code-coordinator 0.5.107__tar.gz → 0.5.109__tar.gz

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.107
+Version: 0.5.109
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.107
+Version: 0.5.109
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.107",
+  "tag": "0.5.109",
   "distance": 0,
-  "node": "gd8477c280ee82a9279e982ed0b3aea53dc089761",
+  "node": "g3cadef6459414c424ff96582a2bebcc8dd3ae08a",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-16"

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/coord/agent.py

@@ -3850,6 +3850,12 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
     For ``type="plan"`` specs the worker gets :data:`WORKER_PLAN_PROMPT` as
     its system prompt and only ``Read,Bash`` in ``--allowedTools`` — no
     Edit/Write tools so it cannot modify the repository.
+
+    For ``type="smoke"`` specs the worker gets ``Read,Bash`` only — no
+    Edit/Write, and deliberately no ``Monitor`` (#2301): a smoke leg is a
+    one-shot ``claude -p`` session, and ``Monitor`` ends the turn to await a
+    notification that can never arrive in time to resume it, which silently
+    kills a backgrounded smoke suite mid-run and leaves no verdict printed.
     """
     if spec.type == "plan":
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_PLAN_PROMPT
@@ -3907,6 +3913,33 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         system_prompt = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
         allowed_tools = "Read,Edit,Write,Bash"
+    elif spec.type == "smoke":
+        # #2301: smoke gets its own branch instead of falling through to the
+        # generic `else` below (which is where it used to land, and where
+        # it inherited the #2169 `Monitor` grant meant for *work* legs).
+        # A smoke runner's whole job is "pull the branch, run the smoke
+        # command, report pass/fail" (see SMOKE_SYSTEM_PROMPT) — it edits
+        # nothing and pushes nothing, so it has no business holding
+        # Edit/Write either.
+        #
+        # `Monitor` is deliberately withheld: it is an await-a-notification
+        # tool — calling it ends the current turn so the harness can wake
+        # the model back up once the condition it's watching fires. That
+        # only resumes anything in an INTERACTIVE session. A smoke leg is a
+        # one-shot `claude -p` session like every coord leg (#1394): ending
+        # the turn ends the session itself, permanently, before any
+        # notification can arrive. The agent was observed reaching for
+        # `Monitor` via ToolSearch to poll a backgrounded smoke suite, then
+        # ending its turn to "wait" — the session (and the backgrounded
+        # suite, reaped ~30s later) died silently with no verdict printed,
+        # burning a Test dispatch for zero signal every single retry.
+        # `BashOutput`/`TaskOutput` (already reachable without an explicit
+        # grant — see the #2169 comment above) return synchronously and are
+        # the correct way to poll a backgrounded task from here.
+        from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
+        system_prompt = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
+        system_prompt += build_deny_prompt(spec.deny_commands)
+        allowed_tools = "Read,Bash"
     else:
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
@@ -3916,6 +3949,15 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # past the 600s Bash ceiling. `TaskOutput`/`TaskStop` were already
         # reachable without being in this list; `Monitor` was the one
         # observed denied.
+        #
+        # #2301: this grant is for *work*-shaped legs (work/review/fix/
+        # conflict-fix) whose system prompt (WORKER_SYSTEM_PROMPT, the
+        # ONE-SHOT section) explicitly teaches the bounded-poll pattern and
+        # explains why an await-a-notification tool is safe to reach for
+        # ONLY with that guidance attached. `smoke` used to fall through to
+        # this branch and inherit `Monitor` with none of that context — see
+        # the dedicated `elif spec.type == "smoke"` branch above, which
+        # deliberately withholds it instead.
         allowed_tools = "Read,Edit,Write,Bash,Monitor"
 
     # NOTE: briefing is NOT passed as a positional arg — it is written to
@@ -7079,6 +7121,20 @@ class AgentServer:
             assert proc.stdin is not None
             proc.stdin.write(initial_input)
             proc.stdin.flush()
+            # #2306: a provider that does not support stdin message injection
+            # (``capabilities().inject == False``, e.g. OpenCodeProvider,
+            # which takes its briefing on argv) never writes to or closes
+            # this pipe again.  Leaving it open blocks the worker forever —
+            # it never sees an EOF on stdin — until the 600s TTFT watchdog
+            # kills it having emitted zero bytes.  Close it here so such a
+            # worker gets its EOF immediately after the (empty) initial
+            # write.  ``provider_obj`` is ``None`` on the legacy path
+            # (``spec.provider is None``, pre-#324 behaviour) — treat that
+            # as claude/inject-capable and leave stdin open, matching
+            # ``inject_message``'s existing "no provider info => allow"
+            # fallback.
+            if provider_obj is not None and not provider_obj.capabilities().inject:  # type: ignore[attr-defined]
+                proc.stdin.close()
         except (BrokenPipeError, OSError) as e:
             log_fh.write(f"\n# failed to send initial briefing: {e}\n")
 

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/coord/providers/claude.py

@@ -120,6 +120,7 @@ class ClaudeProvider(Provider):
             _sealed_write_guard_tools,
             build_deny_prompt,
         )
+        from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
 
         binary = self._binary if self._binary is not None else DEFAULT_WORKER_BINARY
 
@@ -170,12 +171,22 @@ class ClaudeProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
                 _sp += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
                 _at = "Read,Edit,Write,Bash"
+            elif spec.type == "smoke":
+                # #2301: keep in sync with default_worker_command's identical
+                # branch — smoke gets Read,Bash only, deliberately WITHOUT
+                # Monitor (an await-a-notification tool that ends a smoke
+                # leg's one-shot session before any wake-up can arrive) or
+                # Edit/Write (a smoke leg validates; it never mutates).
+                _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
+                _sp += build_deny_prompt(spec.deny_commands)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 # #2169: keep in sync with default_worker_command's identical
                 # branch — Monitor is the sanctioned bounded-poll tool for a
-                # backgrounded long-running command.
+                # backgrounded long-running command. #2301: this grant is for
+                # work-shaped legs only — smoke has its own branch above.
                 _at = "Read,Edit,Write,Bash,Monitor"
 
             if system_prompt is None:

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/coord/providers/claude_pty.py

@@ -485,13 +485,26 @@ class ClaudePtyProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else MILESTONE_CHAT_SYSTEM_PROMPT
                 _sp += build_deny_prompt(MILESTONE_CHAT_DENY_COMMANDS)
                 _at = "Read,Bash"
+            elif spec.type == "smoke":
+                # #2301: keep in sync with default_worker_command's and
+                # ClaudeProvider.build_command's identical branch — smoke
+                # gets SMOKE_SYSTEM_PROMPT and Read,Bash only, deliberately
+                # WITHOUT `Monitor` (an await-a-notification tool: calling it
+                # ends the turn, which ends a one-shot leg's session before
+                # any wake-up can arrive) and without Edit/Write (a smoke leg
+                # validates; it never mutates).
+                from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
+                _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
+                _sp += build_deny_prompt(spec.deny_commands)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 # #2169: keep in sync with default_worker_command's and
                 # ClaudeProvider.build_command's identical branch — Monitor
                 # is the sanctioned bounded-poll tool for a backgrounded
-                # long-running command.
+                # long-running command. #2301: that grant is for *work*-shaped
+                # legs only — smoke has its own branch above.
                 _at = "Read,Edit,Write,Bash,Monitor"
 
             if system_prompt is None:

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/coord/smoke.py

@@ -111,13 +111,24 @@ suite off and stopping there prints no marker, so the Test stage records NO \
 verdict and re-dispatches; because the ceiling is deterministic, every \
 re-dispatch does exactly the same thing, which is why this loop bills \
 indefinitely. Instead: POLL the backgrounded task to completion from THIS \
-same session, in bounded steps (`BashOutput`/`TaskOutput` with the id, or \
-`Monitor`), and read its REAL exit status before you report anything. Do NOT \
-use a foreground `until ! pgrep ...; do sleep ...; done` wait — it hits the \
-identical 600s wall. If you genuinely cannot obtain an exit status before you \
-run out of room, print `SMOKE: fail <the smoke command never returned an exit \
-status within this session>` rather than ending mute: a stated verdict is \
-recoverable, silence is not.
+same session, in bounded steps, with `BashOutput`/`TaskOutput` and the task \
+id, and read its REAL exit status before you report anything. Do NOT use a \
+foreground `until ! pgrep ...; do sleep ...; done` wait — it hits the \
+identical 600s wall.
+- NEVER USE `Monitor` OR ANY OTHER AWAIT-A-NOTIFICATION TOOL TO WAIT FOR A \
+RESULT (#2301). Those tools work by ending your turn so the harness can wake \
+the model back up once the condition they're watching fires — that only \
+resumes anything in an INTERACTIVE session. This is a one-shot `claude -p` \
+session: ending your turn ends the session itself, permanently, and no \
+notification will ever arrive to resume it. The backgrounded suite you were \
+polling is then reaped mid-run by the coordinator, and you have printed no \
+verdict marker — exactly the silent failure the previous bullet exists to \
+prevent, just reached by a different tool. Only `BashOutput`/`TaskOutput` \
+return synchronously without ending your turn; those are the only \
+correct way to poll a backgrounded task from here. If you genuinely cannot \
+obtain an exit status before you run out of room, print `SMOKE: fail <the \
+smoke command never returned an exit status within this session>` rather \
+than ending mute: a stated verdict is recoverable, silence is not.
 
 Where you are:
 - You are in a dedicated git worktree created for this run. Every git command \

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/tests/test_agent.py

@@ -1134,6 +1134,64 @@ def test_default_worker_command_resume_flag_present() -> None:
     assert argv[idx + 1] == "ses-abc123"
 
 
+# ── #2301: smoke legs must not hold Monitor (or Edit/Write) ────────────────
+#
+# Root cause: smoke fell through to the generic `else` branch and inherited
+# the #2169 `Monitor` grant meant for *work*-shaped legs. `Monitor` is an
+# await-a-notification tool — calling it ends the current turn to wait for a
+# wake-up condition, which only resumes anything in an INTERACTIVE session.
+# Every coord leg, smoke included, is a one-shot `claude -p` session (#1394):
+# ending the turn ends the session itself, permanently, before any
+# notification can arrive. Two real smoke legs did exactly this — reached
+# `Monitor` via ToolSearch to poll a backgrounded `cargo test`, ended their
+# turn to "wait" for it, and died 16-24s later with no verdict printed, while
+# the backgrounded suite was reaped out from under them ~30s after that.
+
+
+def _smoke_spec(**overrides) -> AssignmentSpec:
+    base = dict(
+        repo_name="api",
+        repo_path="/tmp/repo",
+        issue_number=2301,
+        issue_title="[smoke] t",
+        briefing="b",
+        branch="main",
+        type="smoke",
+    )
+    base.update(overrides)
+    return AssignmentSpec(**base)
+
+
+def test_default_worker_command_smoke_type_does_not_grant_monitor() -> None:
+    argv = default_worker_command(_smoke_spec())
+    allowed = argv[argv.index("--allowedTools") + 1].split(",")
+    assert "Monitor" not in allowed
+
+
+def test_default_worker_command_smoke_type_gets_read_bash_only() -> None:
+    """A smoke leg validates; it never mutates — no Edit/Write either."""
+    argv = default_worker_command(_smoke_spec())
+    allowed = argv[argv.index("--allowedTools") + 1]
+    assert allowed == "Read,Bash"
+
+
+def test_default_worker_command_smoke_type_uses_smoke_system_prompt() -> None:
+    """Confirms the smoke branch's default system prompt is
+    coord.smoke.SMOKE_SYSTEM_PROMPT, not the generic WORKER_SYSTEM_PROMPT
+    the old fall-through `else` branch would have used."""
+    from coord.smoke import SMOKE_SYSTEM_PROMPT
+
+    argv = default_worker_command(_smoke_spec())
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert system_prompt.startswith(SMOKE_SYSTEM_PROMPT)
+
+
+def test_default_worker_command_smoke_type_honours_explicit_system_prompt() -> None:
+    argv = default_worker_command(_smoke_spec(system_prompt="custom smoke prompt"))
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert system_prompt.startswith("custom smoke prompt")
+
+
 # ── #1315: structural sealing enforcement (write-guard) ─────────────────────
 
 
@@ -4350,6 +4408,111 @@ class TestCapabilityGates:
         assert final.status == ADVISORY
         server.shutdown()
 
+    def test_stdin_closed_after_spawn_when_provider_inject_is_false(
+        self, tmp_path: Path
+    ) -> None:
+        """#2306: a provider with capabilities().inject=False (e.g. opencode,
+        which takes its briefing on argv, not stdin) must have its stdin
+        pipe closed right after the initial (possibly empty) write.
+
+        Before the fix, stdin was held open for the process's entire
+        lifetime regardless of provider.  A worker that never writes to or
+        reads more from stdin itself (opencode) then blocked forever on its
+        own read of an unclosed pipe that would never see EOF, and was
+        killed by the 600s TTFT watchdog having emitted zero bytes.  ``cat``
+        reproduces that shape exactly: it blocks reading stdin until EOF.
+        With stdin closed after the initial write, ``cat`` sees EOF
+        immediately and the assignment finishes well within the test
+        timeout instead of hanging.
+        """
+        repo = _init_repo(tmp_path / "repo")
+        no_inject_provider = _make_provider(
+            inject=False,
+            # argv-only briefing (like opencode) — nothing more is ever
+            # written to stdin by the harness for this provider.
+            build_argv=["/bin/sh", "-c", "cat >/dev/null; echo done"],
+            initial_input_bytes=b"",
+        )
+        server = AgentServer(
+            machine_name="test",
+            repos=["api"],
+            state_dir=tmp_path / "state",
+            repo_paths={"api": str(repo)},
+            providers={"no-inject": no_inject_provider},
+        )
+        a = server.assign(_spec(repo, provider="no-inject"))
+        # The Popen object is available synchronously once assign() returns
+        # for the non-PTY, no-pull path used here.
+        proc = server._processes.get(a.id)
+        assert proc is not None, "process not recorded"
+        assert proc.stdin is not None and proc.stdin.closed, (
+            "stdin must be closed immediately after spawn for a provider "
+            "with capabilities().inject=False"
+        )
+        # And the worker actually completes — proof the closed pipe gave it
+        # an EOF rather than leaving it to hang until the watchdog kills it.
+        final = server.wait_for(a.id, timeout=5)
+        assert final.status == ADVISORY  # no commits made
+        server.shutdown()
+
+    def test_stdin_left_open_after_spawn_when_provider_inject_is_true(
+        self, tmp_path: Path
+    ) -> None:
+        """#2306 regression guard: a provider with capabilities().inject=True
+        (e.g. ClaudeProvider) must still have its stdin left open after
+        spawn — this is the behaviour ``inject_message`` depends on, and it
+        must be bit-for-bit unchanged by the #2306 fix."""
+        repo = _init_repo(tmp_path / "repo")
+        inject_provider = _make_provider(
+            inject=True,
+            build_argv=["/bin/sh", "-c", "read a; read b; echo $b"],
+        )
+        server = AgentServer(
+            machine_name="test",
+            repos=["api"],
+            state_dir=tmp_path / "state",
+            repo_paths={"api": str(repo)},
+            providers={"yes-inject": inject_provider},
+        )
+        a = server.assign(_spec(repo, provider="yes-inject"))
+        proc = server._processes.get(a.id)
+        assert proc is not None, "process not recorded"
+        assert proc.stdin is not None and not proc.stdin.closed, (
+            "stdin must stay open after spawn for a provider with "
+            "capabilities().inject=True"
+        )
+        # inject_message must still work over that open pipe.
+        server.inject_message(a.id, "injected")
+        final = server.wait_for(a.id, timeout=5)
+        assert final.status == ADVISORY
+        server.shutdown()
+
+    def test_stdin_left_open_after_spawn_on_legacy_no_provider_path(
+        self, tmp_path: Path
+    ) -> None:
+        """#2306: when spec.provider is None, ``_spawn`` takes the legacy
+        path where ``provider_obj`` is ``None``.  That must be treated as
+        claude/inject-capable (stdin left open), matching
+        ``inject_message``'s existing "no provider info => allow" fallback
+        — not closed, which would regress every no-config deployment."""
+        repo = _init_repo(tmp_path / "repo")
+        server = _server(
+            tmp_path,
+            argv=["/bin/sh", "-c", "read a; read b; echo $b"],
+            repo_path=repo,
+        )
+        a = server.assign(_spec(repo))  # no provider → legacy path
+        proc = server._processes.get(a.id)
+        assert proc is not None, "process not recorded"
+        assert proc.stdin is not None and not proc.stdin.closed, (
+            "stdin must stay open after spawn on the legacy (provider_obj "
+            "is None) path"
+        )
+        server.inject_message(a.id, "injected")
+        final = server.wait_for(a.id, timeout=5)
+        assert final.status == ADVISORY
+        server.shutdown()
+
 
 # ── #452: Completed-assignment history cap ─────────────────────────────────────
 

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/tests/test_providers.py

@@ -242,6 +242,52 @@ def test_custom_binary() -> None:
     assert result[0] == "my-claude"
 
 
+# ── #2301: the smoke branch, across every call site of the same logic ────────
+
+
+def test_claude_build_command_smoke_matches_legacy_and_withholds_monitor() -> None:
+    """#2301: ``spec.type == "smoke"`` gets ``SMOKE_SYSTEM_PROMPT`` and
+    ``Read,Bash`` only.
+
+    ``Monitor`` is deliberately withheld: it is an await-a-notification tool,
+    so calling it ends the turn — and a smoke leg is a one-shot ``claude -p``
+    session (#1394), where ending the turn ends the session permanently,
+    before any wake-up can arrive. Edit/Write are withheld too (a smoke leg
+    validates; it never mutates). This must stay in parity with
+    ``default_worker_command`` — the same logic lives at three call sites and
+    #2169 already shipped a drift where only some were updated.
+    """
+    from coord.smoke import SMOKE_SYSTEM_PROMPT
+
+    spec = _make_spec(type="smoke")
+    argv = ClaudeProvider().build_command(spec)
+    legacy = default_worker_command(spec)
+    sp = argv[argv.index("--system-prompt") + 1]
+    at = argv[argv.index("--allowedTools") + 1]
+    assert sp == legacy[legacy.index("--system-prompt") + 1]
+    assert at == legacy[legacy.index("--allowedTools") + 1]
+    # Pin the values too, so a *matched* regression on both sides still fails.
+    assert sp.startswith(SMOKE_SYSTEM_PROMPT)
+    assert at == "Read,Bash"
+    assert "Monitor" not in at.split(",")
+
+
+def test_claude_build_command_smoke_honours_explicit_system_prompt() -> None:
+    """#2301: the smoke branch still respects ``spec.system_prompt`` (the
+    dispatcher's per-run prompt) instead of always forcing the default."""
+    argv = ClaudeProvider().build_command(
+        _make_spec(type="smoke", system_prompt="custom smoke prompt")
+    )
+    assert argv[argv.index("--system-prompt") + 1].startswith("custom smoke prompt")
+
+
+def test_claude_build_command_work_still_grants_monitor() -> None:
+    """Scope check for #2301: withholding Monitor from smoke must not have
+    taken it away from the generic worker branch (#2169's grant)."""
+    argv = ClaudeProvider().build_command(_make_spec(type="work"))
+    assert "Monitor" in argv[argv.index("--allowedTools") + 1].split(",")
+
+
 # ── #1706: definition model / env / extra_args threading ──────────────────────
 
 

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/tests/test_providers_pty.py

@@ -199,7 +199,7 @@ def test_pty_build_command_branches_match_claude_for_plan_type() -> None:
     assert argv[argv.index("--allowedTools") + 1] == legacy_at
 
 
-@pytest.mark.parametrize("spec_type", ["work", "review", "smoke", "conflict-fix", "fix"])
+@pytest.mark.parametrize("spec_type", ["work", "review", "conflict-fix", "fix"])
 def test_pty_build_command_branches_match_claude_for_work_type(spec_type: str) -> None:
     """#2169: the generic-worker (``else``) branch must stay in parity too.
 
@@ -210,6 +210,12 @@ def test_pty_build_command_branches_match_claude_for_work_type(spec_type: str) -
     system-prompt/allowed-tools logic and must not drift from it — this
     regression-guards the drift where only two of the three call sites
     were updated to add ``Monitor``.
+
+    ``smoke`` used to be parametrized here because it fell through the same
+    ``else`` branch; #2301 gave it a branch of its own, so its parity is
+    guarded by
+    :func:`test_pty_build_command_smoke_branch_matches_claude_and_withholds_monitor`
+    below instead.
     """
     spec = _make_spec(type=spec_type)
     argv = ClaudePtyProvider().build_command(spec)
@@ -221,6 +227,45 @@ def test_pty_build_command_branches_match_claude_for_work_type(spec_type: str) -
     assert "Monitor" in argv[argv.index("--allowedTools") + 1]
 
 
+def test_pty_build_command_smoke_branch_matches_claude_and_withholds_monitor() -> None:
+    """#2301: the smoke branch is the *third* call site of the same logic.
+
+    ``default_worker_command`` and ``ClaudeProvider.build_command`` both give
+    ``spec.type == "smoke"`` its own branch — ``SMOKE_SYSTEM_PROMPT`` plus
+    ``Read,Bash`` only, deliberately withholding ``Monitor`` (an await-a-
+    notification tool that ends a one-shot ``claude -p`` leg's session before
+    any wake-up can arrive) and Edit/Write (a smoke leg validates; it never
+    mutates). ``ClaudePtyProvider.build_command`` must not drift from them —
+    this regression-guards exactly the drift #2169 hit, where only two of the
+    three call sites were updated.
+    """
+    from coord.smoke import SMOKE_SYSTEM_PROMPT
+
+    spec = _make_spec(type="smoke")
+    argv = ClaudePtyProvider().build_command(spec)
+    legacy = default_worker_command(spec)
+    legacy_sp = legacy[legacy.index("--system-prompt") + 1]
+    legacy_at = legacy[legacy.index("--allowedTools") + 1]
+    pty_sp = argv[argv.index("--system-prompt") + 1]
+    pty_at = argv[argv.index("--allowedTools") + 1]
+    assert pty_sp == legacy_sp
+    assert pty_at == legacy_at
+    # Pin the values too, so a *matched* regression on both sides still fails.
+    assert pty_sp.startswith(SMOKE_SYSTEM_PROMPT)
+    assert pty_at == "Read,Bash"
+    assert "Monitor" not in pty_at.split(",")
+
+
+def test_pty_build_command_smoke_honours_explicit_system_prompt() -> None:
+    """#2301: the new smoke branch must still respect ``spec.system_prompt``
+    (the dispatcher's per-run briefing prompt) rather than always forcing
+    ``SMOKE_SYSTEM_PROMPT`` — same precedence as every other branch."""
+    argv = ClaudePtyProvider().build_command(
+        _make_spec(type="smoke", system_prompt="custom smoke prompt")
+    )
+    assert argv[argv.index("--system-prompt") + 1].startswith("custom smoke prompt")
+
+
 # ── ClaudePtyProvider: capabilities ──────────────────────────────────────────
 
 

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/tests/test_smoke.py

@@ -474,6 +474,45 @@ def test_smoke_system_prompt_tells_the_worker_to_poll_a_backgrounded_run() -> No
     assert not any(line.startswith("SMOKE:") for line in prompt.splitlines())
 
 
+# ── #2301: Monitor is an await-a-notification tool — it ends a headless leg ─
+
+
+def test_smoke_system_prompt_does_not_recommend_monitor_for_polling() -> None:
+    """#2272's own fix text used to name `Monitor` as a sanctioned polling
+    option alongside `BashOutput`/`TaskOutput`. Two real smoke legs took that
+    literally on 2026-08-15: reached `Monitor` via ToolSearch, called it to
+    "wait" for a backgrounded `cargo test`, and ended their turn — which IS
+    the end of a one-shot `claude -p` session (#1394). Both legs died in
+    16-24s, before the suite even finished compiling, with no verdict ever
+    printed; the backgrounded suite was reaped ~30s later by the coordinator.
+    `Monitor` must not appear as a recommended polling tool in this prompt
+    any more — `BashOutput`/`TaskOutput` still do the job without ending the
+    turn."""
+    prompt = SMOKE_SYSTEM_PROMPT
+    assert "BashOutput" in prompt
+    assert "TaskOutput" in prompt
+    # The old phrasing offered Monitor as an alternative poll mechanism
+    # ("...with the id, or `Monitor`)") right next to BashOutput/TaskOutput
+    # — that specific recommendation must be gone.
+    assert "or `Monitor`" not in prompt
+
+
+def test_smoke_system_prompt_states_monitor_ends_a_headless_session() -> None:
+    """Positive statement, not just an absence: the prompt must explain WHY
+    Monitor (and tools like it) are wrong here, or the next worker reaches
+    for it again under a different name — mirrors the #2158 lesson that
+    WORKER_SYSTEM_PROMPT's ONE-SHOT section bakes in for work legs."""
+    prompt = SMOKE_SYSTEM_PROMPT
+    assert "#2301" in prompt
+    assert "Monitor" in prompt
+    lowered = prompt.lower()
+    assert "await-a-notification" in lowered
+    assert "one-shot" in lowered
+    # The actual mechanism, not just "don't do this": ending the turn to
+    # await a notification ends the whole headless session, permanently.
+    assert "ending your turn ends the session itself" in lowered
+
+
 def test_briefing_tells_the_worker_to_poll_a_backgrounded_run() -> None:
     """The briefing carries the same instruction as the system prompt — it is
     what the worker re-reads while deciding what to do next."""

{code_coordinator-0.5.107 → code_coordinator-0.5.109}/tests/test_worker_test_scoping.py

@@ -124,15 +124,30 @@ def test_default_worker_command_grants_monitor_for_work_type() -> None:
         assert tool in allowed.split(",")
 
 
-@pytest.mark.parametrize("spec_type", ["review", "fix", "smoke", "conflict-fix"])
+@pytest.mark.parametrize("spec_type", ["review", "fix", "conflict-fix"])
 def test_default_worker_command_other_write_types_also_get_monitor(spec_type: str) -> None:
-    """`review`/`fix`/`smoke`/`conflict-fix` all fall through the same `else`
-    branch as `work` — confirm the grant isn't accidentally work-only."""
+    """`review`/`fix`/`conflict-fix` all fall through the same `else` branch
+    as `work` — confirm the grant isn't accidentally work-only.
+
+    `smoke` used to be in this list too, but #2301 gave it its own branch
+    (see test_default_worker_command_smoke_type_withholds_monitor below) —
+    smoke legs are one-shot sessions where an await-a-notification tool
+    like `Monitor` ends the session before any wake-up can arrive."""
     argv = default_worker_command(_work_spec(type=spec_type))
     allowed = argv[argv.index("--allowedTools") + 1]
     assert "Monitor" in allowed.split(",")
 
 
+def test_default_worker_command_smoke_type_withholds_monitor() -> None:
+    """#2301: a smoke leg is a one-shot `claude -p` session (#1394) — calling
+    `Monitor` there ends the session permanently before any notification can
+    arrive, silently killing a backgrounded smoke suite mid-run. Smoke must
+    not hold Monitor, or Edit/Write (it validates; it never mutates)."""
+    argv = default_worker_command(_work_spec(type="smoke"))
+    allowed = argv[argv.index("--allowedTools") + 1]
+    assert allowed == "Read,Bash"
+
+
 def test_mock_author_type_does_not_gain_monitor() -> None:
     """Scope check: the Monitor grant is deliberately added to the generic
     worker branch only, not copy-pasted onto every Edit-capable type."""