code-coordinator 0.5.284__tar.gz → 0.5.286__tar.gz

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.284
+Version: 0.5.286
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.284
+Version: 0.5.286
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.284",
+  "tag": "0.5.286",
   "distance": 0,
-  "node": "g2da25f7ff60c998587ccf57e1adf473b56233829",
+  "node": "g5eb1427bf97a93b3a32f4abe3eee184541e12d6d",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-29"

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/coord/agent.py

@@ -6130,14 +6130,30 @@ class AgentServer:
 
         See `_tool_versions_ttl` for why: probing shells out per tool, and
         `/health` is polled frequently.
+
+        #2913: `probe_all()` normally restricts probing to `self.capabilities`
+        so a plain CLI-only machine never pays to probe a browser or GTK4 it
+        never claimed. A config-free agent's `self.capabilities` is `[]` by
+        construction — it has nothing of its own to declare; the coordinator
+        supplies capabilities from its OWN `coordinator.yml` at dispatch time
+        (docs/EPHEMERAL_WORKERS.md). Probing only `self.capabilities` there
+        means `/health.tool_versions` never covers cargo, python3, or any
+        other capability-gated tool, so `unmet_capabilities()` — the #1570 D
+        cross-check `dispatch_smoke` relies on before routing capability-
+        gated work here — finds nothing to compare and fails OPEN, not
+        closed, exactly backwards from what #1570 D exists to guarantee.
+        Probe every known capability instead for a config-free agent: it has
+        no legitimate narrower set to restrict to anyway, since it doesn't
+        know what the coordinator is about to route to it.
         """
         now = time.time()
         cached = self._tool_versions_cache
         if cached is not None and (now - cached[0]) < self._tool_versions_ttl:
             return cached[1]
-        from coord.prereqs import probe_all, tool_versions_summary
+        from coord.prereqs import ALL_CAPABILITY_NAMES, probe_all, tool_versions_summary
 
-        summary = tool_versions_summary(probe_all(self.capabilities))
+        probe_caps = ALL_CAPABILITY_NAMES if self.config_free_reason is not None else self.capabilities
+        summary = tool_versions_summary(probe_all(probe_caps))
         self._tool_versions_cache = (now, summary)
         return summary
 

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/coord/commands/status.py

@@ -923,6 +923,39 @@ def status(config_path: Path, machine_filter: str | None, no_reconcile: bool, ti
         click.echo("FLEET: ?  (health footer unavailable — coord health for detail)")
 
 
+def _host_resolution_lines(machine, ts_map: dict[str, tuple[str, str]] | None) -> list[tuple[bool, str]]:
+    """#2912: does ``host:`` actually resolve to THIS machine's tailnet
+    address? A LAN DHCP/DNS entry that shares a name with a tailnet node
+    (e.g. a WSL2 box named ``dell64`` whose Windows host also registers
+    ``dell64.lan``) shadows MagicDNS in the resolver order — HTTP-by-name
+    times out against the wrong LAN device while ``tailscale ping`` and the
+    agent's own ``/health`` are both perfectly healthy, so the symptom is
+    indistinguishable from a dead agent, a firewall, or a crashed unit.
+
+    Fires regardless of whether the machine is currently reachable — that's
+    the whole point: it names the cause a plain "unreachable" cannot, and it
+    also catches a collision BEFORE it manifests as an outage. Silent when
+    ``coord.network.check_host_resolution`` can't determine an answer (no
+    local ``tailscale``, node not in this box's peer list, ``host:`` doesn't
+    resolve at all) — those are absence-of-evidence, not a finding.
+
+    Pure function over :func:`coord.network.check_host_resolution`'s result
+    — no I/O of its own — so it's testable without a live tailnet.
+    """
+    from coord import network  # noqa: PLC0415
+
+    result = network.check_host_resolution(machine, ts_map)
+    if result.matches is not False:
+        return []
+    return [(
+        True,
+        f"  ✗ CRIT machines.host_resolves_offtailnet: {result.reason} "
+        f"(#2912). Remedy: set `host: {result.magicdns_fqdn}` in "
+        "coordinator.yml — the MagicDNS FQDN — instead of the bare "
+        "hostname, which a LAN DNS entry can shadow.",
+    )]
+
+
 def _health_vs_config_lines(machine, health: dict) -> list[tuple[bool, str]]:
     """Cross-check a machine's ``/health`` against what ``coordinator.yml``
     declares for it. Returns ``(is_problem, line)`` pairs (#1712).
@@ -1323,6 +1356,7 @@ def doctor(
     expected: str | None,
     use_pypi: bool,
 ) -> None:
+    from coord import network
     from coord.network import check_all
     from coord.prereqs import ToolProbe, unmet_capabilities
 
@@ -1339,10 +1373,23 @@ def doctor(
             sys.exit(2)
 
     statuses = check_all(machines, timeout=timeout)
+    # #2912: resolved once, locally, up front — every machine's `host:` is
+    # checked against the SAME local tailscale peer list, and a single
+    # `tailscale status --json` covers the whole fleet. `None` when
+    # tailscale isn't available on THIS box; `_host_resolution_lines`
+    # renders nothing in that case rather than fabricating a mismatch.
+    ts_map = network.tailscale_ip_map(timeout=timeout)
     any_problem = False
     for s in statuses:
         m = s.machine
         click.echo(f"{m.name} ({m.host}):")
+        # Runs even when unreachable — that's the case this exists for:
+        # naming why "unreachable" is misleading instead of leaving it
+        # indistinguishable from a dead agent or a crashed unit.
+        for is_problem, line in _host_resolution_lines(m, ts_map):
+            click.echo(line)
+            if is_problem:
+                any_problem = True
         if not s.is_online:
             click.echo(f"  ✗ unreachable — {s.reason}")
             any_problem = True

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/coord/network.py

@@ -8,7 +8,9 @@ a generic "offline".
 
 from __future__ import annotations
 
+import json
 import socket
+import subprocess
 import time
 from concurrent.futures import ThreadPoolExecutor
 from dataclasses import dataclass
@@ -119,6 +121,150 @@ def check_all(
         return list(pool.map(lambda m: check_machine(m, timeout=timeout), machines))
 
 
+# #2912: `coord doctor` checks reachability by resolving `host:` and hitting
+# it — but never checks whether `host:` resolves to the RIGHT thing. A LAN
+# DHCP/DNS entry that happens to share a name with a tailnet node (e.g. a
+# WSL2 box named `dell64` whose Windows host also registers `dell64.lan`)
+# shadows MagicDNS in the resolver order: `tailscale ping <name>` succeeds
+# (it talks to tailscaled directly, not the resolver) while plain HTTP by
+# name times out against the wrong LAN device — indistinguishable from a
+# dead agent, a firewall, or a crashed unit. The two helpers below let
+# `coord doctor` name that specific cause instead.
+
+
+def tailscale_ip_map(timeout: float = 5.0) -> dict[str, tuple[str, str]] | None:
+    """Map each tailnet node's short hostname (lowercased) to its
+    ``(tailnet_ipv4, magicdns_fqdn)``, read from the LOCAL machine's own
+    ``tailscale status --json`` — i.e. what THIS box's tailscaled believes,
+    which is what its own DNS resolver should agree with.
+
+    Returns ``None`` when the ``tailscale`` CLI is missing, not logged in,
+    or anything else goes wrong. This check is best-effort and must fail
+    soft: a probe that cannot tell tailnet truth from LAN truth must stay
+    silent rather than fabricate a mismatch.
+    """
+    try:
+        result = subprocess.run(
+            ["tailscale", "status", "--json"],
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    if result.returncode != 0:
+        return None
+    try:
+        data = json.loads(result.stdout)
+    except ValueError:
+        return None
+
+    nodes = list((data.get("Peer") or {}).values())
+    self_node = data.get("Self")
+    if self_node:
+        nodes.append(self_node)
+
+    out: dict[str, tuple[str, str]] = {}
+    for node in nodes:
+        if not isinstance(node, dict):
+            continue
+        host_name = (node.get("HostName") or "").strip().lower()
+        if not host_name:
+            continue
+        ipv4 = next(
+            (ip for ip in (node.get("TailscaleIPs") or []) if ":" not in ip), None
+        )
+        if not ipv4:
+            continue
+        dns_name = (node.get("DNSName") or "").rstrip(".")
+        out[host_name] = (ipv4, dns_name)
+    return out
+
+
+def resolve_host_ip(host: str, timeout: float = 5.0) -> str | None:
+    """Resolve *host* via normal system DNS/hosts resolution — the same
+    resolution path plain HTTP-by-name takes. ``None`` on any failure."""
+    old_timeout = socket.getdefaulttimeout()
+    socket.setdefaulttimeout(timeout)
+    try:
+        return socket.gethostbyname(host)
+    except OSError:
+        return None
+    finally:
+        socket.setdefaulttimeout(old_timeout)
+
+
+@dataclass
+class HostResolutionCheck:
+    """Does a machine's configured ``host:`` resolve to ITS tailnet address?
+
+    ``matches is None`` means "could not determine" (no local ``tailscale``,
+    the node wasn't found in this box's peer list, or ``host:`` didn't
+    resolve at all) — that's a different, softer story than ``False``
+    ("resolved, but to the wrong place") and callers must not conflate them.
+    """
+
+    matches: bool | None
+    resolved_ip: str | None = None
+    tailnet_ip: str | None = None
+    magicdns_fqdn: str | None = None
+    reason: str = ""
+
+
+def check_host_resolution(
+    machine: Machine, ts_map: dict[str, tuple[str, str]] | None
+) -> HostResolutionCheck:
+    """Compare ``machine.host``'s DNS resolution against what *ts_map*
+    (from :func:`tailscale_ip_map`) says this tailnet node's real address
+    is. Pure function of its inputs — no I/O — so it's unit-testable
+    without a live tailnet or DNS resolver.
+    """
+    if ts_map is None:
+        return HostResolutionCheck(
+            matches=None, reason="tailscale not available locally — skipped"
+        )
+
+    peer = ts_map.get(machine.name.strip().lower())
+    if peer is None:
+        # `machine.name` and `machine.host`'s leading label don't always
+        # agree (host aliases, an already-FQDN host, ...) — fall back to
+        # the host's own short label before giving up.
+        peer = ts_map.get(machine.host.split(".")[0].strip().lower())
+    if peer is None:
+        return HostResolutionCheck(
+            matches=None,
+            reason=f"{machine.name!r} not found in local tailscale peer list — skipped",
+        )
+
+    tailnet_ip, magicdns_fqdn = peer
+    resolved = resolve_host_ip(machine.host)
+    if resolved is None:
+        return HostResolutionCheck(
+            matches=None,
+            tailnet_ip=tailnet_ip,
+            magicdns_fqdn=magicdns_fqdn,
+            reason=f"{machine.host!r} did not resolve at all",
+        )
+    if resolved == tailnet_ip:
+        return HostResolutionCheck(
+            matches=True,
+            resolved_ip=resolved,
+            tailnet_ip=tailnet_ip,
+            magicdns_fqdn=magicdns_fqdn,
+        )
+    return HostResolutionCheck(
+        matches=False,
+        resolved_ip=resolved,
+        tailnet_ip=tailnet_ip,
+        magicdns_fqdn=magicdns_fqdn,
+        reason=(
+            f"{machine.host!r} resolves to {resolved}, not this machine's "
+            f"tailnet address {tailnet_ip} — a LAN DNS entry is very likely "
+            "shadowing MagicDNS for this name"
+        ),
+    )
+
+
 @dataclass
 class StatusResult:
     """Result of fetching /status from an agent.

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/coord/prereqs.py

@@ -382,6 +382,24 @@ CAPABILITY_PREREQS: tuple[Prereq, ...] = (
 
 ALL_PREREQS: tuple[Prereq, ...] = BASELINE_PREREQS + CAPABILITY_PREREQS
 
+# Every capability name any `CAPABILITY_PREREQS` entry gates, in one place
+# (#2913). `probe_all()` restricts probing to a caller-supplied capability
+# set so a normal, fully-configured machine never pays to probe a browser
+# or GTK4 it never claimed — but that same restriction silently defeats
+# `unmet_capabilities()` for a config-free agent (docs/EPHEMERAL_WORKERS.md):
+# its OWN `capabilities` is `[]` by construction (nothing to declare — the
+# coordinator's `coordinator.yml` supplies capabilities at dispatch time,
+# not this process), so `probe_all(self.capabilities)` never probes cargo,
+# python3, or any other capability-gated tool, and the #1570 D cross-check
+# has nothing to compare against. `AgentServer._cached_tool_versions`
+# (coord/agent.py) passes this set instead of `self.capabilities` for a
+# config-free agent, so `/health` always reports the truth about what is
+# actually on the box regardless of what config, if any, this process
+# itself holds.
+ALL_CAPABILITY_NAMES: frozenset[str] = frozenset(
+    p.capability for p in CAPABILITY_PREREQS if p.capability is not None
+)
+
 
 def _parse_version(text: str, pattern: str) -> str | None:
     match = re.search(pattern, text)
@@ -515,6 +533,18 @@ def unmet_capabilities(
     `CAPABILITY_PREREQS` names it) is silently skipped, not flagged — an
     unprobed claim is not (yet) a *known-broken* one; this only reports
     claims this module can actually verify.
+
+    The `p is None` skip is meant for exactly one case: an agent whose
+    `/health` predates this module probing that particular tool at all.
+    Before #2913 it also silently swallowed a second, permanent case — a
+    config-free agent (`self.capabilities == []`) whose `probes` therefore
+    never included the caller's `required_caps` in the first place, so
+    `dispatch_smoke`'s #1570 D cross-check verified nothing for exactly the
+    machines it exists to protect. `AgentServer._cached_tool_versions`
+    closes that by probing `ALL_CAPABILITY_NAMES` (not `self.capabilities`)
+    when the agent is config-free, so `probes` passed in here now genuinely
+    covers every capability this function is asked about, and `p is None`
+    goes back to meaning only "predates the probe" — see coord/agent.py.
     """
     unmet: dict[str, list[str]] = {}
     for cap in capabilities:

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/coord/smoke.py

@@ -436,6 +436,18 @@ def _capability_probe_reasons(
     would be strictly worse than the blind trust this replaces. Only an
     *explicit* probe failure refuses routing.
 
+    #2913: this used to fail open the same way for a config-free agent too
+    — `tool_versions` was present (baseline `git`/`gh`) but never covered
+    `required_caps`, since a config-free agent has no `capabilities` of its
+    own to probe against and `AgentServer._cached_tool_versions` used to
+    restrict probing to exactly that empty list. `unmet_capabilities` then
+    found nothing to compare and returned `{}`, indistinguishable from
+    "probed and clean". Fixed at the source: a config-free agent now probes
+    every known capability (`coord.prereqs.ALL_CAPABILITY_NAMES`) regardless
+    of what it declares, so `tool_versions` here genuinely covers
+    `required_caps` and this function's refusal path works the same for a
+    config-free agent as for a fully-configured one.
+
     Never raises — a connectivity hiccup here just skips the extra check;
     the POST to `/assign` right after this call in `dispatch_smoke` is the
     real reachability test and fails closed on its own if the machine is

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/tests/test_agent.py

@@ -231,6 +231,54 @@ def test_health_tool_versions_is_cached(tmp_path: Path) -> None:
     assert third == first
 
 
+def test_health_tool_versions_probes_everything_when_config_free(
+    tmp_path: Path,
+) -> None:
+    """#2913: a config-free agent declares `capabilities=[]` by design
+    (docs/EPHEMERAL_WORKERS.md) — the coordinator's own `coordinator.yml`
+    supplies capabilities at dispatch time, not this process. Restricting
+    `/health.tool_versions` to `self.capabilities` (empty) meant the #1570 D
+    cross-check in `dispatch_smoke` never had cargo/python3/etc. to compare
+    against and silently failed OPEN for exactly the machines it exists to
+    protect. A config-free agent must now probe every known capability
+    regardless of its own (empty) declared list."""
+    from coord.prereqs import ALL_CAPABILITY_NAMES
+
+    server = AgentServer(
+        machine_name="ephemeral-1",
+        capabilities=[],
+        repos=[],
+        state_dir=tmp_path / "state",
+        worktree_writable_settings_files=[],
+        config_free_reason="no local coordinator.yml and no board service",
+    )
+    tool_versions = server.health()["tool_versions"]
+    assert "cargo" in tool_versions
+    assert "python3" in tool_versions
+    assert "gtk4" in tool_versions
+    assert "node" in tool_versions
+    # Sanity: the probed set really does cover every capability-gated tool,
+    # not just a hardcoded couple of names.
+    probed_capabilities = {
+        info["capability"] for info in tool_versions.values() if info["capability"]
+    }
+    assert probed_capabilities == set(ALL_CAPABILITY_NAMES)
+
+
+def test_health_tool_versions_stays_restricted_when_not_config_free(
+    tmp_path: Path,
+) -> None:
+    """A normal, fully-configured agent (`config_free_reason=None`, the
+    default) must NOT gain the config-free agent's wider probe — `_server`
+    declares only `capabilities=["python"]`, so `cargo`/`gtk4` stay absent,
+    same as before #2913."""
+    server = _server(tmp_path)
+    tool_versions = server.health()["tool_versions"]
+    assert "python3" in tool_versions
+    assert "cargo" not in tool_versions
+    assert "gtk4" not in tool_versions
+
+
 def test_assign_success(tmp_path: Path) -> None:
     repo = _init_repo(tmp_path / "repo")
     server = _server(tmp_path, repo_path=repo)

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/tests/test_cli_doctor.py

@@ -16,8 +16,13 @@ from coord.commands.status import doctor
 from coord.network import ONLINE, OFFLINE, MachineStatus
 
 
-def _run_doctor(config_path, monkeypatch, statuses, *, extra_args=None):
+def _run_doctor(config_path, monkeypatch, statuses, *, extra_args=None, ts_map=None):
     monkeypatch.setattr(network_mod, "check_all", lambda *a, **k: statuses)
+    # #2912: default the new host-resolution check to "tailscale not
+    # available" (matches=None, silent) so every PRE-EXISTING test here
+    # stays hermetic and unaffected — tests that actually exercise the
+    # check pass their own `ts_map`.
+    monkeypatch.setattr(network_mod, "tailscale_ip_map", lambda *a, **k: ts_map)
     runner = CliRunner()
     # #2082: doctor resolves --expected from PyPI by default now. Default
     # these tests to --no-pypi so they stay hermetic (no real network call);
@@ -101,6 +106,61 @@ def test_doctor_flags_unreachable_machine(valid_config_path, monkeypatch) -> Non
     assert "connection refused" in result.output
 
 
+def test_doctor_names_lan_dns_shadow_even_when_unreachable(
+    valid_config_path, monkeypatch,
+) -> None:
+    """#2912: `laptop`'s `host: laptop.tailnet` resolving to something other
+    than laptop's own tailnet address must be named EVEN on the branch that
+    reports "unreachable" — that's the whole failure mode: a DNS shadow
+    makes a healthy agent look dead with no clue why."""
+    from coord.config import load
+
+    cfg = load(valid_config_path)
+    statuses = [
+        MachineStatus(machine=cfg.machines[0], state=network_mod.TIMEOUT, reason="timed out"),
+        MachineStatus(
+            machine=cfg.machines[1], state=ONLINE,
+            health=_health({"git": _ok_probe(), "gh": _ok_probe()}, cfg.machines[1]),
+        ),
+    ]
+    ts_map = {"laptop": ("100.64.0.1", "laptop.tailf46ef8.ts.net")}
+    monkeypatch.setattr(
+        network_mod, "resolve_host_ip", lambda host, **k: "192.168.1.183"
+    )
+    result = _run_doctor(valid_config_path, monkeypatch, statuses, ts_map=ts_map)
+    assert result.exit_code == 1
+    assert "machines.host_resolves_offtailnet" in result.output
+    assert "100.64.0.1" in result.output
+    assert "laptop.tailf46ef8.ts.net" in result.output
+    assert "unreachable" in result.output
+
+
+def test_doctor_is_silent_when_host_matches_tailnet_address(
+    valid_config_path, monkeypatch,
+) -> None:
+    from coord.config import load
+
+    cfg = load(valid_config_path)
+    statuses = [
+        MachineStatus(
+            machine=m, state=ONLINE,
+            health=_health({"git": _ok_probe(), "gh": _ok_probe()}, m),
+        )
+        for m in cfg.machines
+    ]
+    ts_map = {
+        "laptop": ("100.64.0.1", "laptop.tailf46ef8.ts.net"),
+        "server": ("100.64.0.2", "server.tailf46ef8.ts.net"),
+    }
+    monkeypatch.setattr(
+        network_mod, "resolve_host_ip",
+        lambda host, **k: {"laptop.tailnet": "100.64.0.1", "server.tailnet": "100.64.0.2"}[host],
+    )
+    result = _run_doctor(valid_config_path, monkeypatch, statuses, ts_map=ts_map)
+    assert result.exit_code == 0, result.output
+    assert "host_resolves_offtailnet" not in result.output
+
+
 def test_doctor_flags_missing_baseline_tool(valid_config_path, monkeypatch) -> None:
     from coord.config import load
 

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/tests/test_network.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import socket
 from unittest.mock import MagicMock, patch
 
@@ -276,3 +277,111 @@ class TestCleanWorktrees:
             result = network.clean_worktrees(_m())
         assert result["ok"] is False
         assert "invalid JSON" in result["error"]
+
+
+class TestTailscaleIpMap:
+    """#2912: `tailscale status --json` parsing — best-effort, fails soft."""
+
+    def _fake_run(self, stdout: str, returncode: int = 0):
+        result = MagicMock()
+        result.returncode = returncode
+        result.stdout = stdout
+        return result
+
+    def test_parses_self_and_peers(self) -> None:
+        payload = {
+            "Self": {
+                "HostName": "dellserver",
+                "DNSName": "dellserver.tailf46ef8.ts.net.",
+                "TailscaleIPs": ["100.97.107.88", "fd7a:115c:a1e0::4c3b:6b58"],
+            },
+            "Peer": {
+                "abc": {
+                    "HostName": "dell64",
+                    "DNSName": "dell64.tailf46ef8.ts.net.",
+                    "TailscaleIPs": ["100.118.111.76", "fd7a:115c:a1e0::f430:6f4d"],
+                },
+            },
+        }
+        with patch.object(
+            network.subprocess, "run",
+            return_value=self._fake_run(json.dumps(payload)),
+        ):
+            out = network.tailscale_ip_map()
+        assert out == {
+            "dellserver": ("100.97.107.88", "dellserver.tailf46ef8.ts.net"),
+            "dell64": ("100.118.111.76", "dell64.tailf46ef8.ts.net"),
+        }
+
+    def test_missing_cli_returns_none(self) -> None:
+        with patch.object(network.subprocess, "run", side_effect=FileNotFoundError()):
+            assert network.tailscale_ip_map() is None
+
+    def test_nonzero_exit_returns_none(self) -> None:
+        with patch.object(
+            network.subprocess, "run", return_value=self._fake_run("", returncode=1)
+        ):
+            assert network.tailscale_ip_map() is None
+
+    def test_invalid_json_returns_none(self) -> None:
+        with patch.object(
+            network.subprocess, "run", return_value=self._fake_run("not json")
+        ):
+            assert network.tailscale_ip_map() is None
+
+    def test_timeout_returns_none(self) -> None:
+        with patch.object(
+            network.subprocess, "run",
+            side_effect=network.subprocess.TimeoutExpired(cmd="tailscale", timeout=5),
+        ):
+            assert network.tailscale_ip_map() is None
+
+
+class TestCheckHostResolution:
+    """#2912: is `host:` pointed at the RIGHT tailnet address?"""
+
+    def test_no_tailscale_available_is_unknown(self) -> None:
+        result = network.check_host_resolution(_m(name="dell64", host="dell64"), None)
+        assert result.matches is None
+
+    def test_node_not_in_peer_list_is_unknown(self) -> None:
+        result = network.check_host_resolution(
+            _m(name="dell64", host="dell64"), {"otherbox": ("100.1.1.1", "otherbox.ts.net")}
+        )
+        assert result.matches is None
+
+    def test_matching_address_is_ok(self) -> None:
+        machine = _m(name="dell64", host="dell64.tailf46ef8.ts.net")
+        ts_map = {"dell64": ("100.118.111.76", "dell64.tailf46ef8.ts.net")}
+        with patch.object(network, "resolve_host_ip", return_value="100.118.111.76"):
+            result = network.check_host_resolution(machine, ts_map)
+        assert result.matches is True
+
+    def test_lan_shadow_mismatch_is_flagged(self) -> None:
+        """The exact #2912 scenario: `host: dell64` resolves to the Windows
+        LAN box (192.168.1.183) instead of dell64's own tailnet address."""
+        machine = _m(name="dell64", host="dell64")
+        ts_map = {"dell64": ("100.118.111.76", "dell64.tailf46ef8.ts.net")}
+        with patch.object(network, "resolve_host_ip", return_value="192.168.1.183"):
+            result = network.check_host_resolution(machine, ts_map)
+        assert result.matches is False
+        assert result.tailnet_ip == "100.118.111.76"
+        assert result.magicdns_fqdn == "dell64.tailf46ef8.ts.net"
+        assert "192.168.1.183" in result.reason
+
+    def test_unresolvable_host_is_unknown(self) -> None:
+        machine = _m(name="dell64", host="dell64.invalid")
+        ts_map = {"dell64": ("100.118.111.76", "dell64.tailf46ef8.ts.net")}
+        with patch.object(network, "resolve_host_ip", return_value=None):
+            result = network.check_host_resolution(machine, ts_map)
+        assert result.matches is None
+
+    def test_falls_back_to_host_short_label_when_name_not_found(self) -> None:
+        """`machine.name` doesn't have to match tailscale's `HostName` —
+        e.g. an alias in coordinator.yml — so the host's own short label is
+        tried too before giving up."""
+        machine = _m(name="my-dell-alias", host="dell64.lan")
+        ts_map = {"dell64": ("100.118.111.76", "dell64.tailf46ef8.ts.net")}
+        with patch.object(network, "resolve_host_ip", return_value="100.118.111.76"):
+            result = network.check_host_resolution(machine, ts_map)
+        assert result.matches is True

{code_coordinator-0.5.284 → code_coordinator-0.5.286}/tests/test_prereqs.py

@@ -178,6 +178,30 @@ class TestProbeAll:
             "meets_floor": None, "capability": None, "ok": False,
         }
 
+    def test_all_capability_names_probes_every_capability_prereq(self) -> None:
+        """#2913: `ALL_CAPABILITY_NAMES` is what `AgentServer` probes for a
+        config-free agent in place of its own (empty) `capabilities` — it
+        must actually cover every `CAPABILITY_PREREQS` entry, else the
+        cross-check it exists to unblock would quietly narrow again."""
+        with patch("coord.prereqs.shutil.which", return_value=None):
+            probes = prereqs.probe_all(prereqs.ALL_CAPABILITY_NAMES)
+        expected_tools = {p.tool for p in prereqs.CAPABILITY_PREREQS} | {"git", "gh"}
+        assert set(probes) == expected_tools
+
+
+class TestAllCapabilityNames:
+    def test_matches_every_declared_capability(self) -> None:
+        declared = {
+            p.capability for p in prereqs.CAPABILITY_PREREQS if p.capability is not None
+        }
+        assert prereqs.ALL_CAPABILITY_NAMES == declared
+
+    def test_nonempty(self) -> None:
+        # A regression guard against this collapsing to an empty set (e.g. a
+        # future refactor of CAPABILITY_PREREQS dropping `capability` values)
+        # and silently making the #2913 fix probe nothing again.
+        assert prereqs.ALL_CAPABILITY_NAMES
+
 
 class TestUnmetCapabilities:
     def test_empty_when_capability_backs_out(self) -> None: