code-coordinator 0.5.118__tar.gz → 0.5.120__tar.gz

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.118
+Version: 0.5.120
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.118
+Version: 0.5.120
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/code_coordinator.egg-info/SOURCES.txt

@@ -342,6 +342,7 @@ coord/providers/base.py
 coord/providers/claude.py
 coord/providers/claude_pty.py
 coord/providers/opencode.py
+coord/skills/portal-followup/SKILL.md
 coord/skills/update-issue/SKILL.md
 deploy/coord-agent.service
 deploy/coord-db-backup.service
@@ -783,6 +784,15 @@ tests/acceptance/ms-51/home-active.spec.ts
 tests/acceptance/ms-51/manifest.yml
 tests/acceptance/ms-51/tsconfig.json
 tests/acceptance/ms-51/mocks/home-active.html
+tests/acceptance/ms-65/contract.md
+tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen
+tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen
+tests/acceptance/ms-65/mocks/board-preview-tab.screen
+tests/acceptance/ms-65/mocks/board-split-side-by-side.screen
+tests/acceptance/ms-65/mocks/board-tab-context-menu.screen
+tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen
+tests/acceptance/ms-65/mocks/board-tabs-overflow.screen
+tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen
 tests/acceptance/ms-example/mocks/home-active.html
 tests/fixtures/board-pipeline-basic.json
 tests/fixtures/board-pipeline-terminal-gates.json

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/code_coordinator.egg-info/scm_file_list.json

@@ -305,6 +305,7 @@
     "coord/review.py",
     "coord/scorecard.py",
     "coord/serve_app.py",
+    "coord/skills/portal-followup/SKILL.md",
     "coord/skills/update-issue/SKILL.md",
     "coord/smoke.py",
     "coord/spend_ceiling.py",
@@ -428,6 +429,15 @@
     "tests/acceptance/ms-51/manifest.yml",
     "tests/acceptance/ms-51/mocks/home-active.html",
     "tests/acceptance/ms-51/tsconfig.json",
+    "tests/acceptance/ms-65/contract.md",
+    "tests/acceptance/ms-65/mocks/board-baseline-no-tabs.screen",
+    "tests/acceptance/ms-65/mocks/board-pinned-3-tabs.screen",
+    "tests/acceptance/ms-65/mocks/board-preview-tab.screen",
+    "tests/acceptance/ms-65/mocks/board-split-side-by-side.screen",
+    "tests/acceptance/ms-65/mocks/board-tab-context-menu.screen",
+    "tests/acceptance/ms-65/mocks/board-tabs-help-overlay.screen",
+    "tests/acceptance/ms-65/mocks/board-tabs-overflow.screen",
+    "tests/acceptance/ms-65/mocks/pipeline-tabs-independent.screen",
     "tests/acceptance/ms-example/mocks/home-active.html",
     "tests/conftest.py",
     "tests/fixtures/board-pipeline-basic.json",

code_coordinator-0.5.120/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.120",
+  "distance": 0,
+  "node": "g73a6cc8774d10c7a9a405ba25bd93f772ff445ab",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-17"
+}

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/coord/agent.py

@@ -3500,10 +3500,14 @@ MILESTONE_CHAT_DENY_COMMANDS: list[str] = [
     "Bash(git push *)",
     "Bash(git commit *)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
     "Bash(coord approve *)",
     "Bash(coord merge *)",
     "Bash(coord assign *)",
@@ -3575,11 +3579,19 @@ manually verify in the rendered mock.
 MOCK_AUTHOR_DENY_COMMANDS: list[str] = [
     "Bash(gh *)",
     "Bash(git push --force*)",
+    # #2314: the entry above only matches `--force` IMMEDIATELY after
+    # `push` — a `git push --quiet --force ...` with another flag pushed
+    # in first would evade it.
+    "Bash(git push * --force*)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
     "Bash(coord approve *)",
     "Bash(coord merge *)",
     "Bash(coord assign *)",
@@ -3599,10 +3611,14 @@ NEW_ISSUE_CHAT_DENY_COMMANDS: list[str] = [
     "Bash(git push *)",
     "Bash(git commit *)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
 ]
 
 
@@ -3637,6 +3653,46 @@ def build_deny_prompt(deny_commands: list[str]) -> str:
     )
 
 
+def bash_deny_pattern_matches(pattern: str, command: str) -> bool:
+    """Whether *command* (a raw shell command string) is caught by a single
+    ``Bash(...)`` deny *pattern*, using the same shell-glob semantics those
+    patterns are written in throughout this module (``*`` matches any run of
+    characters, including none, and including across what would look like an
+    argv token boundary — this is a whole-string glob, not an argv-aware
+    parse).
+
+    #2314: a worker evaded ``Bash(pip install -e *)`` simply by inserting
+    another flag first (``pip install --user -e .``) — the pattern only
+    matched ``-e`` IMMEDIATELY after ``install``. This function exists so
+    that claim ("this deny list actually catches that evasion") is a
+    testable fact rather than something read off the pattern text by eye —
+    see the ``Bash(...)`` entries :data:`coord.config.DEFAULT_DENY_COMMANDS`
+    pairs for exactly this reason, and ``tests/test_worker_safety.py`` for
+    the regression tests built on top of this function.
+
+    Returns ``False`` for a *pattern* that isn't a ``Bash(...)`` rule at all
+    (e.g. an ``Edit(...)``/``Write(...)`` path rule) — those constrain a
+    different tool and never match a shell command string.
+    """
+    if not (pattern.startswith("Bash(") and pattern.endswith(")")):
+        return False
+    inner = pattern[5:-1]
+    return fnmatch.fnmatchcase(command.strip(), inner)
+
+
+def find_denying_bash_pattern(command: str, deny_commands: list[str]) -> str | None:
+    """The first pattern in *deny_commands* that blocks *command*, or ``None``.
+
+    Thin fold over :func:`bash_deny_pattern_matches` — a worker's own deny
+    list is small (single digits to low tens of entries), so a linear scan
+    needs no index.
+    """
+    for pattern in deny_commands:
+        if bash_deny_pattern_matches(pattern, command):
+            return pattern
+    return None
+
+
 # #1315: sealed-oracle path prefix that only an independent authoring type
 # (``"mock-author"``/a future ``"test-author"``) may ever write to
 # (docs/ORACLE_LOOP.md sealing v1). ``coord.dispatch.dispatch`` already

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/coord/cli.py

@@ -300,49 +300,80 @@ def _warn_if_source_install_drift() -> None:
         pass
 
 
-def _warn_if_editable_checkout_moved() -> None:
-    """#561/#601 backstop: when running from an EDITABLE checkout, warn loudly if
-    its branch was moved off the default.
-
-    A Build/`coord test`/smoke that git-checkout'd the base — or an interactive
-    agent inspecting a branch in the live checkout — silently puts the running
-    coordinator on that branch's code until restored (#561 incident: disabled
-    guards; #601 incident: old code + retired local DB). This makes that state
-    visible on every command instead of waiting for a verdict or manual restore.
+def _editable_checkout_drift() -> tuple[Path, str] | None:
+    """Pure query behind both #561/#601's CLI warning and #2314's
+    drive-queue tick refusal (:mod:`coord.drive_queue`): is THIS process an
+    EDITABLE checkout of coord, and if so, is it on a branch other than the
+    default one?
+
+    A Build/`coord test`/smoke that git-checkout'd the base — or an
+    interactive agent inspecting a branch in the live checkout — silently
+    puts the running coordinator on that branch's code until restored (#561
+    incident: disabled guards; #601 incident: old code + retired local DB).
+
+    Returns ``(repo_root, shown)`` when drifted — ``shown`` is the branch
+    name formatted the way both callers print it (quoted, or
+    ``"(detached HEAD)"``) — or ``None`` when this is a non-editable/
+    site-packages install, isn't a git checkout at all, is cleanly on
+    ``main``/``master``, or the check itself couldn't be completed (git not
+    on PATH, no ``.git``, a timeout). Every failure mode here is read-only
+    and best-effort, so it degrades to "no drift detected" rather than
+    raising — a flaky read must never itself block a tick or crash a
+    command.
     """
     import subprocess  # noqa: PLC0415
-    import sys as _sys  # noqa: PLC0415
 
-    if "pytest" in _sys.modules:
-        return  # don't add startup noise to the test suite
     try:
         import coord as _coord  # noqa: PLC0415
 
         coord_file = _coord.__file__ or ""
         if "site-packages" in coord_file:
-            return  # PyPI/snapshot install — moving a checkout can't affect it.
+            return None  # PyPI/snapshot install — moving a checkout can't affect it.
         repo_root = Path(coord_file).resolve().parents[1]
         if not (repo_root / ".git").exists():
-            return
+            return None
         head = subprocess.run(
             ["git", "rev-parse", "--abbrev-ref", "HEAD"],
             cwd=str(repo_root), capture_output=True, text=True, timeout=3,
         )
         if head.returncode != 0:
-            return
+            return None
         branch = head.stdout.strip()
         if branch in ("main", "master"):
-            return
+            return None
         shown = "(detached HEAD)" if branch == "HEAD" else f"'{branch}'"
-        click.echo(
-            f"⚠ coord: editable checkout {repo_root} is on {shown}, not the "
-            "default branch — the running coordinator is on THAT code. A "
-            "Build/smoke/test may have checked it out. Restore with:  "
-            f"git -C {repo_root} checkout main",
-            err=True,
-        )
-    except Exception:  # noqa: BLE001 — best-effort, never break the CLI
-        pass
+        return (repo_root, shown)
+    except Exception:  # noqa: BLE001 — best-effort, never break the caller
+        return None
+
+
+def _warn_if_editable_checkout_moved() -> None:
+    """#561/#601 backstop: when running from an EDITABLE checkout, warn loudly if
+    its branch was moved off the default.
+
+    This makes that state visible on every command instead of waiting for a
+    verdict or manual restore. #2314 escalated the SAME underlying reading
+    (:func:`_editable_checkout_drift`) from advisory-only here to a hard
+    refusal inside the drive-queue tick gate — see
+    ``coord.drive_queue.plan_tick``'s ``editable_drift`` parameter — because
+    a warning nobody is watching an unattended tick's log for is not a gate.
+    This function stays as the interactive/human-facing half of that fix.
+    """
+    import sys as _sys  # noqa: PLC0415
+
+    if "pytest" in _sys.modules:
+        return  # don't add startup noise to the test suite
+    drift = _editable_checkout_drift()
+    if drift is None:
+        return
+    repo_root, shown = drift
+    click.echo(
+        f"⚠ coord: editable checkout {repo_root} is on {shown}, not the "
+        "default branch — the running coordinator is on THAT code. A "
+        "Build/smoke/test may have checked it out. Restore with:  "
+        f"git -C {repo_root} checkout main",
+        err=True,
+    )
 
 
 @click.group(help="Multi-agent coordinator for Claude Code workers.")

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/coord/commands/drive_queue.py

@@ -1634,6 +1634,42 @@ def _fetch_cordons() -> dict[str, str]:
         return {}
 
 
+def _fetch_editable_drift() -> tuple[str, str] | None:
+    """``(repo_root, shown)`` when THIS host's own `coord` is an editable
+    checkout that has drifted off its default branch, else ``None`` (#2314).
+
+    Thin wrapper around ``coord.cli._editable_checkout_drift`` — the exact
+    same read `coord.cli._warn_if_editable_checkout_moved` uses for its
+    CLI-startup warning — reshaped to a plain ``(str, str)`` tuple so
+    :func:`coord.drive_queue.plan_tick` (a pure function; see its module
+    docstring) never has to import ``coord.cli`` or touch a ``Path``.
+    Already fail-soft/best-effort at the source (see that function's
+    docstring); this wrapper adds nothing on top beyond the reshape and the
+    ``str(repo_root)`` conversion.
+
+    Same ``"pytest" in sys.modules`` guard as
+    ``_warn_if_editable_checkout_moved`` — for the identical reason: this
+    repo's OWN test suite runs from an editable checkout on a feature
+    branch as a matter of course (that is what a worker's worktree is), so
+    without the guard every CLI-level `drive-queue tick` test would trip
+    this exact gate on itself. `coord.drive_queue.plan_tick`'s own tests
+    (tests/test_drive_queue.py) exercise the real gate logic directly via
+    its ``editable_drift`` parameter, unaffected by this guard.
+    """
+    import sys as _sys  # noqa: PLC0415
+
+    if "pytest" in _sys.modules:
+        return None
+
+    from coord.cli import _editable_checkout_drift  # noqa: PLC0415
+
+    drift = _editable_checkout_drift()
+    if drift is None:
+        return None
+    repo_root, shown = drift
+    return (str(repo_root), shown)
+
+
 def _fetch_board_view() -> BoardView:
     """Board + live drive sessions, typed.
 
@@ -2316,6 +2352,13 @@ def drive_queue_tick(
         # a rollable state.
         cordons = _fetch_cordons()
 
+        # #2314: is THIS host's own `coord` a drifted editable checkout?
+        # Escalates `coord.cli._warn_if_editable_checkout_moved` from an
+        # advisory-only startup warning (nothing unattended ever reads) to
+        # an actual refusal — see `_editable_drift_alert` and `plan_tick`'s
+        # `editable_drift` parameter for the gate itself.
+        editable_drift = _fetch_editable_drift()
+
         # #1794: the clock is the shell's to read, never `coord.drive_queue`'s.
         # It powers the startup grace window on both sides of the tick — a
         # drive launched seconds ago is `starting`, not dead, and cannot be
@@ -2342,6 +2385,7 @@ def drive_queue_tick(
             cordons=cordons,
             live_ci_gate=live_ci_gate,
             live_blocked_gate=live_blocked_gate,
+            editable_drift=editable_drift,
         )
 
         if reconcile_only:

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/coord/commands/portal.py

@@ -17,10 +17,16 @@ operator see and drive it without waiting for a tick:
 * ``requeue`` revives a row the drain retired after burning its retry budget.
 
 The state-touching commands (``sync``, ``outbox``, ``events``, ``enqueue-*``,
-``requeue``)
-read and write the daemon's own ``~/.coord/coord.db`` and are therefore
-**daemon-host commands**. Run from a thin client they operate on that box's
-empty local DB, which is not where the bridge lives.
+``requeue``) read and write the daemon's own ``~/.coord/coord.db`` and are
+therefore **daemon-host commands**. Run from a thin client they used to silently
+operate on that box's empty local DB, which is not where the bridge lives —
+producing a normal-looking "nothing pending" instead of an error (#2336).
+Every one of them now calls :func:`_refuse_if_thin_client` first, which
+raises a loud, explicit error instead when ``board_service`` is configured
+(i.e. this machine is a thin client per ``coord/client.py``'s bootstrap
+contract) rather than silently reading the wrong box's empty tables. There is
+no daemon-proxy for these yet (Option A in #2336 — a bigger lift, left for a
+follow-up); this is the "fail loud instead of running wrong" half.
 """
 
 from __future__ import annotations
@@ -30,6 +36,7 @@ import json
 import click
 
 from coord.commands._common import _CONFIG_OPTION, _load_config
+from coord.config import has_unexpanded_env_var
 from coord.portal_bridge import (
     PortalBridgeError,
     SUBMISSION_STATUSES,
@@ -37,6 +44,48 @@ from coord.portal_bridge import (
 )
 
 
+def _refuse_if_thin_client(cmd_name: str) -> None:
+    """Refuse *cmd_name* when this machine isn't the daemon host (#2336).
+
+    ``sync``/``outbox``/``events``/``enqueue-*``/``requeue`` read and write
+    the daemon's own ``~/.coord/coord.db`` directly — there is no daemon
+    proxy for portal state yet (unlike ``coord status``/``coord log``/etc,
+    which already route through ``board_service`` when it's configured; see
+    ``coord/client.py``'s module docstring for the bootstrap contract). Run
+    on a machine that has ``board_service`` set in ``~/.coord/client.toml``
+    (a thin client, by definition — every other machine in the fleet that
+    isn't the daemon host), these commands would read/write that machine's
+    own empty local DB and report a normal-looking, silently wrong result
+    (2026-08-16 incident: a customer ``signoff.approved`` event sat
+    unnoticed on the daemon host for over an hour because every portal
+    command run from a thin client reported nothing pending).
+
+    Mirrors the guard already used for the same reason in
+    ``coord.commands.drive_queue``'s ``diagnose`` command (#615/#906), which
+    refuses rather than "diagnose an empty queue" on a thin client. The
+    local-vs-daemon decision goes through ``coord.board_service`` — the #749
+    facade that exists precisely so call sites stop hand-rolling
+    ``resolve_board_service()`` — rather than importing ``coord.client``
+    directly. ``resolve()`` and not ``is_remote()`` because the error names
+    the host the operator should ssh to, which needs the resolved URL.
+    """
+    from coord.board_service import resolve  # noqa: PLC0415
+
+    svc = resolve()
+    if svc is None:
+        return
+    from urllib.parse import urlparse  # noqa: PLC0415
+
+    host = urlparse(svc.url).hostname or svc.url
+    raise click.ClickException(
+        f"coord portal {cmd_name} must run on the daemon host ({host}) — "
+        "this machine's ~/.coord/coord.db is not where the bridge lives "
+        "(board_service is configured in ~/.coord/client.toml, making this "
+        "a thin client). Run it over `ssh` on the daemon host instead. "
+        "See coord/skills/portal-followup/SKILL.md."
+    )
+
+
 @click.group("portal")
 def portal_group() -> None:
     """coord-portal sync bridge — status, manual push, heartbeat (#2179)."""
@@ -48,10 +97,20 @@ def portal_group() -> None:
 def portal_status(config_path, as_json: bool) -> None:
     """Show whether the portal bridge is configured, without sending anything."""
     cfg = _load_config(config_path).portal
+    # #2336: a non-empty-string check alone can't tell "resolved to a real
+    # secret" from "the ${VAR} placeholder was never expanded because the
+    # env var wasn't set in this shell" — both are non-empty strings. Reject
+    # either credential if it still carries an unexpanded placeholder.
+    credentials_set = bool(
+        cfg.bridge_client_id
+        and cfg.bridge_client_secret
+        and not has_unexpanded_env_var(cfg.bridge_client_id)
+        and not has_unexpanded_env_var(cfg.bridge_client_secret)
+    )
     payload = {
         "enabled": cfg.enabled,
         "base_url": cfg.base_url,
-        "credentials_set": bool(cfg.bridge_client_id and cfg.bridge_client_secret),
+        "credentials_set": credentials_set,
         "timeout_secs": cfg.timeout_secs,
         "max_retries": cfg.max_retries,
     }
@@ -151,6 +210,8 @@ def portal_sync_once(config_path, as_json: bool) -> None:
 
     Daemon-host command: it reads and writes the daemon's ~/.coord/coord.db.
     """
+    _refuse_if_thin_client("sync")
+
     from coord import portal_sync as _sync  # noqa: PLC0415
 
     config = _load_config(config_path)
@@ -198,6 +259,8 @@ def portal_outbox(as_json: bool, show_all: bool) -> None:
     refusing to announce something to the customer before the thing it
     announces has been confirmed applied.
     """
+    _refuse_if_thin_client("outbox")
+
     from coord import portal_store  # noqa: PLC0415
     from coord.portal_sync import ordering_block_reason  # noqa: PLC0415
 
@@ -277,6 +340,8 @@ def portal_outbox(as_json: bool, show_all: bool) -> None:
 @click.option("--limit", type=int, default=20, show_default=True)
 def portal_events(as_json: bool, limit: int) -> None:
     """List pulled, not-yet-consumed customer events (the inbound half)."""
+    _refuse_if_thin_client("events")
+
     from coord import portal_store  # noqa: PLC0415
 
     events = portal_store.unhandled_events(limit=limit)
@@ -315,6 +380,8 @@ def portal_enqueue_status(submission_id: str, status: str) -> None:
     that would summon the customer to an empty screen — `awaiting-signoff`
     with no design round queued, `needs-input` with no question (#835).
     """
+    _refuse_if_thin_client("enqueue-status")
+
     from coord.portal_sync import PortalSyncError, enqueue_status  # noqa: PLC0415
 
     try:
@@ -338,6 +405,8 @@ def portal_enqueue_design_round(submission_id: str, payload_json: str) -> None:
     expected to carry whatever reference the customer's browser follows, plus
     a `round` number if this is not the first.
     """
+    _refuse_if_thin_client("enqueue-design-round")
+
     from coord.portal_sync import PortalSyncError, enqueue_design_round  # noqa: PLC0415
 
     try:
@@ -361,6 +430,8 @@ def portal_enqueue_design_round(submission_id: str, payload_json: str) -> None:
 @click.argument("question")
 def portal_enqueue_question(submission_id: str, question: str) -> None:
     """Queue an open question for SUBMISSION_ID (sent on the next sync)."""
+    _refuse_if_thin_client("enqueue-question")
+
     from coord.portal_sync import PortalSyncError, enqueue_question  # noqa: PLC0415
 
     try:
@@ -389,6 +460,8 @@ def portal_requeue(submission_id: str, seq: int) -> None:
 
     Find the seq with `coord portal outbox --all`.
     """
+    _refuse_if_thin_client("requeue")
+
     from coord import portal_store  # noqa: PLC0415
 
     row = portal_store.requeue(submission_id, seq)

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/coord/config.py

@@ -73,15 +73,66 @@ def is_canonical_config_path(path: Path) -> bool:
 
 
 # Safety-by-default: repos without explicit worker_permissions get this deny-list.
+#
+# #2314: every ``Bash(<verb> <flag> *)`` entry only matches *flag* IMMEDIATELY
+# after *verb* — a worker that inserted one more flag first (or swapped a
+# combined short flag's letter order) sailed straight through undetected. The
+# `git push`/`rm` entries below each pair the original adjacent form with a
+# reordering-safe one (an interior ``*`` before the flag, or — for `rm` — the
+# `-fr` letter-swap of `-rf`); this is the "audit other Bash(...) deny
+# patterns for the same positional weakness" half of #2314, not exhaustive
+# (it does not attempt to catch shell chaining/subshells, which is a
+# different, much larger problem than argv flag position).
 DEFAULT_DENY_COMMANDS: list[str] = [
     "Bash(gh *)",
     "Bash(git push --force *)",
     "Bash(git push -f *)",
+    "Bash(git push * --force *)",
+    "Bash(git push * -f *)",
     "Bash(git reset --hard *)",
+    "Bash(git reset * --hard *)",
     "Bash(git branch -D *)",
+    "Bash(git branch * -D *)",
     "Bash(git checkout -- .)",
     "Bash(git clean -f *)",
+    "Bash(git clean * -f *)",
     "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
+    # #2314: a worker ran `pip install --break-system-packages -e .` — an
+    # editable install of coord's own source re-links (or, combined with
+    # `--user`/`--break-system-packages`, outright shadows) the interpreter
+    # `coord` itself is running under, out from under this and every other
+    # session on the box (see coord/cli.py's
+    # `_warn_if_source_install_drift`/`_editable_checkout_drift`). The old
+    # single `Bash(pip install -e *)` entry only matched `-e` IMMEDIATELY
+    # after `install`, so putting any other flag first evaded it entirely.
+    # Every entry below is duplicated with a leading `*` (covers `python -m
+    # pip install ...` / `python3 -m pip install ...`, which reach the exact
+    # same installer) and, for `-e`/`--editable` specifically, ALSO with an
+    # interior `*` before the flag (covers it appearing anywhere in argv,
+    # not just first) — the adjacent form alone still catches
+    # `pip install -e --break-system-packages .` (the flag being pushed
+    # AFTER `-e` doesn't break the immediate `install -e` adjacency), but
+    # not `pip install --break-system-packages -e .` (something pushed
+    # BEFORE it).
+    "Bash(pip install -e *)",
+    "Bash(*pip install -e *)",
+    "Bash(pip install * -e *)",
+    "Bash(*pip install * -e *)",
+    "Bash(pip install --editable *)",
+    "Bash(*pip install --editable *)",
+    "Bash(pip install * --editable *)",
+    "Bash(*pip install * --editable *)",
+    # `--break-system-packages` / `--user` are denied INDEPENDENTLY of
+    # `-e`/`--editable` — either flag alone, on a perfectly ordinary
+    # non-editable `pip install`, still lets a worker write into (or
+    # reconfigure) the interpreter coord itself runs under. No adjacency
+    # requirement at all: both are boolean flags a real `pip install`
+    # invocation can place anywhere after `install`.
+    "Bash(pip install *--break-system-packages*)",
+    "Bash(*pip install *--break-system-packages*)",
+    "Bash(pip install *--user*)",
+    "Bash(*pip install *--user*)",
 ]
 
 
@@ -3321,6 +3372,31 @@ def _expand_env_vars(value: str) -> str:
     return _ENV_VAR_RE.sub(_replace, value)
 
 
+def has_unexpanded_env_var(value: str | None) -> bool:
+    """Whether *value* still contains an unexpanded ``${VAR}`` placeholder.
+
+    #2336: :func:`_expand_env_vars` leaves an unset variable's placeholder
+    untouched — ``${MISSING}`` stays the literal string ``"${MISSING}"`` —
+    so a plain ``bool(value)`` check on the *result* can't tell "this
+    resolved to a real secret" from "the env var was never set in this
+    process's environment": both are non-empty strings. This is the
+    "actually resolved" check the config's own env-var expansion needs a
+    caller to run afterward — e.g. ``coord portal status``'s
+    ``credentials_set`` used to report ``true`` for
+    ``portal.bridge_client_id: "${BRIDGE_CLIENT_ID}"`` even when
+    ``BRIDGE_CLIENT_ID`` was never exported into the shell the command ran
+    in, which read as "credentials fine" while troubleshooting what was
+    actually a missing-env-var problem.
+
+    ``None`` is treated as not-a-placeholder (``False``) — an unset field is
+    a separate "not configured" state, distinct from "configured but the
+    env var didn't resolve".
+    """
+    if value is None:
+        return False
+    return bool(_ENV_VAR_RE.search(value))
+
+
 #: Matches exactly what opencode's own ``OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX``
 #: parser (#2321) accepts as a *string form* of a number: one or more ASCII
 #: digits, nothing else — no sign, no decimal point, no whitespace, no

{code_coordinator-0.5.118 → code_coordinator-0.5.120}/coord/conflict_fix.py

@@ -70,6 +70,13 @@ CONFLICT_FIX_DENY_COMMANDS = [
     "Bash(gh *)",
     "Bash(git push --force *)",
     "Bash(git push -f *)",
+    # #2314: the two entries above only match `--force`/`-f` IMMEDIATELY
+    # after `push` — a `--force-with-lease` push (the sanctioned, allowed
+    # form, see this module's own guidance above) must stay clear, but
+    # `git push --quiet --force ...` / `git push --quiet -f ...` (the flag
+    # pushed after some other one) must not evade the ban either.
+    "Bash(git push * --force *)",
+    "Bash(git push * -f *)",
 ]