtime provisioning (telys_onboarding) so the user authorizes ONCE. It is a
+    credential — callers must never print, log, or persist it beyond this process.
+    """
     accounts, api = accounts_url(), api_url()
     token = access_token or os.environ.get("CODNA_TOKEN")
     if token:
@@ -147,5 +154,91 @@ def login(*, access_token: str | None = None, open_browser: bool = True) -> dict
         stored = "env (this process) — set CODNA_API_KEY to persist; no OS keychain available"
 
     # Return ONLY where the key was stored (a literal location) — never the key or any prefix derived from
-    # it, so no credential-tainted value can reach a logging sink (CodeQL: clear-text logging of secrets).
-    return {"ok": True, "api_key_stored": stored}
+    # it — plus the device flow's access token for the provisioning step. No credential-tainted value may
+    # reach a logging sink (CodeQL: clear-text logging of sensitive information).
+    return {"ok": True, "api_key_stored": stored, "access_token": token}
+
+
+# ── `codna login` command body (kept here so cli.py stays under the module-size ceiling) ───────────
+def run(args, *, runtime_keys) -> int:
+    """One-time device authorization that ALSO installs the on-device runtime — one command.
+
+    Uniform with `telys login` / `algenta login` / `sqai login`: device-code auth via the accounts
+    portal → self-serve free-tier onboard → the first Codna API key (stored in the OS keychain as
+    CODNA_API_KEY) → a local LLM provider key check so `codna fix` runs on-device → the per-device
+    Telys license + signed memory runtime (telys_onboarding), reusing the SAME device-flow access
+    token so the user authorizes once. After this one command every `codna mcp` tool — including
+    `codna_recall` — works, fully offline thereafter.
+
+    Idempotent: an already fully provisioned device skips re-provisioning (no network). A partial
+    failure (Codna key stored, runtime fetch failed) is completed by re-running `codna login`.
+    Exit codes: 0 = signed in AND provisioned (or already provisioned); 1 = sign-in failed;
+    2 = signed in but runtime provisioning incomplete (needs network on first run — re-run).
+
+    ``runtime_keys`` is the CLI's key-resolution callable (passed in, never imported, so this
+    module stays free of cli.py).
+    """
+    import sys
+
+    try:
+        # The return is bound for exactly one field — the device flow's access token, handed to the
+        # provisioning step below so the user authorizes ONCE. It is a credential and never reaches
+        # output: the status JSON at the end is built from literals + non-secret fields only (the
+        # account key itself is stored by login() and never returned). CodeQL: clear-text logging
+        # of sensitive information.
+        login_result = login(
+            access_token=getattr(args, "token", None),
+            open_browser=not getattr(args, "no_browser", False),
+        )
+    except LoginError as exc:
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 1
+
+    # After sign-in, make sure a local LLM provider key exists so `codna fix` can run on-device. The
+    # provider key stays on the machine (OS keychain) — never sent to the cloud (distinct from the account
+    # API key just minted). See `codna key`.
+    from . import byok_cli
+    provider_status = byok_cli.ensure_local_provider_key(
+        interactive=sys.stdin.isatty() and sys.stdout.isatty(),
+        runtime_keys=runtime_keys(include_keychain=False),
+    )
+
+    # The fleet-uniform half: provision the per-device license + signed on-device runtime so
+    # `codna_recall` works after ONE command (not only triage/secure). Already provisioned → an
+    # offline no-op. Offline first run → a clear, actionable error (never a traceback); re-running
+    # resumes provisioning without corrupting state.
+    from . import memory
+    from . import telys_onboarding
+
+    try:
+        provisioning = telys_onboarding.ensure_provisioned(
+            access_token=login_result.get("access_token"),
+            open_browser=not getattr(args, "no_browser", False),
+        )
+    except telys_onboarding.OnboardingError as exc:
+        print(json.dumps({
+            "ok": False,
+            "error": str(exc),
+            "hint": ("You are signed in and your Codna key is stored, but the on-device runtime is "
+                     "not fully provisioned — that step needs network access on this first run. "
+                     "Check your connection and re-run `codna login` (safe to re-run: it finishes "
+                     "provisioning without corrupting state). Everything runs offline after that."),
+        }, indent=2), file=sys.stderr)
+        return 2
+    except memory.CodeMemoryError as exc:
+        # A local runtime misconfig (e.g. TELYS_KERNEL pointing at a missing file, or a corrupt
+        # packaged-runtime manifest): not a network problem — surface the actionable message the
+        # memory layer already wrote, cleanly (never a traceback).
+        print(json.dumps({"ok": False, "error": str(exc)}, indent=2), file=sys.stderr)
+        return 2
+
+    # login() raised on failure and provisioning returned, so reaching here means signed-in AND
+    # provisioned. Report ONLY sign-in + BYOK + non-secret provisioning status — never anything on
+    # the account-key dataflow (login() already stored the key in the keychain; no credential-tainted
+    # value reaches this sink). CodeQL: clear-text logging of sensitive information.
+    print(json.dumps({
+        "ok": True,
+        "provider_key": provider_status,
+        "runtime": provisioning,
+    }, indent=2))
+    return 0

{codna-0.2.84 → codna-0.2.86}/codna/mcp_server.py

@@ -14,7 +14,28 @@ import json
 import os
 from pathlib import Path
 
-from .cli import _client, _dump, _register
+from .cli import _api_key, _client, _dump, _register, _runtime_keys
+
+LOGIN_REQUIRED_MESSAGE = (
+    "requires the one-time free `codna login` device authorization (free community license); "
+    "run `codna login` once — fully offline thereafter"
+)
+
+
+def _login_required_error(tool: str) -> str | None:
+    """Uniform execution gate: every MCP tool call requires the free community login.
+
+    All codna tools execute under the same licensing model (algenta house pattern — sqai returns
+    `login_required`, algenta-mcp an auth error; introspection stays credential-free, execution
+    needs the login). The `codna login` artifact is the codna account key, resolved through the
+    same key layer the CLI/status paths use: env first, then the OS keychain via the non-secret
+    name index (a clean machine is never prompted), never the network — offline after the one
+    login. The key's presence proves the login state; it is not validated against the control
+    plane (offline by design). Returns the structured error line, or None when authorized.
+    """
+    if _api_key(_runtime_keys(include_keychain=True)):
+        return None
+    return f"{tool} error: {LOGIN_REQUIRED_MESSAGE}"
 
 
 def _default_repo(repo: str) -> str:
@@ -44,6 +65,9 @@ def _mcp_memory_db_path(repo: str) -> str:
 def recall_json(repo: str = ".", query: str = "", service: str = "", language: str = "",
                 final_k: int = 8) -> str:
     """Return local Telys memory recall as JSON without crashing the MCP server."""
+    gate = _login_required_error("codna_recall")
+    if gate:
+        return gate
     if not query:
         return "codna_recall error: query is required"
     repo = _default_repo(repo)
@@ -69,6 +93,9 @@ def report_bug_json(
     """File a report to thyn-ai/feedback and return the result as JSON, without crashing the MCP
     server. Same submission path `codna report` (the CLI) uses, so an agent and a human land in
     the same place with the same fields."""
+    gate = _login_required_error("codna_report_bug")
+    if gate:
+        return gate
     if not title:
         return "codna_report_bug error: title is required"
     try:
@@ -90,6 +117,9 @@ def secure_json(repo: str = ".", sarif_path: str = "", ref: str = "") -> str:
 
     MCP secure is read-only and local by default: it must not start or depend on the agent sidecar.
     """
+    gate = _login_required_error("codna_secure")
+    if gate:
+        return gate
     del ref  # local reference classification is SARIF-only; repo is included for caller traceability.
     repo = _default_repo(repo)
     try:
@@ -134,6 +164,9 @@ def fix_json(
     runs it in a worker thread so local repository-intelligence calls can safely use their own
     event loop internally.
     """
+    gate = _login_required_error("codna_fix")
+    if gate:
+        return gate
     repo = _default_repo(repo)
     try:
         c = _client(include_keychain=True)
@@ -212,10 +245,16 @@ def _build_server():
     def codna_triage(repo: str = ".", issue: str = "") -> str:
         """Understand a repository and locate the code relevant to an issue.
 
+        Requires the one-time free `codna login` device authorization (free community
+        license); fully offline thereafter.
+
         repo: a local path or a git URL (default: current directory).
         issue: optional description of what you're looking for.
         Returns suspect files + the context-reduction the engine achieved (0 LLM tokens).
         """
+        gate = _login_required_error("codna_triage")
+        if gate:
+            return gate
         repo = _default_repo(repo)
         try:
             c = _client()
@@ -246,6 +285,10 @@ def _build_server():
     ) -> str:
         """Find and fix a bug. Runs the full Codna agent + engine + risk simulation.
 
+        Requires the one-time free `codna login` device authorization (free community
+        license) plus a provider key (BYOK — e.g. ANTHROPIC_API_KEY or `codna key set
+        anthropic`); fully offline thereafter.
+
         repo: a local path or a git URL. issue: what's broken (e.g. the failing test).
         model: optional provider-qualified model such as openai/gpt-5.
         open_pr: when false (default) this is READ-ONLY — returns the plan (root cause, confidence,
@@ -268,6 +311,9 @@ def _build_server():
         Semgrep / Snyk / Trivy), classifies each finding (exploitable / production-reachable /
         unreachable / unknown) via the engine, and reports which are autofix-eligible.
         Read-only and 0 LLM tokens. `sarif_path` is required.
+
+        Requires the one-time free `codna login` device authorization (free community
+        license); fully offline thereafter.
         """
         return secure_json(repo, sarif_path, ref)
 
@@ -290,8 +336,9 @@ def _build_server():
         rather than a whole-repo map (codna_triage) — and when you want it offline. The index
         is built on first use (an empty index auto-indexes the repo, once) and is stored
         outside the git checkout. On a fresh machine, first use requires the one-time free
-        `codna login` device authorization (it provisions the on-device memory runtime);
-        after that, recall is fully offline with no key and no network calls.
+        `codna login` device authorization (free community license); the on-device memory
+        runtime arrives via the login-gated runtime install. After that, recall is fully
+        offline with no key and no network calls.
 
         repo: a local path or git URL (default: current directory, or the server default set
           by `codna mcp start --repo`).
@@ -322,6 +369,9 @@ def _build_server():
         """File a report to thyn-ai/feedback — the public front door for algenta, codna, telys,
         and sqai. Files the same shape of issue `codna report` (the CLI) does.
 
+        Requires the one-time free `codna login` device authorization (free community
+        license); auto-filing additionally needs a GitHub token (else a pre-filled URL).
+
         title: a short summary, e.g. "codna fix hangs on a monorepo".
         body: what happened, or what you want — as much detail as you have.
         product: one of algenta, codna, telys, sqai, accounts, docs (default: codna).

{codna-0.2.84 → codna-0.2.86}/codna/telys_onboarding.py

@@ -100,7 +100,10 @@ def run_login(
     except getattr(telys_login, "LoginError", Exception) as exc:
         raise OnboardingError(f"Codna device authorization failed: {exc}") from exc
     except Exception as exc:  # noqa: BLE001 - surface any onboarding failure with remediation
-        raise OnboardingError(f"Codna device authorization failed: {type(exc).__name__}: {exc}") from exc
+        # Non-LoginError failures past the auth step are provisioning failures (the signed-runtime
+        # download/verify, e.g. telys.installer.InstallError "could not reach install host" when
+        # offline) — name them accurately so `codna login` can point at the network, not at auth.
+        raise OnboardingError(f"Codna runtime provisioning failed: {type(exc).__name__}: {exc}") from exc
 
     # Make the device license discoverable by codna.memory in this process (belt-and-suspenders; the
     # cross-process default is the codna:onboarding-license source in memory._configured_license_token).
@@ -110,6 +113,58 @@ def run_login(
     return result
 
 
+def provision_status() -> dict:
+    """Offline, non-raising precheck: does this device already have a Telys license + a resolvable
+    kernel? Same two memory seams :func:`ensure_licensed` uses, but safe to call anywhere — no
+    network, no device flow, no raise. ``codna login`` uses it to stay idempotent: an already
+    fully provisioned device skips re-provisioning (and its download) entirely."""
+    from codna import memory
+
+    try:
+        token, source = memory._configured_license_token()
+    except memory.CodeMemoryError:
+        token, source = None, None
+    kernel = memory._resolve_telys_kernel(configure_env=False)
+    return {
+        "provisioned": bool(token and kernel.get("found")),
+        "license_source": source if token else None,
+        "kernel_source": kernel.get("source") if kernel.get("found") else None,
+    }
+
+
+def ensure_provisioned(*, access_token: str | None = None, plan: str = _DEFAULT_PLAN,
+                       open_browser: bool | None = None) -> dict:
+    """Guarantee this device has its per-device license AND the signed on-device runtime.
+
+    This is the provisioning half of `codna login` — the uniform fleet model (`telys login` /
+    `algenta login` / `sqai login` all authorize AND provision in one command). When the device is
+    already fully provisioned this is a pure offline status read (no network). Otherwise it runs
+    :func:`run_login`, reusing ``access_token`` from the codna device flow so the user authorizes
+    ONCE, and downloads the runtime only when no kernel already resolves. Re-running after a
+    partial failure is safe: the flow re-mints the device credentials and the runtime installer
+    promotes atomically, so a second `codna login` completes provisioning without corrupting state.
+
+    Returns a non-secret status dict (safe to print). Raises :class:`OnboardingError` with
+    remediation when provisioning cannot complete (e.g. offline first run).
+    """
+    status = provision_status()
+    if status["provisioned"]:
+        status["already_provisioned"] = True
+        return status
+    result = run_login(
+        token=access_token,
+        plan=plan,
+        install=status["kernel_source"] is None,
+        open_browser=open_browser,
+    )
+    return {
+        "provisioned": True,
+        "already_provisioned": False,
+        "runtime_installed": bool(result.get("installed")),
+        "tier": result.get("tier"),
+    }
+
+
 def ensure_licensed(*, allow_interactive_login: bool = False) -> dict:
     """Precheck before using codna memory: confirm this device is provisioned, or steer the user.
 
@@ -120,13 +175,9 @@ def ensure_licensed(*, allow_interactive_login: bool = False) -> dict:
     """
     from codna import memory
 
-    try:
-        token, source = memory._configured_license_token()
-    except memory.CodeMemoryError:
-        token, source = None, None
-    kernel = memory._resolve_telys_kernel(configure_env=False)
-    if token and kernel.get("found"):
-        return {"provisioned": True, "license_source": source, "kernel_source": kernel.get("source")}
+    status = provision_status()
+    if status["provisioned"]:
+        return status
 
     if allow_interactive_login:
         import sys

{codna-0.2.84 → codna-0.2.86}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.84
+Version: 0.2.86
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -133,26 +133,27 @@ codna mcp install --client cursor     # optional: write the client config for yo
 Five tools, each returning JSON; a failure comes back as `codna_<tool> error: …` text and never
 crashes the server:
 
-| Tool | What it does | Key needed |
+| Tool | What it does | Needs |
 | --- | --- | --- |
-| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | none |
-| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | none |
-| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | no key — one-time free `codna login` (device authorization) |
-| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | provider key (+ `GITHUB_TOKEN` for `open_pr=true`) |
-| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | `GITHUB_TOKEN` (else returns a pre-filled URL) |
-
-Introspection (`initialize`/`tools/list`) needs no credentials. Executing tools requires a free
-community login (`codna login` — one-time device authorization that installs the on-device
-runtime) — fully offline thereafter. Zero-credential exceptions: `codna_triage` and
-`codna_secure` run fully local with no login and no key. `codna_fix` additionally needs a
-provider key (BYOK, e.g. `ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it
-returns a pre-filled issue URL. Full reference:
+| `codna_triage` | Understand a repo and locate the code relevant to an issue. Deterministic, 0 LLM tokens. | free `codna login` |
+| `codna_secure` | Prove which SARIF scanner findings (CodeQL, Semgrep, Snyk, Trivy) are reachable. Read-only, 0 LLM tokens. | free `codna login` |
+| `codna_recall` | Recall code from local on-device memory — semantic + lexical search, fully offline. | free `codna login` (which also installs the on-device runtime) |
+| `codna_fix` | Root-cause and plan a fix (read-only by default); with `open_pr=true` pushes a branch and opens a real PR. | free `codna login` + provider key (BYOK; + `GITHUB_TOKEN` for `open_pr=true`) |
+| `codna_report_bug` | File a bug, feature, or question to thyn-ai/feedback. | free `codna login` + `GITHUB_TOKEN` (else returns a pre-filled URL) |
+
+Introspection (`initialize`/`tools/list`) needs no credentials. Executing any of the five tools
+requires the one-time free community login (`codna login` — device authorization, free community
+license) — fully offline thereafter. `codna_fix` additionally needs a provider key (BYOK, e.g.
+`ANTHROPIC_API_KEY`); `codna_report_bug` needs `GITHUB_TOKEN` or it returns a pre-filled issue
+URL; `codna_recall` additionally uses the on-device memory runtime that the same `codna login`
+installs.
+Full reference:
 [docs.codna.ai/guides/mcp](https://docs.codna.ai/guides/mcp).
 
 ## Code memory
 
 Code memory and recall run on your machine after a one-time free `codna login` (device
-authorization — it provisions the signed on-device runtime). From then on, recall runs fully
+authorization), which also installs the signed on-device runtime. From then on, recall runs fully
 offline: no key, no network calls. The optional
 `codna[memory]` extra adds the on-device semantic reranker; without it, recall ranks lexically.
 
@@ -170,5 +171,5 @@ offline: no key, no network calls. The optional
 
 - Homepage: https://codna.ai
 - Documentation: https://docs.codna.ai
-- Source: https://github.com/thyn-ai/codna
+- Source (public mirror): https://github.com/thyn-ai/codna-cli
 - Security: https://codna.ai/security

{codna-0.2.84 → codna-0.2.86}/codna.egg-info/SOURCES.txt

@@ -162,10 +162,12 @@ tests/test_local_runtime.py
 tests/test_local_runtime_lifecycle.py
 tests/test_localfix.py
 tests/test_login.py
+tests/test_login_provisions_runtime.py
 tests/test_manifest.py
 tests/test_mcp_default_repo.py
 tests/test_mcp_enrich.py
 tests/test_mcp_install.py
+tests/test_mcp_login_gate.py
 tests/test_mcp_recall.py
 tests/test_mcp_report_bug.py
 tests/test_mcp_secure.py