code-coordinator 0.5.313__tar.gz → 0.5.314__tar.gz

{code_coordinator-0.5.313 → code_coordinator-0.5.314}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.313
+Version: 0.5.314
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.313 → code_coordinator-0.5.314}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.313
+Version: 0.5.314
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.313 → code_coordinator-0.5.314}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.313",
+  "tag": "0.5.314",
   "distance": 0,
-  "node": "g55f6fe539f84cd3b47398af2d29c746352db15e2",
+  "node": "gc38f3dc007e19c5f559fba9c15807c1b5a0e4b7f",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.313 → code_coordinator-0.5.314}/coord/commands/tui.py

@@ -240,7 +240,7 @@ def _print_skew_notice(
         "release publishes one) before an atomic rename into place -- so a "
         "running coord-tui, or an interrupted download, never observes a "
         "partial binary.\n\n"
-        "Dev-checkout guard: tui/Cargo.toml's committed [package] version "
+        "Dev-checkout guard: coord-tui's own Cargo.toml's committed [package] version "
         f"is the {DEV_BUILD_SENTINEL_VERSION!r} placeholder that only "
         "release-tui.yml's CI build stamps a real version over (never "
         "committed back) -- so a plain local `cargo build` always reports "
@@ -340,11 +340,32 @@ def tui_update(
 
     if dest_path.exists() and not force:
         installed = read_installed_version(dest_path)
+        # #2984: check "already at the target version" BEFORE "looks like a
+        # dev build", not after. DEV_BUILD_SENTINEL_VERSION is coord-tui's
+        # committed placeholder, and it collides with coord-tui's real
+        # `v0.1.0` release tag -- a CI-built v0.1.0 binary reports the exact
+        # same string a bare `cargo build` always does. Version-equality
+        # can't tell those apart, but it doesn't need to here: if what's
+        # installed already matches what this run would install, installing
+        # again changes nothing, so there is nothing worth refusing over --
+        # dev build or not. This ordering is what makes the check stop
+        # depending on the release tag differing from the placeholder (see
+        # is_dev_build's docstring and the module docstring's "#2984"
+        # paragraph in tui_release.py); it does NOT resolve the one case
+        # that stays genuinely ambiguous -- a real dev build sitting at the
+        # destination while coord-tui's latest release also happens to be
+        # 0.1.0 -- which is a documented, self-limiting gap, not a bug here.
+        if normalize_version(installed) == target_version:
+            click.echo(
+                f"coord-tui is already v{target_version} at {dest_path} -- "
+                "nothing to do (--force to reinstall)."
+            )
+            return
         if installed == DEV_BUILD_SENTINEL_VERSION:
             click.echo(
                 f"refusing to overwrite {dest_path}: it reports version "
                 f"{DEV_BUILD_SENTINEL_VERSION!r}, the sentinel a locally "
-                "`cargo build`'d coord-tui always carries (coord-tui's "
+                "`cargo build`'d coord-tui always carries (coord-tui's own "
                 "Cargo.toml "
                 "committed version is only stamped for real in CI release "
                 "builds). This looks like a dev build someone is iterating "
@@ -354,12 +375,6 @@ def tui_update(
                 err=True,
             )
             sys.exit(3)
-        if normalize_version(installed) == target_version:
-            click.echo(
-                f"coord-tui is already v{target_version} at {dest_path} -- "
-                "nothing to do (--force to reinstall)."
-            )
-            return
 
     click.echo(f"Detected platform target: {target}")
     click.echo(f"Resolving coord-tui v{target_version} from {repo}...")

{code_coordinator-0.5.313 → code_coordinator-0.5.314}/coord/tui_release.py

@@ -3,7 +3,7 @@
 
 ``release-tui.yml`` builds ``coord-tui`` for linux/macOS/Windows on every
 ``vX.Y.Z`` tag push and attaches ``coord-tui-<target>`` assets to a GitHub
-Release, with ``tui/Cargo.toml``'s version stamped from that tag. This module
+Release, with coord-tui's own ``Cargo.toml``'s version stamped from that tag. This module
 is the client half: find the release to install, detect which of that
 workflow's build-matrix targets this host needs, and install the binary
 without a human ever visiting the Releases page by hand.
@@ -50,9 +50,9 @@ Two invariants drive the design:
   interrupted download, can only ever observe the old binary or the new
   one — never a partial file at the destination path.
 
-* **Never clobber a dev build silently.** ``tui/Cargo.toml``'s committed
-  ``[package] version`` is the ``0.1.0`` placeholder — see
-  ``tui/src/main.rs``'s ``version_string()`` docstring — and only
+* **Never clobber a dev build silently.** coord-tui's own committed
+  ``Cargo.toml``'s ``[package] version`` is the ``0.1.0`` placeholder — see
+  ``src/main.rs``'s ``version_string()`` docstring in that repo — and only
   ``release-tui.yml``'s CI build stamps a real ``vX.Y.Z`` over it, as a
   build-time edit that is never committed back. A binary built locally with
   a bare ``cargo build`` therefore *always* reports exactly ``coord-tui
@@ -61,6 +61,23 @@ Two invariants drive the design:
   destination is a developer's own local build, not a stale release —
   :func:`is_dev_build` checks for it, and ``coord tui update`` refuses to
   overwrite it without ``--force``.
+
+  #2984: version-equality is a *guess*, not a provenance check, and it has
+  exactly one collision — the sentinel is coord-tui's committed placeholder,
+  so a real CI-built binary reports it verbatim on precisely the tag that
+  reproduces the placeholder (``v0.1.0``, which is also where any new release
+  channel's tag line starts). ``coord tui update`` does not try to resolve
+  that collision by inspecting the binary harder; it sidesteps it by checking
+  "is the destination already at the version this run would install?"
+  *before* asking "does the destination look like a dev build?" — when they
+  already match there is nothing this run would change by installing again,
+  dev build or not, so refusing serves no purpose. The one case that stays
+  irreducibly ambiguous — a genuine local dev build sitting at the
+  destination while coord-tui's latest release *also* happens to be
+  ``0.1.0`` — is a real gap, not a bug in this check: nothing short of a
+  provenance marker neither path can fake (out of scope here; see issue
+  #2984's "alternative" fix) can tell those two apart from the version
+  string alone.
 """
 
 from __future__ import annotations
@@ -98,9 +115,13 @@ DEFAULT_API_BASE = "https://api.github.com"
 DEFAULT_INSTALL_PATH = "~/.local/bin/coord-tui"
 
 #: See the module docstring's "never clobber a dev build" invariant:
-#: `tui/Cargo.toml`'s committed `[package] version` field, which a plain
-#: `cargo build` always reports verbatim because only release-tui.yml's CI
-#: stamps a real version over it (and never commits that stamp back).
+#: coord-tui's own `Cargo.toml`'s committed `[package] version` field, which a
+#: plain `cargo build` always reports verbatim because only release-tui.yml's
+#: CI stamps a real version over it (and never commits that stamp back).
+#:
+#: #2984: this value collides with coord-tui's real `v0.1.0` release tag —
+#: see the module docstring's "#2984" paragraph for how `coord tui update`
+#: avoids misreading that collision as a dev build.
 DEV_BUILD_SENTINEL_VERSION = "0.1.0"
 
 #: release-tui.yml's build matrix, keyed by (system, machine) as reported by
@@ -354,7 +375,8 @@ def install_atomically(tmp_path: Path, dest_path: Path) -> None:
 def read_installed_version(binary_path: Path, timeout: float = 5.0) -> str | None:
     """Parse ``<binary_path> --version``'s ``coord-tui <version>`` output,
     or ``None`` when the path doesn't exist, isn't runnable, or its output
-    doesn't match that shape (see ``tui/src/main.rs``'s ``version_string``)."""
+    doesn't match that shape (see coord-tui's own ``src/main.rs``'s
+    ``version_string``)."""
     if not binary_path.exists():
         return None
     try:
@@ -378,7 +400,22 @@ def read_installed_version(binary_path: Path, timeout: float = 5.0) -> str | Non
     return None
 
 
-def is_dev_build(binary_path: Path) -> bool:
-    """True when *binary_path* reports the :data:`DEV_BUILD_SENTINEL_VERSION`
-    — see the module docstring's "never clobber a dev build" invariant."""
-    return read_installed_version(binary_path) == DEV_BUILD_SENTINEL_VERSION
+def is_dev_build(binary_path: Path, *, target_version: str | None = None) -> bool:
+    """True when *binary_path* reports :data:`DEV_BUILD_SENTINEL_VERSION` in
+    a way that isn't already explained by the destination holding
+    *target_version* — see the module docstring's "#2984" paragraph.
+
+    #2984: the sentinel collides with coord-tui's real ``v0.1.0`` release, so
+    version-equality alone cannot always tell a genuine local ``cargo build``
+    apart from a CI-built binary of that one release. It doesn't have to: pass
+    *target_version* — the version this run resolved as "the one to install"
+    (bare, e.g. via :func:`normalize_version`) — and a destination that
+    already reports exactly that version is never reported as a dev build,
+    sentinel or not, because there is nothing a refusal would protect there.
+    Omitting *target_version* falls back to the old, collision-prone,
+    version-only check — the most a bare *binary_path* can ever support.
+    """
+    installed = read_installed_version(binary_path)
+    if installed != DEV_BUILD_SENTINEL_VERSION:
+        return False
+    return target_version is None or installed != target_version

{code_coordinator-0.5.313 → code_coordinator-0.5.314}/tests/test_cli_tui_update.py

@@ -541,6 +541,66 @@ def test_tui_update_force_overwrites_dev_build(stub_server, tmp_path: Path) -> N
     assert out == f"coord-tui {version}"
 
 
+def test_tui_update_v0_1_0_release_is_not_misclassified_as_dev_build(
+    stub_server, tmp_path: Path
+) -> None:
+    """#2984 regression, pinned at the CLI level.
+
+    `DEV_BUILD_SENTINEL_VERSION` is `"0.1.0"` -- and that is ALSO coord-tui's
+    real first release tag, because `release-tui.yml` stamps the tag straight
+    over `Cargo.toml`'s committed placeholder, and the one tag that
+    reproduces the placeholder exactly is the one every new release channel
+    starts on. A host that already carries a CI-built v0.1.0 binary must be
+    able to run `coord tui update` again, with no `--force`, and have that
+    recognised as "already current" -- not refused as if it were a dev
+    build someone is iterating on.
+    """
+    from coord.tui_release import DEV_BUILD_SENTINEL_VERSION
+
+    version = DEV_BUILD_SENTINEL_VERSION
+    assert version == "0.1.0"  # fixture assumption: this IS the colliding tag
+    dest = _installed(tmp_path, version)
+
+    server = stub_server
+    lpath, lpayload = _latest_route(version)
+    server.routes[lpath] = ("json", lpayload)
+    # No asset/download routes registered: reaching the download would 404,
+    # proving the "already current" short-circuit is what actually fired.
+
+    result = CliRunner().invoke(
+        main,
+        [
+            "tui", "update",
+            "--repo", REPO,
+            "--api-base", _api_base(server),
+            "--dest", str(dest),
+        ],
+    )
+
+    assert result.exit_code == 0, result.output
+    assert "nothing to do" in result.output
+    assert "refusing to overwrite" not in result.output
+    # Untouched -- the same bytes that were already there, not re-downloaded.
+    assert dest.read_bytes() == _fake_binary(version)
+
+
+def test_is_dev_build_does_not_misclassify_the_v0_1_0_collision(tmp_path: Path) -> None:
+    """#2984 regression, at the `tui_release.is_dev_build` unit level -- no
+    CLI or network involved. A sentinel-versioned binary whose
+    `target_version` (the release a run resolved as "the one to install") is
+    that very same value must not be reported as a dev build; that's exactly
+    the v0.1.0 collision. Omitting `target_version` keeps the old,
+    collision-prone, version-only check, asserted here as a control so this
+    test would fail loudly if that fallback ever silently changed too."""
+    from coord.tui_release import DEV_BUILD_SENTINEL_VERSION, is_dev_build
+
+    binary = _installed(tmp_path, DEV_BUILD_SENTINEL_VERSION)
+
+    assert is_dev_build(binary) is True
+    assert is_dev_build(binary, target_version=DEV_BUILD_SENTINEL_VERSION) is False
+    assert is_dev_build(binary, target_version="0.9.9") is True
+
+
 # ── version-skew notice (`coord tui status`, and bare `coord tui`) ─────────
 #
 # #2898's acceptance criterion: `coord tui status` compares against coord-tui's