Skip to content

sync: mirror from thyn-ai/codna@912b399d9a843964fd7681662ae563dff5e2769d - #43

Closed
0xamlab wants to merge 1 commit into
mainfrom
sync/912b399d9a843964fd7681662ae563dff5e2769d
Closed

0xamlab wants to merge 1 commit into
mainfrom
sync/912b399d9a843964fd7681662ae563dff5e2769d

Conversation

@0xamlab

@0xamlab 0xamlab commented Nov 5, 2026

Copy link
Copy Markdown
Contributor

Automated mirror of cli/ (flattened), the root allowlist (server.json, glama.json, LICENSE, .gitleaks.toml) and the public-root/ community tree from thyn-ai/codna at 912b399d9a843964fd7681662ae563dff5e2769d. Merges itself via auto-merge once the mirror's required checks (codna review, Analyze (python)) pass and the codna-ai review approves; if a later sync lands first, this PR is closed as superseded -- every sync PR is a full snapshot of the exported surface.

@github-actions

github-actions Bot commented Nov 5, 2026

Copy link
Copy Markdown

Thanks for opening your first pull request in the Codna CLI! Please make sure the checks are green and that the change follows CONTRIBUTING.md. A maintainer will review it shortly.

@codna-ai codna-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

codna review — 2 finding(s): 2 inline, 0 in summary.

Reply @codna fix on a finding to have Codna open a verified, test-green, risk-gated fix PR.

⏸ Not approved: 1 medium/high finding(s) in this review.

Comment thread codna/config_file.py
Comment on lines +157 to +161
if not target:
raise ConfigError(
f"model.key is not applicable to the keyless provider {provider!r} "
"(ollama/lmstudio/openai-compatible/litellm accept requests without a credential)"
)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM · correctness — Key rejected for openai-compatible/litellm even when provider requires a credent

The new block at lines 157-161 raises ConfigError when model.key is set for any KEYLESS_PROVIDERS member (ollama, lmstudio, openai-compatible, litellm). However, openai-compatible and litellm deployments commonly require an API key — a self-hosted LiteLLM proxy behind authentication, or an openai-compatible endpoint with token auth, is a standard setup. The blanket rejection prevents those valid configurations: users will get a hard error ("model.key is not applicable to the keyless provider 'litellm'") even when their deployment requires a credential. The design intent ("keyless by default") should use a warning or be limited to ollama/lmstudio which never use keys.

Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.

Comment thread codna/durable/__init__.py
Comment on lines +102 to +106
DURABLE_RANGES: Final[dict[str, str]] = {
"temporalio": ">=1.34,<2",
"langgraph": ">=1,<2",
"langchain-core": ">=1,<2",
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW · correctness — DURABLE_RANGES missing langgraph-checkpoint entry

DURABLE_PINS declares four requirements including langgraph-checkpoint (minimum=(4,), maximum=(5,)), but DURABLE_RANGES only contains three entries — langgraph-checkpoint is absent. When require_durable() raises DurableUnavailableError for an out-of-range langgraph-checkpoint version it calls DURABLE_RANGES.get(requirement.distribution, ""), which returns "" for langgraph-checkpoint. The error details.range field is therefore empty, making the error message less actionable: the user is told the version is unsupported but not what range is accepted.

Suggested change
DURABLE_RANGES: Final[dict[str, str]] = {
"temporalio": ">=1.34,<2",
"langgraph": ">=1,<2",
"langchain-core": ">=1,<2",
}
DURABLE_RANGES: Final[dict[str, str]] = {
"temporalio": ">=1.34,<2",
"langgraph": ">=1,<2",
"langchain-core": ">=1,<2",
"langgraph-checkpoint": ">=4,<5",
}

Reply @codna fix and Codna opens a verified, test-green, risk-gated fix PR.

@0xamlab

0xamlab commented Nov 5, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #44 (a later thyn-ai/codna commit). Every sync PR is a full snapshot of the exported surface, so this one carries nothing #44 does not. Closing.

@0xamlab 0xamlab closed this Nov 5, 2026
auto-merge was automatically disabled November 5, 2026 05:57

Pull request was closed

@0xamlab
0xamlab deleted the sync/912b399d9a843964fd7681662ae563dff5e2769d branch November 5, 2026 05:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant