codna 0.2.86__tar.gz → 0.2.88__tar.gz

{codna-0.2.86 → codna-0.2.88}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.86
+Version: 0.2.88
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -11,7 +11,7 @@ Project-URL: Source, https://github.com/thyn-ai/codna
 Project-URL: Issues, https://github.com/thyn-ai/codna/issues
 Project-URL: Security, https://codna.ai/security
 Keywords: agent,ai,code-intelligence,codna,debugging,mcp,repository-intelligence,telys
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: MacOS

{codna-0.2.86 → codna-0.2.88}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.86"
+__version__ = "0.2.88"

{codna-0.2.86 → codna-0.2.88}/codna/mcp_server.py

@@ -10,12 +10,24 @@ from __future__ import annotations
 
 import asyncio
 import hashlib
+import importlib.util
 import json
 import os
 from pathlib import Path
+from typing import Annotated
 
 from .cli import _api_key, _client, _dump, _register, _runtime_keys
 
+# FastMCP builds each tool's input schema by evaluating the Annotated[str, Field(...)]
+# annotations below against THIS module's globals (inspect.signature(eval_str=True)), so
+# pydantic's Field must resolve here whenever a server can be built. But this module must also
+# import without pydantic: the offline CI lane installs neither pydantic nor the mcp extra and
+# exercises the *_json handlers directly. Keying the import to pydantic's presence satisfies
+# both — a server can only be built when the mcp extra (which hard-requires pydantic) exists,
+# so the binding is never absent when FastMCP evaluates the annotations.
+if importlib.util.find_spec("pydantic") is not None:
+    from pydantic import Field
+
 LOGIN_REQUIRED_MESSAGE = (
     "requires the one-time free `codna login` device authorization (free community license); "
     "run `codna login` once — fully offline thereafter"
@@ -306,16 +318,41 @@ def _build_server():
         # Reads one local SARIF file; never starts the sidecar or touches the network.
         openWorldHint=False,
     ))
-    def codna_secure(repo: str = ".", sarif_path: str = "", ref: str = "") -> str:
-        """Prove which scanner findings are reachable. Ingests a SARIF report (CodeQL /
+    def codna_secure(
+        sarif_path: Annotated[str, Field(
+            description="Path to the scanner's SARIF 2.1.0 report (CodeQL, Semgrep, Snyk, "
+                        "Trivy, or any other scanner). REQUIRED — there is no auto-discovery: "
+                        "omitting it fails input validation, and an empty string returns "
+                        "'codna_secure error: sarif_path is required'.",
+        )],
+        repo: Annotated[str, Field(
+            description="Repository the findings belong to (a local path or a git URL), echoed "
+                        "as 'repository' in the output for traceability. The classification "
+                        "reads ONLY the SARIF file — repo is never scanned. Default '.': the "
+                        "current directory, or the server default set by `codna mcp start "
+                        "--repo` (env CODNA_MCP_DEFAULT_REPO).",
+        )] = ".",
+        ref: Annotated[str, Field(
+            description="Branch, tag, or commit the SARIF was produced from. Accepted for "
+                        "parity with `codna secure --ref`; informational only in the MCP path — "
+                        "the local SARIF-only classifier does not resolve it. Default ''.",
+        )] = "",
+    ) -> str:
+        """Prove which scanner findings are reachable. Ingests a SARIF 2.1.0 report (CodeQL /
         Semgrep / Snyk / Trivy), classifies each finding (exploitable / production-reachable /
-        unreachable / unknown) via the engine, and reports which are autofix-eligible.
-        Read-only and 0 LLM tokens. `sarif_path` is required.
+        unreachable / unknown) via the local engine, and reports which are autofix-eligible.
+        Read-only, deterministic, 0 LLM tokens — the SARIF file is the only input read; the
+        repo is never scanned and the agent sidecar never starts.
+
+        `sarif_path` is REQUIRED (see the input schema) — there is no workspace scan or
+        default-path fallback. SARIF provenance (tool name + revision) must be complete or the
+        report is rejected. All failures come back as 'codna_secure error: ...' text — the
+        tool never raises.
 
         Requires the one-time free `codna login` device authorization (free community
         license); fully offline thereafter.
         """
-        return secure_json(repo, sarif_path, ref)
+        return secure_json(repo=repo, sarif_path=sarif_path, ref=ref)
 
     @server.tool(annotations=ToolAnnotations(
         title="Recall code from local memory",

{codna-0.2.86 → codna-0.2.88}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.86
+Version: 0.2.88
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn
@@ -11,7 +11,7 @@ Project-URL: Source, https://github.com/thyn-ai/codna
 Project-URL: Issues, https://github.com/thyn-ai/codna/issues
 Project-URL: Security, https://codna.ai/security
 Keywords: agent,ai,code-intelligence,codna,debugging,mcp,repository-intelligence,telys
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
 Classifier: Operating System :: MacOS

{codna-0.2.86 → codna-0.2.88}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.86"
+version = "0.2.88"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -18,7 +18,7 @@ keywords = [
   "telys",
 ]
 classifiers = [
-  "Development Status :: 3 - Alpha",
+  "Development Status :: 5 - Production/Stable",
   "Environment :: Console",
   "Intended Audience :: Developers",
   "Operating System :: MacOS",

{codna-0.2.86 → codna-0.2.88}/tests/test_mcp_enrich.py

@@ -49,6 +49,28 @@ def test_full_hint_annotations():
     assert tools["codna_report_bug"].annotations.openWorldHint is True
 
 
+def test_codna_secure_schema_marks_sarif_path_required_and_documents_params():
+    """TDQS: prose said sarif_path is required while the schema had it optional, and ref/repo
+    carried no semantics. The handler (secure_json) errors on omission — there is no
+    auto-discovery — so the served schema must say required and document every parameter."""
+    s = _build_server()
+    tools = {t.name: t for t in asyncio.run(s.list_tools())}
+    schema = tools["codna_secure"].inputSchema
+
+    assert schema["required"] == ["sarif_path"]
+    props = schema["properties"]
+    assert set(props) == {"sarif_path", "repo", "ref"}
+    assert "default" not in props["sarif_path"]  # required: no default to lean on
+    assert props["repo"]["default"] == "."
+    assert props["ref"]["default"] == ""
+    for name in ("sarif_path", "repo", "ref"):
+        assert props[name].get("description"), f"{name} must carry parameter semantics"
+    # The honest-truth claims behind each description (guarded against future drift):
+    assert "no auto-discovery" in props["sarif_path"]["description"]
+    assert "never scanned" in props["repo"]["description"]  # classification reads ONLY the SARIF
+    assert "does not resolve it" in props["ref"]["description"]  # `del ref` in secure_json
+
+
 def test_resource_and_prompt_registered():
     s = _build_server()
     assert "codna://capabilities" in [str(r.uri) for r in asyncio.run(s.list_resources())]