code-coordinator 0.5.119__tar.gz → 0.5.120__tar.gz

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.119
+Version: 0.5.120
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.119
+Version: 0.5.120
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/code_coordinator.egg-info/SOURCES.txt

@@ -342,6 +342,7 @@ coord/providers/base.py
 coord/providers/claude.py
 coord/providers/claude_pty.py
 coord/providers/opencode.py
+coord/skills/portal-followup/SKILL.md
 coord/skills/update-issue/SKILL.md
 deploy/coord-agent.service
 deploy/coord-db-backup.service

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/code_coordinator.egg-info/scm_file_list.json

@@ -305,6 +305,7 @@
     "coord/review.py",
     "coord/scorecard.py",
     "coord/serve_app.py",
+    "coord/skills/portal-followup/SKILL.md",
     "coord/skills/update-issue/SKILL.md",
     "coord/smoke.py",
     "coord/spend_ceiling.py",

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.119",
+  "tag": "0.5.120",
   "distance": 0,
-  "node": "gb23236717c72c8a9be1338d9e8084ff44e2ae589",
+  "node": "g73a6cc8774d10c7a9a405ba25bd93f772ff445ab",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-17"

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/coord/commands/portal.py

@@ -17,10 +17,16 @@ operator see and drive it without waiting for a tick:
 * ``requeue`` revives a row the drain retired after burning its retry budget.
 
 The state-touching commands (``sync``, ``outbox``, ``events``, ``enqueue-*``,
-``requeue``)
-read and write the daemon's own ``~/.coord/coord.db`` and are therefore
-**daemon-host commands**. Run from a thin client they operate on that box's
-empty local DB, which is not where the bridge lives.
+``requeue``) read and write the daemon's own ``~/.coord/coord.db`` and are
+therefore **daemon-host commands**. Run from a thin client they used to silently
+operate on that box's empty local DB, which is not where the bridge lives —
+producing a normal-looking "nothing pending" instead of an error (#2336).
+Every one of them now calls :func:`_refuse_if_thin_client` first, which
+raises a loud, explicit error instead when ``board_service`` is configured
+(i.e. this machine is a thin client per ``coord/client.py``'s bootstrap
+contract) rather than silently reading the wrong box's empty tables. There is
+no daemon-proxy for these yet (Option A in #2336 — a bigger lift, left for a
+follow-up); this is the "fail loud instead of running wrong" half.
 """
 
 from __future__ import annotations
@@ -30,6 +36,7 @@ import json
 import click
 
 from coord.commands._common import _CONFIG_OPTION, _load_config
+from coord.config import has_unexpanded_env_var
 from coord.portal_bridge import (
     PortalBridgeError,
     SUBMISSION_STATUSES,
@@ -37,6 +44,48 @@ from coord.portal_bridge import (
 )
 
 
+def _refuse_if_thin_client(cmd_name: str) -> None:
+    """Refuse *cmd_name* when this machine isn't the daemon host (#2336).
+
+    ``sync``/``outbox``/``events``/``enqueue-*``/``requeue`` read and write
+    the daemon's own ``~/.coord/coord.db`` directly — there is no daemon
+    proxy for portal state yet (unlike ``coord status``/``coord log``/etc,
+    which already route through ``board_service`` when it's configured; see
+    ``coord/client.py``'s module docstring for the bootstrap contract). Run
+    on a machine that has ``board_service`` set in ``~/.coord/client.toml``
+    (a thin client, by definition — every other machine in the fleet that
+    isn't the daemon host), these commands would read/write that machine's
+    own empty local DB and report a normal-looking, silently wrong result
+    (2026-08-16 incident: a customer ``signoff.approved`` event sat
+    unnoticed on the daemon host for over an hour because every portal
+    command run from a thin client reported nothing pending).
+
+    Mirrors the guard already used for the same reason in
+    ``coord.commands.drive_queue``'s ``diagnose`` command (#615/#906), which
+    refuses rather than "diagnose an empty queue" on a thin client. The
+    local-vs-daemon decision goes through ``coord.board_service`` — the #749
+    facade that exists precisely so call sites stop hand-rolling
+    ``resolve_board_service()`` — rather than importing ``coord.client``
+    directly. ``resolve()`` and not ``is_remote()`` because the error names
+    the host the operator should ssh to, which needs the resolved URL.
+    """
+    from coord.board_service import resolve  # noqa: PLC0415
+
+    svc = resolve()
+    if svc is None:
+        return
+    from urllib.parse import urlparse  # noqa: PLC0415
+
+    host = urlparse(svc.url).hostname or svc.url
+    raise click.ClickException(
+        f"coord portal {cmd_name} must run on the daemon host ({host}) — "
+        "this machine's ~/.coord/coord.db is not where the bridge lives "
+        "(board_service is configured in ~/.coord/client.toml, making this "
+        "a thin client). Run it over `ssh` on the daemon host instead. "
+        "See coord/skills/portal-followup/SKILL.md."
+    )
+
+
 @click.group("portal")
 def portal_group() -> None:
     """coord-portal sync bridge — status, manual push, heartbeat (#2179)."""
@@ -48,10 +97,20 @@ def portal_group() -> None:
 def portal_status(config_path, as_json: bool) -> None:
     """Show whether the portal bridge is configured, without sending anything."""
     cfg = _load_config(config_path).portal
+    # #2336: a non-empty-string check alone can't tell "resolved to a real
+    # secret" from "the ${VAR} placeholder was never expanded because the
+    # env var wasn't set in this shell" — both are non-empty strings. Reject
+    # either credential if it still carries an unexpanded placeholder.
+    credentials_set = bool(
+        cfg.bridge_client_id
+        and cfg.bridge_client_secret
+        and not has_unexpanded_env_var(cfg.bridge_client_id)
+        and not has_unexpanded_env_var(cfg.bridge_client_secret)
+    )
     payload = {
         "enabled": cfg.enabled,
         "base_url": cfg.base_url,
-        "credentials_set": bool(cfg.bridge_client_id and cfg.bridge_client_secret),
+        "credentials_set": credentials_set,
         "timeout_secs": cfg.timeout_secs,
         "max_retries": cfg.max_retries,
     }
@@ -151,6 +210,8 @@ def portal_sync_once(config_path, as_json: bool) -> None:
 
     Daemon-host command: it reads and writes the daemon's ~/.coord/coord.db.
     """
+    _refuse_if_thin_client("sync")
+
     from coord import portal_sync as _sync  # noqa: PLC0415
 
     config = _load_config(config_path)
@@ -198,6 +259,8 @@ def portal_outbox(as_json: bool, show_all: bool) -> None:
     refusing to announce something to the customer before the thing it
     announces has been confirmed applied.
     """
+    _refuse_if_thin_client("outbox")
+
     from coord import portal_store  # noqa: PLC0415
     from coord.portal_sync import ordering_block_reason  # noqa: PLC0415
 
@@ -277,6 +340,8 @@ def portal_outbox(as_json: bool, show_all: bool) -> None:
 @click.option("--limit", type=int, default=20, show_default=True)
 def portal_events(as_json: bool, limit: int) -> None:
     """List pulled, not-yet-consumed customer events (the inbound half)."""
+    _refuse_if_thin_client("events")
+
     from coord import portal_store  # noqa: PLC0415
 
     events = portal_store.unhandled_events(limit=limit)
@@ -315,6 +380,8 @@ def portal_enqueue_status(submission_id: str, status: str) -> None:
     that would summon the customer to an empty screen — `awaiting-signoff`
     with no design round queued, `needs-input` with no question (#835).
     """
+    _refuse_if_thin_client("enqueue-status")
+
     from coord.portal_sync import PortalSyncError, enqueue_status  # noqa: PLC0415
 
     try:
@@ -338,6 +405,8 @@ def portal_enqueue_design_round(submission_id: str, payload_json: str) -> None:
     expected to carry whatever reference the customer's browser follows, plus
     a `round` number if this is not the first.
     """
+    _refuse_if_thin_client("enqueue-design-round")
+
     from coord.portal_sync import PortalSyncError, enqueue_design_round  # noqa: PLC0415
 
     try:
@@ -361,6 +430,8 @@ def portal_enqueue_design_round(submission_id: str, payload_json: str) -> None:
 @click.argument("question")
 def portal_enqueue_question(submission_id: str, question: str) -> None:
     """Queue an open question for SUBMISSION_ID (sent on the next sync)."""
+    _refuse_if_thin_client("enqueue-question")
+
     from coord.portal_sync import PortalSyncError, enqueue_question  # noqa: PLC0415
 
     try:
@@ -389,6 +460,8 @@ def portal_requeue(submission_id: str, seq: int) -> None:
 
     Find the seq with `coord portal outbox --all`.
     """
+    _refuse_if_thin_client("requeue")
+
     from coord import portal_store  # noqa: PLC0415
 
     row = portal_store.requeue(submission_id, seq)

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/coord/config.py

@@ -3372,6 +3372,31 @@ def _expand_env_vars(value: str) -> str:
     return _ENV_VAR_RE.sub(_replace, value)
 
 
+def has_unexpanded_env_var(value: str | None) -> bool:
+    """Whether *value* still contains an unexpanded ``${VAR}`` placeholder.
+
+    #2336: :func:`_expand_env_vars` leaves an unset variable's placeholder
+    untouched — ``${MISSING}`` stays the literal string ``"${MISSING}"`` —
+    so a plain ``bool(value)`` check on the *result* can't tell "this
+    resolved to a real secret" from "the env var was never set in this
+    process's environment": both are non-empty strings. This is the
+    "actually resolved" check the config's own env-var expansion needs a
+    caller to run afterward — e.g. ``coord portal status``'s
+    ``credentials_set`` used to report ``true`` for
+    ``portal.bridge_client_id: "${BRIDGE_CLIENT_ID}"`` even when
+    ``BRIDGE_CLIENT_ID`` was never exported into the shell the command ran
+    in, which read as "credentials fine" while troubleshooting what was
+    actually a missing-env-var problem.
+
+    ``None`` is treated as not-a-placeholder (``False``) — an unset field is
+    a separate "not configured" state, distinct from "configured but the
+    env var didn't resolve".
+    """
+    if value is None:
+        return False
+    return bool(_ENV_VAR_RE.search(value))
+
+
 #: Matches exactly what opencode's own ``OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX``
 #: parser (#2321) accepts as a *string form* of a number: one or more ASCII
 #: digits, nothing else — no sign, no decimal point, no whitespace, no

code_coordinator-0.5.120/coord/skills/portal-followup/SKILL.md

@@ -0,0 +1,84 @@
+# portal-followup skill
+
+**Trigger:** Investigating a customer-portal signoff/event that "hasn't shown up"
+— a submission stuck on an old status, a customer event (e.g.
+`signoff.approved`) that doesn't seem to have registered, or any troubleshooting
+of `coord portal` state.
+
+**Purpose:** Get a straight answer out of `coord portal outbox`/`events`/`sync`
+without re-discovering #2336 the hard way — a normal-looking "nothing pending"
+from these commands used to be indistinguishable from "the bridge genuinely has
+nothing pending," because they read/write **the local machine's**
+`~/.coord/coord.db` directly, and only the daemon host's copy is real.
+
+---
+
+## The one thing to know
+
+`coord portal status` / `heartbeat` / `push` touch only the config + the portal
+API — safe to run from anywhere.
+
+`coord portal sync` / `outbox` / `events` / `enqueue-*` / `requeue` touch the
+daemon's own `~/.coord/coord.db`. **Run them on the daemon host directly**
+(`ssh <daemon-host>` first — check `~/.coord/client.toml`'s `board_service` for
+which host that is, or ask `coord status` on this machine, which already routes
+through it).
+
+Since #2336, running one of these from a thin client (any machine with
+`board_service` configured) no longer silently reads that machine's empty local
+DB — it refuses outright:
+
+```
+Error: coord portal outbox must run on the daemon host (dellserver) — this
+machine's ~/.coord/coord.db is not where the bridge lives (board_service is
+configured in ~/.coord/client.toml, making this a thin client). Run it over
+`ssh` on the daemon host instead. See coord/skills/portal-followup/SKILL.md.
+```
+
+If you see that error, you have your answer: SSH to the named host and re-run
+the same command there.
+
+## Steps
+
+1. **Identify the daemon host.** `cat ~/.coord/client.toml` (if present) shows
+   `board_service = "http://<host>:<port>"` — that host is where the real
+   `coord.db` lives. If this machine has no `client.toml` at all, it may *be*
+   the daemon host already; try the command locally first.
+
+2. **Run the portal command on that host** (over `ssh`, or directly if you're
+   already on it):
+
+   ```
+   ssh <daemon-host> 'coord portal outbox --all'
+   ssh <daemon-host> 'coord portal events'
+   ssh <daemon-host> 'coord portal sync --json'
+   ```
+
+3. **Cross-check credentials separately if a push/heartbeat looks like a 401.**
+   `coord portal status --json` reports `credentials_set: false` whenever
+   `BRIDGE_CLIENT_ID`/`BRIDGE_CLIENT_SECRET` are unset in *this shell's*
+   environment, even if `coordinator.yml` has non-empty `${VAR}` strings for
+   them (#2336) — a bare interactive `ssh <host> '...'` does not source
+   `~/.coord/coord-serve.env`, but the actual `coord-serve` systemd unit does
+   via `EnvironmentFile=`. A 401 from a manual `ssh` + `coord portal heartbeat`
+   check does not necessarily mean the credential itself is bad — check
+   `credentials_set` first before assuming the secret rotated.
+
+4. **If a submission's outbox row is `HELD`,** that's the #835 ordering guard
+   working as intended (announcing a status like `awaiting-signoff` before its
+   design round applied would email the customer toward an empty screen), not
+   a bug — resolve the blocking condition rather than trying to force the push.
+
+5. **If a row is terminal (retired) after burning its retry budget,** fix the
+   underlying cause first, then `coord portal requeue <submission_id> <seq>`
+   (find the seq with `coord portal outbox --all`) — also a daemon-host command.
+
+## Rules
+
+- Never try to work around the "must run on the daemon host" error by editing
+  `~/.coord/client.toml` to unset `board_service` on a thin client — that
+  changes what *every other* `coord` command on that machine reads too, not
+  just `portal`.
+- Prefer `coord portal enqueue-status`/`enqueue-design-round`/`enqueue-question`
+  over `coord portal push` for anything the customer will see — `push` bypasses
+  the #835 ordering guard entirely.

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/tests/test_cli_portal.py

@@ -34,6 +34,21 @@ DISABLED_CONFIG_YAML = textwrap.dedent("""
         repos: [coord]
 """)
 
+ENV_VAR_CONFIG_YAML = textwrap.dedent("""
+    repos:
+      - name: coord
+        github: owner/coord
+    machines:
+      - name: dellserver
+        host: dellserver
+        repos: [coord]
+    portal:
+      enabled: true
+      base_url: https://intake.heurontech.com
+      bridge_client_id: ${BRIDGE_CLIENT_ID}
+      bridge_client_secret: ${BRIDGE_CLIENT_SECRET}
+""")
+
 
 @pytest.fixture
 def config_path(tmp_path):
@@ -49,6 +64,19 @@ def disabled_config_path(tmp_path):
     return str(path)
 
 
+@pytest.fixture
+def env_var_config_path(tmp_path, monkeypatch):
+    # #2336: BRIDGE_CLIENT_ID/BRIDGE_CLIENT_SECRET deliberately left unset in
+    # this shell — mirrors a manual `ssh dellserver` session that never
+    # sourced ~/.coord/coord-serve.env, unlike the coord-serve systemd unit's
+    # EnvironmentFile=.
+    monkeypatch.delenv("BRIDGE_CLIENT_ID", raising=False)
+    monkeypatch.delenv("BRIDGE_CLIENT_SECRET", raising=False)
+    path = tmp_path / "coordinator.yml"
+    path.write_text(ENV_VAR_CONFIG_YAML)
+    return str(path)
+
+
 def run(*args):
     return CliRunner().invoke(main, list(args))
 
@@ -82,6 +110,23 @@ def test_status_reports_enabled_and_credentials(config_path):
     assert "credentials=set" in result.output
 
 
+def test_status_reports_credentials_missing_for_unexpanded_env_var(env_var_config_path):
+    """#2336: portal.bridge_client_id/secret are non-empty '${VAR}' strings,
+    but the env var was never set in this shell — credentials_set must be
+    false, not true just because the placeholder text itself is non-empty."""
+    result = run("portal", "status", "--config", env_var_config_path, "--json")
+    assert result.exit_code == 0, result.output
+    assert '"credentials_set": false' in result.output
+
+
+def test_status_reports_credentials_set_once_env_var_resolves(env_var_config_path, monkeypatch):
+    monkeypatch.setenv("BRIDGE_CLIENT_ID", "id-from-env")
+    monkeypatch.setenv("BRIDGE_CLIENT_SECRET", "secret-from-env")
+    result = run("portal", "status", "--config", env_var_config_path, "--json")
+    assert result.exit_code == 0, result.output
+    assert '"credentials_set": true' in result.output
+
+
 def test_heartbeat_refuses_when_disabled(disabled_config_path):
     result = run("portal", "heartbeat", "--config", disabled_config_path)
     assert result.exit_code != 0
@@ -260,3 +305,58 @@ def test_requeue_reports_an_unknown_row_cleanly():
     result = run("portal", "requeue", "sub_1", "1")
     assert result.exit_code != 0
     assert "no outbox row" in result.output
+
+
+# ── #2336: state-touching commands refuse to run on a thin client ──────────
+
+
+@pytest.fixture
+def thin_client(monkeypatch):
+    """Simulate running on a machine with board_service configured — i.e. a
+    thin client, per coord/client.py's resolve_board_service() bootstrap
+    contract (flag > env > ~/.coord/client.toml)."""
+    monkeypatch.setenv("COORD_SERVICE_URL", "http://dellserver:7435")
+
+
+@pytest.mark.parametrize(
+    "args",
+    [
+        ("portal", "sync"),
+        ("portal", "outbox"),
+        ("portal", "events"),
+        ("portal", "enqueue-status", "sub_1", "shipped"),
+        ("portal", "enqueue-design-round", "sub_1", "{}"),
+        ("portal", "enqueue-question", "sub_1", "why?"),
+        ("portal", "requeue", "sub_1", "1"),
+    ],
+)
+def test_state_touching_commands_refuse_on_a_thin_client(thin_client, args):
+    result = run(*args)
+    assert result.exit_code != 0
+    assert "must run on the daemon host" in result.output
+    assert "dellserver" in result.output
+
+
+def test_status_heartbeat_and_push_do_not_call_the_thin_client_guard(thin_client):
+    """status/heartbeat/push never touch the local DB, so they must not be
+    gated by the #2336 guard — only sync/outbox/events/enqueue-*/requeue call
+    _refuse_if_thin_client. (A full CLI invocation isn't used here: setting
+    COORD_SERVICE_URL also reroutes _load_config's own config fetch to the
+    daemon per #1080, which is unrelated to this guard and would make the
+    assertion about a network error rather than about this guard.)"""
+    import coord.commands.portal as portal_mod
+
+    calls = []
+    real_guard = portal_mod._refuse_if_thin_client
+
+    def _tracking_guard(cmd_name):
+        calls.append(cmd_name)
+        return real_guard(cmd_name)
+
+    portal_mod._refuse_if_thin_client = _tracking_guard
+    try:
+        result = run("portal", "heartbeat", "--config", "/does/not/exist.yml")
+    finally:
+        portal_mod._refuse_if_thin_client = real_guard
+    assert result.exit_code != 0  # fails for an unrelated reason (bad --config)
+    assert calls == []

{code_coordinator-0.5.119 → code_coordinator-0.5.120}/tests/test_portal_config.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import pytest
 
-from coord.config import ConfigError, PortalConfig, _parse_portal
+from coord.config import ConfigError, PortalConfig, _parse_portal, has_unexpanded_env_var
 
 BASE = {
     "enabled": True,
@@ -119,6 +119,25 @@ def test_timeout_secs_must_be_a_number():
         _parse_portal({**BASE, "timeout_secs": "soon"})
 
 
+# ── #2336: has_unexpanded_env_var — the "did this actually resolve" check ──
+
+
+def test_has_unexpanded_env_var_true_for_a_placeholder_left_as_is():
+    assert has_unexpanded_env_var("${DEFINITELY_NOT_SET_XYZ}") is True
+
+
+def test_has_unexpanded_env_var_false_for_a_resolved_value():
+    assert has_unexpanded_env_var("id-from-env") is False
+
+
+def test_has_unexpanded_env_var_false_for_none():
+    assert has_unexpanded_env_var(None) is False
+
+
+def test_has_unexpanded_env_var_false_for_empty_string():
+    assert has_unexpanded_env_var("") is False
+
+
 def test_max_retries_must_be_an_int_not_a_bool():
     with pytest.raises(ConfigError, match="non-negative integer"):
         _parse_portal({**BASE, "max_retries": True})