code-coordinator 0.5.191__tar.gz → 0.5.194__tar.gz

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.191
+Version: 0.5.194
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.191
+Version: 0.5.194
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/code_coordinator.egg-info/SOURCES.txt

@@ -71,6 +71,7 @@ coord/events.py
 coord/failure_class.py
 coord/filelock.py
 coord/fleet_config_health.py
+coord/forge_availability.py
 coord/freshness.py
 coord/gate_a.py
 coord/gate_b.py
@@ -391,6 +392,7 @@ tests/test_cli_audit.py
 tests/test_cli_chat_continue.py
 tests/test_cli_decide.py
 tests/test_cli_diagnose_config_provenance.py
+tests/test_cli_diagnose_forge_availability.py
 tests/test_cli_diagnose_graph.py
 tests/test_cli_diagnose_self.py
 tests/test_cli_doctor.py
@@ -494,6 +496,7 @@ tests/test_fix_of_force_override.py
 tests/test_fleet_config_health.py
 tests/test_fleet_health_probes.py
 tests/test_fleet_health_snapshot.py
+tests/test_forge_availability.py
 tests/test_freshness.py
 tests/test_gate_a.py
 tests/test_gate_b.py

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/code_coordinator.egg-info/scm_file_list.json

@@ -117,6 +117,7 @@
     "coord/failure_class.py",
     "coord/filelock.py",
     "coord/fleet_config_health.py",
+    "coord/forge_availability.py",
     "coord/freshness.py",
     "coord/gate_a.py",
     "coord/gate_b.py",
@@ -453,6 +454,7 @@
     "tests/test_cli_chat_continue.py",
     "tests/test_cli_decide.py",
     "tests/test_cli_diagnose_config_provenance.py",
+    "tests/test_cli_diagnose_forge_availability.py",
     "tests/test_cli_diagnose_graph.py",
     "tests/test_cli_diagnose_self.py",
     "tests/test_cli_doctor.py",
@@ -556,6 +558,7 @@
     "tests/test_fleet_config_health.py",
     "tests/test_fleet_health_probes.py",
     "tests/test_fleet_health_snapshot.py",
+    "tests/test_forge_availability.py",
     "tests/test_freshness.py",
     "tests/test_gate_a.py",
     "tests/test_gate_b.py",

code_coordinator-0.5.194/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.194",
+  "distance": 0,
+  "node": "g8dc0f31443ec84d69abafcaaa0a1af05c2152bf4",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-21"
+}

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/coord/agent.py

@@ -3901,16 +3901,30 @@ def _base_checkout_write_guard_tools(repo_path: str) -> list[str]:
 # editing coordinator.yml/coord.db) silently also blocked every worker's own
 # worktree under `~/.coord/worktrees/<id>/`, burning a full $5.23 session
 # that reasoned, designed, and only discovered at the very end that it could
-# not save anything. `default_worker_command`'s `--bare` (above, #2462;
-# originally the narrower `--setting-sources user`) closes off the specific
-# mechanism for headless workers — they no longer load *any* Claude Code
-# settings.json (user, project, or local) — but this preflight check is kept
-# as a defense-in-depth: it still catches a blanket deny rule living in the
-# machine's *user*-level settings (`~/.claude/settings.json`) that would
-# affect the human-attended interactive PTY path (which intentionally keeps
-# the default setting sources, see the comment in `default_worker_command`),
-# and it catches plain OS-level write failures (read-only mount, wrong
-# ownership, full disk) that have nothing to do with Claude Code at all.
+# not save anything. `default_worker_command`'s `--setting-sources user`
+# (above) closes off the specific mechanism (workers no longer load
+# project/local settings at all), but this preflight check is kept as a
+# defense-in-depth: it also catches a blanket deny rule living in the
+# machine's *user*-level settings (`~/.claude/settings.json`, still loaded)
+# and plain OS-level write failures (read-only mount, wrong ownership, full
+# disk) that have nothing to do with Claude Code at all.
+#
+# #2462 EMERGENCY REVERT (2026-08-20): #2462 briefly switched this to
+# `--bare` to also close the hooks/.mcp.json leak (a never-trusted repo's
+# `.claude/hooks/` and `.mcp.json` still loading/connecting under
+# `--setting-sources user`, since that flag only governs settings.json).
+# `--bare` also unconditionally disables reading OAuth credentials / the
+# system keychain — this fleet authenticates headless dispatch via
+# `claude login`/OAuth (CLAUDE.md: "No API key needed... runs on a Max/Pro
+# subscription via OAuth"), not `ANTHROPIC_API_KEY`, so every worker
+# dispatch on every machine started failing at turn 1 with "Not logged in"
+# within the hour it went live (misreported fleet-wide as generic
+# `api_error`). Reverted back to `--setting-sources user` to restore
+# dispatch immediately. The hooks/.mcp.json leak this was meant to close is
+# real and still open — re-closing it needs a fix that doesn't require
+# `ANTHROPIC_API_KEY`/an `apiKeyHelper` (e.g. explicit `--settings '{}'`
+# plus verifying whether hooks/.mcp.json can be suppressed without full
+# `--bare`), tracked as a fresh follow-up rather than re-landing this as-is.
 _DENY_PATTERN_RE = re.compile(r"^(Edit|Write)\(//(.+)\)$")
 
 
@@ -3980,13 +3994,11 @@ def find_blocking_deny_rule(
     """Scan Claude Code settings files for a deny rule blocking *worktree_path*.
 
     Defaults to scanning just the machine's user-level settings
-    (``~/.claude/settings.json``). Since #2462, headless workers run with
-    ``--bare`` and load no Claude Code settings.json at all (user, project,
-    or local) — this file matters for the human-attended interactive PTY
-    path (:class:`coord.providers.claude_pty.ClaudePtyProvider`), which
-    intentionally keeps the default setting sources; a checkout-local
-    ``.claude/settings.local.json`` can no longer reach a headless worker at
-    all either way, so it is intentionally not scanned here.
+    (``~/.claude/settings.json``) — the one settings source a worker still
+    loads after the ``--setting-sources user`` restriction in
+    :func:`default_worker_command`; a checkout-local
+    ``.claude/settings.local.json`` can no longer reach a worker at all, so
+    it is intentionally not scanned here.
 
     Returns a human-readable ``"'<pattern>' in <file>"`` message for the
     first matching rule found, or ``None`` when no scanned file carries one
@@ -4260,47 +4272,39 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # so a deny rule that never touches the worktree's working directory
         # still blocked Edit/Write calls from a `claude -p` session cwd'd
         # into that worktree.
+        # into that worktree. Restricting to "user" means a worker's
+        # permission profile is fully controlled by the --allowedTools /
+        # --disallowedTools / --permission-mode flags in this function (and
+        # its own hard-coded system prompt), not by the checkout's
+        # settings.json / settings.local.json. This is the headless/
+        # `claude -p` path only — the human-attended interactive PTY path
+        # (coord.providers.claude_pty.ClaudePtyProvider) intentionally keeps
+        # the default sources so an operator's own `coord init`-configured
+        # convenience allow-list still applies to a session they're
+        # attached to and watching.
         #
-        # `--setting-sources user` (the original #1445 fix) only closed this
-        # for *settings.json* — a checkout's `.claude/hooks/` and `.mcp.json`
-        # are governed separately and kept loading regardless, so a
-        # never-trusted repo's hooks would still run and its MCP servers
-        # would still connect in every worker session, because a `-p`
-        # session shows neither the workspace-trust dialog nor the
-        # per-server MCP approval prompt that would normally gate that (see
-        # code.claude.com/docs/en/headless.md). `--bare` is the flag that
-        # closes all three sources (settings, hooks, .mcp.json) at once, plus
-        # LSP/plugin-sync/CLAUDE.md auto-discovery — none of which a headless
-        # worker should be picking up *ambiently* from the target repo's own
-        # checkout either. A worker's permission profile is fully controlled
-        # by the --allowedTools / --disallowedTools / --permission-mode
-        # flags in this function (and its own hard-coded system prompt); it
-        # needs no MCP servers (no spec.type grants the `Agent` tool, so
-        # `--agents` is unneeded too) and no `--settings`.
-        #
-        # CLAUDE.md is the one exception worth calling out: losing its
-        # *ambient* auto-discovery does NOT mean a work-shaped leg loses the
-        # content. `_claude_md_system_prompt_suffix` (see the branches
-        # above: "plan", "mock-author", and this catch-all "else") reads it
-        # explicitly off *spec.repo_path* and embeds it into --system-prompt
-        # instead — the same defensive pattern coord.review.read_repo_claude_md
-        # already used for review legs (#2462).
+        # #2462 tried `--bare` here (closes settings + hooks + .mcp.json +
+        # CLAUDE.md auto-discovery at once, vs. this flag's settings.json-only
+        # scope) but `--bare` also unconditionally disables reading OAuth
+        # credentials / the system keychain, and this fleet authenticates
+        # headless dispatch via `claude login`/OAuth, not `ANTHROPIC_API_KEY`
+        # (see CLAUDE.md: "No API key needed... Max/Pro subscription via
+        # OAuth"). It went live and broke every worker dispatch fleet-wide
+        # within the hour ("Not logged in · Please run /login", misreported
+        # as generic `api_error`) — reverted back to `--setting-sources user`
+        # same-day. The hooks/.mcp.json leak `--bare` closed is real and
+        # still open; re-closing it needs an approach that doesn't require
+        # `ANTHROPIC_API_KEY`/an `apiKeyHelper`, tracked as a fresh
+        # follow-up rather than re-landing `--bare` as-is.
         #
-        # AUTH CAVEAT: per Claude Code's own docs, `--bare` "never reads
-        # OAuth credentials or the system keychain" — only `ANTHROPIC_API_KEY`
-        # (env, inherited via `_worker_subprocess_env`) or an `apiKeyHelper`
-        # supplied via `--settings` authenticate. This is a behavior change
-        # for any fleet machine whose worker auth today comes from
-        # `claude setup-token` / `CLAUDE_CODE_OAUTH_TOKEN` or an interactive
-        # `claude login` (the pattern docs/CONTROL_CENTER.md §14 documents for
-        # per-person subscription auth) rather than an API key — such a
-        # machine must switch to `ANTHROPIC_API_KEY` (or an `apiKeyHelper`)
-        # for headless dispatch to keep authenticating. This is the
-        # headless/`claude -p` path only — the human-attended interactive PTY
-        # path (coord.providers.claude_pty.ClaudePtyProvider) intentionally
-        # keeps the default sources, so OAuth/keychain login still works for
-        # a session an operator is attached to and watching.
-        "--bare",
+        # `_claude_md_system_prompt_suffix` (see the "plan", "mock-author",
+        # and catch-all "else" branches above) explicitly embeds the target
+        # repo's CLAUDE.md into --system-prompt regardless — kept as
+        # defense-in-depth (the same double-load pattern
+        # coord.review.read_repo_claude_md already used for review legs)
+        # even though `--setting-sources user` alone still lets CLAUDE.md's
+        # own ambient auto-discovery run too.
+        "--setting-sources", "user",
     ]
     if spec.model:
         argv.extend(["--model", spec.model])

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/coord/ci_github.py

@@ -14,11 +14,13 @@ from __future__ import annotations
 import re
 import subprocess
 import time
+from collections import Counter
 from dataclasses import dataclass, field
 from datetime import datetime
 
 from coord import github_ops
 from coord.ci_store import CheckRun, JobRun, JobStep, failed_checks
+from coord.forge_availability import record_ci_check_fetch
 
 
 def _parse_ts(raw: str | None) -> float | None:
@@ -381,6 +383,18 @@ class GitHubCi:
     # ── Internal ────────────────────────────────────────────────────────────
 
     def _fetch(self, repo: str, number: int) -> list[CheckRun]:
+        # #1896 Phase 0: this is the "every CiStore.list_checks_for_pr
+        # outcome" seam the forge-availability program asks for — reachable/
+        # unreachable, plus the check-level conclusion distribution.
+        # `github_ops.get_pr_checks` does NOT go through `_gh()` — it shells
+        # out to `gh pr checks` directly (a non-zero exit there can still
+        # carry usable JSON on stdout, which `_gh()`'s raise-on-nonzero
+        # contract can't express, see `get_pr_checks`'s own docstring) — so
+        # this call is the *only* forge-availability observation this read
+        # produces. It stands alone, not "layered on top" of anything.
+        # Only fires on a real cache miss — a cached `list_checks_for_pr`
+        # hit never reaches here, so this costs nothing extra either.
+        _t0 = time.monotonic()
         try:
             raw = github_ops.get_pr_checks(repo, number)
         except github_ops.GhTooOldForJsonChecks as e:
@@ -394,6 +408,8 @@ class GitHubCi:
             # it into `_unreadable_check`'s generic wording) means an operator
             # reading the merge refusal never has to guess which of the two
             # this was.
+            record_ci_check_fetch(repo, number, outcome="unreachable",
+                                   duration_s=time.monotonic() - _t0, detail="gh too old")
             return [_gh_too_old_check(repo, number, str(e))]
         except (FileNotFoundError, subprocess.TimeoutExpired, RuntimeError, ValueError) as e:
             # #1525: a `gh pr checks` read that outright failed (gh missing,
@@ -407,8 +423,13 @@ class GitHubCi:
             # failing check instead so the gate blocks and says why; a caller
             # that genuinely wants "unknown" treated as clear must pass
             # `force_merge=True` explicitly.
+            record_ci_check_fetch(repo, number, outcome="unreachable",
+                                   duration_s=time.monotonic() - _t0, detail=str(e))
             return [_unreadable_check(repo, number, str(e))]
+        duration = time.monotonic() - _t0
         if not isinstance(raw, list):
+            record_ci_check_fetch(repo, number, outcome="unreachable",
+                                   duration_s=duration, detail="non-list JSON")
             return [_unreadable_check(repo, number, "gh pr checks returned non-list JSON")]
         # #2446: `_all_checks` (this method's only caller) is the single
         # unfiltered fetch shared by both `list_checks_for_pr` (narrowed to
@@ -416,7 +437,7 @@ class GitHubCi:
         # required-contexts narrowing used to happen here, which meant an
         # advisory check's regression was invisible everywhere, not just to
         # the merge gate. See both methods' docstrings.
-        return [
+        checks = [
             CheckRun(
                 name=str(entry.get("name", "")),
                 status=_status_from_bucket(str(entry.get("bucket", ""))),
@@ -429,6 +450,10 @@ class GitHubCi:
             for entry in raw
             if isinstance(entry, dict)
         ]
+        conclusions = Counter(c.conclusion or "pending" for c in checks)
+        record_ci_check_fetch(repo, number, outcome="ok", duration_s=duration,
+                               conclusions=dict(conclusions))
+        return checks
 
     def _required_contexts(self, repo: str) -> frozenset[str] | None:
         now = time.time()

{code_coordinator-0.5.191 → code_coordinator-0.5.194}/coord/commands/status.py

@@ -1585,6 +1585,26 @@ def _diagnose_via_daemon(svc, params: dict) -> None:
         "behind."
     ),
 )
+@click.option(
+    "--forge-availability",
+    "forge_availability",
+    is_flag=True,
+    help=(
+        "#1896: report forge/CI availability over a trailing window — "
+        "uptime %, longest contiguous unavailable stretch, and merge-gate "
+        "CI refusal counts by reason — from observations recorded at the "
+        "gh/CI/merge-gate seams. Read-only, local audit_log only. Pair "
+        "with --window-days to change the window (default 30)."
+    ),
+)
+@click.option(
+    "--window-days",
+    "forge_availability_window_days",
+    default=30.0,
+    show_default=True,
+    type=float,
+    help="With --forge-availability, the trailing window (days) to summarize.",
+)
 
 
 @_CONFIG_OPTION
@@ -1601,6 +1621,8 @@ def diagnose(
     config_provenance_check: bool = False,
     self_check: bool = False,
     self_no_fetch: bool = False,
+    forge_availability: bool = False,
+    forge_availability_window_days: float = 30.0,
 ) -> None:
     """Per-stage doctor — diagnose, best-effort recover, optional reset."""
     # ── graphify graph freshness sweep (read-only) ───────────────────────────
@@ -1608,6 +1630,11 @@ def diagnose(
         _diagnose_graph_health(config_path)
         return
 
+    # ── #1896: forge/CI availability read-out (read-only) ───────────────────
+    if forge_availability:
+        _diagnose_forge_availability(forge_availability_window_days)
+        return
+
     # ── #1779: fleet coordinator.yml provenance (read-only) ─────────────────
     if config_provenance_check:
         _diagnose_config_provenance()
@@ -1762,6 +1789,28 @@ def _diagnose_graph_health(config_path: Path) -> None:
     )
 
 
+def _diagnose_forge_availability(window_days: float) -> None:
+    """Report forge/CI availability over the trailing *window_days* (#1896).
+
+    Read-only: summarizes the ``forge_availability``-category rows in the
+    local ``audit_log`` (recorded best-effort at the ``gh`` call seam, the
+    CI check-fetch seam, and the merge-gate refusal seam — see
+    :mod:`coord.forge_availability`). Same family as ``--graph``/
+    ``--config-provenance``/``--self``: local-machine only, no network call
+    of its own.
+    """
+    from coord.forge_availability import (  # noqa: PLC0415
+        availability_report,
+        format_report_lines,
+        summary_line as forge_summary_line,
+    )
+
+    report = availability_report(window_days=window_days)
+    for line in format_report_lines(report):
+        click.echo(f"  {line}")
+    click.echo(forge_summary_line(report))
+
+
 def _diagnose_config_provenance() -> None:
     """Report whether THIS machine's live ``coordinator.yml`` is still the
     reviewed one (#1779).