code-coordinator 0.5.246__tar.gz → 0.5.247__tar.gz

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.246
+Version: 0.5.247
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.246
+Version: 0.5.247
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/code_coordinator.egg-info/SOURCES.txt

@@ -381,6 +381,7 @@ tests/test_agent_update_bluegreen.py
 tests/test_agent_usage_limit.py
 tests/test_agent_zero_commit.py
 tests/test_ambient_home_isolation.py
+tests/test_approve_dependency_busy_2804.py
 tests/test_approve_reject_plan.py
 tests/test_approve_usage_gate.py
 tests/test_approved_work_2532.py
@@ -411,6 +412,7 @@ tests/test_ci_gitlab.py
 tests/test_ci_parity_2091.py
 tests/test_ci_store.py
 tests/test_claim.py
+tests/test_claude_md_budget.py
 tests/test_cli_acceptance.py
 tests/test_cli_assign.py
 tests/test_cli_assign_interactive_oracle_gate.py
@@ -712,6 +714,7 @@ tests/test_status_fleet_footer.py
 tests/test_stop_1567.py
 tests/test_store_contract.py
 tests/test_stuck.py
+tests/test_stuck_test_state_watchdog_2803.py
 tests/test_terminal_command.py
 tests/test_test_author.py
 tests/test_test_chat.py

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/code_coordinator.egg-info/scm_file_list.json

@@ -453,6 +453,7 @@
     "tests/test_agent_usage_limit.py",
     "tests/test_agent_zero_commit.py",
     "tests/test_ambient_home_isolation.py",
+    "tests/test_approve_dependency_busy_2804.py",
     "tests/test_approve_reject_plan.py",
     "tests/test_approve_usage_gate.py",
     "tests/test_approved_work_2532.py",
@@ -483,6 +484,7 @@
     "tests/test_ci_parity_2091.py",
     "tests/test_ci_store.py",
     "tests/test_claim.py",
+    "tests/test_claude_md_budget.py",
     "tests/test_cli_acceptance.py",
     "tests/test_cli_assign.py",
     "tests/test_cli_assign_interactive_oracle_gate.py",
@@ -784,6 +786,7 @@
     "tests/test_stop_1567.py",
     "tests/test_store_contract.py",
     "tests/test_stuck.py",
+    "tests/test_stuck_test_state_watchdog_2803.py",
     "tests/test_terminal_command.py",
     "tests/test_test_author.py",
     "tests/test_test_chat.py",

code_coordinator-0.5.247/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.247",
+  "distance": 0,
+  "node": "g4f09a4eb9bb9c5df7bd584afa61ad7985896abe7",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-08-27"
+}

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/coord/agent.py

@@ -4525,11 +4525,14 @@ def _base_checkout_write_guard_tools(repo_path: str) -> list[str]:
 # dispatch on every machine started failing at turn 1 with "Not logged in"
 # within the hour it went live (misreported fleet-wide as generic
 # `api_error`). Reverted back to `--setting-sources user` to restore
-# dispatch immediately. The hooks/.mcp.json leak this was meant to close is
-# real and still open — re-closing it needs a fix that doesn't require
+# dispatch immediately. The hooks/.mcp.json leak this was meant to close was
+# real; #2820 closed the `.mcp.json`/MCP-server half of it via
+# `--strict-mcp-config` in `default_worker_command` (no OAuth side-effect —
+# it only strips MCP server definitions, not hooks). The hooks half is
+# still open — re-closing it needs a fix that doesn't require
 # `ANTHROPIC_API_KEY`/an `apiKeyHelper` (e.g. explicit `--settings '{}'`
-# plus verifying whether hooks/.mcp.json can be suppressed without full
-# `--bare`), tracked as a fresh follow-up rather than re-landing this as-is.
+# plus verifying whether hooks can be suppressed without full `--bare`),
+# tracked as a fresh follow-up rather than re-landing this as-is.
 _DENY_PATTERN_RE = re.compile(r"^(Edit|Write)\(//(.+)\)$")
 
 
@@ -4676,14 +4679,25 @@ def check_worktree_writable(
 def _claude_md_system_prompt_suffix(repo_path: str) -> str:
     """Return a system-prompt suffix embedding the target repo's CLAUDE.md.
 
-    #2462: worker dispatch below passes ``--bare``, which disables Claude
-    Code's own automatic CLAUDE.md auto-discovery (along with hooks,
-    ``.mcp.json``, and settings — see the ``--bare`` comment in
-    :func:`default_worker_command`). Nothing else in a work-shaped leg's
-    briefing embeds the target repo's actual CLAUDE.md text, so without this
-    a worker would silently lose every per-repo convention, testing rule,
-    and sealed-path note that isn't hardcoded into the repo-agnostic
-    ``WORKER_SYSTEM_PROMPT``.
+    Worker dispatch below passes ``--setting-sources user`` — **not**
+    ``--bare``, which #2462 tried and reverted same-day (see the long
+    comment in :func:`default_worker_command`). ``--setting-sources user``
+    suppresses Claude Code's own project-level CLAUDE.md auto-discovery
+    (along with project/local settings.json) just as thoroughly as
+    ``--bare`` would have, for this one mechanism. #2820 measured it
+    directly with four controlled probes: an empty dir and a real repo
+    checkout, both under ``--setting-sources user``, differ by only ~200
+    prompt-framing tokens (22,489 vs 22,686) — essentially no CLAUDE.md
+    content leaking through. The same repo under Claude Code's *default*
+    setting sources adds ~7,675 tokens (30,361) for the auto-discovered
+    file. So this function is **not** defense-in-depth alongside some
+    still-running ambient auto-discovery — it is the **only** mechanism
+    that delivers the target repo's CLAUDE.md to a work-shaped ``-p`` leg.
+    Nothing else in a work-shaped leg's briefing embeds the target repo's
+    actual CLAUDE.md text, so without this a worker would silently lose
+    every per-repo convention, testing rule, and sealed-path note that
+    isn't hardcoded into the repo-agnostic ``WORKER_SYSTEM_PROMPT`` — with
+    no error and no test failing to surface the loss.
 
     Mirrors :func:`coord.review.read_repo_claude_md`, which the review leg
     already uses for the same reason (a review must never run blind to
@@ -4723,8 +4737,10 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
     """
     if spec.type == "plan":
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_PLAN_PROMPT
-        # #2462: --bare drops CLAUDE.md auto-discovery; a plan leg still
-        # needs the target repo's conventions to plan against.
+        # `--setting-sources user` (below) drops CLAUDE.md auto-discovery; a
+        # plan leg still needs the target repo's conventions to plan
+        # against. See _claude_md_system_prompt_suffix for what the flag
+        # actually does and the measured numbers behind it.
         system_prompt += _claude_md_system_prompt_suffix(spec.repo_path)
         allowed_tools = "Read,Bash"
     elif spec.type == "refinement":
@@ -4793,7 +4809,8 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # and deny list instead of the generic WORKER_SYSTEM_PROMPT.
         system_prompt = spec.system_prompt if spec.system_prompt else MOCK_AUTHOR_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(MOCK_AUTHOR_DENY_COMMANDS)
-        # #2462: --bare drops CLAUDE.md auto-discovery.
+        # `--setting-sources user` (below) drops CLAUDE.md auto-discovery —
+        # see _claude_md_system_prompt_suffix.
         system_prompt += _claude_md_system_prompt_suffix(spec.repo_path)
         allowed_tools = "Read,Edit,Write,Bash"
     elif spec.type == "smoke":
@@ -4846,10 +4863,11 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
     else:
         system_prompt = spec.system_prompt if spec.system_prompt else WORKER_SYSTEM_PROMPT
         system_prompt += build_deny_prompt(spec.deny_commands)
-        # #2462: --bare drops CLAUDE.md auto-discovery for this catch-all
-        # branch too — it covers "work", "fix", "conflict-fix", and
-        # "test-author", every one of which edits code and needs the
-        # target repo's conventions. See _claude_md_system_prompt_suffix.
+        # `--setting-sources user` (below) drops CLAUDE.md auto-discovery
+        # for this catch-all branch too — it covers "work", "fix",
+        # "conflict-fix", and "test-author", every one of which edits code
+        # and needs the target repo's conventions. See
+        # _claude_md_system_prompt_suffix.
         system_prompt += _claude_md_system_prompt_suffix(spec.repo_path)
         # #2169: `Monitor` is the sanctioned way to poll a backgrounded
         # long-running command in bounded steps (see the ONE-SHOT section of
@@ -4911,19 +4929,52 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # OAuth"). It went live and broke every worker dispatch fleet-wide
         # within the hour ("Not logged in · Please run /login", misreported
         # as generic `api_error`) — reverted back to `--setting-sources user`
-        # same-day. The hooks/.mcp.json leak `--bare` closed is real and
-        # still open; re-closing it needs an approach that doesn't require
-        # `ANTHROPIC_API_KEY`/an `apiKeyHelper`, tracked as a fresh
-        # follow-up rather than re-landing `--bare` as-is.
+        # same-day. The hooks/.mcp.json leak `--bare` would have closed was
+        # real; #2820 closed the `.mcp.json`/MCP-server half of it below
+        # with `--strict-mcp-config`, which has no OAuth side-effect (it
+        # only strips project/user-scope MCP server definitions, nothing
+        # else `--bare` touched). The hooks half is still open; re-closing
+        # it needs an approach that doesn't require `ANTHROPIC_API_KEY`/an
+        # `apiKeyHelper`, tracked as a fresh follow-up rather than
+        # re-landing `--bare` as-is.
         #
         # `_claude_md_system_prompt_suffix` (see the "plan", "mock-author",
         # and catch-all "else" branches above) explicitly embeds the target
-        # repo's CLAUDE.md into --system-prompt regardless — kept as
-        # defense-in-depth (the same double-load pattern
-        # coord.review.read_repo_claude_md already used for review legs)
-        # even though `--setting-sources user` alone still lets CLAUDE.md's
-        # own ambient auto-discovery run too.
+        # repo's CLAUDE.md into --system-prompt — this is NOT defense-in-
+        # depth alongside some still-running ambient auto-discovery.
+        # #2820 measured that `--setting-sources user` *suppresses* Claude
+        # Code's own project CLAUDE.md auto-discovery: a real repo checkout
+        # under `--setting-sources user` costs ~22,686 prompt tokens vs.
+        # ~30,361 under Claude Code's *default* setting sources — a
+        # ~7,675-token gap that is almost entirely the auto-discovered
+        # file. So `_claude_md_system_prompt_suffix` is the ONLY mechanism
+        # that delivers the target repo's CLAUDE.md to a work-shaped `-p`
+        # leg; treating it as redundant and dropping it would silently
+        # strip every per-repo convention, with no error and no test
+        # failing to surface the loss.
         "--setting-sources", "user",
+        # #2820: every `-p` leg otherwise also loads the OPERATOR's
+        # personal user-scope MCP servers — observed across the 120 most
+        # recent worker sessions as 20 Google Drive/Calendar tool defs plus
+        # a Gmail server on 111/120 legs, a smaller subset on 3 more, and 0
+        # on the remaining 6 (i.e. non-deterministic: the same dispatch
+        # shape gets a different tool surface depending on whether the
+        # operator's MCP servers happened to connect by the time the
+        # session started). No worker can ever use any of those tools.
+        # `--strict-mcp-config` ignores all project/user `.mcp.json`
+        # servers for this invocation (with no `--mcp-config` passed, that
+        # means none load) — `--setting-sources user` above does NOT cover
+        # this, it only gates settings.json. Measured cost of leaving this
+        # open is small — two controlled `claude -p` probes with the
+        # production flags went from 47 tools / 23,096 prompt tokens
+        # without this flag to 27 tools / 22,483 tokens with it, i.e.
+        # ~600 tokens, not the several-thousand a raw tool-count drop
+        # suggests (MCP tool schemas are deferred behind ToolSearch in
+        # current Claude Code, so an unused server costs a name, not a
+        # schema). Worth doing anyway: one flag, no OAuth side-effect, and
+        # it makes the worker tool surface deterministic — not worth doing
+        # as a cost measure on its own.
+        "--strict-mcp-config",
     ]
     if spec.model:
         argv.extend(["--model", spec.model])

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/coord/commands/_common.py

@@ -158,7 +158,9 @@ def _note_withheld_snapshot(config: Config, config_path: Path) -> None:
     )
 
 
-def _save_config_snapshot(config: Config, config_path: Path | None = None) -> None:
+def _save_config_snapshot(
+    config: Config, config_path: Path | None = None, *, allow_thin_client: bool = True
+) -> None:
     """Persist machine + pipeline metadata to the DB so dashboards can read it.
 
     Writes:
@@ -176,13 +178,22 @@ def _save_config_snapshot(config: Config, config_path: Path | None = None) -> No
     entirely — see the #2208 guard below. Callers that omit it (mainly
     direct unit tests exercising the write itself) get the pre-#2208
     behavior: always write.
+
+    *allow_thin_client* mirrors ``_load_config``'s flag (#2824) — pass
+    ``False`` for ``coord serve``'s own bootstrap so a stray
+    ``~/.coord/client.toml``/``$COORD_SERVICE_URL`` on the daemon host can't
+    also make the daemon skip writing its OWN machines/board_meta snapshot
+    (the same "am I a thin client" question, asked a second time here for
+    the DB write rather than the config read — a caller that already knows
+    it is the daemon for one must know it for the other).
     """
     # #584: a thin client (board_service configured) must not create/write a
     # local DB — the daemon/host owns the config snapshot.  On the host
     # board_service is unset, so the snapshot is written as before.
-    from coord.client import resolve_board_service
-    if resolve_board_service() is not None:
-        return
+    if allow_thin_client:
+        from coord.client import resolve_board_service
+        if resolve_board_service() is not None:
+            return
     # #2208: an explicit `--config <file>` pointed away from the fleet's real
     # config (a scratch fixture, a CI-only stub) must not be treated as a
     # request to redefine the shared `machines` table — that table is global
@@ -316,7 +327,7 @@ def _save_config_snapshot(config: Config, config_path: Path | None = None) -> No
                 pass
 
 
-def _load_config(path: Path | None) -> Config:
+def _load_config(path: Path | None, *, allow_thin_client: bool = True) -> Config:
     # Resolve the default location ($COORD_CONFIG → ~/.coord/coordinator.yml →
     # ./coordinator.yml) when no explicit --config was given, so `coord` works on
     # a machine without a repo checkout and isn't sensitive to the CWD.
@@ -333,27 +344,47 @@ def _load_config(path: Path | None) -> Config:
     # config on every command). On a machine with no client.toml/board_service
     # (svc is None — e.g. the daemon host), this is a no-op and local-file
     # resolution proceeds exactly as before (#584/#591).
+    #
+    # #2824: *allow_thin_client=False* opts a caller OUT of that branch
+    # entirely — never even calls ``resolve_board_service()``. This is for
+    # ``coord serve`` alone: the board daemon does not consume "the board's"
+    # config, it MINTS it (every other machine's ``GET /config`` reads come
+    # from THIS process's in-memory ``Config``). A leftover/stray
+    # ``~/.coord/client.toml`` or ``$COORD_SERVICE_URL`` on the daemon host
+    # (e.g. surviving a migration from an old primary) made `coord serve`
+    # silently proxy its own boot through `_load_config`'s thin-client branch
+    # and boot on *another machine's* ``coordinator.yml`` instead of the
+    # ``--config`` path the operator explicitly passed — the daemon then kept
+    # re-reading (`_refresh_config`'s mtime-guarded reload) that same wrong,
+    # remote-fetched file forever, with no signal anything was wrong: this is
+    # exactly how a real, on-disk ``portal.enabled: true`` was never seen by
+    # the running daemon while `coord.config.load()` on the same path,
+    # standalone, correctly reported it (the #2824 root cause). Every other
+    # caller of ``_load_config`` legitimately wants thin-client resolution
+    # (they ARE clients of the daemon's board) — this flag exists so ONLY
+    # `coord serve`'s own bootstrap can opt out.
     try:
-        from coord.client import resolve_board_service  # noqa: PLC0415
-
-        svc = resolve_board_service()
-        if svc is not None:
-            from coord.client import fetch_remote_config  # noqa: PLC0415
-
-            try:
-                path = fetch_remote_config(svc)
-            except Exception as exc:  # noqa: BLE001 — do NOT fall through to
-                # load(path): path may point at a local file that happens to
-                # exist (the exact bypass this issue closes). Fail loudly
-                # instead of silently trusting whatever is on disk.
-                raise ConfigError(
-                    f"could not fetch config from {svc.url}: {exc}"
-                ) from exc
+        if allow_thin_client:
+            from coord.client import resolve_board_service  # noqa: PLC0415
+
+            svc = resolve_board_service()
+            if svc is not None:
+                from coord.client import fetch_remote_config  # noqa: PLC0415
+
+                try:
+                    path = fetch_remote_config(svc)
+                except Exception as exc:  # noqa: BLE001 — do NOT fall through to
+                    # load(path): path may point at a local file that happens to
+                    # exist (the exact bypass this issue closes). Fail loudly
+                    # instead of silently trusting whatever is on disk.
+                    raise ConfigError(
+                        f"could not fetch config from {svc.url}: {exc}"
+                    ) from exc
         cfg = load(path)
     except ConfigError as e:
         click.echo(f"error: {e}", err=True)
         sys.exit(2)
-    _save_config_snapshot(cfg, path)
+    _save_config_snapshot(cfg, path, allow_thin_client=allow_thin_client)
     return cfg
 
 

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/coord/commands/dispatch.py

@@ -433,6 +433,15 @@ def approve(
                 )
                 click.echo(format_chunks_summary(chunks))
 
+    # #2804: repos this SAME batch has already dispatched to a given
+    # machine, keyed by machine_name. `board` (read once, above) only knows
+    # about assignments from a PRIOR `coord approve`/`coord assign` — two
+    # proposals in THIS batch that land on the same machine and share a
+    # build dependency (e.g. both vimcode and coord-tui pulling quadraui)
+    # would otherwise never see each other. Populated as each proposal
+    # below is actually dispatched (not on `dry_run`/`continue`).
+    dispatched_this_batch: dict[str, set[str]] = {}
+
     for p in selected:
         click.echo(f"[{p.id}] {p.machine_name} → {p.repo_name} #{p.issue_number}: {p.issue_title}")
         # Resolve model so the dispatched record and board reflect what ran.
@@ -614,15 +623,44 @@ def approve(
                         + (f" ({f.error})" if f.error else ""),
                         err=True,
                     )
+                # #2804: never pull a build dep's single shared checkout out
+                # from under some OTHER assignment on the same machine that
+                # may be building against it right now — that race is
+                # exactly what turned a correct vimcode#555 branch into a
+                # phantom red. `busy` names every such repo; both the
+                # auto-pull list and the briefing's pull instruction skip it.
+                busy = {
+                    f.repo_name
+                    for f in needs
+                    if f.kind == fresh.BUILD
+                    and fresh.repo_busy_elsewhere(
+                        f.repo_name,
+                        p.machine_name,
+                        cfg,
+                        board,
+                        also_running=dispatched_this_batch.get(p.machine_name, ()),
+                    )
+                }
+                if busy:
+                    click.echo(
+                        f"     not pulling (in use by a concurrent assignment "
+                        f"on {p.machine_name}, #2804): {sorted(busy)}",
+                        err=True,
+                    )
                 if auto_pull:
-                    pull_repos = [f.repo_name for f in needs if f.state == fresh.STALE]
+                    pull_repos = [
+                        f.repo_name for f in needs
+                        if f.state == fresh.STALE and f.repo_name not in busy
+                    ]
                     if pull_repos:
                         click.echo(f"     will pull on agent before worker: {pull_repos}")
                 else:
-                    addendum = fresh.format_briefing_addendum(freshness)
+                    addendum = fresh.format_briefing_addendum(freshness, busy=busy)
                     if addendum:
                         p.briefing = (p.briefing or "") + addendum
 
+        dispatched_this_batch.setdefault(p.machine_name, set()).add(p.repo_name)
+
         def _on_retry(attempt, max_r, state, reason, wait):
             click.echo(
                 f"     retry {attempt}/{max_r} after {state} ({reason}), "

{code_coordinator-0.5.246 → code_coordinator-0.5.247}/coord/commands/dispatch_workers.py

@@ -4845,12 +4845,31 @@ def _dispatch_headless(
                     f"  dependency {f.repo_name}: {f.state}"
                     + (f" ({f.error})" if f.error else ""),
                 )
+            # #2804: never pull a build dep's single shared checkout out
+            # from under some OTHER assignment on this machine that may be
+            # building against it right now (see
+            # `coord.freshness.repo_busy_elsewhere`'s docstring — this is
+            # the same guard `coord approve` applies).
+            busy = {
+                f.repo_name
+                for f in needs
+                if f.kind == _fresh.BUILD
+                and _fresh.repo_busy_elsewhere(f.repo_name, proposal.machine_name, cfg, board)
+            }
+            if busy:
+                click.echo(
+                    f"  not pulling (in use by a concurrent assignment on "
+                    f"{proposal.machine_name}, #2804): {sorted(busy)}"
+                )
             if not no_pull:
-                pull_repos = [f.repo_name for f in needs if f.state == _fresh.STALE]
+                pull_repos = [
+                    f.repo_name for f in needs
+                    if f.state == _fresh.STALE and f.repo_name not in busy
+                ]
                 if pull_repos:
                     click.echo(f"  will pull on agent before worker: {pull_repos}")
             else:
-                addendum = _fresh.format_briefing_addendum(freshness)
+                addendum = _fresh.format_briefing_addendum(freshness, busy=busy)
                 if addendum:
                     proposal.briefing = (proposal.briefing or "") + addendum