Repository navigation
Conversation
|
Thanks for opening your first pull request in the Codna CLI! Please make sure the checks are green and that the change follows CONTRIBUTING.md. A maintainer will review it shortly. |
![codna-ai[bot]](https://avatars.githubusercontent.com/in/4061960?s=60&v=4){kind=small}
| from pathlib import Path | ||
| from typing import Any, Callable, Final, Mapping | ||
|
|
||
| from temporalio import activity |
There was a problem hiding this comment.
🔴 HIGH · correctness — Module-level import of temporalio breaks codna without the durable extra
activities.py has from temporalio import activity at module scope (line 34). The package docstring and __init__.py guarantee that importing codna.durable must NOT import temporalio. Any code path that transitively imports codna.durable.activities at module scope — without going through require_durable() first — will raise ModuleNotFoundError when the durable extra is not installed, breaking the base CLI. If durable/cli.py or anything it imports transitively pulls in activities.py at import time, the base codna command fails for all users who haven't installed the extra.
Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.
| DURABLE_RANGES: Final[dict[str, str]] = { | ||
| "temporalio": ">=1.34,<2", | ||
| "langgraph": ">=1,<2", | ||
| "langchain-core": ">=1,<2", | ||
| } |
There was a problem hiding this comment.
🟡 MEDIUM · correctness — DURABLE_RANGES missing langgraph-checkpoint entry
DURABLE_PINS declares four requirements including langgraph-checkpoint (minimum=(4,), maximum=(5,)), but DURABLE_RANGES only contains entries for three distributions — it omits langgraph-checkpoint. When require_durable() rejects an out-of-range langgraph-checkpoint install, the error details include "range": DURABLE_RANGES.get(requirement.distribution, "") which evaluates to "" for this package. The user sees an empty range string and cannot determine what version to install.
| DURABLE_RANGES: Final[dict[str, str]] = { | |
| "temporalio": ">=1.34,<2", | |
| "langgraph": ">=1,<2", | |
| "langchain-core": ">=1,<2", | |
| } | |
| DURABLE_RANGES: Final[dict[str, str]] = { | |
| "temporalio": ">=1.34,<2", | |
| "langgraph": ">=1,<2", | |
| "langchain-core": ">=1,<2", | |
| "langgraph-checkpoint": ">=4,<5", | |
| } |
Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.
| netloc = parts.netloc | ||
| return f"{parts.scheme}://{netloc}{path}" |
There was a problem hiding this comment.
🟡 MEDIUM · security — Validated base URL reconstruction uses raw netloc including potential credential
In _validated_base_url, the function checks parts.username or parts.password and raises if present. However the reconstructed URL f"{parts.scheme}://{netloc}{path}" uses parts.netloc, which for urlsplit INCLUDES the userinfo portion (e.g. user:pass@host). If the credential check is ever bypassed or refactored, the returned URL will silently reinclude the embedded credential. A safer construction would be f"{parts.scheme}://{parts.hostname}" + (f":{parts.port}" if parts.port else "") + path to explicitly exclude any userinfo.
Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.
Automated mirror of cli/ (flattened), the root allowlist (server.json, glama.json, LICENSE, .gitleaks.toml) and the public-root/ community tree from thyn-ai/codna at 5d00f705715460068630300ec33528e079f6949b. Merges itself via auto-merge once the mirror's required checks (codna review, Analyze (python)) pass and the codna-ai review approves; if a later sync lands first, this PR is closed as superseded -- every sync PR is a full snapshot of the exported surface.