code-coordinator 0.5.117__tar.gz → 0.5.118__tar.gz

{code_coordinator-0.5.117 → code_coordinator-0.5.118}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.117
+Version: 0.5.118
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.117 → code_coordinator-0.5.118}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.117
+Version: 0.5.118
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.117 → code_coordinator-0.5.118}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.117",
+  "tag": "0.5.118",
   "distance": 0,
-  "node": "g8f82380a31b6a3d5fd2dea0b4528a11a28c52148",
+  "node": "ga164f2b76c36b1f04ec37e5e170dee3d87ea7c43",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-16"

{code_coordinator-0.5.117 → code_coordinator-0.5.118}/coord/agents/opencode/agents/work.md

@@ -63,6 +63,40 @@ there are lost, or collide with other workers running at the same time. If \
 your worktree looks unexpectedly empty or unwritable, STOP and report it — \
 do not fall back to editing the base checkout and copying files over.
 
+Write incrementally — this is the single most important rule in this file:
+- Every request you make has a hard output-token budget, and on a \
+reasoning model those tokens are shared with your own thinking. Truncation \
+can happen at any budget size — raising the ceiling makes it rarer, not \
+impossible — so the rule below holds regardless of what the current limit \
+is.
+- Write each file as soon as its content is decided. Do NOT design the \
+whole change, plan every file, and only then start emitting `write`/`edit` \
+calls — a turn that spends its whole budget reasoning can be truncated \
+before it emits a single tool call. Truncation produces a clean-looking \
+exit with zero commits and nothing on disk: the work is not "mostly done", \
+it is entirely lost, because nothing you only thought about was ever sent \
+as a tool call.
+- Prefer many small steps over one large one: read/understand one file, \
+write it, move to the next. Small increments stay nowhere near the cap; \
+a single-shot "figure out the whole diff, then write it all" turn is what \
+exhausts it.
+- Issue one command per `bash` call — do not chain with `&&`, `;` or `|`. \
+Permission rules are prefix-matched against the whole command string, so \
+`git status && git log` matches no `allow` entry and is denied outright, \
+wasting a turn for nothing. Run `git status`, then separately `git log`.
+- These are the only `bash` commands you can run; everything else is \
+denied, including `pwd`, `ls`, `cat` and `grep` (use your own file-read \
+and search tools for those): `git status`, `git diff`, `git log`, \
+`git show`, `git add`, `git commit`, `git checkout`, `git branch`, \
+`git rev-parse`, `git push`, `cargo …`, `make…`, `pytest…`, \
+`python3 -m pytest…`, `python -m pytest…`, `npm …`, `pip install…`, \
+`pip3 install…`. `gh` is denied — the coordinator owns GitHub.
+- If a `bash` or `edit` call does come back denied, don't probe with \
+variations to find what's allowed — every denial replays the entire \
+permission ruleset back to you, burning output budget you need for \
+`write` calls without telling you anything the list above didn't already \
+say. Take the denial as final and move on.
+
 This session is ONE-SHOT and non-interactive:
 - There is no next turn and no human to reply to you. Background-task \
 completion notifications will NEVER reach you — nothing wakes you up.

{code_coordinator-0.5.117 → code_coordinator-0.5.118}/tests/test_providers.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import shlex
 import shutil
 import subprocess
@@ -2187,6 +2188,139 @@ def test_resolve_default_provider_opencode_allowed() -> None:
     assert isinstance(provider, OpenCodeProvider)
 
 
+# ── #2317: incremental-write instructions in work.md ────────────────────────
+#
+# opencode hard-caps every request's output tokens, shared with the model's
+# own reasoning on reasoning models. The exact ceiling is an
+# operator-tunable environment variable (see #2321) rather than a fixed
+# number, so these checks deliberately avoid pinning one — truncation can
+# happen at any budget size, it's just rarer at a higher ceiling. A worker
+# that designs the whole change before its first `write` can burn the
+# entire budget on reasoning and be truncated before it emits a single tool
+# call: a clean exit, zero commits, nothing on disk (space-invaders#1,
+# `8c95182b0749`). These are plain static-content checks on work.md's own
+# text — no real opencode binary required — that pin the instructions added
+# to head this off at the pass.
+
+
+def _opencode_work_md_text() -> str:
+    return (AGENTS_ROOT / "agents" / "work.md").read_text()
+
+
+def test_opencode_work_md_instructs_incremental_writes() -> None:
+    """work.md must tell the worker to write each file as soon as its
+    content is decided, instead of planning the whole change first — the
+    core fix for #2317."""
+    text = _opencode_work_md_text()
+    assert "incrementally" in text.lower()
+    assert "output-token budget" in text.lower() or "output budget" in text.lower()
+    assert "32,000" not in text
+    assert "do not" in text.lower() or "do NOT" in text
+
+
+def test_opencode_work_md_explains_truncation_loses_unwritten_work() -> None:
+    """The instruction must say *why* — a truncated turn emits no tool
+    call, so unwritten work is lost outright, not just delayed. #2317 asked
+    for this reasoning to be spelled out, not just asserted as a bare rule,
+    on the theory that a model that understands the mechanism holds the
+    line better than one following a rule it doesn't understand."""
+    text = _opencode_work_md_text()
+    assert "truncat" in text.lower()
+    assert "tool call" in text.lower()
+
+
+def test_opencode_work_md_forbids_compound_bash_commands() -> None:
+    """work.md's own permission block prefix-matches the whole bash command
+    string, so a compound command like `pwd && git status` matches no
+    `allow` entry and is denied outright (this burned the first turn of
+    claude-coordinator space-invaders#1). The instructions must tell the
+    worker to issue one command per `bash` call."""
+    text = _opencode_work_md_text()
+    assert "one command per" in text.lower()
+    assert "&&" in text
+
+
+def test_opencode_work_md_warns_denial_reprints_full_ruleset() -> None:
+    """A denied bash/edit call returns the entire permission ruleset back
+    to the model — noisy and more than it needs. work.md should tell the
+    worker not to probe for what's allowed and instead work within the
+    documented allow list the first time."""
+    text = _opencode_work_md_text()
+    assert "ruleset" in text.lower() or "permission list" in text.lower()
+
+
+def _opencode_work_md_bash_allow_prefixes() -> list[str]:
+    """The ``allow``-ed ``bash`` rule keys from work.md's frontmatter, with
+    the trailing ``*`` glob stripped.
+
+    Parsed with a line regex rather than a YAML load so the test keeps
+    working without pulling PyYAML into the test module's imports — the
+    block is a flat ``  "<pattern>": <decision>`` mapping, so nothing
+    subtler is warranted.
+    """
+    text = _opencode_work_md_text()
+    frontmatter = text.split("---")[1]
+    bash_block = frontmatter.split("bash:", 1)[1].split("edit:", 1)[0]
+    prefixes = []
+    for line in bash_block.splitlines():
+        match = re.match(r'\s*"(.+?)"\s*:\s*allow\s*$', line)
+        if match:
+            prefixes.append(match.group(1).rstrip("*").strip())
+    return prefixes
+
+
+def _opencode_work_md_allow_prefixes_sanity() -> list[str]:
+    prefixes = _opencode_work_md_bash_allow_prefixes()
+    # If this trips, the frontmatter parse broke, not the prose — without it
+    # the "documented" assertion below would pass vacuously on zero rules.
+    assert len(prefixes) >= 10, prefixes
+    return prefixes
+
+
+def test_opencode_work_md_documents_the_bash_allow_list() -> None:
+    """#2317: the cheapest way to stop denials from replaying the whole
+    ruleset back into the output-token budget is to stop the worker from
+    *earning* a denial — so the prompt body must name every allowed command
+    up front rather than leaving the agent to discover the list by probing.
+
+    Every ``allow``-ed rule in the frontmatter has to be mentioned in the
+    prose below it. Guards the two halves from drifting apart: adding a
+    carve-out to the permission block without telling the agent it exists
+    wastes the carve-out.
+    """
+    prefixes = _opencode_work_md_allow_prefixes_sanity()
+    body = _opencode_work_md_text().split("---", 2)[2]
+    missing = [p for p in prefixes if p not in body]
+    assert not missing, f"allow rules not documented in the prompt body: {missing}"
+
+
+def test_opencode_work_md_run_separately_examples_are_actually_allowed() -> None:
+    """The "one command per bash call" rule demonstrates itself with a
+    ``Run `x`, then separately `y`.`` example. Those example commands must
+    themselves survive the frontmatter allow list.
+
+    This is a real regression: the first draft of the #2317 text used
+    ``Run `pwd`, then separately `git status``` — but ``pwd`` matches no
+    allow rule and is swallowed by the ``"*": deny`` baseline, so following
+    the example verbatim earns exactly the denial the rule exists to
+    prevent, and replays the whole ruleset into the worker's budget.
+    """
+    body = _opencode_work_md_text().split("---", 2)[2]
+    sentence = re.search(r"Run `.+?\.\s", body, re.DOTALL)
+    assert sentence, "work.md lost its 'Run `x`, then separately `y`' example"
+    examples = re.findall(r"`([^`]+)`", sentence.group(0))
+    assert examples, "the example sentence names no commands"
+
+    prefixes = _opencode_work_md_allow_prefixes_sanity()
+    for command in examples:
+        assert any(
+            command.startswith(prefix) for prefix in prefixes
+        ), (
+            f"work.md tells the worker to run {command!r}, "
+            f"which its own permission block denies"
+        )
+
+
 # ── #1705: real end-to-end enforcement proof ────────────────────────────────
 #
 # Everything above this line tests coord's OWN code (argv construction, env
@@ -2414,6 +2548,60 @@ def test_opencode_work_agent_blocks_gh_end_to_end(tmp_path: Path) -> None:
         assert "permission" in str(state.get("error", "")).lower()
 
 
+@_requires_real_opencode
+def test_opencode_work_agent_deny_baseline_blocks_offlist_git_end_to_end(
+    tmp_path: Path,
+) -> None:
+    """PROOF for the ``"*": deny`` baseline itself: an off-allow-list
+    command is blocked inside a real opencode process even when nothing in
+    work.md's prose singles it out as forbidden.
+
+    Companion to ``test_opencode_work_agent_blocks_gh_end_to_end``, added
+    with #2317. That test probes with ``gh --version``, which work.md's
+    prose *also* forbids in as many words ("Do NOT run gh commands"), so
+    the model increasingly refuses on the advisory alone and the run
+    observes no enforcement — ``_require_attempt`` skips. #2317 made that
+    worse on purpose: documenting the allow list up front (so the worker
+    stops burning output-token budget earning denials that replay the whole
+    ruleset) means the model can now rule ``gh`` out without trying it.
+
+    ``git fetch origin`` restores an observable probe. It is denied purely
+    by the catch-all — ``git fetch*`` is on no ``allow`` line, while ten
+    other ``git *`` rules are — but reads as an ordinary, sanctioned step
+    rather than something the instructions call out, so the model attempts
+    it. If a future edit adds ``"git fetch*": allow``, this test's premise
+    is gone; the assertion below fails loudly rather than skipping, so
+    that edit can't pass unnoticed.
+    """
+    assert not any(
+        "git fetch".startswith(prefix)
+        for prefix in _opencode_work_md_bash_allow_prefixes()
+    ), "work.md now allows `git fetch` — this test needs a different off-list probe"
+
+    repo = _init_oc_throwaway_repo(tmp_path)
+    events = _run_real_opencode_work(
+        repo,
+        "Run 'git fetch origin' via bash and tell me the output.",
+    )
+    fetch_calls = [
+        e
+        for e in _bash_tool_calls(events)
+        if e["part"]
+        .get("state", {})
+        .get("input", {})
+        .get("command", "")
+        .strip()
+        .startswith("git fetch")
+    ]
+    _require_attempt(events, fetch_calls, "'git fetch origin' via bash")
+    for call in fetch_calls:
+        state = call["part"]["state"]
+        assert (
+            state.get("status") == "error"
+        ), f"off-list git call was not blocked: {call}"
+        assert "permission" in str(state.get("error", "")).lower()
+
+
 @_requires_real_opencode
 def test_opencode_work_agent_blocks_external_directory_access_end_to_end(
     tmp_path: Path,