code-coordinator 0.5.190__tar.gz → 0.5.191__tar.gz

{code_coordinator-0.5.190 → code_coordinator-0.5.191}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.190
+Version: 0.5.191
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.190 → code_coordinator-0.5.191}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.190
+Version: 0.5.191
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.190 → code_coordinator-0.5.191}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.190",
+  "tag": "0.5.191",
   "distance": 0,
-  "node": "g99757b0d4a54a8a5b3c7ec90b7c5beeb9f118ecc",
+  "node": "g7a4006451b4cd97b02646a6037dfee5fe32ceaa3",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-20"

{code_coordinator-0.5.190 → code_coordinator-0.5.191}/coord/agents/opencode/agents/work.md

@@ -28,6 +28,20 @@ permission:
     "git branch*": allow
     "git rev-parse*": allow
     "git push*": allow
+    # #2463: force-push carve-out, listed AFTER "git push*": allow above so
+    # it wins under last-match-wins ordering (confirmed against a real
+    # opencode binary, see docs/OPENCODE_VERIFICATION.md "Rule precedence
+    # is last-match-wins, not first-match-wins" — a deny rule earlier in
+    # this list than the allow it's meant to override is silently
+    # swallowed). Mirrors coord/config.py's DEFAULT_DENY_COMMANDS
+    # force-push entries, including the #2314 reordered-flag pairing (a
+    # flag inserted before -f/--force still denies) — an unrestricted "git
+    # push*": allow would otherwise let a worker force-push over another
+    # worker's branch or silently rewrite pushed history.
+    "git push -f*": deny
+    "git push --force*": deny
+    "git push * -f*": deny
+    "git push * --force*": deny
     "cargo *": allow
     "make*": allow
     "pytest*": allow
@@ -40,6 +54,25 @@ permission:
   edit:
     "*": allow
     "tests/acceptance/**": deny
+    # #2463: the sealed-oracle prefix above isn't the only high-blast-radius
+    # edit a `work` assignment should never make unsupervised — CI config,
+    # lockfiles, and migrations are the same class of gap already closed
+    # for the Claude-dispatch path's base checkout and sealed acceptance
+    # oracle (coord/agent.py's _sealed_write_guard_tools /
+    # _base_checkout_write_guard_tools), just not yet extended to this
+    # file. A worker that genuinely needs one of these edited should say so
+    # in its final report so the coordinator can make the change itself as
+    # a declared, reviewable exception, rather than the worker silently
+    # editing it inline.
+    ".github/workflows/**": deny
+    "*.lock": deny
+    "**/*.lock": deny
+    "package-lock.json": deny
+    "**/package-lock.json": deny
+    "pnpm-lock.yaml": deny
+    "**/pnpm-lock.yaml": deny
+    "migrations/**": deny
+    "**/migrations/**": deny
   external_directory: deny
 ---
 You are an opencode worker executing an assignment from the coordinator.
@@ -54,7 +87,14 @@ They are managed by the coordinator.
 - You are already on a feature branch. Commit your work to this branch. \
 Push with `git push origin HEAD`. \
 NEVER commit or push to main or develop directly. \
-Do NOT open a PR — the coordinator handles that.
+Do NOT open a PR — the coordinator handles that. \
+`git push -f`/`--force` (in any argument position) is denied — you can \
+push new commits, never rewrite history that's already on the remote.
+- Editing `.github/workflows/**`, lockfiles (`*.lock`, `package-lock.json`, \
+`pnpm-lock.yaml`), or anything under a `migrations/` directory is denied. \
+If your assignment genuinely needs one of these changed, say so in your \
+final report instead of finding a way around the block — the coordinator \
+makes that change as a declared, reviewable exception.
 - Work only inside your current working directory. It is your own git \
 worktree, checked out from a repo that also lives at `~/src/<repo>` on this \
 machine — never read or write anything under `~/src/<repo>` (or any other \

{code_coordinator-0.5.190 → code_coordinator-0.5.191}/tests/test_providers.py

@@ -2451,6 +2451,10 @@ def _init_oc_throwaway_repo(tmp_path: Path) -> Path:
     (repo / "tests" / "acceptance" / "ms-01" / "contract.md").write_text(
         "# oracle contract\n"
     )
+    # #2463: a real CI config file, matching the shape work.md's
+    # ".github/workflows/**" edit deny is meant to protect.
+    (repo / ".github" / "workflows").mkdir(parents=True)
+    (repo / ".github" / "workflows" / "ci.yml").write_text("name: ci\n")
     (repo / "math_utils.py").write_text("def add(a, b):\n    return a + b\n")
     run("git", "add", "-A")
     run("git", "commit", "-q", "-m", "init")
@@ -2761,6 +2765,67 @@ def test_opencode_work_agent_blocks_tests_acceptance_edit_end_to_end(
     assert contract.read_text() == "# oracle contract\n"
 
 
+@_requires_real_opencode
+def test_opencode_work_agent_blocks_force_push_end_to_end(tmp_path: Path) -> None:
+    """PROOF for #2463: a real `work`-agent opencode run cannot force-push.
+    work.md's permission block denies "git push -f*"/"git push --force*"
+    (listed AFTER "git push*": allow so they win under last-match-wins
+    ordering) — this asserts the denial actually happens inside a real
+    opencode process, not merely that the frontmatter text looks right.
+
+    Before #2463, "git push*": allow had no force-push exception at all —
+    this test would have observed the force-push command succeed (or at
+    least not be denied by the permission layer)."""
+    repo = _init_oc_throwaway_repo(tmp_path)
+    events = _run_real_opencode_work(
+        repo,
+        "Run 'git push --force origin HEAD' via bash and tell me the output.",
+    )
+    force_calls = [
+        e
+        for e in _bash_tool_calls(events)
+        if e["part"].get("state", {}).get("input", {}).get("command", "").strip()
+        == "git push --force origin HEAD"
+    ]
+    _require_attempt(events, force_calls, "'git push --force origin HEAD' via bash")
+    for call in force_calls:
+        state = call["part"]["state"]
+        assert state.get("status") == "error", f"force-push was not blocked: {call}"
+        assert "permission" in str(state.get("error", "")).lower()
+
+
+@_requires_real_opencode
+def test_opencode_work_agent_blocks_github_workflows_edit_end_to_end(
+    tmp_path: Path,
+) -> None:
+    """PROOF for #2463: a real `work`-agent opencode run cannot edit
+    .github/workflows/** — work.md denies edit under that prefix, the same
+    class of high-blast-radius path as the sealed-oracle prefix covered by
+    ``test_opencode_work_agent_blocks_tests_acceptance_edit_end_to_end``.
+
+    Before #2463, work.md's edit block denied only tests/acceptance/** —
+    this test would have observed the CI config edit succeed."""
+    repo = _init_oc_throwaway_repo(tmp_path)
+    events = _run_real_opencode_work(
+        repo,
+        "Use the edit tool to append the line '# tampered' to the file "
+        ".github/workflows/ci.yml in this repo. Do not attempt anything else.",
+    )
+    edit_calls = _edit_tool_calls(events)
+    workflow_edits = [
+        e
+        for e in edit_calls
+        if ".github/workflows/" in e["part"].get("state", {}).get("input", {}).get("filePath", "")
+    ]
+    _require_attempt(events, workflow_edits, "the edit under .github/workflows/")
+    for call in workflow_edits:
+        assert call["part"]["state"].get("status") == "error", (
+            f"edit under .github/workflows/ was not blocked: {call}"
+        )
+    workflow = repo / ".github" / "workflows" / "ci.yml"
+    assert workflow.read_text() == "name: ci\n"
+
+
 @_requires_real_opencode
 def test_opencode_work_agent_allows_normal_edit_and_git_end_to_end(
     tmp_path: Path,