code-coordinator 0.5.326__tar.gz → 0.5.327__tar.gz

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.326
+Version: 0.5.327
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.326
+Version: 0.5.327
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.326",
+  "tag": "0.5.327",
   "distance": 0,
-  "node": "g4f5acb0a5caf92650d4867c894085c97109eebc7",
+  "node": "g33af929d66cfc03789a677518e08ff5c0b6d4000",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-31"

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/coord/dao.py

@@ -393,6 +393,15 @@ class SqliteStore:
         forward-compatible stand-in the issue asks for (#1039 can replace the
         semantics without a wire-shape change — it's still one integer).
         Fail-open to 0 so a missing/pre-migration table never 503s the board.
+
+        #2983: that fail-open needs a rollback to actually be fail-open on
+        Postgres. This runs inside a caller's ``with closing(self._connect())``
+        block alongside many other reads (``_board_meta``, ``_round_number``,
+        every ``_table`` call in ``board_projection``), and Postgres aborts the
+        whole transaction on a failed statement — so a missing ``audit_log``
+        took out every *sibling* read on that connection too, producing
+        precisely the 503 this guard exists to prevent. Nothing uncommitted
+        can be lost: ``SqliteStore``'s connections are opened read-only.
         """
         try:
             cutoff = time.time() - _AUDIT_RECENT_WINDOW_SECONDS
@@ -400,7 +409,8 @@ class SqliteStore:
                 conn, "SELECT COUNT(*) AS n FROM audit_log WHERE ts >= ?", (cutoff,)
             ).fetchone()
             return int(row["n"]) if row else 0
-        except sql.driver_error(conn):
+        except sql.driver_error(conn) as exc:
+            db_mod.rollback_after_driver_error(conn, exc)  # #2983: caller reuses `conn`
             return 0
 
     # ── public reads ────────────────────────────────────────────────────────────

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/coord/db.py

@@ -429,6 +429,79 @@ def close() -> None:
 
 _T = TypeVar("_T")
 
+
+# ── Recovering a connection after a swallowed driver error (#2983) ──────────
+
+
+def _board_connection_if_open() -> Any | None:
+    """This process's already-open board connection, or ``None`` (#2983).
+
+    Deliberately NOT :func:`get_connection`: this is called from inside a
+    driver-error handler, where *opening* a connection that wasn't open
+    before would be a surprising side effect (and, on the SQLite path,
+    would create the database file). It only ever hands back a connection
+    something else already opened — the ``override_connection()``/SQLite
+    singleton, else THIS thread's Postgres connection, mirroring
+    :func:`get_connection`'s own precedence order.
+    """
+    if _conn is not None:
+        return _conn
+    return getattr(_pg_thread_local, "conn", None)
+
+
+def rollback_after_driver_error(conn: Any | None, exc: BaseException) -> None:
+    """Clear the aborted transaction *exc* left behind on *conn*, so a
+    handler that swallowed *exc* and keeps using the same connection still
+    has a usable one (#2983).
+
+    **The rule this implements.** After catching a driver error through the
+    dialect seam (``except sql.driver_error(conn):`` /
+    ``except sql.driver_errors():``), a handler that intends to CONTINUE on
+    the same connection must roll back first. A handler that re-raises need
+    not. Postgres aborts the *whole* transaction on any failed statement,
+    so without this every statement issued afterwards on that connection —
+    for the rest of the process, since ``coord.db``'s connection is a
+    process-/thread-lived singleton — raises
+    ``psycopg.errors.InFailedSqlTransaction``. That is what made the whole
+    #2597/#2689/#2784 degrade-gracefully layer inert or actively harmful on
+    the second backend: guards written to *prevent* a crash caused one.
+    SQLite has no such concept — a failed statement there leaves the
+    connection perfectly usable — which is exactly why every one of these
+    21 handler sites read as correct for years.
+
+    **Gated on the exception, not on the connection's dialect.** *exc* is a
+    Postgres driver error iff it carries a SQLSTATE (``psycopg3``'s
+    ``.sqlstate``, ``psycopg2``'s ``.pgcode`` — the same pair
+    :func:`is_lock_contention_error` dispatches on, for the same #2719
+    reason: no config flag, no driver import). Keying off that rather than
+    ``sql.detect_dialect(conn)`` makes "SQLite behaviour is byte-identical
+    to before #2983" true *by construction* rather than by argument: a
+    ``sqlite3.Error`` has no SQLSTATE, so this returns without touching the
+    connection and no SQLite caller can lose uncommitted work it expected
+    to survive into the next statement (``retry_on_locked``'s multi-
+    statement writers being the case where that would actually be
+    observable). #2982's sibling fix in ``_migrate_add_columns`` predates
+    this helper and rolls back unconditionally; it is correct there (the
+    only uncommitted statement at that point is the one that just failed)
+    and is deliberately left as-is.
+
+    A ``None`` *conn* is a no-op — see :func:`_board_connection_if_open`,
+    which may legitimately have nothing to hand over. A failure of the
+    rollback itself is suppressed: this runs inside an ``except`` block
+    whose original exception is the interesting one, and masking it with a
+    secondary error from the recovery attempt would be strictly worse than
+    leaving the connection unrecovered.
+    """
+    if conn is None:
+        return
+    if getattr(exc, "sqlstate", None) is None and getattr(exc, "pgcode", None) is None:
+        return  # not a Postgres driver error — nothing was aborted
+    try:
+        conn.rollback()
+    except Exception:  # noqa: BLE001 — never mask the caught driver error
+        pass
+
+
 # #2538: a handful of consecutive short retries — long enough to ride out a
 # concurrent writer (the daemon's own passive tick, another `coord merge`/
 # `coord notify` invocation) that only holds the DB for a moment, short
@@ -517,6 +590,7 @@ def is_lock_contention_error(exc: BaseException) -> bool:
 def retry_on_locked(
     write: Callable[[], _T],
     *,
+    conn: Any | None = None,
     attempts: int = _LOCK_RETRY_ATTEMPTS,
     base_delay: float = _LOCK_RETRY_BASE_DELAY_S,
 ) -> _T:
@@ -547,12 +621,58 @@ def retry_on_locked(
     ``coord.state._record_dispatched_assignment_local``, whose caller —
     ``coord.auto_loop._dispatch_fix`` — treats it as a declined dispatch
     rather than letting it crash the whole run).
+
+    Transaction recovery, and whether "retry" means anything on Postgres
+    (#2983)
+    ------------------------------------------------------------------
+    SQLite's ``SQLITE_BUSY`` retry model is "the statement never ran; the
+    lock is held elsewhere; the transaction is untouched" — so re-running
+    *write* verbatim is exactly the right move, and has been since #2538.
+    Postgres's three contention SQLSTATEs
+    (:data:`_POSTGRES_LOCK_CONTENTION_SQLSTATES`) are contention-shaped in
+    the same way, but they ALSO abort the whole transaction. That makes the
+    retry loop *worse than useless* on Postgres without recovery: attempt 2
+    onwards raises ``InFailedSqlTransaction`` instead of re-attempting the
+    write, ``is_lock_contention_error`` reads False for it, and the loop
+    bails out on attempt 2 re-raising the wrong error — the #2597/#2689
+    retry budget silently reduced to a single attempt.
+
+    So the answer to "does SQLite's retry model have a Postgres analogue at
+    all, or should the retry just be a no-op there?" is: it has one, and it
+    is the standard Postgres idiom — **roll back, then re-run the whole
+    transaction.** Every *write* callable in this tree is already a
+    self-contained transaction (its own statements followed by its own
+    ``conn.commit()``), which is precisely what makes re-running it after a
+    rollback correct rather than a partial replay. Hence
+    :func:`rollback_after_driver_error` before both the retry and the final
+    re-raise: after the re-raise the connection must still be usable too,
+    because ~13 of this tree's callers catch that exception and *swallow*
+    it (a cache mirror whose upstream GitHub write already landed must not
+    turn into a 503), then keep using the same singleton connection.
+    Recovering here rather than in each of those handlers is what keeps the
+    guarantee in one place: **when this function returns OR raises, it has
+    not left an aborted transaction behind.**
+
+    *conn* is the connection *write* writes through, needed only for that
+    rollback. It defaults to :func:`_board_connection_if_open` because
+    every call site in this tree writes through ``get_connection()``
+    (``coord.state``, ``coord.merge_queue``, ``coord.audit``,
+    ``coord.commands.merge``), so the default is correct for all of them
+    and none had to be churned; pass it explicitly if you ever write
+    through a different connection. Rolling back an innocent already-
+    committed connection would be a no-op anyway — every writer here
+    commits immediately — and the rollback is skipped entirely unless the
+    caught exception carries a Postgres SQLSTATE, so the SQLite path is
+    byte-identical to before #2983.
     """
     delay = base_delay
     for attempt in range(1, attempts + 1):
         try:
             return write()
         except sql.driver_errors() as exc:
+            rollback_after_driver_error(
+                conn if conn is not None else _board_connection_if_open(), exc
+            )
             if not is_lock_contention_error(exc) or attempt >= attempts:
                 raise
             time.sleep(delay)
@@ -619,10 +739,21 @@ def _read_schema_version(conn: sqlite3.Connection) -> int:
     the current ``_DB_SCHEMA_VERSION`` and skips the write path entirely —
     until the next bump (#2675: that skip is exactly what silently dropped
     two `_migrate_add_columns` entries when they landed without one).
+
+    #2983: the "table doesn't exist yet" swallow below needs its own
+    rollback — #2982's fix is one layer downstream and does not cover this.
+    On a fresh Postgres database this is the FIRST statement `_open_postgres`
+    -> `_migrate_if_needed` runs, it errors (`UndefinedTable`), and that
+    aborts the transaction; the caller then continues on the same connection
+    straight into `_fix_schema_version_table`'s `CREATE TABLE IF NOT
+    EXISTS`, which raises `InFailedSqlTransaction`. So on Postgres the
+    brand-new-database path — the one case this guard exists for — could
+    never get past its own first statement.
     """
     try:
         row = sql.execute(conn, "SELECT MAX(version) FROM schema_version").fetchone()
-    except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+    except sql.driver_errors() as exc:  # #2784: was sqlite3.OperationalError only
+        rollback_after_driver_error(conn, exc)  # #2983: caller keeps using `conn`
         return 0  # table doesn't exist yet
     if row is None or row[0] is None:
         return 0

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/coord/merge_queue.py

@@ -42,7 +42,7 @@ from coord.ci_store import (
     summarize,
     summarize_counts,
 )
-from coord.db import get_connection, retry_on_locked
+from coord.db import get_connection, retry_on_locked, rollback_after_driver_error
 from coord.forge_availability import MERGE_GATE_REFUSAL_KINDS, record_merge_gate_refusal
 from coord.models import (
     CLOSES_ISSUE_TYPES,
@@ -3812,11 +3812,23 @@ def _archived_merged_issue_keys(conn: sqlite3.Connection) -> set[tuple[str, int]
             "SELECT repo_name, issue_number FROM merge_queue_archive WHERE state = ?",
             (MERGED,),
         ).fetchall()
-    except sql.driver_errors():  # #2784: not just sqlite3.OperationalError
+    except sql.driver_errors() as exc:  # #2784: not just sqlite3.OperationalError
         # "no such table" surfaces as a *different* driver-named exception
         # per backend (sqlite3.OperationalError vs psycopg.errors.
         # UndefinedTable), so this must go through the dialect seam or the
         # not-yet-archived case becomes an uncaught crash on Postgres.
+        #
+        # #2983: and catching it is only half the job. `conn` here is the
+        # process-lived `get_connection()` singleton, which the caller
+        # (`merged_issue_keys`, and in turn `enqueue_approved_work` /
+        # `staging_items`) keeps writing and reading through long after this
+        # returns — on Postgres the swallowed UndefinedTable aborts that
+        # connection's transaction, so the "archive doesn't exist yet"
+        # degrade turned every subsequent statement into
+        # InFailedSqlTransaction. Nothing uncommitted is at risk: this
+        # function only reads, and on Postgres the abort had already
+        # discarded anything pending regardless.
+        rollback_after_driver_error(conn, exc)
         return set()
     return {(r["repo_name"], r["issue_number"]) for r in rows}
 

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/coord/state.py

@@ -46,7 +46,12 @@ from coord.board_service import route_assignment_patch as _route_assignment_patc
 from coord.board_service import route_issue_comment as _route_issue_comment
 from coord.board_service import route_issue_patch as _route_issue_patch
 from coord.board_service import route_write as _route_write
-from coord.db import get_connection, is_lock_contention_error, retry_on_locked
+from coord.db import (
+    get_connection,
+    is_lock_contention_error,
+    retry_on_locked,
+    rollback_after_driver_error,
+)
 from coord.models import (
     WORK_LIKE_TYPES,
     Assignment,
@@ -3137,6 +3142,13 @@ def _update_assignment_tokens_local(
         # and now also covers a lock that outlasts the retry budget.
         retry_on_locked(_write)
     except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+        # #2983 audit: safe to swallow without a rollback here, unlike the
+        # sibling handlers below — `retry_on_locked` guarantees it has not
+        # left an aborted transaction behind when it returns OR raises (see
+        # its "Transaction recovery" docstring section), so every handler
+        # whose `try` body is a `retry_on_locked(...)` call inherits the fix
+        # for free. Adding a second rollback here would be redundant, not
+        # safer.
         pass
 
 
@@ -3184,9 +3196,17 @@ def _update_assignment_stop_reason_local(assignment_id: str, stop_reason: str) -
             (stop_reason, assignment_id),
         )
         conn.commit()
-    except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+    except sql.driver_errors() as exc:  # #2784: was sqlite3.OperationalError only
         # Column may not exist yet (pre-migration DB or test fixtures).
-        pass
+        #
+        # #2983: `conn` is the process-/thread-lived `get_connection()`
+        # singleton, so on Postgres swallowing this without a rollback
+        # leaves the transaction aborted for every LATER caller of
+        # `get_connection()` in this process, not just for the rest of this
+        # function. Nothing uncommitted is lost: the only statement in the
+        # transaction is the UPDATE that just failed (the `commit()` above
+        # is the last thing in the block).
+        rollback_after_driver_error(conn, exc)
 
 
 def mark_assignment_interactive(assignment_id: str) -> None:
@@ -3221,9 +3241,12 @@ def _mark_assignment_interactive_local(assignment_id: str) -> None:
             (assignment_id,),
         )
         conn.commit()
-    except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+    except sql.driver_errors() as exc:  # #2784: was sqlite3.OperationalError only
         # Column may not exist on a pre-migration DB.
-        pass
+        # #2983: same shared-singleton reasoning as
+        # `_update_assignment_stop_reason_local` above — swallow, but leave
+        # the connection usable for the next `get_connection()` caller.
+        rollback_after_driver_error(conn, exc)
 
 
 def set_test_plan(
@@ -3392,8 +3415,14 @@ def _set_assignment_failure_reason_local(assignment_id: str, reason: str) -> Non
             (reason[:512], now, assignment_id),  # cap at 512 chars — one-liner
         )
         conn.commit()
-    except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+    except sql.driver_errors() as exc:  # #2784: was sqlite3.OperationalError only
         # Column may not exist on a pre-migration DB — best-effort.
+        # #2983: the `return` ends this function but NOT the connection's
+        # life — it is the shared `get_connection()` singleton, so an
+        # un-rolled-back abort here would take out every later statement in
+        # the process on Postgres (including this same daemon request's
+        # audit write below).
+        rollback_after_driver_error(conn, exc)
         return
     # #1036 fix review finding 2: no matching row (bad/stale assignment_id)
     # means the UPDATE above touched nothing — don't audit a transition that
@@ -5982,7 +6011,15 @@ def _list_issue_numbers_with_assignments_local(repo_name: str) -> set[int]:
                 f"SELECT DISTINCT issue_number FROM {table} WHERE repo_name = ?",  # noqa: S608
                 (repo_name,),
             ).fetchall()
-        except sql.driver_errors():  # #2784: was sqlite3.OperationalError only
+        except sql.driver_errors() as exc:  # #2784: was sqlite3.OperationalError only
+            # #2983: `continue` goes straight back round the loop on the SAME
+            # connection, so on Postgres a missing `assignments_archive` (the
+            # exact case named below) aborted the transaction and the NEXT
+            # iteration — plus everything else this process later ran through
+            # `get_connection()` — raised InFailedSqlTransaction uncaught.
+            # Read-only loop, so the rollback can only discard the SELECT
+            # that just failed.
+            rollback_after_driver_error(conn, exc)
             continue  # assignments_archive may not exist yet (housekeeping never ran)
         numbers.update(r[0] for r in rows if r[0] is not None)
     return numbers

{code_coordinator-0.5.326 → code_coordinator-0.5.327}/tests/test_dao.py

@@ -21,6 +21,12 @@ from coord import db as db_mod
 from coord import sql
 from coord.dao import CoordStore, SqliteStore
 from coord.db import _ensure_schema
+from tests import backends
+from tests.test_db import (
+    AbortOnErrorConn,
+    abort_simulating_connection,
+    schema_migrated_sqlite_connection,
+)
 
 
 @pytest.fixture
@@ -262,3 +268,79 @@ class TestConnectDialectRouting:
         store = SqliteStore(read_db)
         with pytest.raises(db_mod.ProductionDatabaseGuardError):
             store._connect()
+
+
+# ── #2983: a swallowed driver error must not poison the read connection ─────
+#
+# `_audit_recent_count` is documented as failing "open to 0 so a
+# missing/pre-migration table never 503s the board".  On Postgres a failed
+# statement aborts the whole transaction, so before #2983 the swallow took
+# out every *sibling* read sharing that `with closing(self._connect())`
+# block -- `escalations` and `drive_queue` are evaluated after it in
+# `board_projection`'s dict literal -- producing precisely the 503 the guard
+# exists to prevent.
+
+
+class TestAuditRecentCountRollsBackOnDriverError:
+    """Drives the regression with the shared abort-simulating stub, so it is
+    meaningful on a SQLite-only dev machine with no Postgres server."""
+
+    def _store_with_missing_audit_log(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> tuple[SqliteStore, AbortOnErrorConn]:
+        conn = abort_simulating_connection(
+            monkeypatch, schema_migrated_sqlite_connection(drop=("audit_log",))
+        )
+        monkeypatch.setattr(SqliteStore, "_connect", lambda self: conn)
+        return SqliteStore(Path("unused-the-connection-is-injected.db")), conn
+
+    def test_returns_zero_and_leaves_the_connection_usable(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        store, conn = self._store_with_missing_audit_log(monkeypatch)
+
+        assert store._audit_recent_count(conn) == 0
+        assert conn.rollbacks == 1
+        # The "further operation on the same connection" acceptance
+        # criterion -- pre-fix this raises "current transaction is aborted".
+        assert sql.execute(conn, "SELECT 1 AS ok").fetchone()["ok"] == 1
+
+    def test_board_projection_still_serves_the_reads_after_the_swallow(
+        self, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """The user-visible shape: a missing `audit_log` must degrade to
+        `audit_recent_count: 0`, not 503 the whole board.  `escalations` and
+        `drive_queue` are read *after* `_audit_recent_count` in
+        `board_projection`'s dict literal, so they are what actually broke."""
+        store, conn = self._store_with_missing_audit_log(monkeypatch)
+
+        payload = store.board_projection()
+
+        assert payload["audit_recent_count"] == 0
+        assert payload["escalations"] == []
+        assert payload["drive_queue"] == []
+        assert payload["assignments"] == []
+
+
+class TestAuditRecentCountRollsBackOnRealPostgres:
+    """The same regression against an actual Postgres server, when one is
+    reachable -- `psycopg.errors.UndefinedTable` followed by
+    `InFailedSqlTransaction`, the real shapes the stub above simulates."""
+
+    def test_sibling_reads_survive_a_missing_audit_log(self) -> None:
+        unavailable = backends.postgres_available()
+        if unavailable:
+            pytest.skip(f"no Postgres backend available: {unavailable}")
+
+        session = backends.open_named_session(backends.BACKEND_POSTGRES)
+        try:
+            _ensure_schema(session.conn)
+            sql.execute(session.conn, "DROP TABLE audit_log")
+            session.conn.commit()
+            store = SqliteStore(Path("unused-the-connection-is-injected.db"))
+
+            assert store._audit_recent_count(session.conn) == 0
+            # Pre-fix: psycopg.errors.InFailedSqlTransaction.
+            assert sql.execute(session.conn, "SELECT 1 AS ok").fetchone()["ok"] == 1
+        finally:
+            session.close()