code-coordinator 0.5.115__tar.gz → 0.5.117__tar.gz

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.115
+Version: 0.5.117
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.115
+Version: 0.5.117
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/code_coordinator.egg-info/SOURCES.txt

@@ -673,6 +673,7 @@ tests/test_quiet_hours.py
 tests/test_quiet_hours_store_2146.py
 tests/test_reap_merged_sessions.py
 tests/test_reap_stale_interactive_tick.py
+tests/test_reconcile.py
 tests/test_reconcile_branch.py
 tests/test_reconcile_completions.py
 tests/test_reconcile_merges.py

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/code_coordinator.egg-info/scm_file_list.json

@@ -704,6 +704,7 @@
     "tests/test_quiet_hours_store_2146.py",
     "tests/test_reap_merged_sessions.py",
     "tests/test_reap_stale_interactive_tick.py",
+    "tests/test_reconcile.py",
     "tests/test_reconcile_branch.py",
     "tests/test_reconcile_completions.py",
     "tests/test_reconcile_merges.py",

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.115",
+  "tag": "0.5.117",
   "distance": 0,
-  "node": "g28e36b1a94feb56072af2832c5a0025e5b6ffa90",
+  "node": "g8f82380a31b6a3d5fd2dea0b4528a11a28c52148",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-16"

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/coord/agent.py

@@ -4416,9 +4416,26 @@ class AgentServer:
     #:                          capability that disappears simply stops
     #:                          attracting new work (degrade) instead of
     #:                          stranding anything in flight.
+    #:   * ``providers``      — #2326: rebuilt from ``providers.definitions``
+    #:                          at DISPATCH time (``assign()``, before
+    #:                          ``_resolve_provider``), not on a timer — that
+    #:                          is the only moment the answer matters. Before
+    #:                          #2326 this dict was parsed once at startup and
+    #:                          never invalidated, so an agent with its own
+    #:                          local ``coordinator.yml`` silently ran on a
+    #:                          days-stale provider definition (wrong model,
+    #:                          missing env) even though every coordinator-
+    #:                          side surface (``coord config``, the daemon's
+    #:                          own ``build_provider(...)``) showed the edit
+    #:                          as live. Any provider name in use by a
+    #:                          PENDING/RUNNING assignment is pinned to its
+    #:                          pre-reload entry (present or absent) —
+    #:                          swapping a live worker's provider identity
+    #:                          mid-flight (model, env, log-parser shape)
+    #:                          remains forbidden; only the NEXT dispatch
+    #:                          sees the new definition.
     #:
     #: RESTART-ONLY (documented at their assignment sites in ``__init__``):
-    #:   * ``providers``      — a live worker holds a resolved provider.
     #:   * ``bash_wrap_spawn`` / ``first_output_timeout`` — process tuning.
     #:   * bind host/port     — uvicorn has already bound the socket.
     _RELOADABLE_FIELDS = (
@@ -4427,6 +4444,7 @@ class AgentServer:
         "artifact_paths",
         "build_commands",
         "capabilities",
+        "providers",
     )
 
     def _maybe_reload_config(self) -> bool:
@@ -4491,6 +4509,40 @@ class AgentServer:
             self._apply_reloaded_config(reloaded, machine)
             return True
 
+    def _rebuild_providers(self, cfg: "Any") -> "dict[str, object] | None":
+        """Build a fresh provider registry from *cfg*'s ``providers.definitions``.
+
+        Mirrors the startup-time loop in
+        ``coord.commands.agent_ops._resolve_agent_startup`` (``build_provider``
+        for every entry), but — unlike startup — must never raise. A typo'd
+        ``providers.definitions`` entry reaching this agent via a hot reload
+        must not take a running daemon down; ``reload_config_if_stale``
+        already applies that same fail-soft contract to a malformed YAML
+        edit, and a config that parses fine but names an unknown provider
+        ``type`` deserves the identical treatment. Returns ``None`` (rather
+        than a partial dict) on any failure, so the caller keeps the
+        entire previous registry until the edit is fixed — matching the
+        "keep last-good config" behaviour for a bad ``coordinator.yml``.
+        """
+        from coord.providers import build_provider  # noqa: PLC0415
+
+        fresh: dict[str, object] = {}
+        try:
+            for name, defn in cfg.providers.definitions.items():
+                fresh[name] = build_provider(name, defn, cfg.models)
+        except Exception as exc:  # noqa: BLE001 — never let a bad edit kill the agent
+            _log.warning(
+                "coord agent: %s's providers.definitions failed to rebuild "
+                "(%s: %s); keeping the previous provider registry (%s) "
+                "until the edit is fixed",
+                cfg.path,
+                type(exc).__name__,
+                exc,
+                sorted(self._providers) if self._providers else "none configured",
+            )
+            return None
+        return fresh
+
     def _apply_reloaded_config(self, cfg: "Any", machine: "Any") -> None:
         """Swap the reloadable fields in place, pinning anything in flight.
 
@@ -4510,6 +4562,17 @@ class AgentServer:
         advertise *new* work only, so removing a repo correctly means "take no
         more dispatches for it", not "abandon the worker already running".
 
+        #2326: ``providers`` gets the exact same pin treatment, keyed by
+        provider *name* instead of repo name. A provider name in use by a
+        PENDING/RUNNING assignment keeps its pre-reload instance (including
+        absence) — ``_reap`` re-resolves the same ``spec`` after the worker
+        exits (to pick a log parser), and it must get back the SAME provider
+        identity ``assign()``/``_spawn()`` resolved, not one a reload swapped
+        underneath it (different model/env/log-parser shape). Any provider
+        name with no in-flight assignment is free to pick up the new
+        definition immediately — that is the entire point of #2326: the next
+        *dispatch*, not the next restart, sees a config edit.
+
         Every field is *rebound* to a freshly-built list/dict rather than
         mutated in place, so the many unsynchronized readers elsewhere in this
         class (``_servable_repos``, ``_stash_artifacts``, ``assign``, ...) see
@@ -4525,6 +4588,11 @@ class AgentServer:
         new_build_commands: dict[str, str] = {
             r.name: r.build_command for r in cfg.repos if r.build_command
         }
+        # #2326: built outside the lock — `build_provider` is pure
+        # construction (no I/O), but there is no reason to hold `self._lock`
+        # across it. `None` means "rebuild failed, keep the old registry
+        # verbatim" (see `_rebuild_providers`'s docstring).
+        new_providers = self._rebuild_providers(cfg)
 
         def _pin(old: dict, new: dict, keys: "Iterable[str]") -> None:
             """Restore *old*'s entry for each pinned key — including absence."""
@@ -4553,6 +4621,33 @@ class AgentServer:
             self.repo_paths = new_repo_paths
             self.artifact_paths = new_artifact_paths
             self.build_commands = new_build_commands
+
+            providers_added: list[str] = []
+            providers_removed: list[str] = []
+            providers_pinned: list[str] = []
+            if new_providers is not None:
+                in_flight_providers = {
+                    a.spec.provider
+                    for a in self._assignments.values()
+                    if a.status in (PENDING, RUNNING) and a.spec.provider is not None
+                }
+                old_providers = self._providers
+                _pin(old_providers, new_providers, in_flight_providers)
+                # Deliberately NOT trying to report "changed vs unchanged" per
+                # provider: `build_provider` mints a fresh instance every call
+                # and the provider classes carry no value equality, so any such
+                # comparison is really just "was it rebuilt", which is always
+                # true for every non-pinned entry. Report what IS knowable —
+                # the resulting registry, which names appeared/disappeared, and
+                # which kept their pre-reload instance because a PENDING/
+                # RUNNING assignment pinned them.
+                providers_added = [p for p in new_providers if p not in old_providers]
+                providers_removed = [p for p in old_providers if p not in new_providers]
+                providers_pinned = sorted(
+                    p for p in in_flight_providers if p in old_providers
+                )
+                self._providers = new_providers
+
             self._health_config = cfg
             self._config_reloads += 1
             self._config_reloaded_at = time.time()
@@ -4565,7 +4660,7 @@ class AgentServer:
 
         _log.info(
             "coord agent: applied config reload from %s — repos=%s "
-            "(added=%s removed=%s) capabilities=%s%s",
+            "(added=%s removed=%s) capabilities=%s%s%s",
             getattr(cfg, "path", None),
             new_repos,
             added or "[]",
@@ -4576,6 +4671,17 @@ class AgentServer:
                 if in_flight
                 else ""
             ),
+            (
+                # #2326: separate clause so a provider-only edit (the #2321
+                # incident this issue describes) shows up even when no repo
+                # changed at all.
+                f" providers={sorted(self._providers)}"
+                f"{f' (added={providers_added})' if providers_added else ''}"
+                f"{f' (removed={providers_removed})' if providers_removed else ''}"
+                f"{f' (pinned in-flight={providers_pinned})' if providers_pinned else ''}"
+                if new_providers is not None
+                else " providers=rebuild failed, kept previous registry"
+            ),
         )
 
     # ── Public API ──────────────────────────────────────────────────────────
@@ -4681,6 +4787,29 @@ class AgentServer:
                 "watching": str(watched_config) if watched_config else None,
                 "reloads": self._config_reloads,
                 "last_reload_at": self._config_reloaded_at,
+                # #2326: this agent's own last-observed mtime of `watching`
+                # (seeded from the file at startup, advanced on every
+                # reload attempt — including a swallowed bad edit, see
+                # `reload_config_if_stale`). `coord status` can diff this
+                # against the coordinator's own mtime for the SAME path to
+                # flag an agent whose config — and therefore whose
+                # `provider_names` below — predates the edit, without
+                # needing to probe `/proc/<pid>/environ` on the worker to
+                # notice (the failure mode that made #2326 a live-process
+                # investigation instead of a one-line `coord status` read).
+                # `None` for a config-free/thin-client agent, same as
+                # `watching`.
+                "config_mtime": self._config_mtime,
+                # #2326: the provider names THIS process would actually
+                # resolve `spec.provider` against right now — i.e. the keys
+                # of `self._providers`, refreshed at dispatch time (see
+                # `_apply_reloaded_config`). Lets `coord status` compare this
+                # list (or `config_mtime` above) against the coordinator's
+                # `providers.definitions` and flag drift directly, instead of
+                # every surface short of the worker's own process agreeing
+                # while the running registry is actually stale — exactly the
+                # split-brain #2326 describes.
+                "provider_names": sorted(self._providers) if self._providers else [],
             },
         }
 
@@ -5940,7 +6069,36 @@ class AgentServer:
         if spec.provider is None:
             return None
         if spec.provider in self._providers:
-            return self._providers[spec.provider]
+            local = self._providers[spec.provider]
+            if spec.provider_def is not None:
+                # #2326: step 2 (local override) is winning over a wire
+                # provider_def the coordinator DID send — the precedence is
+                # deliberate (see docstring), but before this the decision
+                # left no trace, which is why a days-stale local registry
+                # silently shadowing a fresh coordinator edit took a live
+                # `/proc/<pid>/environ` probe to catch instead of a log
+                # line. Env keys only (not values) — provider env commonly
+                # carries API keys/tokens, and the point here is "does this
+                # instance carry the key the coordinator's does", not the
+                # secret itself.
+                try:
+                    local_env_keys = sorted(local.env())  # type: ignore[attr-defined]
+                except Exception:  # noqa: BLE001 — logging must never break dispatch
+                    local_env_keys = None
+                wire_env_keys = sorted((spec.provider_def or {}).get("env") or {})
+                _log.info(
+                    "coord agent: provider %r resolved from this agent's "
+                    "local providers.definitions (env keys=%s), overriding "
+                    "the coordinator's wire-carried provider_def (env "
+                    "keys=%s) — local-wins-over-wire is deliberate "
+                    "precedence (#1796); if that's not what you expected, "
+                    "check this agent's own coordinator.yml for a stale "
+                    "definition (#2326)",
+                    spec.provider,
+                    local_env_keys,
+                    wire_env_keys,
+                )
+            return local
         if spec.provider_def is not None:
             from coord.providers import build_provider_from_wire  # noqa: PLC0415
 

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/coord/commands/agent_ops.py

@@ -333,9 +333,12 @@ def _resolve_agent_startup(
     if cfg.path is not None:
         notices.append(
             f"coord agent: watching {cfg.path} for edits — repos, repo_paths, "
-            "capabilities, artifact_paths and build_command are re-read on the "
-            "next /health poll, no restart needed (#2299). RESTART-ONLY: "
-            "providers, concurrency (bash_wrap_spawn/first_output_timeout), "
+            "capabilities, artifact_paths, build_command and (#2326) "
+            "providers.definitions are re-read on the next /health poll or "
+            "dispatch, no restart needed (#2299). providers.definitions "
+            "changes apply to the NEXT dispatch of that provider name — an "
+            "in-flight assignment keeps the definition it started with. "
+            "RESTART-ONLY: concurrency (bash_wrap_spawn/first_output_timeout) "
             "and the bind host/port."
         )
     else:

{code_coordinator-0.5.115 → code_coordinator-0.5.117}/coord/commands/dispatch.py

@@ -1797,9 +1797,12 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
     from coord.board_service import read_board, write_board
     from coord.models import WORK_LIKE_TYPES
     from coord.reconcile import (
+        RetryProviderMismatch,
         UnsupportedRetryType,
         _reassign,
+        _resolve_retry_provider,
         describe_no_candidate_machines,
+        describe_retry_provider_mismatch,
         describe_unsupported_retry_type,
     )
 
@@ -1920,14 +1923,59 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
         click.echo(f"error: {describe_unsupported_retry_type(exc)}", err=True)
         sys.exit(1)
 
-    # Determine escalated model for the retry.
+    # #2323: resolve (and #437 TOS-guard) the provider this retry would
+    # dispatch through BEFORE deciding anything about the model — printed
+    # up front so it's never left for the drive's own header to contradict
+    # four seconds later, and checked before the escalation message so a
+    # refusal is never preceded by a reassuring "escalating model" line for
+    # a retry that's about to be refused. `providers.labels` is consulted
+    # the same way a first work dispatch consults it (gated to
+    # `type="work"`, coord/dispatch.py:548); a genuine `harness:opencode`
+    # label match here means retry lands back on `opencode`, not the
+    # claude default that a label-blind resolution used to fall through to.
+    from coord.state import get_cached_issue_labels  # noqa: PLC0415
+
+    issue_labels = get_cached_issue_labels(
+        assignment.repo_name, assignment.issue_number,
+    )
+    try:
+        resolved_provider_name = _resolve_retry_provider(assignment, cfg, issue_labels)
+    except RetryProviderMismatch as exc:
+        click.echo(f"error: {describe_retry_provider_mismatch(exc)}", err=True)
+        sys.exit(1)
+    except ValueError as exc:
+        click.echo(f"error: {exc}", err=True)
+        sys.exit(1)
+    click.echo(f"  provider: {resolved_provider_name}")
+
+    # Determine escalated model for the retry. #2323: `cfg.models.
+    # next_model` walks the claude tier ladder — only meaningful when this
+    # retry actually resolves to a claude-family provider. The precheck
+    # above already guarantees `resolved_provider_name` matches the failed
+    # run's own provider (else it would have refused), so gating on the
+    # resolved provider's TYPE here is equivalent to gating on the failed
+    # run's, without a second lookup.
+    from coord.config import IMPLICIT_PROVIDER_TYPES  # noqa: PLC0415
+    from coord.providers import provider_type_for  # noqa: PLC0415
+
     original_model = assignment.model or cfg.models.default
-    escalated = cfg.models.next_model(original_model)
-    if escalated != original_model:
-        click.echo(f"  escalating model: {original_model} → {escalated}")
+    if provider_type_for(resolved_provider_name, cfg.providers) in IMPLICIT_PROVIDER_TYPES:
+        escalated = cfg.models.next_model(original_model)
+        if escalated != original_model:
+            click.echo(f"  escalating model: {original_model} → {escalated}")
+        retry_model = escalated
+    else:
+        # Not a claude-family provider — the escalation ladder doesn't
+        # apply; reuse the failed run's own model field exactly (`None`
+        # tells `_reassign` to reuse `assignment.model` verbatim, rather
+        # than stamping `original_model`'s `cfg.models.default` fallback
+        # onto a provider that fallback means nothing to).
+        retry_model = None
 
     try:
-        result = _reassign(assignment, board, cfg, model=escalated)
+        result = _reassign(
+            assignment, board, cfg, model=retry_model, issue_labels=issue_labels,
+        )
     except UnsupportedRetryType as exc:
         # Defense in depth — the precheck above already covers this, but
         # `_reassign` is shared with `auto_reassign` and must never silently
@@ -1935,12 +1983,19 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
         # precheck.
         click.echo(f"error: {describe_unsupported_retry_type(exc)}", err=True)
         sys.exit(1)
+    except RetryProviderMismatch as exc:
+        # Defense in depth — the precheck above already covers this, but
+        # `_reassign` is shared with `auto_reassign` and must never
+        # silently substitute the provider even if a future caller skips
+        # the precheck.
+        click.echo(f"error: {describe_retry_provider_mismatch(exc)}", err=True)
+        sys.exit(1)
     if result is None:
         # #1396: name the blocking machines and their apparent load instead
         # of a bare "no available machine" — the usual cause is a phantom
         # `running` row from a dead interactive session nothing reaped.
         click.echo(
-            f"error: {describe_no_candidate_machines(assignment, board, cfg)}",
+            f"error: {describe_no_candidate_machines(assignment, board, cfg, issue_labels)}",
             err=True,
         )
         sys.exit(1)
@@ -1960,7 +2015,7 @@ def retry(assignment_id: str, config_path: Path, acknowledge_cost: bool = False)
     click.echo(
         f"Retried: {result.machine_name} → {result.repo_name} "
         f"#{result.issue_number} (assignment {result.assignment_id}, "
-        f"type={result.type})"
+        f"type={result.type}, provider={resolved_provider_name})"
     )
     # #1101: surface the continued branch so it's obvious the retry picked
     # up existing work instead of forking a fresh branch off the default.