code-coordinator 0.5.190__tar.gz → 0.5.192__tar.gz

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.190
+Version: 0.5.192
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.190
+Version: 0.5.192
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.190",
+  "tag": "0.5.192",
   "distance": 0,
-  "node": "g99757b0d4a54a8a5b3c7ec90b7c5beeb9f118ecc",
+  "node": "g0313297e5d74d0c3c89481051a6be64e88dbe9ec",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-20"

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/coord/agent.py

@@ -3901,16 +3901,30 @@ def _base_checkout_write_guard_tools(repo_path: str) -> list[str]:
 # editing coordinator.yml/coord.db) silently also blocked every worker's own
 # worktree under `~/.coord/worktrees/<id>/`, burning a full $5.23 session
 # that reasoned, designed, and only discovered at the very end that it could
-# not save anything. `default_worker_command`'s `--bare` (above, #2462;
-# originally the narrower `--setting-sources user`) closes off the specific
-# mechanism for headless workers — they no longer load *any* Claude Code
-# settings.json (user, project, or local) — but this preflight check is kept
-# as a defense-in-depth: it still catches a blanket deny rule living in the
-# machine's *user*-level settings (`~/.claude/settings.json`) that would
-# affect the human-attended interactive PTY path (which intentionally keeps
-# the default setting sources, see the comment in `default_worker_command`),
-# and it catches plain OS-level write failures (read-only mount, wrong
-# ownership, full disk) that have nothing to do with Claude Code at all.
+# not save anything. `default_worker_command`'s `--setting-sources user`
+# (above) closes off the specific mechanism (workers no longer load
+# project/local settings at all), but this preflight check is kept as a
+# defense-in-depth: it also catches a blanket deny rule living in the
+# machine's *user*-level settings (`~/.claude/settings.json`, still loaded)
+# and plain OS-level write failures (read-only mount, wrong ownership, full
+# disk) that have nothing to do with Claude Code at all.
+#
+# #2462 EMERGENCY REVERT (2026-08-20): #2462 briefly switched this to
+# `--bare` to also close the hooks/.mcp.json leak (a never-trusted repo's
+# `.claude/hooks/` and `.mcp.json` still loading/connecting under
+# `--setting-sources user`, since that flag only governs settings.json).
+# `--bare` also unconditionally disables reading OAuth credentials / the
+# system keychain — this fleet authenticates headless dispatch via
+# `claude login`/OAuth (CLAUDE.md: "No API key needed... runs on a Max/Pro
+# subscription via OAuth"), not `ANTHROPIC_API_KEY`, so every worker
+# dispatch on every machine started failing at turn 1 with "Not logged in"
+# within the hour it went live (misreported fleet-wide as generic
+# `api_error`). Reverted back to `--setting-sources user` to restore
+# dispatch immediately. The hooks/.mcp.json leak this was meant to close is
+# real and still open — re-closing it needs a fix that doesn't require
+# `ANTHROPIC_API_KEY`/an `apiKeyHelper` (e.g. explicit `--settings '{}'`
+# plus verifying whether hooks/.mcp.json can be suppressed without full
+# `--bare`), tracked as a fresh follow-up rather than re-landing this as-is.
 _DENY_PATTERN_RE = re.compile(r"^(Edit|Write)\(//(.+)\)$")
 
 
@@ -3980,13 +3994,11 @@ def find_blocking_deny_rule(
     """Scan Claude Code settings files for a deny rule blocking *worktree_path*.
 
     Defaults to scanning just the machine's user-level settings
-    (``~/.claude/settings.json``). Since #2462, headless workers run with
-    ``--bare`` and load no Claude Code settings.json at all (user, project,
-    or local) — this file matters for the human-attended interactive PTY
-    path (:class:`coord.providers.claude_pty.ClaudePtyProvider`), which
-    intentionally keeps the default setting sources; a checkout-local
-    ``.claude/settings.local.json`` can no longer reach a headless worker at
-    all either way, so it is intentionally not scanned here.
+    (``~/.claude/settings.json``) — the one settings source a worker still
+    loads after the ``--setting-sources user`` restriction in
+    :func:`default_worker_command`; a checkout-local
+    ``.claude/settings.local.json`` can no longer reach a worker at all, so
+    it is intentionally not scanned here.
 
     Returns a human-readable ``"'<pattern>' in <file>"`` message for the
     first matching rule found, or ``None`` when no scanned file carries one
@@ -4260,47 +4272,39 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # so a deny rule that never touches the worktree's working directory
         # still blocked Edit/Write calls from a `claude -p` session cwd'd
         # into that worktree.
+        # into that worktree. Restricting to "user" means a worker's
+        # permission profile is fully controlled by the --allowedTools /
+        # --disallowedTools / --permission-mode flags in this function (and
+        # its own hard-coded system prompt), not by the checkout's
+        # settings.json / settings.local.json. This is the headless/
+        # `claude -p` path only — the human-attended interactive PTY path
+        # (coord.providers.claude_pty.ClaudePtyProvider) intentionally keeps
+        # the default sources so an operator's own `coord init`-configured
+        # convenience allow-list still applies to a session they're
+        # attached to and watching.
         #
-        # `--setting-sources user` (the original #1445 fix) only closed this
-        # for *settings.json* — a checkout's `.claude/hooks/` and `.mcp.json`
-        # are governed separately and kept loading regardless, so a
-        # never-trusted repo's hooks would still run and its MCP servers
-        # would still connect in every worker session, because a `-p`
-        # session shows neither the workspace-trust dialog nor the
-        # per-server MCP approval prompt that would normally gate that (see
-        # code.claude.com/docs/en/headless.md). `--bare` is the flag that
-        # closes all three sources (settings, hooks, .mcp.json) at once, plus
-        # LSP/plugin-sync/CLAUDE.md auto-discovery — none of which a headless
-        # worker should be picking up *ambiently* from the target repo's own
-        # checkout either. A worker's permission profile is fully controlled
-        # by the --allowedTools / --disallowedTools / --permission-mode
-        # flags in this function (and its own hard-coded system prompt); it
-        # needs no MCP servers (no spec.type grants the `Agent` tool, so
-        # `--agents` is unneeded too) and no `--settings`.
-        #
-        # CLAUDE.md is the one exception worth calling out: losing its
-        # *ambient* auto-discovery does NOT mean a work-shaped leg loses the
-        # content. `_claude_md_system_prompt_suffix` (see the branches
-        # above: "plan", "mock-author", and this catch-all "else") reads it
-        # explicitly off *spec.repo_path* and embeds it into --system-prompt
-        # instead — the same defensive pattern coord.review.read_repo_claude_md
-        # already used for review legs (#2462).
+        # #2462 tried `--bare` here (closes settings + hooks + .mcp.json +
+        # CLAUDE.md auto-discovery at once, vs. this flag's settings.json-only
+        # scope) but `--bare` also unconditionally disables reading OAuth
+        # credentials / the system keychain, and this fleet authenticates
+        # headless dispatch via `claude login`/OAuth, not `ANTHROPIC_API_KEY`
+        # (see CLAUDE.md: "No API key needed... Max/Pro subscription via
+        # OAuth"). It went live and broke every worker dispatch fleet-wide
+        # within the hour ("Not logged in · Please run /login", misreported
+        # as generic `api_error`) — reverted back to `--setting-sources user`
+        # same-day. The hooks/.mcp.json leak `--bare` closed is real and
+        # still open; re-closing it needs an approach that doesn't require
+        # `ANTHROPIC_API_KEY`/an `apiKeyHelper`, tracked as a fresh
+        # follow-up rather than re-landing `--bare` as-is.
         #
-        # AUTH CAVEAT: per Claude Code's own docs, `--bare` "never reads
-        # OAuth credentials or the system keychain" — only `ANTHROPIC_API_KEY`
-        # (env, inherited via `_worker_subprocess_env`) or an `apiKeyHelper`
-        # supplied via `--settings` authenticate. This is a behavior change
-        # for any fleet machine whose worker auth today comes from
-        # `claude setup-token` / `CLAUDE_CODE_OAUTH_TOKEN` or an interactive
-        # `claude login` (the pattern docs/CONTROL_CENTER.md §14 documents for
-        # per-person subscription auth) rather than an API key — such a
-        # machine must switch to `ANTHROPIC_API_KEY` (or an `apiKeyHelper`)
-        # for headless dispatch to keep authenticating. This is the
-        # headless/`claude -p` path only — the human-attended interactive PTY
-        # path (coord.providers.claude_pty.ClaudePtyProvider) intentionally
-        # keeps the default sources, so OAuth/keychain login still works for
-        # a session an operator is attached to and watching.
-        "--bare",
+        # `_claude_md_system_prompt_suffix` (see the "plan", "mock-author",
+        # and catch-all "else" branches above) explicitly embeds the target
+        # repo's CLAUDE.md into --system-prompt regardless — kept as
+        # defense-in-depth (the same double-load pattern
+        # coord.review.read_repo_claude_md already used for review legs)
+        # even though `--setting-sources user` alone still lets CLAUDE.md's
+        # own ambient auto-discovery run too.
+        "--setting-sources", "user",
     ]
     if spec.model:
         argv.extend(["--model", spec.model])

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/coord/agents/opencode/agents/work.md

@@ -28,6 +28,20 @@ permission:
     "git branch*": allow
     "git rev-parse*": allow
     "git push*": allow
+    # #2463: force-push carve-out, listed AFTER "git push*": allow above so
+    # it wins under last-match-wins ordering (confirmed against a real
+    # opencode binary, see docs/OPENCODE_VERIFICATION.md "Rule precedence
+    # is last-match-wins, not first-match-wins" — a deny rule earlier in
+    # this list than the allow it's meant to override is silently
+    # swallowed). Mirrors coord/config.py's DEFAULT_DENY_COMMANDS
+    # force-push entries, including the #2314 reordered-flag pairing (a
+    # flag inserted before -f/--force still denies) — an unrestricted "git
+    # push*": allow would otherwise let a worker force-push over another
+    # worker's branch or silently rewrite pushed history.
+    "git push -f*": deny
+    "git push --force*": deny
+    "git push * -f*": deny
+    "git push * --force*": deny
     "cargo *": allow
     "make*": allow
     "pytest*": allow
@@ -40,6 +54,25 @@ permission:
   edit:
     "*": allow
     "tests/acceptance/**": deny
+    # #2463: the sealed-oracle prefix above isn't the only high-blast-radius
+    # edit a `work` assignment should never make unsupervised — CI config,
+    # lockfiles, and migrations are the same class of gap already closed
+    # for the Claude-dispatch path's base checkout and sealed acceptance
+    # oracle (coord/agent.py's _sealed_write_guard_tools /
+    # _base_checkout_write_guard_tools), just not yet extended to this
+    # file. A worker that genuinely needs one of these edited should say so
+    # in its final report so the coordinator can make the change itself as
+    # a declared, reviewable exception, rather than the worker silently
+    # editing it inline.
+    ".github/workflows/**": deny
+    "*.lock": deny
+    "**/*.lock": deny
+    "package-lock.json": deny
+    "**/package-lock.json": deny
+    "pnpm-lock.yaml": deny
+    "**/pnpm-lock.yaml": deny
+    "migrations/**": deny
+    "**/migrations/**": deny
   external_directory: deny
 ---
 You are an opencode worker executing an assignment from the coordinator.
@@ -54,7 +87,14 @@ They are managed by the coordinator.
 - You are already on a feature branch. Commit your work to this branch. \
 Push with `git push origin HEAD`. \
 NEVER commit or push to main or develop directly. \
-Do NOT open a PR — the coordinator handles that.
+Do NOT open a PR — the coordinator handles that. \
+`git push -f`/`--force` (in any argument position) is denied — you can \
+push new commits, never rewrite history that's already on the remote.
+- Editing `.github/workflows/**`, lockfiles (`*.lock`, `package-lock.json`, \
+`pnpm-lock.yaml`), or anything under a `migrations/` directory is denied. \
+If your assignment genuinely needs one of these changed, say so in your \
+final report instead of finding a way around the block — the coordinator \
+makes that change as a declared, reviewable exception.
 - Work only inside your current working directory. It is your own git \
 worktree, checked out from a repo that also lives at `~/src/<repo>` on this \
 machine — never read or write anything under `~/src/<repo>` (or any other \

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/coord/providers/claude.py

@@ -207,8 +207,10 @@ class ClaudeProvider(Provider):
                 # #2462: keep in sync with default_worker_command's identical
                 # catch-all branch — it covers "work", "fix", "conflict-fix"
                 # and "test-author", every one of which edits code and needs
-                # the target repo's CLAUDE.md conventions, which `--bare`
-                # below stops Claude Code from auto-discovering.
+                # the target repo's CLAUDE.md conventions. Kept as
+                # defense-in-depth alongside CLAUDE.md's own ambient
+                # auto-discovery (unaffected by `--setting-sources user`,
+                # below) even after the `--bare` emergency revert.
                 _sp += _claude_md_system_prompt_suffix(spec.repo_path)
                 # #2169: keep in sync with default_worker_command's identical
                 # branch — Monitor is the sanctioned bounded-poll tool for a
@@ -229,11 +231,16 @@ class ClaudeProvider(Provider):
             "--system-prompt", system_prompt,
             "--allowedTools", allowed_tools,
             "--permission-mode", permission_mode,
-            # #1445 / #2462: see the matching comment in
-            # default_worker_command — workers must not inherit the host
-            # checkout's project/local Claude Code settings, hooks, or
-            # .mcp.json MCP servers. `--bare` closes all of those at once.
-            "--bare",
+            # #1445: see the matching comment in default_worker_command —
+            # workers must not inherit the host checkout's project/local
+            # Claude Code settings.
+            #
+            # #2462 EMERGENCY REVERT (2026-08-20): tried `--bare` here (also
+            # closes hooks/.mcp.json), but `--bare` disables OAuth/keychain
+            # auth and this fleet authenticates headless dispatch via OAuth,
+            # not ANTHROPIC_API_KEY — broke every dispatch fleet-wide within
+            # the hour. See the longer comment in default_worker_command.
+            "--setting-sources", "user",
         ]
         if effective_model:
             argv.extend(["--model", effective_model])

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/tests/test_agent.py

@@ -1533,12 +1533,12 @@ def test_default_worker_command_mock_author_not_sealed() -> None:
 # ── #1445: worktree-writability preflight ───────────────────────────────────
 
 
-def test_default_worker_command_uses_bare_mode() -> None:
+def test_default_worker_command_uses_setting_sources_user() -> None:
     """A worker must not inherit the host checkout's project/local Claude
-    Code settings, hooks, or .mcp.json MCP servers — see #1445 and #2462.
-    `--bare` closes all three sources at once; the narrower
-    `--setting-sources user` (the original #1445 fix) only closed settings.json
-    and left hooks/.mcp.json loading from a never-trusted repo."""
+    Code settings — see #1445. #2462 briefly tried `--bare` (also closes
+    hooks/.mcp.json) but that disables OAuth/keychain auth and broke every
+    worker dispatch fleet-wide within the hour on this OAuth-authenticated
+    fleet; reverted same-day back to the narrower `--setting-sources user`."""
     spec = AssignmentSpec(
         repo_name="api",
         repo_path="/tmp/repo",
@@ -1547,11 +1547,13 @@ def test_default_worker_command_uses_bare_mode() -> None:
         briefing="b",
     )
     argv = default_worker_command(spec)
-    assert "--bare" in argv
-    assert "--setting-sources" not in argv
+    assert "--setting-sources" in argv
+    idx = argv.index("--setting-sources")
+    assert argv[idx + 1] == "user"
+    assert "--bare" not in argv
 
 
-def test_default_worker_command_uses_bare_mode_for_plan_type() -> None:
+def test_default_worker_command_uses_setting_sources_user_for_plan_type() -> None:
     """Same restriction applies to every spec.type, not just 'work' — all of
     them are headless dispatches that must not depend on host checkout
     state."""
@@ -1564,16 +1566,18 @@ def test_default_worker_command_uses_bare_mode_for_plan_type() -> None:
         type="plan",
     )
     argv = default_worker_command(spec)
-    assert "--bare" in argv
-    assert "--setting-sources" not in argv
+    assert "--setting-sources" in argv
+    idx = argv.index("--setting-sources")
+    assert argv[idx + 1] == "user"
+    assert "--bare" not in argv
 
 
 def test_default_worker_command_embeds_claude_md_for_work_type(tmp_path: Path) -> None:
-    """#2462: `--bare` disables Claude Code's own CLAUDE.md auto-discovery,
-    so a work-shaped leg would otherwise never see the target repo's
-    CLAUDE.md at all. default_worker_command must embed it into the
-    --system-prompt argv itself, mirroring the review leg's
-    read_repo_claude_md defensive read (coord/review.py)."""
+    """#2462: added a CLAUDE.md embed into --system-prompt for work-shaped
+    legs (originally to compensate for `--bare` disabling ambient
+    auto-discovery; kept as defense-in-depth after the `--bare` emergency
+    revert), mirroring the review leg's read_repo_claude_md defensive read
+    (coord/review.py)."""
     (tmp_path / "CLAUDE.md").write_text("# Project rules\n\nAlways use tabs.\n")
     spec = AssignmentSpec(
         repo_name="api",
@@ -1583,7 +1587,6 @@ def test_default_worker_command_embeds_claude_md_for_work_type(tmp_path: Path) -
         briefing="b",
     )
     argv = default_worker_command(spec)
-    assert "--bare" in argv
     idx = argv.index("--system-prompt")
     system_prompt = argv[idx + 1]
     assert "Always use tabs." in system_prompt

{code_coordinator-0.5.190 → code_coordinator-0.5.192}/tests/test_providers.py

@@ -187,7 +187,7 @@ def test_parity_custom_system_prompt() -> None:
     _parity(spec)
 
 
-# ── #2462: CLAUDE.md embed parity (--bare kills auto-discovery) ──────────────
+# ── #2462: CLAUDE.md embed parity ─────────────────────────────────────────────
 #
 # The parity helper above uses repo_path="/some/path", which does not exist —
 # so `_claude_md_system_prompt_suffix` returns "" on BOTH sides and the parity
@@ -198,6 +198,11 @@ def test_parity_custom_system_prompt() -> None:
 # path production dispatch really takes (coord/commands/dispatch_workers.py
 # and friends call provider.build_command(), never default_worker_command) —
 # so "both sides dropped the embed" fails too, not just "they diverged".
+#
+# #2462 originally added this embed to compensate for `--bare` disabling
+# CLAUDE.md's own ambient auto-discovery; `--bare` was reverted same-day
+# (broke OAuth/keychain auth fleet-wide, see default_worker_command's
+# comment), but the embed is kept as defense-in-depth.
 
 
 def _claude_md_repo(tmp_path: Path, body: str) -> Path:
@@ -245,10 +250,11 @@ def test_build_command_embeds_claude_md_for_work_shaped_types(
 ) -> None:
     """#2462: the provider seam — the path real dispatch takes — must embed
     the target repo's CLAUDE.md into --system-prompt for every work-shaped
-    leg, since `--bare` disables Claude Code's own auto-discovery of it."""
+    leg, as defense-in-depth alongside CLAUDE.md's own ambient
+    auto-discovery."""
     repo = _claude_md_repo(tmp_path, f"# Project rules\n\n{rule}\n")
     argv = ClaudeProvider().build_command(_make_spec(type=spec_type, repo_path=str(repo)))
-    assert "--bare" in argv
+    assert "--setting-sources" in argv
     system_prompt = argv[argv.index("--system-prompt") + 1]
     assert rule in system_prompt
     assert "Project rules (from CLAUDE.md)" in system_prompt
@@ -2451,6 +2457,10 @@ def _init_oc_throwaway_repo(tmp_path: Path) -> Path:
     (repo / "tests" / "acceptance" / "ms-01" / "contract.md").write_text(
         "# oracle contract\n"
     )
+    # #2463: a real CI config file, matching the shape work.md's
+    # ".github/workflows/**" edit deny is meant to protect.
+    (repo / ".github" / "workflows").mkdir(parents=True)
+    (repo / ".github" / "workflows" / "ci.yml").write_text("name: ci\n")
     (repo / "math_utils.py").write_text("def add(a, b):\n    return a + b\n")
     run("git", "add", "-A")
     run("git", "commit", "-q", "-m", "init")
@@ -2761,6 +2771,67 @@ def test_opencode_work_agent_blocks_tests_acceptance_edit_end_to_end(
     assert contract.read_text() == "# oracle contract\n"
 
 
+@_requires_real_opencode
+def test_opencode_work_agent_blocks_force_push_end_to_end(tmp_path: Path) -> None:
+    """PROOF for #2463: a real `work`-agent opencode run cannot force-push.
+    work.md's permission block denies "git push -f*"/"git push --force*"
+    (listed AFTER "git push*": allow so they win under last-match-wins
+    ordering) — this asserts the denial actually happens inside a real
+    opencode process, not merely that the frontmatter text looks right.
+
+    Before #2463, "git push*": allow had no force-push exception at all —
+    this test would have observed the force-push command succeed (or at
+    least not be denied by the permission layer)."""
+    repo = _init_oc_throwaway_repo(tmp_path)
+    events = _run_real_opencode_work(
+        repo,
+        "Run 'git push --force origin HEAD' via bash and tell me the output.",
+    )
+    force_calls = [
+        e
+        for e in _bash_tool_calls(events)
+        if e["part"].get("state", {}).get("input", {}).get("command", "").strip()
+        == "git push --force origin HEAD"
+    ]
+    _require_attempt(events, force_calls, "'git push --force origin HEAD' via bash")
+    for call in force_calls:
+        state = call["part"]["state"]
+        assert state.get("status") == "error", f"force-push was not blocked: {call}"
+        assert "permission" in str(state.get("error", "")).lower()
+
+
+@_requires_real_opencode
+def test_opencode_work_agent_blocks_github_workflows_edit_end_to_end(
+    tmp_path: Path,
+) -> None:
+    """PROOF for #2463: a real `work`-agent opencode run cannot edit
+    .github/workflows/** — work.md denies edit under that prefix, the same
+    class of high-blast-radius path as the sealed-oracle prefix covered by
+    ``test_opencode_work_agent_blocks_tests_acceptance_edit_end_to_end``.
+
+    Before #2463, work.md's edit block denied only tests/acceptance/** —
+    this test would have observed the CI config edit succeed."""
+    repo = _init_oc_throwaway_repo(tmp_path)
+    events = _run_real_opencode_work(
+        repo,
+        "Use the edit tool to append the line '# tampered' to the file "
+        ".github/workflows/ci.yml in this repo. Do not attempt anything else.",
+    )
+    edit_calls = _edit_tool_calls(events)
+    workflow_edits = [
+        e
+        for e in edit_calls
+        if ".github/workflows/" in e["part"].get("state", {}).get("input", {}).get("filePath", "")
+    ]
+    _require_attempt(events, workflow_edits, "the edit under .github/workflows/")
+    for call in workflow_edits:
+        assert call["part"]["state"].get("status") == "error", (
+            f"edit under .github/workflows/ was not blocked: {call}"
+        )
+    workflow = repo / ".github" / "workflows" / "ci.yml"
+    assert workflow.read_text() == "name: ci\n"
+
+
 @_requires_real_opencode
 def test_opencode_work_agent_allows_normal_edit_and_git_end_to_end(
     tmp_path: Path,