code-coordinator 0.5.188__tar.gz → 0.5.190__tar.gz

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.188
+Version: 0.5.190
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.188
+Version: 0.5.190
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.188",
+  "tag": "0.5.190",
   "distance": 0,
-  "node": "ge96703c949bd613e9a8c2b576d71050e015f956e",
+  "node": "g99757b0d4a54a8a5b3c7ec90b7c5beeb9f118ecc",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-20"

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/coord/agent.py

@@ -3678,6 +3678,49 @@ NEW_ISSUE_CHAT_DENY_COMMANDS: list[str] = [
 ]
 
 
+# Deny list applied to review workers (#2461). Unlike every other member of
+# WRITE_CAPABLE_SPEC_TYPES, a reviewer has ZERO legitimate mutations of its
+# own — coord.review.REVIEWER_SYSTEM_PROMPT already tells it "You are NOT
+# allowed to push commits or modify the PR's code. You only review" and "You
+# are NOT allowed to run any `gh` commands" (the coordinator posts the
+# review on its behalf after the session ends). Before #2461 that was
+# enforced by the PROMPT ALONE: `"review"` wasn't one of the explicit
+# branches in `default_worker_command`, so it fell through to the generic
+# `else` below and got the exact same `Read,Edit,Write,Bash,Monitor` grant as
+# a real work leg — nothing but the model's own good behaviour stood between
+# "read the diff" and "silently commit a fix and push it". This list is
+# wired into BOTH the system prompt (via `build_deny_prompt`, soft — a
+# reminder) AND `--disallowedTools` (CLI-enforced, hard — see the
+# `spec.type == "review"` branch below) so a reviewer that ignores its own
+# prompt still cannot shell out to a mutating git/gh command. The read-only
+# git the briefing actually tells reviewers to run (`git fetch`, `git diff`,
+# `git log`) stays allowed by omission.
+REVIEW_DENY_COMMANDS: list[str] = [
+    "Bash(gh *)",
+    "Bash(git push *)",
+    "Bash(git commit *)",
+    "Bash(git add *)",
+    "Bash(git merge *)",
+    "Bash(git rebase *)",
+    "Bash(git cherry-pick *)",
+    "Bash(git reset *)",
+    "Bash(git checkout *)",
+    "Bash(git switch *)",
+    "Bash(git branch *)",
+    "Bash(git stash *)",
+    "Bash(git clean *)",
+    "Bash(git rm *)",
+    "Bash(git apply *)",
+    "Bash(git am *)",
+    "Bash(git tag *)",
+    "Bash(rm -rf *)",
+    "Bash(rm -fr *)",
+    "Bash(coord approve *)",
+    "Bash(coord merge *)",
+    "Bash(coord assign *)",
+]
+
+
 WorkerCommandBuilder = Callable[[AssignmentSpec], list[str]]
 
 
@@ -3858,13 +3901,16 @@ def _base_checkout_write_guard_tools(repo_path: str) -> list[str]:
 # editing coordinator.yml/coord.db) silently also blocked every worker's own
 # worktree under `~/.coord/worktrees/<id>/`, burning a full $5.23 session
 # that reasoned, designed, and only discovered at the very end that it could
-# not save anything. `default_worker_command`'s `--setting-sources user`
-# (above) closes off the specific mechanism (workers no longer load
-# project/local settings at all), but this preflight check is kept as a
-# defense-in-depth: it also catches a blanket deny rule living in the
-# machine's *user*-level settings (`~/.claude/settings.json`, still loaded)
-# and plain OS-level write failures (read-only mount, wrong ownership, full
-# disk) that have nothing to do with Claude Code at all.
+# not save anything. `default_worker_command`'s `--bare` (above, #2462;
+# originally the narrower `--setting-sources user`) closes off the specific
+# mechanism for headless workers — they no longer load *any* Claude Code
+# settings.json (user, project, or local) — but this preflight check is kept
+# as a defense-in-depth: it still catches a blanket deny rule living in the
+# machine's *user*-level settings (`~/.claude/settings.json`) that would
+# affect the human-attended interactive PTY path (which intentionally keeps
+# the default setting sources, see the comment in `default_worker_command`),
+# and it catches plain OS-level write failures (read-only mount, wrong
+# ownership, full disk) that have nothing to do with Claude Code at all.
 _DENY_PATTERN_RE = re.compile(r"^(Edit|Write)\(//(.+)\)$")
 
 
@@ -3934,11 +3980,13 @@ def find_blocking_deny_rule(
     """Scan Claude Code settings files for a deny rule blocking *worktree_path*.
 
     Defaults to scanning just the machine's user-level settings
-    (``~/.claude/settings.json``) — the one settings source a worker still
-    loads after the ``--setting-sources user`` restriction in
-    :func:`default_worker_command`; a checkout-local
-    ``.claude/settings.local.json`` can no longer reach a worker at all, so
-    it is intentionally not scanned here.
+    (``~/.claude/settings.json``). Since #2462, headless workers run with
+    ``--bare`` and load no Claude Code settings.json at all (user, project,
+    or local) — this file matters for the human-attended interactive PTY
+    path (:class:`coord.providers.claude_pty.ClaudePtyProvider`), which
+    intentionally keeps the default setting sources; a checkout-local
+    ``.claude/settings.local.json`` can no longer reach a headless worker at
+    all either way, so it is intentionally not scanned here.
 
     Returns a human-readable ``"'<pattern>' in <file>"`` message for the
     first matching rule found, or ``None`` when no scanned file carries one
@@ -4008,6 +4056,34 @@ def check_worktree_writable(
     return None
 
 
+def _claude_md_system_prompt_suffix(repo_path: str) -> str:
+    """Return a system-prompt suffix embedding the target repo's CLAUDE.md.
+
+    #2462: worker dispatch below passes ``--bare``, which disables Claude
+    Code's own automatic CLAUDE.md auto-discovery (along with hooks,
+    ``.mcp.json``, and settings — see the ``--bare`` comment in
+    :func:`default_worker_command`). Nothing else in a work-shaped leg's
+    briefing embeds the target repo's actual CLAUDE.md text, so without this
+    a worker would silently lose every per-repo convention, testing rule,
+    and sealed-path note that isn't hardcoded into the repo-agnostic
+    ``WORKER_SYSTEM_PROMPT``.
+
+    Mirrors :func:`coord.review.read_repo_claude_md`, which the review leg
+    already uses for the same reason (a review must never run blind to
+    CLAUDE.md) — this repo's own CLAUDE.md says it is "loaded into every
+    worker leg, every review leg, and every coordinator session", so the
+    work-shaped legs need the identical defensive read now that ambient
+    discovery is gone. Returns ``""`` (a no-op suffix) when the repo has no
+    CLAUDE.md or it can't be read.
+    """
+    from coord.review import read_repo_claude_md  # noqa: PLC0415
+
+    claude_md = read_repo_claude_md(Path(repo_path).expanduser())
+    if not claude_md:
+        return ""
+    return "\n\n## Project rules (from CLAUDE.md)\n\n" + claude_md.strip() + "\n"
+
+
 def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER_BINARY) -> list[str]:
     """Build the argv for invoking the worker on this assignment.
 
@@ -4030,6 +4106,9 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
     """
     if spec.type == "plan":
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_PLAN_PROMPT
+        # #2462: --bare drops CLAUDE.md auto-discovery; a plan leg still
+        # needs the target repo's conventions to plan against.
+        system_prompt += _claude_md_system_prompt_suffix(spec.repo_path)
         allowed_tools = "Read,Bash"
     elif spec.type == "refinement":
         # #264: refinement is a developer-driven chat for scoping an issue.
@@ -4083,6 +4162,8 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # and deny list instead of the generic WORKER_SYSTEM_PROMPT.
         system_prompt = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
+        # #2462: --bare drops CLAUDE.md auto-discovery.
+        system_prompt += _claude_md_system_prompt_suffix(spec.repo_path)
         allowed_tools = "Read,Edit,Write,Bash"
     elif spec.type == "smoke":
         # #2301: smoke gets its own branch instead of falling through to the
@@ -4111,9 +4192,34 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         system_prompt = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
         allowed_tools = "Read,Bash"
+    elif spec.type == "review":
+        # #2461: give review its own branch instead of falling through to
+        # the generic `else` below — see REVIEW_DENY_COMMANDS for the full
+        # story. A reviewer reads the diff and reports a verdict; it edits
+        # and pushes nothing, so it gets no Edit/Write. `Monitor` is
+        # withheld too, for the same #1394/#2301 reason the `smoke` branch
+        # above withholds it: a review leg is a one-shot `claude -p`
+        # session, and an await-a-notification tool that only resumes an
+        # INTERACTIVE session would silently kill it mid-run.
+        #
+        # A scratch/tmp path outside the worktree (e.g. `/tmp/...`) stays
+        # writable for a reviewer that wants to stage its findings before
+        # the final `coord report-result --body-file` call — Bash retains
+        # ordinary shell redirection (`cat >`, heredocs) even with no Write
+        # tool grant; only the Edit/Write *tools* (which target the
+        # worktree/repo) and the mutating git/gh commands below are blocked.
+        from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
+        system_prompt = spec.system_prompt if spec.system_prompt else REVIEWER_SYSTEM_PROMPT
+        system_prompt += build_deny_prompt(REVIEW_DENY_COMMANDS)
+        allowed_tools = "Read,Bash"
     else:
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
+        # #2462: --bare drops CLAUDE.md auto-discovery for this catch-all
+        # branch too — it covers "work", "fix", "conflict-fix", and
+        # "test-author", every one of which edits code and needs the
+        # target repo's conventions. See _claude_md_system_prompt_suffix.
+        system_prompt += _claude_md_system_prompt_suffix(spec.repo_path)
         # #2169: `Monitor` is the sanctioned way to poll a backgrounded
         # long-running command in bounded steps (see the ONE-SHOT section of
         # WORKER_SYSTEM_PROMPT) instead of a foreground loop that blocks
@@ -4141,8 +4247,8 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         "--system-prompt", system_prompt,
         "--allowedTools", allowed_tools,
         "--permission-mode", "acceptEdits",
-        # #1445: a worker must not inherit whatever project/local Claude Code
-        # settings the host's checkout happens to carry — e.g. a
+        # #1445 / #2462: a worker must not inherit whatever project/local
+        # Claude Code settings the host's checkout happens to carry — e.g. a
         # `.claude/settings.local.json` deny rule the OPERATOR added for
         # their own interactive session in that checkout (meant to protect
         # ~/.coord/coordinator.yml etc from an interactive session, but
@@ -4153,17 +4259,48 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # has no .claude/ dir of its own (it's untracked/gitignored there),
         # so a deny rule that never touches the worktree's working directory
         # still blocked Edit/Write calls from a `claude -p` session cwd'd
-        # into that worktree. Restricting to "user" means a worker's
-        # permission profile is fully controlled by the --allowedTools /
-        # --disallowedTools / --permission-mode flags in this function (and
-        # its own hard-coded system prompt), not by the checkout's
-        # settings.json / settings.local.json. This is the headless/
-        # `claude -p` path only — the human-attended interactive PTY path
-        # (coord.providers.claude_pty.ClaudePtyProvider) intentionally keeps
-        # the default sources so an operator's own `coord init`-configured
-        # convenience allow-list still applies to a session they're
-        # attached to and watching.
-        "--setting-sources", "user",
+        # into that worktree.
+        #
+        # `--setting-sources user` (the original #1445 fix) only closed this
+        # for *settings.json* — a checkout's `.claude/hooks/` and `.mcp.json`
+        # are governed separately and kept loading regardless, so a
+        # never-trusted repo's hooks would still run and its MCP servers
+        # would still connect in every worker session, because a `-p`
+        # session shows neither the workspace-trust dialog nor the
+        # per-server MCP approval prompt that would normally gate that (see
+        # code.claude.com/docs/en/headless.md). `--bare` is the flag that
+        # closes all three sources (settings, hooks, .mcp.json) at once, plus
+        # LSP/plugin-sync/CLAUDE.md auto-discovery — none of which a headless
+        # worker should be picking up *ambiently* from the target repo's own
+        # checkout either. A worker's permission profile is fully controlled
+        # by the --allowedTools / --disallowedTools / --permission-mode
+        # flags in this function (and its own hard-coded system prompt); it
+        # needs no MCP servers (no spec.type grants the `Agent` tool, so
+        # `--agents` is unneeded too) and no `--settings`.
+        #
+        # CLAUDE.md is the one exception worth calling out: losing its
+        # *ambient* auto-discovery does NOT mean a work-shaped leg loses the
+        # content. `_claude_md_system_prompt_suffix` (see the branches
+        # above: "plan", "mock-author", and this catch-all "else") reads it
+        # explicitly off *spec.repo_path* and embeds it into --system-prompt
+        # instead — the same defensive pattern coord.review.read_repo_claude_md
+        # already used for review legs (#2462).
+        #
+        # AUTH CAVEAT: per Claude Code's own docs, `--bare` "never reads
+        # OAuth credentials or the system keychain" — only `ANTHROPIC_API_KEY`
+        # (env, inherited via `_worker_subprocess_env`) or an `apiKeyHelper`
+        # supplied via `--settings` authenticate. This is a behavior change
+        # for any fleet machine whose worker auth today comes from
+        # `claude setup-token` / `CLAUDE_CODE_OAUTH_TOKEN` or an interactive
+        # `claude login` (the pattern docs/CONTROL_CENTER.md §14 documents for
+        # per-person subscription auth) rather than an API key — such a
+        # machine must switch to `ANTHROPIC_API_KEY` (or an `apiKeyHelper`)
+        # for headless dispatch to keep authenticating. This is the
+        # headless/`claude -p` path only — the human-attended interactive PTY
+        # path (coord.providers.claude_pty.ClaudePtyProvider) intentionally
+        # keeps the default sources, so OAuth/keychain login still works for
+        # a session an operator is attached to and watching.
+        "--bare",
     ]
     if spec.model:
         argv.extend(["--model", spec.model])
@@ -4177,6 +4314,14 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         for pattern in _base_checkout_write_guard_tools(spec.repo_path):
             if pattern not in disallowed_tools:
                 disallowed_tools.append(pattern)
+    # #2461: review gets its mutating-command deny list wired into
+    # --disallowedTools too, not just the soft system-prompt reminder from
+    # build_deny_prompt above — the CLI enforces this one even if the model
+    # decides to ignore its own prompt.
+    if spec.type == "review":
+        for pattern in REVIEW_DENY_COMMANDS:
+            if pattern not in disallowed_tools:
+                disallowed_tools.append(pattern)
     if disallowed_tools:
         argv.extend(["--disallowedTools", ",".join(disallowed_tools)])
     # #315: when resuming a prior chat session, load the prior conversation so

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/coord/commands/dispatch_workers.py

@@ -147,8 +147,8 @@ def _dispatch_review_of(
 
     from coord.review import (  # noqa: PLC0415
         REVIEWER_SYSTEM_PROMPT,
-        _read_repo_claude_md,
         build_review_briefing,
+        read_repo_claude_md,
     )
     from coord.models import Assignment  # noqa: PLC0415
     from coord.state import (  # noqa: PLC0415
@@ -194,7 +194,7 @@ def _dispatch_review_of(
     # have the reviewer read ./CLAUDE.md in the remote checkout it sits
     # in (its actual rules, not the coordinator's possibly-divergent copy).
     claude_md = (
-        _read_repo_claude_md(Path(review_repo_path)) if _is_local else ""
+        read_repo_claude_md(Path(review_repo_path)) if _is_local else ""
     )
 
     # #612: embed the merge-base (three-dot) diff so the reviewer has

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/coord/providers/claude.py

@@ -113,13 +113,16 @@ class ClaudeProvider(Provider):
             NEW_ISSUE_CHAT_DENY_COMMANDS,
             NEW_ISSUE_CHAT_SYSTEM_PROMPT,
             REFINEMENT_SYSTEM_PROMPT,
+            REVIEW_DENY_COMMANDS,
             TEST_CHAT_SYSTEM_PROMPT,
             WORKER_PLAN_PROMPT,
             WORKER_SYSTEM_PROMPT,
             _base_checkout_write_guard_tools,
+            _claude_md_system_prompt_suffix,
             _sealed_write_guard_tools,
             build_deny_prompt,
         )
+        from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
         from coord.smoke import SMOKE_SYSTEM_PROMPT  # noqa: PLC0415
 
         binary = self._binary if self._binary is not None else DEFAULT_WORKER_BINARY
@@ -140,6 +143,10 @@ class ClaudeProvider(Provider):
         if system_prompt is None or allowed_tools is None:
             if spec.type == "plan":
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_PLAN_PROMPT
+                # #2462: keep in sync with default_worker_command's identical
+                # branch — `--bare` below drops CLAUDE.md auto-discovery, so a
+                # plan leg needs the target repo's conventions embedded here.
+                _sp += _claude_md_system_prompt_suffix(spec.repo_path)
                 _at = "Read,Bash"
             elif spec.type == "refinement":
                 _sp = spec.system_prompt if spec.system_prompt else REFINEMENT_SYSTEM_PROMPT
@@ -170,6 +177,9 @@ class ClaudeProvider(Provider):
             elif spec.type == "mock-author":
                 _sp = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
                 _sp += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
+                # #2462: keep in sync with default_worker_command — `--bare`
+                # drops CLAUDE.md auto-discovery.
+                _sp += _claude_md_system_prompt_suffix(spec.repo_path)
                 _at = "Read,Edit,Write,Bash"
             elif spec.type == "smoke":
                 # #2301: keep in sync with default_worker_command's identical
@@ -180,9 +190,26 @@ class ClaudeProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 _at = "Read,Bash"
+            elif spec.type == "review":
+                # #2461: keep in sync with default_worker_command's identical
+                # branch — a reviewer reads the diff and reports a verdict,
+                # it edits and pushes nothing, so Read,Bash only (no
+                # Edit/Write, no Monitor — same one-shot-session reasoning as
+                # the `smoke` branch above). See REVIEW_DENY_COMMANDS for why
+                # its mutating-command deny list also lands in
+                # --disallowedTools below, not just this prompt text.
+                _sp = spec.system_prompt if spec.system_prompt else REVIEWER_SYSTEM_PROMPT
+                _sp += build_deny_prompt(REVIEW_DENY_COMMANDS)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
+                # #2462: keep in sync with default_worker_command's identical
+                # catch-all branch — it covers "work", "fix", "conflict-fix"
+                # and "test-author", every one of which edits code and needs
+                # the target repo's CLAUDE.md conventions, which `--bare`
+                # below stops Claude Code from auto-discovering.
+                _sp += _claude_md_system_prompt_suffix(spec.repo_path)
                 # #2169: keep in sync with default_worker_command's identical
                 # branch — Monitor is the sanctioned bounded-poll tool for a
                 # backgrounded long-running command. #2301: this grant is for
@@ -202,10 +229,11 @@ class ClaudeProvider(Provider):
             "--system-prompt", system_prompt,
             "--allowedTools", allowed_tools,
             "--permission-mode", permission_mode,
-            # #1445: see the matching comment in default_worker_command —
-            # workers must not inherit the host checkout's project/local
-            # Claude Code settings.
-            "--setting-sources", "user",
+            # #1445 / #2462: see the matching comment in
+            # default_worker_command — workers must not inherit the host
+            # checkout's project/local Claude Code settings, hooks, or
+            # .mcp.json MCP servers. `--bare` closes all of those at once.
+            "--bare",
         ]
         if effective_model:
             argv.extend(["--model", effective_model])
@@ -217,6 +245,12 @@ class ClaudeProvider(Provider):
             for pattern in _base_checkout_write_guard_tools(spec.repo_path):
                 if pattern not in disallowed_tools:
                     disallowed_tools.append(pattern)
+        # #2461: same CLI-enforced hard block as default_worker_command —
+        # see REVIEW_DENY_COMMANDS.
+        if spec.type == "review":
+            for pattern in REVIEW_DENY_COMMANDS:
+                if pattern not in disallowed_tools:
+                    disallowed_tools.append(pattern)
         if disallowed_tools:
             argv.extend(["--disallowedTools", ",".join(disallowed_tools)])
         if spec.resume_session_id:

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/coord/providers/claude_pty.py

@@ -433,6 +433,7 @@ class ClaudePtyProvider(Provider):
             NEW_ISSUE_CHAT_DENY_COMMANDS,
             NEW_ISSUE_CHAT_SYSTEM_PROMPT,
             REFINEMENT_SYSTEM_PROMPT,
+            REVIEW_DENY_COMMANDS,
             TEST_CHAT_SYSTEM_PROMPT,
             WORKER_PLAN_PROMPT,
             WORKER_SYSTEM_PROMPT,
@@ -497,6 +498,16 @@ class ClaudePtyProvider(Provider):
                 _sp = spec.system_prompt if spec.system_prompt else SMOKE_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)
                 _at = "Read,Bash"
+            elif spec.type == "review":
+                # #2461: keep in sync with default_worker_command's identical
+                # branch — a reviewer reads the diff and reports a verdict,
+                # it edits and pushes nothing, so Read,Bash only (no
+                # Edit/Write, no Monitor — same one-shot-session reasoning as
+                # the `smoke` branch above).
+                from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
+                _sp = spec.system_prompt if spec.system_prompt else REVIEWER_SYSTEM_PROMPT
+                _sp += build_deny_prompt(REVIEW_DENY_COMMANDS)
+                _at = "Read,Bash"
             else:
                 _sp = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
                 _sp += build_deny_prompt(spec.deny_commands)

{code_coordinator-0.5.188 → code_coordinator-0.5.190}/coord/review.py

@@ -1213,7 +1213,7 @@ def _ranked_reviewer_candidates(
 
 # ── Briefing construction ───────────────────────────────────────────────────
 
-def _read_repo_claude_md(repo_path: Path) -> str | None:
+def read_repo_claude_md(repo_path: Path) -> str | None:
     """Return the contents of CLAUDE.md at the repo root, or None.
 
     The coordinator runs on the machine that dispatches; the reviewer runs on
@@ -1221,6 +1221,12 @@ def _read_repo_claude_md(repo_path: Path) -> str | None:
     here so the briefing is self-contained — if the reviewer's checkout is
     behind, the worker's diff still gets reviewed against the rules the
     coordinator thought were current.
+
+    Public (no leading underscore) because #2462 reuses it from
+    :mod:`coord.agent` — since worker dispatch switched to ``--bare``,
+    Claude Code's own CLAUDE.md auto-discovery no longer runs for
+    work-shaped legs, so ``default_worker_command`` embeds this the same
+    defensive way the review briefing already did.
     """
     candidate = repo_path / "CLAUDE.md"
     if not candidate.exists():
@@ -1883,7 +1889,7 @@ def dispatch_review(
     *,
     http_client: httpx.Client | None = None,
     pr_lookup=_find_or_open_pr,
-    claude_md_reader=_read_repo_claude_md,
+    claude_md_reader=read_repo_claude_md,
     issue_body_fetcher=None,
     now: float | None = None,
     terminal_cache: dict | None = None,