code-coordinator 0.5.188__tar.gz → 0.5.189__tar.gz

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.188
+Version: 0.5.189
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.188
+Version: 0.5.189
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.188",
+  "tag": "0.5.189",
   "distance": 0,
-  "node": "ge96703c949bd613e9a8c2b576d71050e015f956e",
+  "node": "g9c81a5128ae2355b8dee8b005e2836f58e553167",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-20"

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/coord/agent.py

@@ -3678,6 +3678,49 @@ NEW_ISSUE_CHAT_DENY_COMMANDS: list[str] = [
 ]
 
 
+# Deny list applied to review workers (#2461). Unlike every other member of
+# WRITE_CAPABLE_SPEC_TYPES, a reviewer has ZERO legitimate mutations of its
+# own — coord.review.REVIEWER_SYSTEM_PROMPT already tells it "You are NOT
+# allowed to push commits or modify the PR's code. You only review" and "You
+# are NOT allowed to run any `gh` commands" (the coordinator posts the
+# review on its behalf after the session ends). Before #2461 that was
+# enforced by the PROMPT ALONE: `"review"` wasn't one of the explicit
+# branches in `default_worker_command`, so it fell through to the generic
+# `else` below and got the exact same `Read,Edit,Write,Bash,Monitor` grant as
+# a real work leg — nothing but the model's own good behaviour stood between
+# "read the diff" and "silently commit a fix and push it". This list is
+# wired into BOTH the system prompt (via `build_deny_prompt`, soft — a
+# reminder) AND `--disallowedTools` (CLI-enforced, hard — see the
+# `spec.type == "review"` branch below) so a reviewer that ignores its own
+# prompt still cannot shell out to a mutating git/gh command. The read-only
+# git the briefing actually tells reviewers to run (`git fetch`, `git diff`,
+# `git log`) stays allowed by omission.
+REVIEW_DENY_COMMANDS: list[str] = [
+    "Bash(gh *)",
+    "Bash(git push *)",
+    "Bash(git commit *)",
+    "Bash(git add *)",
+    "Bash(git merge *)",
+    "Bash(git rebase *)",
+    "Bash(git cherry-pick *)",
+    "Bash(git reset *)",
+    "Bash(git checkout *)",
+    "Bash(git switch *)",
+    "Bash(git branch *)",
+    "Bash(git stash *)",
+    "Bash(git clean *)",
+    "Bash(git rm *)",
+    "Bash(git apply *)",
+    "Bash(git am *)",
+    "Bash(git tag *)",
+    "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
+    "Bash(coord approve *)",
+    "Bash(coord merge *)",
+    "Bash(coord assign *)",
+]
+
+
 WorkerCommandBuilder = Callable[[AssignmentSpec], list[str]]
 
 
@@ -4111,6 +4154,26 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         system_prompt = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
         allowed_tools = "Read,Bash"
+    elif spec.type == "review":
+        # #2461: give review its own branch instead of falling through to
+        # the generic `else` below — see REVIEW_DENY_COMMANDS for the full
+        # story. A reviewer reads the diff and reports a verdict; it edits
+        # and pushes nothing, so it gets no Edit/Write. `Monitor` is
+        # withheld too, for the same #1394/#2301 reason the `smoke` branch
+        # above withholds it: a review leg is a one-shot `claude -p`
+        # session, and an await-a-notification tool that only resumes an
+        # INTERACTIVE session would silently kill it mid-run.
+        #
+        # A scratch/tmp path outside the worktree (e.g. `/tmp/...`) stays
+        # writable for a reviewer that wants to stage its findings before
+        # the final `coord report-result --body-file` call — Bash retains
+        # ordinary shell redirection (`cat >`, heredocs) even with no Write
+        # tool grant; only the Edit/Write *tools* (which target the
+        # worktree/repo) and the mutating git/gh commands below are blocked.
+        from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
+        system_prompt = spec.system_prompt if spec.system_prompt else REVIEWER_SYSTEM_PROMPT
+        system_prompt += build_deny_prompt(REVIEW_DENY_COMMANDS)
+        allowed_tools = "Read,Bash"
     else:
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
@@ -4177,6 +4240,14 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         for pattern in _base_checkout_write_guard_tools(spec.repo_path):
             if pattern not in disallowed_tools:
                 disallowed_tools.append(pattern)
+    # #2461: review gets its mutating-command deny list wired into
+    # --disallowedTools too, not just the soft system-prompt reminder from
+    # build_deny_prompt above — the CLI enforces this one even if the model
+    # decides to ignore its own prompt.
+    if spec.type == "review":
+        for pattern in REVIEW_DENY_COMMANDS:
+            if pattern not in disallowed_tools:
+                disallowed_tools.append(pattern)
     if disallowed_tools:
         argv.extend(["--disallowedTools", ",".join(disallowed_tools)])
     # #315: when resuming a prior chat session, load the prior conversation so

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/coord/providers/claude.py

@@ -113,6 +113,7 @@ class ClaudeProvider(Provider):
             NEW_ISSUE_CHAT_DENY_COMMANDS,
             NEW_ISSUE_CHAT_SYSTEM_PROMPT,
             REFINEMENT_SYSTEM_PROMPT,
+            REVIEW_DENY_COMMANDS,
             TEST_CHAT_SYSTEM_PROMPT,
             WORKER_PLAN_PROMPT,
             WORKER_SYSTEM_PROMPT,
@@ -120,6 +121,7 @@ class ClaudeProvider(Provider):
             _sealed_write_guard_tools,
             build_deny_prompt,
         )
+        from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
         from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
 
         binary = self._binary if self._binary is not None else DEFAULT_WORKER_BINARY
@@ -180,6 +182,17 @@ class ClaudeProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 _at = "Read,Bash"
+            elif spec.type == "review":
+                # #2461: keep in sync with default_worker_command's identical
+                # branch — a reviewer reads the diff and reports a verdict,
+                # it edits and pushes nothing, so Read,Bash only (no
+                # Edit/Write, no Monitor — same one-shot-session reasoning as
+                # the `smoke` branch above). See REVIEW_DENY_COMMANDS for why
+                # its mutating-command deny list also lands in
+                # --disallowedTools below, not just this prompt text.
+                _sp = spec.system_prompt if spec.system_prompt else REVIEWER_SYSTEM_PROMPT
+                _sp += build_deny_prompt(REVIEW_DENY_COMMANDS)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
@@ -217,6 +230,12 @@ class ClaudeProvider(Provider):
             for pattern in _base_checkout_write_guard_tools(spec.repo_path):
                 if pattern not in disallowed_tools:
                     disallowed_tools.append(pattern)
+        # #2461: same CLI-enforced hard block as default_worker_command —
+        # see REVIEW_DENY_COMMANDS.
+        if spec.type == "review":
+            for pattern in REVIEW_DENY_COMMANDS:
+                if pattern not in disallowed_tools:
+                    disallowed_tools.append(pattern)
         if disallowed_tools:
             argv.extend(["--disallowedTools", ",".join(disallowed_tools)])
         if spec.resume_session_id:

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/coord/providers/claude_pty.py

@@ -433,6 +433,7 @@ class ClaudePtyProvider(Provider):
             NEW_ISSUE_CHAT_DENY_COMMANDS,
             NEW_ISSUE_CHAT_SYSTEM_PROMPT,
             REFINEMENT_SYSTEM_PROMPT,
+            REVIEW_DENY_COMMANDS,
             TEST_CHAT_SYSTEM_PROMPT,
             WORKER_PLAN_PROMPT,
             WORKER_SYSTEM_PROMPT,
@@ -497,6 +498,16 @@ class ClaudePtyProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 _at = "Read,Bash"
+            elif spec.type == "review":
+                # #2461: keep in sync with default_worker_command's identical
+                # branch — a reviewer reads the diff and reports a verdict,
+                # it edits and pushes nothing, so Read,Bash only (no
+                # Edit/Write, no Monitor — same one-shot-session reasoning as
+                # the `smoke` branch above).
+                from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
+                _sp = spec.system_prompt if spec.system_prompt else REVIEWER_SYSTEM_PROMPT
+                _sp += build_deny_prompt(REVIEW_DENY_COMMANDS)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/tests/test_agent.py

@@ -21,6 +21,7 @@ from coord.agent import (
     FAILED,
     PENDING,
     REFUSED_POLICY,
+    REVIEW_DENY_COMMANDS,
     RUNNING,
     MOCK_AUTHOR_SYSTEM_PROMPT,
     WORKER_SYSTEM_PROMPT,
@@ -1192,6 +1193,116 @@ def test_default_worker_command_smoke_type_honours_explicit_system_prompt() -> N
     assert system_prompt.startswith("custom smoke prompt")
 
 
+# ── #2461: review legs must be read-only ─────────────────────────────────
+#
+# Root cause: `"review"` wasn't one of the explicit branches in
+# `default_worker_command`, so it fell through to the generic `else` and got
+# the exact same `Read,Edit,Write,Bash,Monitor` grant as a real work leg —
+# REVIEWER_SYSTEM_PROMPT's "you only review, you are NOT allowed to push
+# commits or modify the PR's code" was enforced by the prompt text alone,
+# with nothing stopping a review worker from calling Edit/Write or shelling
+# out to `git push`/`gh` if it decided to.
+
+
+def _review_spec(**overrides) -> AssignmentSpec:
+    base = dict(
+        repo_name="api",
+        repo_path="/tmp/repo",
+        issue_number=2461,
+        issue_title="[review] t",
+        briefing="b",
+        branch="main",
+        type="review",
+    )
+    base.update(overrides)
+    return AssignmentSpec(**base)
+
+
+def test_default_worker_command_review_type_gets_read_bash_only() -> None:
+    """A review leg only reads the diff and reports a verdict — no
+    Edit/Write (it must not modify the PR's code), and (mirroring the
+    `smoke` branch's #1394/#2301 reasoning) no Monitor either — a review leg
+    is a one-shot `claude -p` session, so an await-a-notification tool can
+    never resume it."""
+    argv = default_worker_command(_review_spec())
+    allowed = argv[argv.index("--allowedTools") + 1]
+    assert allowed == "Read,Bash"
+
+
+def test_default_worker_command_review_type_uses_reviewer_system_prompt() -> None:
+    """Confirms the review branch's default system prompt is
+    coord.review.REVIEWER_SYSTEM_PROMPT, not the generic WORKER_SYSTEM_PROMPT
+    the old fall-through `else` branch would have used."""
+    from coord.review import REVIEWER_SYSTEM_PROMPT
+
+    argv = default_worker_command(_review_spec())
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert system_prompt.startswith(REVIEWER_SYSTEM_PROMPT)
+
+
+def test_default_worker_command_review_type_honours_explicit_system_prompt() -> None:
+    argv = default_worker_command(_review_spec(system_prompt="custom review prompt"))
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert system_prompt.startswith("custom review prompt")
+
+
+def test_default_worker_command_review_type_blocks_mutating_git_and_gh() -> None:
+    """The deny list must be wired into the CLI-enforced --disallowedTools,
+    not just the soft system-prompt reminder text — a reviewer that ignores
+    its own prompt must still be structurally unable to push, commit, or
+    touch GitHub. This is the actual "tool scope" enforcement #2461 asks
+    for, as opposed to the prompt-only status quo."""
+    argv = default_worker_command(_review_spec())
+    idx = argv.index("--disallowedTools")
+    disallowed = argv[idx + 1].split(",")
+    for pattern in REVIEW_DENY_COMMANDS:
+        assert pattern in disallowed
+    # And Edit/Write themselves are denied by simple omission from
+    # --allowedTools (Claude Code only grants tools it's explicitly told to).
+    allowed = argv[argv.index("--allowedTools") + 1].split(",")
+    assert "Edit" not in allowed
+    assert "Write" not in allowed
+
+
+def test_default_worker_command_review_type_deny_list_also_in_prompt() -> None:
+    """Belt-and-braces: the same deny list also lands in the system prompt
+    text (build_deny_prompt) so a reasoning model sees an explicit reminder,
+    not just a silent tool-call rejection."""
+    argv = default_worker_command(_review_spec())
+    system_prompt = argv[argv.index("--system-prompt") + 1]
+    assert "FORBIDDEN COMMANDS" in system_prompt
+    assert "git push *" in system_prompt
+    assert "gh *" in system_prompt
+
+
+def test_assign_wires_the_review_deny_list_into_the_real_dispatch(tmp_path: Path) -> None:
+    """End-to-end (mirrors test_assign_wires_the_base_checkout_guard_into_the_real_dispatch
+    for #1642): dispatch a real review-type assignment through
+    default_worker_command via AgentServer.assign() and confirm the argv the
+    agent actually launched carries the hard --disallowedTools guard, not
+    just a spec built by hand in isolation."""
+    repo = _init_repo(tmp_path / "repo")
+    server = AgentServer(
+        machine_name="test",
+        capabilities=["python"],
+        repos=["api"],
+        state_dir=tmp_path / "state",
+        worker_command=lambda spec: default_worker_command(spec, binary="/bin/true"),
+        repo_paths={"api": str(repo)},
+    )
+    spec = _spec(repo, type="review")
+    a = server.assign(spec)
+    final = server.wait_for(a.id, timeout=30)
+    assert final.exit_code == 0
+
+    log = Path(final.log_path).read_text()
+    header = log.splitlines()[0]
+    assert "--disallowedTools" in header
+    for pattern in REVIEW_DENY_COMMANDS:
+        assert pattern in header
+    assert "--allowedTools Read,Bash" in header
+
+
 # ── #1315: structural sealing enforcement (write-guard) ─────────────────────
 
 

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/tests/test_providers_pty.py

@@ -199,7 +199,7 @@ def test_pty_build_command_branches_match_claude_for_plan_type() -> None:
     assert argv[argv.index("--allowedTools") + 1] == legacy_at
 
 
-@pytest.mark.parametrize("spec_type", ["work", "review", "conflict-fix", "fix"])
+@pytest.mark.parametrize("spec_type", ["work", "conflict-fix", "fix"])
 def test_pty_build_command_branches_match_claude_for_work_type(spec_type: str) -> None:
     """#2169: the generic-worker (``else``) branch must stay in parity too.
 
@@ -215,7 +215,10 @@ def test_pty_build_command_branches_match_claude_for_work_type(spec_type: str) -
     ``else`` branch; #2301 gave it a branch of its own, so its parity is
     guarded by
     :func:`test_pty_build_command_smoke_branch_matches_claude_and_withholds_monitor`
-    below instead.
+    below instead. ``review`` likewise used to fall through here; #2461 gave
+    it its own branch (read-only, no Edit/Write/Monitor — see
+    ``coord.agent.REVIEW_DENY_COMMANDS``), guarded by
+    :func:`test_pty_build_command_review_branch_matches_claude_and_withholds_monitor`.
     """
     spec = _make_spec(type=spec_type)
     argv = ClaudePtyProvider().build_command(spec)
@@ -256,6 +259,35 @@ def test_pty_build_command_smoke_branch_matches_claude_and_withholds_monitor() -
     assert "Monitor" not in pty_at.split(",")
 
 
+def test_pty_build_command_review_branch_matches_claude_and_withholds_monitor() -> None:
+    """#2461: the review branch is another call site of the same logic.
+
+    ``default_worker_command`` and ``ClaudeProvider.build_command`` both give
+    ``spec.type == "review"`` its own branch — ``REVIEWER_SYSTEM_PROMPT``
+    plus ``Read,Bash`` only, deliberately withholding ``Monitor`` (a review
+    leg is a one-shot ``claude -p`` session per #1394) and Edit/Write (a
+    reviewer reads the diff and reports a verdict; it must not modify the
+    PR's code). ``ClaudePtyProvider.build_command`` must not drift from
+    them — mirrors
+    :func:`test_pty_build_command_smoke_branch_matches_claude_and_withholds_monitor`.
+    """
+    from coord.review import REVIEWER_SYSTEM_PROMPT
+
+    spec = _make_spec(type="review", review_target="123")
+    argv = ClaudePtyProvider().build_command(spec)
+    legacy = default_worker_command(spec)
+    legacy_sp = legacy[legacy.index("--system-prompt") + 1]
+    legacy_at = legacy[legacy.index("--allowedTools") + 1]
+    pty_sp = argv[argv.index("--system-prompt") + 1]
+    pty_at = argv[argv.index("--allowedTools") + 1]
+    assert pty_sp == legacy_sp
+    assert pty_at == legacy_at
+    # Pin the values too, so a *matched* regression on both sides still fails.
+    assert pty_sp.startswith(REVIEWER_SYSTEM_PROMPT)
+    assert pty_at == "Read,Bash"
+    assert "Monitor" not in pty_at.split(",")
+
+
 def test_pty_build_command_smoke_honours_explicit_system_prompt() -> None:
     """#2301: the new smoke branch must still respect ``spec.system_prompt``
     (the dispatcher's per-run briefing prompt) rather than always forcing

{code_coordinator-0.5.188 → code_coordinator-0.5.189}/tests/test_worker_test_scoping.py

@@ -124,20 +124,39 @@ def test_default_worker_command_grants_monitor_for_work_type() -> None:
         assert tool in allowed.split(",")
 
 
-@pytest.mark.parametrize("spec_type", ["review", "fix", "conflict-fix"])
+@pytest.mark.parametrize("spec_type", ["fix", "conflict-fix"])
 def test_default_worker_command_other_write_types_also_get_monitor(spec_type: str) -> None:
-    """`review`/`fix`/`conflict-fix` all fall through the same `else` branch
-    as `work` — confirm the grant isn't accidentally work-only.
+    """`fix`/`conflict-fix` both fall through the same `else` branch as
+    `work` — confirm the grant isn't accidentally work-only.
 
     `smoke` used to be in this list too, but #2301 gave it its own branch
     (see test_default_worker_command_smoke_type_withholds_monitor below) —
     smoke legs are one-shot sessions where an await-a-notification tool
-    like `Monitor` ends the session before any wake-up can arrive."""
+    like `Monitor` ends the session before any wake-up can arrive. `review`
+    was removed for the same reason by #2461 (see
+    test_default_worker_command_review_type_withholds_monitor below), plus a
+    second one: a reviewer has no legitimate mutations at all, so it no
+    longer shares the generic write-capable grant."""
     argv = default_worker_command(_work_spec(type=spec_type))
     allowed = argv[argv.index("--allowedTools") + 1]
     assert "Monitor" in allowed.split(",")
 
 
+def test_default_worker_command_review_type_withholds_monitor() -> None:
+    """#2461: a review leg reads the diff and reports a verdict — it must not
+    modify the PR's code, so no Edit/Write, and (the same #1394 reasoning as
+    `smoke` below) no `Monitor` either: a one-shot `claude -p` session that
+    calls an await-a-notification tool ends before any wake-up can arrive.
+
+    Before #2461 `review` fell through the generic `else` branch and got the
+    full `Read,Edit,Write,Bash,Monitor` work grant, with only
+    REVIEWER_SYSTEM_PROMPT's "you only review" prompt text standing between a
+    reviewer and a silent commit-and-push."""
+    argv = default_worker_command(_work_spec(type="review"))
+    allowed = argv[argv.index("--allowedTools") + 1]
+    assert allowed == "Read,Bash"
+
+
 def test_default_worker_command_smoke_type_withholds_monitor() -> None:
     """#2301: a smoke leg is a one-shot `claude -p` session (#1394) — calling
     `Monitor` there ends the session permanently before any notification can