code-coordinator 0.5.490__tar.gz → 0.5.491__tar.gz

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.490
+Version: 0.5.491
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.490
+Version: 0.5.491
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.490",
+  "tag": "0.5.491",
   "distance": 0,
-  "node": "gfb5dc047d0e9acfa22f379bebb343d14c749080c",
+  "node": "g0bf722668fffd8f60d76696692afdbf7f1b292ff",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-09-18"

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/coord/diagnose.py

@@ -735,6 +735,22 @@ def diagnose_stage(
     latest = _latest(assignments)
 
     if latest is None:
+        # #3383: a `review_claims` row held for a work assignment with ZERO
+        # review/test-author/mock-author rows (never dispatched, or all
+        # deleted) is unreachable from `_recover_review` below — that
+        # function only ever runs once `latest` above is non-None. Before
+        # this, `--stage review` hit this exact branch and reported the
+        # stage healthy while `dispatch_review` was permanently wedged
+        # behind the leaked claim (#3206's failure one state earlier — see
+        # `_leaked_review_claim_without_row`'s docstring). Checked BEFORE
+        # the "no review assignment" finding below, on claim state rather
+        # than on row existence, exactly as #3206 already does once a row
+        # exists.
+        if stage == "review" and _leaked_review_claim_without_row(
+            board, repo_name, issue_number, res, reset=reset, dry_run=dry_run,
+        ):
+            _cleanup_issue(board, config, repo_name, issue_number, res, dry_run=dry_run, reset=reset)
+            return res
         res.findings.append(f"no {stage} assignment on the board for #{issue_number}")
         res.recovered = True  # nothing wedged
         # Still run the issue-wide cleanup below.
@@ -818,6 +834,154 @@ def diagnose_stage(
     return res
 
 
+# #3383: a claim taken by `claim_review_dispatch` shortly before its caller
+# inserts the review row it's claiming for looks, from a single read,
+# identical to a genuinely leaked claim — the same false-positive window
+# `_recover_review` below already documents for the terminal-row case
+# (#3206). Below this age the claim is reported but NOT offered for release;
+# above it, treated as leaked.
+#
+# NOT short on purpose — `dispatch_review` (coord/review.py) claims at
+# `claim_review_dispatch` (~line 3070) and does NOT insert the review's
+# `assignments` row until `record_dispatched_assignment` (~line 3763); its
+# own `except Exception` handler at ~line 3815 calls the ~500 lines between
+# those two points "pr_lookup, briefing assembly, JSON handling of
+# agent_response, ...". That gap includes several sequential GitHub API
+# calls (`work_is_terminal`, `branch_commits_ahead`, `pr_lookup`,
+# `branch_exists_on_remote`, `pr_diff`, `get_compare_files`,
+# `get_compare_diff`, `get_pr_commit_messages`, an issue-body fetch) and then
+# a candidate loop that POSTs to each reviewer machine's `/assign` with
+# `timeout=ASSIGN_POST_TIMEOUT_SECS` (`coord/dispatch.py` — 60.0s),
+# falling through to the next candidate on rejection/timeout/unreachability.
+# A single slow/unreachable first-choice reviewer machine alone can burn the
+# full 60s before a second candidate is even tried, and there is no hard cap
+# on candidate count — so this has to clear that whole chain, not one
+# network round trip. Picked as a small multiple of minutes so it
+# comfortably outlasts a worst-case multi-candidate dispatch plus GitHub API
+# latency, while still being short enough that a *genuinely* leaked claim
+# doesn't sit unrecoverable for long once someone runs `--reset`.
+_REVIEW_CLAIM_LEAK_GRACE_SECS = 600.0
+
+
+def _leaked_review_claim_without_row(
+    board: "Board",
+    repo_name: str,
+    issue_number: int,
+    res: DiagnoseResult,
+    *,
+    reset: bool,
+    dry_run: bool,
+) -> bool:
+    """#3383: detect (and, under ``--reset``, release) a leaked
+    ``review_claims`` row for a work assignment that has NO review /
+    test-author / mock-author row at all — the one shape `_recover_review`
+    can never see, because `diagnose_stage` only calls it once
+    `stage_assignments(..., "review")` finds a row. A claim can be (and, per
+    the issue that reported this, was) taken and never released when the
+    work assignment it's keyed on was dispatched to review, that review
+    never got as far as inserting its own `assignments` row (or its row was
+    later deleted, e.g. by an earlier `--reset`), and the claim outlived it.
+    Every future `dispatch_review` for that work assignment then denies
+    forever with the misleading #3113 "lost the atomic dispatch-claim race"
+    reason — while `coord diagnose --stage review` (which hit the
+    `latest is None` "no review assignment" branch before this function
+    existed) reported the stage healthy.
+
+    Checked against the WORK assignment's id — `claim_review_dispatch` is
+    keyed on the id of the assignment BEING reviewed, never on a review
+    row's own id (see `_recover_review`'s `work_assignment_id` resolution).
+
+    Returns ``True`` when a claim was found (whether or not it could be
+    released yet — see the grace-period case) and this function has already
+    appended the appropriate finding(s); ``False`` when there is nothing to
+    report, in which case the caller's own "no review assignment" message
+    is the correct (healthy) diagnosis.
+    """
+    from coord.state import (  # noqa: PLC0415
+        has_review_claim,
+        release_review_dispatch_claim,
+        review_claim_age_secs,
+    )
+
+    # Narrowing, acknowledged: this only checks the NEWEST `work`-type row
+    # for the issue, whereas `claim_review_dispatch` is keyed on whatever
+    # work-assignment id `dispatch_review` was actually called with. If the
+    # issue ever accumulates more than one `work` row (e.g. a rework/retry
+    # dispatched after the original work assignment that leaked the claim),
+    # a claim held on the *older* id is invisible here because this checks
+    # only the *newest* one. `_recover_review` avoids this by reading the
+    # exact id off the review row's own `review_of_assignment_id` FK — there
+    # is no review row here to read that FK from, so this has to guess.
+    # Probably rare, and the issue's own "worth also considering" `coord
+    # doctor` suggestion is the more complete fix; left as a known gap
+    # rather than iterating over every `work` row here.
+    work_rows = stage_assignments(board, repo_name, issue_number, "work")
+    work_latest = _latest(work_rows)
+    if work_latest is None or not work_latest.assignment_id:
+        return False
+    work_assignment_id = work_latest.assignment_id
+    if not has_review_claim(work_assignment_id):
+        return False
+
+    age = review_claim_age_secs(work_assignment_id)
+    if age is not None and age < _REVIEW_CLAIM_LEAK_GRACE_SECS:
+        # Too fresh to distinguish from an in-flight `dispatch_review` call
+        # that has taken the claim but not yet inserted its review row —
+        # report it, but don't offer to release something that might still
+        # be a live, wanted dispatch.
+        res.findings.append(
+            f"work assignment {work_assignment_id} holds a review-dispatch "
+            f"claim taken {age:.1f}s ago with no review row yet — likely an "
+            "in-flight dispatch_review, not a leak; re-run diagnose again "
+            "shortly if this persists"
+        )
+        res.recovered = True
+        return True
+
+    res.findings.append(
+        f"no review assignment exists for #{issue_number}, but work "
+        f"assignment {work_assignment_id} still holds a review-dispatch "
+        "claim (leaked review_claims row, #3383 — the #3206 class one state "
+        "earlier) — every future dispatch_review for this work assignment "
+        "will deny with the misleading #3113 'lost the atomic dispatch-claim "
+        "race' reason until it is released. Re-run with --reset to release it."
+    )
+    res.recovered = False
+    res.needs_reset = True
+
+    if reset:
+        if dry_run:
+            res.findings.append(
+                "(dry-run) would release the leaked review-dispatch claim"
+            )
+            return True
+        release_review_dispatch_claim(work_assignment_id)
+        if has_review_claim(work_assignment_id):
+            res.findings.append(
+                f"release requested for {work_assignment_id}'s "
+                "review-dispatch claim, but it is still present on re-read "
+                "— the release did NOT persist"
+            )
+        else:
+            res.actions_taken.append(
+                "released leaked review-dispatch claim for work assignment "
+                f"{work_assignment_id} — dispatch_review is now re-dispatchable"
+            )
+            res.reset_performed = True
+            res.recovered = True
+            res.branch_preserved = True
+            # Matches `_do_reset`'s (#3206) convention: a successful release
+            # must clear the `needs_reset=True` set a few lines above, or
+            # `to_json_dict()` — documented as read by the TUI without
+            # scraping human-readable lines — carries the internally
+            # contradictory `recovered=true needs_reset=true
+            # reset_performed=true` even though the plain-text CLI's "still
+            # wedged" warning happens to be gated on `not reset` and so never
+            # shows it.
+            res.needs_reset = False
+    return True
+
+
 def _recover_review(
     board, config, latest, state, res: DiagnoseResult, *, dry_run: bool
 ) -> None:

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/coord/state.py

@@ -2388,6 +2388,36 @@ def has_review_claim(of_assignment_id: str) -> bool:
     return row is not None
 
 
+def review_claim_age_secs(of_assignment_id: str) -> float | None:
+    """Seconds since *of_assignment_id*'s ``review_claims`` row was taken, or
+    ``None`` when no claim is held (#3383).
+
+    Sibling read to :func:`has_review_claim`, used by ``coord diagnose
+    --stage review`` to gate a claim release on age: a claim taken
+    microseconds ago by an in-flight :func:`claim_review_dispatch` call that
+    has not yet inserted its review ``assignments`` row is indistinguishable,
+    from a single read, from a genuinely leaked claim — exactly the
+    false-positive window already documented on the terminal-review-row path
+    in ``diagnose._recover_review`` (#3206). Comparing ``claimed_at`` against
+    a short grace period lets the caller tell "just claimed, dispatch still
+    running" apart from "claimed a long time ago, nothing is coming".
+
+    Same local-DB-only caveat as :func:`has_review_claim` — reads the local
+    connection, not the daemon, so it undercounts on a thin client.
+    """
+    if not of_assignment_id:
+        return None
+    conn = get_connection()
+    row = sql.execute(
+        conn,
+        "SELECT claimed_at FROM review_claims WHERE of_assignment_id=?",
+        (of_assignment_id,),
+    ).fetchone()
+    if row is None or row[0] is None:
+        return None
+    return time.time() - row[0]
+
+
 def release_review_dispatch_claim(of_assignment_id: str) -> None:
     """Release a claim taken by :func:`claim_review_dispatch`.
 

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/tests/test_diagnose.py

@@ -1220,6 +1220,24 @@ def _record(a: Assignment) -> None:
     conn.commit()
 
 
+def _backdate_review_claim(of_assignment_id: str, *, seconds_ago: float) -> None:
+    """Push a `review_claims` row's `claimed_at` into the past — used to put
+    a claim outside #3383's grace period (real claims in these tests are
+    taken via `state.claim_review_dispatch`, which stamps `time.time()`;
+    without this every test claim looks "just taken", which is exactly the
+    fresh-claim case the grace period is meant to protect)."""
+    import time as _time
+
+    from coord.db import get_connection
+
+    conn = get_connection()
+    conn.execute(
+        "UPDATE review_claims SET claimed_at=? WHERE of_assignment_id=?",
+        (_time.time() - seconds_ago, of_assignment_id),
+    )
+    conn.commit()
+
+
 def test_reset_review_real_db_deletes_review_when_latest_is_the_review_row(
     monkeypatch, config, coord_db
 ) -> None:
@@ -1381,6 +1399,141 @@ def test_diagnose_review_healthy_when_no_claim_leaked(
     assert any("healthy" in f for f in res.findings)
 
 
+def test_diagnose_review_detects_leaked_claim_with_no_review_rows(
+    monkeypatch, config, coord_db
+) -> None:
+    """#3383 regression: a `review_claims` row held for a work assignment
+    that has NO review/test-author/mock-author row AT ALL (the state one
+    step earlier than #3206's terminal-row case) used to be unreachable —
+    `stage_assignments(..., "review")` finds nothing, `latest is None`, and
+    `diagnose_stage` took the "no review assignment on the board" early
+    return before ever calling `_recover_review` (which is the only place
+    that cross-checked `review_claims`). This left the claim permanently
+    wedged with `coord diagnose --stage review --reset` reporting the stage
+    healthy AND doing nothing. This reproduces against unfixed `main`: the
+    old early return set `recovered=True` unconditionally with no claim
+    check at all.
+    """
+    from coord import state
+
+    _stub(monkeypatch, session="dead")
+    _record(_assign(
+        aid="w1", typ="work", status="done", review_state="dispatched",
+        dispatched_at=100.0,
+    ))
+    # Simulate the leak: a claim was taken (e.g. by a `dispatch_review` call
+    # whose review row never landed, or was later deleted) and never
+    # released — no review row exists to cross-check it against. Backdated
+    # well past the #3383 grace period so it isn't mistaken for a claim an
+    # in-flight `dispatch_review` just took (see the fresh-claim test below).
+    assert state.claim_review_dispatch("w1") is True
+    _backdate_review_claim("w1", seconds_ago=3600.0)
+
+    board = Board(completed=[_assign(aid="w1", typ="work", status="done", dispatched_at=100.0)])
+
+    res = diagnose.diagnose_stage(board, config, "api", 42, "review", dry_run=True)
+
+    assert res.recovered is False
+    assert res.needs_reset is True
+    assert any("review_claims" in f or "review-dispatch claim" in f for f in res.findings)
+    # A dry-run must not touch the claim.
+    assert state.claim_review_dispatch("w1") is False
+
+
+def test_reset_review_releases_leaked_claim_with_no_review_rows(
+    monkeypatch, config, coord_db
+) -> None:
+    """#3383: `--reset` must actually clear the leaked claim detected above
+    so `coord review <work-assignment-id>` becomes dispatchable again — the
+    whole point of the issue (there was previously NO operator CLI path at
+    all to clear this)."""
+    from coord import state
+
+    _stub(monkeypatch, session="dead")
+    _record(_assign(
+        aid="w1", typ="work", status="done", review_state="dispatched",
+        dispatched_at=100.0,
+    ))
+    assert state.claim_review_dispatch("w1") is True
+    _backdate_review_claim("w1", seconds_ago=3600.0)
+
+    board = Board(completed=[_assign(aid="w1", typ="work", status="done", dispatched_at=100.0)])
+
+    res = diagnose.diagnose_stage(board, config, "api", 42, "review", reset=True)
+
+    assert res.reset_performed is True
+    assert res.recovered is True
+    # The claim is gone — a fresh claim attempt for "w1" must succeed again,
+    # exactly like `dispatch_review` would need for a real re-dispatch.
+    assert state.claim_review_dispatch("w1") is True
+
+
+def test_reset_review_reports_leaked_claim_delete_failure_when_row_survives(
+    monkeypatch, config, coord_db
+) -> None:
+    """#3383 non-blocking review gap: `_leaked_review_claim_without_row`'s
+    own release path has the same "trust the write, not a re-read" risk that
+    `_do_reset`'s analogous #3206 terminal-row path already guards against
+    (see `test_reset_review_reports_delete_failure_when_row_survives`
+    above) — but nothing exercised it for this no-review-row shape. Simulate
+    `release_review_dispatch_claim` reporting success while the claim is
+    still present on re-read (mirrors the coord-tui#49 non-persisting write)
+    and assert the action line is honest about it rather than claiming the
+    claim is gone."""
+    from coord import state
+
+    _stub(monkeypatch, session="dead")
+    _record(_assign(
+        aid="w1", typ="work", status="done", review_state="dispatched",
+        dispatched_at=100.0,
+    ))
+    assert state.claim_review_dispatch("w1") is True
+    _backdate_review_claim("w1", seconds_ago=3600.0)
+
+    # Simulate a release call that reports success but never actually
+    # removes the row — `has_review_claim` still finds it on re-read.
+    monkeypatch.setattr(state, "release_review_dispatch_claim", lambda *a, **k: None)
+
+    board = Board(completed=[_assign(aid="w1", typ="work", status="done", dispatched_at=100.0)])
+
+    res = diagnose.diagnose_stage(board, config, "api", 42, "review", reset=True)
+
+    assert res.reset_performed is False
+    assert res.recovered is False
+    assert res.needs_reset is True
+    assert any(
+        "did NOT persist" in f
+        for f in res.findings
+    )
+    # Still held — the release never actually took.
+    assert state.claim_review_dispatch("w1") is False
+
+
+def test_diagnose_review_fresh_claim_without_row_not_treated_as_leaked(
+    monkeypatch, config, coord_db
+) -> None:
+    """Sibling of the two tests above: a claim taken only moments ago, with
+    no review row yet, is indistinguishable from an in-flight
+    `dispatch_review` call that has claimed but not yet inserted its review
+    row — the same false-positive window `_recover_review` already
+    documents for the terminal-row case (#3206), one state earlier. Must be
+    reported but NOT offered for release while this fresh."""
+    from coord import state
+
+    _stub(monkeypatch, session="dead")
+    _record(_assign(aid="w1", typ="work", status="done", dispatched_at=100.0))
+    assert state.claim_review_dispatch("w1") is True  # claimed "just now"
+
+    board = Board(completed=[_assign(aid="w1", typ="work", status="done", dispatched_at=100.0)])
+
+    res = diagnose.diagnose_stage(board, config, "api", 42, "review", dry_run=True)
+
+    assert res.needs_reset is False
+    assert any("in-flight dispatch_review" in f for f in res.findings)
+    # Untouched — still held.
+    assert state.claim_review_dispatch("w1") is False
+
+
 def test_reset_review_reports_delete_failure_when_row_survives(
     monkeypatch, config, coord_db
 ) -> None:

{code_coordinator-0.5.490 → code_coordinator-0.5.491}/tests/test_state.py

@@ -4645,6 +4645,46 @@ class TestHasReviewClaim:
         assert state.has_review_claim("") is False
 
 
+class TestReviewClaimAgeSecs:
+    """`review_claim_age_secs` (#3383): sibling read to `has_review_claim`
+    used by `coord diagnose --stage review` to gate a claim release on age
+    — a claim taken microseconds ago by an in-flight `claim_review_dispatch`
+    call that hasn't inserted its review row yet must not be released as if
+    it were a leak (the same false-positive window #3206 documents for the
+    terminal-row case)."""
+
+    def test_small_positive_age_while_freshly_claimed(self, coord_db) -> None:
+        assert state.claim_review_dispatch("w1") is True
+        age = state.review_claim_age_secs("w1")
+        assert age is not None
+        assert 0.0 <= age < 5.0
+
+    def test_none_when_never_claimed(self, coord_db) -> None:
+        assert state.review_claim_age_secs("never-claimed") is None
+
+    def test_none_after_release(self, coord_db) -> None:
+        assert state.claim_review_dispatch("w1") is True
+        state.release_review_dispatch_claim("w1")
+        assert state.review_claim_age_secs("w1") is None
+
+    def test_none_for_empty_id(self, coord_db) -> None:
+        assert state.review_claim_age_secs("") is None
+
+    def test_reflects_a_backdated_claim(self, coord_db) -> None:
+        from coord.db import get_connection
+
+        assert state.claim_review_dispatch("w1") is True
+        conn = get_connection()
+        conn.execute(
+            "UPDATE review_claims SET claimed_at=? WHERE of_assignment_id=?",
+            (time.time() - 3600.0, "w1"),
+        )
+        conn.commit()
+        age = state.review_claim_age_secs("w1")
+        assert age is not None
+        assert age >= 3599.0
+
+
 class TestMarkNotifiedReleasesLeakedReviewClaim:
     """#3206 root-cause regression: a review assignment reaped by
     `AgentServer._reap`'s SIGKILL max-wait ceiling writes its terminal