code-coordinator 0.5.568__tar.gz → 0.5.569__tar.gz

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.568
+Version: 0.5.569
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.568
+Version: 0.5.569
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/code_coordinator.egg-info/SOURCES.txt

@@ -812,6 +812,7 @@ tests/test_repo_edit_2220.py
 tests/test_repo_graph_fleet_2237.py
 tests/test_repo_max_parallel_3423.py
 tests/test_repo_onboard_2220.py
+tests/test_report_public_export.py
 tests/test_report_result_push.py
 tests/test_reports.py
 tests/test_restart_cmd.py

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/code_coordinator.egg-info/scm_file_list.json

@@ -839,6 +839,7 @@
     "tests/test_repo_graph_fleet_2237.py",
     "tests/test_repo_max_parallel_3423.py",
     "tests/test_repo_onboard_2220.py",
+    "tests/test_report_public_export.py",
     "tests/test_report_result_push.py",
     "tests/test_reports.py",
     "tests/test_restart_cmd.py",

code_coordinator-0.5.569/code_coordinator.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.5.569",
+  "distance": 0,
+  "node": "g5c759420fc3645ac55648f65ba5bfddf7ceae8f2",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-03"
+}

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/coord/commands/report.py

@@ -26,10 +26,34 @@ why ``started_at`` exports as an epoch (or a real Excel datetime cell for
 extra rather than a crash.  ``--json`` survives as a hidden alias for
 ``--format json``.
 
+``coord report export <id> --public`` (#3474) runs a report the same way
+``report run`` does (``coord.state.run_report`` — daemon when
+``board_service`` is set, local registry otherwise) and then redacts it for
+an audience OUTSIDE the fleet, via :func:`coord.reports.redact_report_for_public`:
+every repo not named in ``coordinator.yml``'s ``reporting.public.allowlist_
+repos`` is dropped and folded into one aggregate ``"private repo"`` row —
+no name, no issue number, no title. The result is written as a
+self-contained ``.public.html`` (data inlined, chart on a pinned ECharts
+CDN) plus the same redacted ``.public.csv`` into ``--out`` (default: the
+current directory). A report whose dollar figure has no stated cost basis
+left standing after redaction is refused outright (``PublicExportError``) —
+"a public number with no stated basis is not produced" (#3474). The
+redaction itself runs **client-side**, over the already-fetched result —
+same precedent as every ``--format`` above, which also serialises
+client-side over ``run_report``'s own return value — so a thin client never
+needs a second, DB-backed export path. The allowlist that drives it,
+though, is resolved via :func:`_resolve_public_allowlist` — the same
+thin-client-first ``board_service``/``fetch_remote_config`` seam
+``coord.commands._common._load_config`` uses for every other config read
+(#1080/#947/#2824), never a raw local ``coordinator.yml`` load: the
+allowlist is the one input here that is explicitly security-sensitive, so
+a thin client with a stale local copy must never under-redact against it.
+
 Exit codes: ``2`` for a bad request (unknown report, unknown parameter, bad
-value, or ``--format xlsx`` without the extra installed — the message names
-what was allowed/needed), ``1`` for a read/transport failure.  Never a
-traceback for either.
+value, ``--format xlsx`` without the extra installed, or a public export
+refused over an unstated cost basis — the message names what was
+allowed/needed), ``1`` for a read/transport failure.  Never a traceback for
+either.
 """
 
 from __future__ import annotations
@@ -43,6 +67,36 @@ import click
 
 from coord.commands._common import _CONFIG_OPTION
 
+
+def _resolve_public_allowlist(config_path) -> frozenset[str]:  # noqa: ANN001
+    """The thin-client-safe ``reporting.public.allowlist_repos`` for
+    ``coord report export --public`` (#3474 review).
+
+    Mirrors :func:`coord.commands._common._load_config`'s "thin client
+    first" resolution — a machine with ``board_service``/``client.toml``
+    configured fetches the DAEMON's live config (``fetch_remote_config``)
+    rather than trusting whatever ``coordinator.yml`` happens to sit on
+    local disk, the exact bug class #1080/#947/#2824 already paid for
+    (a stale/stray local file silently diverging from the daemon's real
+    config with no signal anything is wrong). ``_load_config`` itself
+    ``sys.exit(2)``s on a bad config, which is right for every OTHER
+    command but wrong here: the allowlist is the one input this feature
+    treats as security-sensitive, so a failure to resolve it (daemon
+    unreachable, local file malformed/absent) must fail SOFT — the caller
+    catches whatever this raises and falls back to the empty allowlist,
+    i.e. "redact everything" (same posture as the daemon-side sibling,
+    :func:`coord.reports.load_public_allowlist`).
+    """
+    from coord.client import fetch_remote_config, resolve_board_service  # noqa: PLC0415
+    from coord.config import load as load_config  # noqa: PLC0415
+
+    path = config_path
+    svc = resolve_board_service()
+    if svc is not None:
+        path = fetch_remote_config(svc)
+    return frozenset(load_config(path).reporting.public.allowlist_repos)
+
+
 # Row keys whose values are epoch timestamps — rendered as a relative age in
 # the human table (absolute in --json, which is the machine contract).
 # Fallback only: used when a row column is not covered by the report's
@@ -372,3 +426,120 @@ def report_run(
         click.echo(f"notes ({len(notes)}):")
         for note in notes:
             click.echo(f"  • {note}")
+
+
+@report_group.command(
+    "export",
+    help="Export a report for sharing outside the fleet (#3474; --public is required today).",
+)
+@click.argument("report_id")
+@click.option(
+    "--param", "raw_params", multiple=True, metavar="KEY=VALUE",
+    help="Report parameter, repeatable (e.g. --param since=13h).",
+)
+@click.option(
+    "--public", is_flag=True, default=False,
+    help=(
+        "Redact every repo not in coordinator.yml's "
+        "reporting.public.allowlist_repos before exporting — everything "
+        "else is aggregated into one 'private repo' row with no name, "
+        "issue number or title. The only export mode supported today; "
+        "omitting this flag is a usage error rather than silently "
+        "producing an un-redacted export."
+    ),
+)
+@click.option(
+    "--out", "out_dir", type=click.Path(path_type=Path), default=Path("."),
+    show_default=True,
+    help="Directory to write the exported <report>.public.html/.csv pair into.",
+)
+@_CONFIG_OPTION
+def report_export(
+    report_id: str,
+    raw_params: tuple[str, ...],
+    public: bool,
+    out_dir: Path,
+    config_path: Path,
+) -> None:
+    if not public:
+        click.echo(
+            "error: `coord report export` needs --public today — a "
+            "self-contained, redacted HTML+CSV pair for sharing outside the "
+            "fleet (#3474). There is no un-redacted export mode.",
+            err=True,
+        )
+        raise SystemExit(2)
+
+    from coord.reports import (  # noqa: PLC0415
+        REPORTS,
+        PublicExportError,
+        assert_public_export_allowed,
+        public_csv_filename,
+        public_html_filename,
+        redact_report_for_public,
+        result_to_csv,
+        result_to_public_html,
+    )
+    from coord.state import run_report  # noqa: PLC0415
+
+    params: dict[str, str] = {}
+    for raw in raw_params:
+        if "=" not in raw:
+            click.echo(
+                f"error: --param expects KEY=VALUE, got {raw!r} "
+                "(e.g. --param since=13h)",
+                err=True,
+            )
+            raise SystemExit(2)
+        key, _, value = raw.partition("=")
+        params[key.strip()] = value
+
+    try:
+        result = run_report(report_id, params)
+    except ValueError as e:
+        # ReportError (local) or the daemon's 400/404 body, re-raised as a
+        # ValueError by coord.client.fetch_report — mirrors `report run`.
+        click.echo(f"error: {e}", err=True)
+        raise SystemExit(2) from e
+    except Exception as e:  # noqa: BLE001 — transport/DB failure
+        click.echo(f"error: report run failed: {e}", err=True)
+        raise SystemExit(1) from e
+
+    # #3474: redaction runs HERE, client-side, over the already-fetched
+    # `result` — same precedent `--format csv|xlsx|...` above already sets
+    # (those also serialise client-side over `run_report`'s own return
+    # value), so a thin client never needs a second, DB-backed export path.
+    # The allowlist itself goes through `_resolve_public_allowlist` — the
+    # SAME thin-client-first resolution every other config read uses
+    # (#1080/#947/#2824), not a raw local-file load — so a thin client whose
+    # daemon has since tightened `reporting.public.allowlist_repos` can
+    # never under-redact from a stale local copy. Any failure to resolve it
+    # (daemon unreachable, local file malformed/absent — reports need no
+    # config at all for `list`/`run`) is NOT a usage error here: it falls
+    # back to the empty allowlist, i.e. redact everything, the only safe
+    # default for an export leaving the fleet.
+    try:
+        allowed = _resolve_public_allowlist(config_path)
+    except Exception as e:  # noqa: BLE001 — fail CLOSED: unreadable/unreachable config => redact everything
+        click.echo(
+            f"warning: could not resolve reporting.public.allowlist_repos "
+            f"({e}) — redacting every repo.",
+            err=True,
+        )
+        allowed = frozenset()
+
+    report_def = REPORTS.get(report_id)
+    redacted = redact_report_for_public(result, allowed_repos=allowed, report=report_def)
+    try:
+        assert_public_export_allowed(redacted, report_id)
+    except PublicExportError as e:
+        click.echo(f"error: {e}", err=True)
+        raise SystemExit(2) from e
+
+    out_dir.mkdir(parents=True, exist_ok=True)
+    html_path = out_dir / public_html_filename(redacted)
+    csv_path = out_dir / public_csv_filename(redacted)
+    html_path.write_text(result_to_public_html(redacted), encoding="utf-8")
+    csv_path.write_text(result_to_csv(redacted), encoding="utf-8")
+    click.echo(f"wrote {html_path}")
+    click.echo(f"wrote {csv_path}")

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/coord/config.py

@@ -1956,6 +1956,29 @@ class PricingConfig:
 COST_BASIS_CHOICES = ("api_equivalent", "billed")
 
 
+@dataclass
+class PublicReportingConfig:
+    """``reporting.public:`` block (#3474) — the redaction policy for a
+    report export meant to leave the fleet (``coord report export
+    --public``, the dashboard's ``/reports`` "Share" button).
+
+    A public export is for an audience that must never see a private repo's
+    name, issue titles or numbers — someone evaluating the tool, or
+    marketing material quoting "cost per merged issue". ``allowlist_repos``
+    is the only field: the coord-local repo names (as declared under
+    ``coordinator.yml``'s ``repos:``) that MAY be named verbatim in a public
+    export. Every row about any other repo is redacted — aggregated into a
+    single ``"private repo"`` row with no issue number, no title, and no
+    repo name of its own (:func:`coord.reports.redact_report_for_public`).
+
+    Default is empty, i.e. **redact everything** — the safe default for a
+    config that predates this block, or one that simply never opted a repo
+    in.
+    """
+
+    allowlist_repos: tuple[str, ...] = ()
+
+
 @dataclass
 class ReportingConfig:
     """``reporting:`` block (#3471) — what a cost-bearing report's dollar
@@ -1980,9 +2003,13 @@ class ReportingConfig:
     and the figure is real money charged — set it only when that is
     actually true; this config does no verification of its own; it only
     labels, on every report, what the operator asserts here.
+
+    ``public`` (#3474) is the redaction policy for a report export that
+    leaves the fleet entirely — see :class:`PublicReportingConfig`.
     """
 
     cost_basis: str = "api_equivalent"
+    public: PublicReportingConfig = field(default_factory=PublicReportingConfig)
 
 
 @dataclass
@@ -5088,6 +5115,22 @@ def _parse_reporting(raw: Any) -> ReportingConfig:
                 + ", ".join(COST_BASIS_CHOICES)
             )
         cfg.cost_basis = value
+    if "public" in raw:
+        public_raw = raw["public"]
+        if public_raw is None:
+            public_raw = {}
+        if not isinstance(public_raw, dict):
+            raise ConfigError("'reporting.public' must be a mapping")
+        allowlist = public_raw.get("allowlist_repos", [])
+        if allowlist is None:
+            allowlist = []
+        if not isinstance(allowlist, list) or not all(
+            isinstance(x, str) for x in allowlist
+        ):
+            raise ConfigError(
+                "reporting.public.allowlist_repos must be a list of repo names"
+            )
+        cfg.public = PublicReportingConfig(allowlist_repos=tuple(allowlist))
     return cfg
 
 

{code_coordinator-0.5.568 → code_coordinator-0.5.569}/coord/dashboard/server.py

@@ -1820,6 +1820,59 @@ def openapi_spec() -> dict:
                 },
             }
         },
+        "/api/report/{report_id}/public": {
+            "get": {
+                "summary": (
+                    "#3474: a redacted, self-contained export of a report "
+                    "for sharing OUTSIDE the fleet. Every repo not in "
+                    "coordinator.yml's reporting.public.allowlist_repos is "
+                    "aggregated into one 'private repo' row — no name, "
+                    "issue number or title. Refused with 400 when the "
+                    "report carries a cost figure but no cost-basis/"
+                    "coverage note survives redaction."
+                ),
+                "parameters": [
+                    _dashboard_path_param("report_id", "report id from the catalogue"),
+                    {
+                        "name": "format",
+                        "in": "query",
+                        "required": False,
+                        "schema": {"type": "string", "enum": ["html", "csv"]},
+                        "description": (
+                            "Absent/`html` returns a self-contained static "
+                            "page (data inlined; a declared chart renders "
+                            "via a pinned ECharts CDN script). `csv` "
+                            "returns the identical redacted rows as "
+                            "text/csv. Both ship a Content-Disposition "
+                            "filename."
+                        ),
+                    },
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "content": {
+                            "text/html": {
+                                "schema": {"type": "string"},
+                                "description": "`?format=html` (default).",
+                            },
+                            "text/csv": {
+                                "schema": {"type": "string"},
+                                "description": "`?format=csv`.",
+                            },
+                        },
+                    },
+                    "400": {
+                        "description": (
+                            "Unknown parameter / bad parameter value / "
+                            "unknown format / an unstated cost basis "
+                            "refused the export"
+                        )
+                    },
+                    "404": {"description": "Unknown report id"},
+                },
+            }
+        },
         "/api/approve": {
             "post": {
                 "summary": "Dispatch one or more proposals by id",
@@ -3721,6 +3774,82 @@ def build_app(
             result.to_dict() if isinstance(result, _reports.ReportResult) else result
         )
 
+    async def api_report_export_public(request: Request) -> Response:
+        """GET /api/report/{report_id}/public?format=html|csv&... — a
+        redacted, self-contained export for sharing OUTSIDE the fleet
+        (#3474): the dashboard's ``/reports`` "Share" affordance and
+        ``coord report export --public`` both end up describing the exact
+        same redaction, since both go through
+        ``coord.reports.redact_report_for_public`` — never a second,
+        independently-drifting idea of what "public" means (#2096).
+
+        ``format`` defaults to ``html`` (the self-contained page: data
+        inlined, chart — if any — on a pinned ECharts CDN); ``csv`` returns
+        the identical redacted rows as a download. Every repo not in the
+        loaded ``coordinator.yml``'s ``reporting.public.allowlist_repos``
+        is aggregated into one ``"private repo"`` row with no name, issue
+        number or title. A cost-bearing report whose basis/coverage note
+        did not survive redaction is refused with 400 — "a public number
+        with no stated basis is not produced" (#3474).
+        """
+        from starlette.concurrency import run_in_threadpool  # noqa: PLC0415
+
+        from coord import reports as _reports  # noqa: PLC0415
+
+        report_id = request.path_params["report_id"]
+        params = dict(request.query_params)
+        fmt = (params.pop("format", "") or "html").strip().lower()
+        if fmt not in ("html", "csv"):
+            return JSONResponse(
+                {"error": f"unknown public export format {fmt!r} — allowed values: html, csv"},
+                status_code=400,
+            )
+        try:
+            if _fixture is not None:
+                raw_result = _fixture.report_result(report_id, params)
+            else:
+                raw_result = await run_in_threadpool(_reports.run_report, report_id, params)
+        except _reports.UnknownReportError as e:
+            return JSONResponse({"error": str(e)}, status_code=404)
+        except _reports.ReportError as e:
+            return JSONResponse({"error": str(e)}, status_code=400)
+        except Exception as e:  # noqa: BLE001 — surface a clean 503 rather than a stack trace
+            return JSONResponse(
+                {"error": "report run failed", "detail": str(e)}, status_code=503
+            )
+
+        report_def = _reports.REPORTS.get(report_id)
+        # The app's own bound `config` (fixture or live — see `build_app`'s
+        # own docstring), never a second, independent `coordinator.yml`
+        # read off disk: fixture mode's "every read is answered from the
+        # fixture" promise has to hold for the redaction policy too, not
+        # just the report data being redacted.
+        allowed = frozenset(config.reporting.public.allowlist_repos)
+        redacted = await run_in_threadpool(
+            _reports.redact_report_for_public,
+            raw_result,
+            allowed_repos=allowed,
+            report=report_def,
+        )
+        try:
+            _reports.assert_public_export_allowed(redacted, report_id)
+        except _reports.PublicExportError as e:
+            return JSONResponse({"error": str(e)}, status_code=400)
+
+        if fmt == "csv":
+            body = await run_in_threadpool(_reports.result_to_csv, redacted)
+            filename = _reports.public_csv_filename(redacted)
+            media_type = "text/csv; charset=utf-8"
+        else:
+            body = await run_in_threadpool(_reports.result_to_public_html, redacted)
+            filename = _reports.public_html_filename(redacted)
+            media_type = "text/html; charset=utf-8"
+        return Response(
+            body,
+            media_type=media_type,
+            headers={"Content-Disposition": f'attachment; filename="{filename}"'},
+        )
+
     async def api_approve(request: Request) -> JSONResponse:
         from coord.dispatch import (
             apply_liveness_reroute,
@@ -5666,6 +5795,11 @@ def build_app(
         Route("/api/drive-queue/action", api_drive_queue_action, methods=["POST"]),
         Route("/api/report", api_report_catalogue, methods=["GET"]),
         Route("/api/report/{report_id}", api_report_run, methods=["GET"]),
+        Route(
+            "/api/report/{report_id}/public",
+            api_report_export_public,
+            methods=["GET"],
+        ),
         Route("/api/approve", api_approve, methods=["POST"]),
         Route("/api/reject", api_reject, methods=["POST"]),
         Route("/api/diff/{id}", api_diff, methods=["GET"]),