code-coordinator 0.5.654__tar.gz → 0.5.655__tar.gz

{code_coordinator-0.5.654 → code_coordinator-0.5.655}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.654
+Version: 0.5.655
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.654 → code_coordinator-0.5.655}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.654
+Version: 0.5.655
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.654 → code_coordinator-0.5.655}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.654",
+  "tag": "0.5.655",
   "distance": 0,
-  "node": "gfb5fe0770972418d5fdcaf022adb307f60f81c3c",
+  "node": "g8f314f82888f9fbb19e3afbb2d2715b02cc648a0",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-10-19"

{code_coordinator-0.5.654 → code_coordinator-0.5.655}/coord/agent.py

@@ -5886,6 +5886,27 @@ def _workflow_leg_system_prompt_suffix() -> str:
     hands a dispatched Review leg (see the ``elif spec.type == "review"``
     branch above) — never a second, hand-copied description of what a
     reviewer checks (#2096: one question, one answer).
+
+    #3730 adds three more guardrails on top of #3681's Workflow/Task
+    un-denial, each a system-prompt-level mitigation rather than a new CLI
+    flag (no documented, stable way to express any of the three as
+    ``--settings``/``--allowedTools`` was found):
+
+    * isolation — the leg already runs inside its own dedicated worktree;
+      a workflow subagent that additionally requests ``isolation:
+      "worktree"``/``"remote"`` would nest a second worktree inside it,
+      risking collision with the leg's own base-checkout guard and the
+      graphify symlink. Subagents must stay in the leg's own working
+      directory instead.
+    * fail-fast — a Workflow invocation that still gets denied (e.g. the
+      confirmation dialog auto-denies despite the --allowedTools grant)
+      must not be retried; retrying was observed to thrash into the
+      fleet's rapid-refill cost breaker. The leg must fall back to
+      performing the assignment directly, as a normal non-workflow leg
+      would.
+    * size — a small, bounded workflow (few agents/phases) keeps cost and
+      token usage predictable; ``WORK_AUTOCOMPACT_TOKENS`` is still the
+      hard backstop regardless.
     """
     from coord.review import REVIEWER_SYSTEM_PROMPT  # noqa: PLC0415
 
@@ -5906,7 +5927,24 @@ def _workflow_leg_system_prompt_suffix() -> str:
         "exactly the following as that review step's system prompt/lens "
         "(this is the identical text coord's own dispatched Review leg "
         "receives for this repo, byte for byte):\n\n"
-        "-----\n" + REVIEWER_SYSTEM_PROMPT + "\n-----\n"
+        "-----\n" + REVIEWER_SYSTEM_PROMPT + "\n-----\n\n"
+        "Three more rules for this workflow specifically (#3730):\n\n"
+        "1. Isolation: this leg already runs inside its own dedicated git "
+        "worktree. Do NOT give any agent in your workflow script "
+        "`isolation: \"worktree\"` or `isolation: \"remote\"` — that would "
+        "nest a second worktree inside the one you're already in, which is "
+        "unsupported here and risks colliding with this leg's own "
+        "base-checkout guard. Leave isolation unset (or `\"none\"`) so every "
+        "subagent shares this leg's own working directory.\n"
+        "2. Fail fast: if starting the workflow (or the Workflow tool call "
+        "itself) is ever denied, do NOT retry it — retrying has thrashed "
+        "other legs into the fleet's cost circuit breaker. Immediately fall "
+        "back to completing this assignment directly yourself, exactly as a "
+        "non-workflow leg would, and say so in your final message.\n"
+        "3. Keep it small: use the fewest agents/phases that can do the "
+        "job (e.g. implement, review, fix — not a long chain). This leg "
+        "still has its own hard context/cost caps regardless, but a small "
+        "workflow keeps you well inside them.\n"
     )
 
 
@@ -6272,6 +6310,16 @@ def default_worker_command(spec: AssignmentSpec, *, binary: str = DEFAULT_WORKER
         # the dedicated `elif spec.type == "smoke"` branch above, which
         # deliberately withholds it instead.
         allowed_tools = "Read,Edit,Write,Bash,Monitor"
+        # #3730: being absent from --disallowedTools (worker_disallowed_tools
+        # above) is not sufficient for Workflow/Task — the Workflow tool's
+        # own confirmation dialog still fires per invocation, and a headless
+        # `-p` leg has no TTY to answer it, so without an explicit
+        # --allowedTools grant it is auto-denied exactly like any other
+        # unconfirmed permission prompt. Granting it here is the same
+        # pre-approval mechanism `Bash` already relies on in this list to
+        # skip its own per-command confirmations.
+        if spec.workflow:
+            allowed_tools += ",Workflow,Task"
         # #3672: force earlier auto-compaction for work-shaped legs — see
         # `WORK_AUTOCOMPACT_TOKENS`'s docstring. These are exactly the legs
         # the cost analysis found running 200-450 turns with zero

{code_coordinator-0.5.654 → code_coordinator-0.5.655}/coord/providers/claude.py

@@ -263,6 +263,14 @@ class ClaudeProvider(Provider):
                 # backgrounded long-running command. #2301: this grant is for
                 # work-shaped legs only — smoke has its own branch above.
                 _at = "Read,Edit,Write,Bash,Monitor"
+                # #3730: keep in sync with default_worker_command's identical
+                # `if spec.workflow:` branch — being absent from
+                # --disallowedTools is not enough to actually use Workflow/
+                # Task; its per-invocation confirmation dialog auto-denies
+                # with no TTY unless pre-approved via --allowedTools, the
+                # same mechanism `Bash` already relies on above.
+                if spec.workflow:
+                    _at += ",Workflow,Task"
                 # #3672: keep in sync with default_worker_command's identical
                 # branch — force earlier auto-compaction for work-shaped legs.
                 # #3697: fix/conflict-fix legs carry the review findings as

{code_coordinator-0.5.654 → code_coordinator-0.5.655}/tests/test_agent_reap.py

@@ -29,6 +29,7 @@ from coord.agent import (
     _workflow_leg_system_prompt_suffix,
     _PTY_RESULT_LINE_MARKER,
     _RESULT_LINE_MARKER,
+    default_worker_command,
     format_host_sleep_reason,
     format_runtime_ceiling_reason,
     is_host_sleep_reason,
@@ -561,6 +562,29 @@ def test_disallowed_tools_un_disallows_workflow_and_task_only_for_opted_in_leg()
         assert pattern in not_opted_in
 
 
+# ── workflow opt-in: --allowedTools (#3730) ──────────────────────────────────
+
+
+def test_allowed_tools_grants_workflow_and_task_only_for_opted_in_leg() -> None:
+    """#3730 item 2: merely absent from --disallowedTools is not enough to
+    actually use Workflow — its own per-invocation confirmation dialog
+    auto-denies with no TTY unless pre-approved via --allowedTools (the same
+    mechanism `Bash` already relies on in this list). A workflow leg's argv
+    must explicitly grant `Workflow`/`Task`; a non-opted-in leg must not."""
+    opted_in = default_worker_command(_make_spec(workflow=True))
+    not_opted_in = default_worker_command(_make_spec(workflow=False))
+
+    opted_in_allowed = opted_in[opted_in.index("--allowedTools") + 1].split(",")
+    not_opted_in_allowed = not_opted_in[
+        not_opted_in.index("--allowedTools") + 1
+    ].split(",")
+
+    assert "Workflow" in opted_in_allowed
+    assert "Task" in opted_in_allowed
+    assert "Workflow" not in not_opted_in_allowed
+    assert "Task" not in not_opted_in_allowed
+
+
 # ── in-workflow review system prompt (#3681 item 5) ──────────────────────────
 
 def test_workflow_system_prompt_suffix_embeds_the_real_reviewer_prompt_verbatim() -> None:
@@ -579,6 +603,32 @@ def test_workflow_system_prompt_suffix_embeds_the_real_reviewer_prompt_verbatim(
     assert suffix[start : start + len(REVIEWER_SYSTEM_PROMPT)] == REVIEWER_SYSTEM_PROMPT
 
 
+def test_workflow_system_prompt_suffix_tells_worker_not_to_nest_worktree_isolation() -> None:
+    """#3730 item 3: the leg already runs inside its own dedicated worktree;
+    a workflow subagent must not additionally request `isolation:
+    "worktree"`/`"remote"`, which would nest a second worktree inside it."""
+    suffix = _workflow_leg_system_prompt_suffix()
+    assert 'isolation: "worktree"' in suffix
+    assert 'isolation: "remote"' in suffix
+
+
+def test_workflow_system_prompt_suffix_tells_worker_to_fail_fast_on_denial() -> None:
+    """#3730 item 4: a denied Workflow invocation must not be retried — a
+    real leg thrashed into the fleet's rapid-refill cost breaker doing
+    exactly that — the worker must fall back to a direct, non-workflow
+    completion of the assignment instead."""
+    suffix = _workflow_leg_system_prompt_suffix()
+    assert "do NOT retry it" in suffix
+    assert "fall back to completing this assignment directly" in suffix
+
+
+def test_workflow_system_prompt_suffix_tells_worker_to_keep_workflow_small() -> None:
+    """#3730 item 5: guide the worker toward a small/bounded workflow rather
+    than shipping an unverified workflow-size settings flag."""
+    suffix = _workflow_leg_system_prompt_suffix()
+    assert "Keep it small" in suffix
+
+
 # ── _log_has_output ──────────────────────────────────────────────────────────
 
 def test_log_has_output_false_for_header_only(tmp_path: Path) -> None: