windcode 0.1.2__tar.gz → 0.1.3__tar.gz

{windcode-0.1.2 → windcode-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: windcode
-Version: 0.1.2
+Version: 0.1.3
 Summary: A safe, extensible terminal coding agent
 Project-URL: Homepage, https://github.com/tingfeng347/windcode
 Project-URL: Repository, https://github.com/tingfeng347/windcode

{windcode-0.1.2 → windcode-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "windcode"
-version = "0.1.2"
+version = "0.1.3"
 description = "A safe, extensible terminal coding agent"
 readme = "README.md"
 requires-python = ">=3.12"

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/__init__.py

@@ -3,4 +3,4 @@
 from windcode.sdk import Windcode
 
 __all__ = ["Windcode"]
-__version__ = "0.1.2"
+__version__ = "0.1.3"

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/domain/subagents.py

@@ -48,7 +48,9 @@ TERMINAL_SUBAGENT_STATUSES = frozenset(
 )
 
 _ALLOWED_TRANSITIONS: dict[SubagentStatus, frozenset[SubagentStatus]] = {
-    SubagentStatus.QUEUED: frozenset({SubagentStatus.RUNNING, SubagentStatus.CANCELLED}),
+    SubagentStatus.QUEUED: frozenset(
+        {SubagentStatus.RUNNING, SubagentStatus.FAILED, SubagentStatus.CANCELLED}
+    ),
     SubagentStatus.RUNNING: frozenset(
         {
             SubagentStatus.BLOCKED,

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/extensions/mcp/tools.py

@@ -439,13 +439,18 @@ class SearchMcpToolsTool:
         selected_tools: set[str],
     ) -> None:
         self.service = service
-        self.registry = registry
+        self.registries = [registry]
         self.selected_tools = selected_tools
 
+    def add_registry(self, registry: ToolRegistry) -> None:
+        if all(item is not registry for item in self.registries):
+            self.registries.append(registry)
+
     async def _select(self, stable_id: str) -> tuple[McpToolAdapter, bool]:
         already_selected = stable_id in self.selected_tools
         adapter = await self.service.adapter(stable_id)
-        self.registry.register(adapter, replace=True)
+        for registry in self.registries:
+            registry.register(adapter, replace=True)
         self.selected_tools.add(stable_id)
         return adapter, already_selected
 

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/runtime/prompts.py

@@ -77,6 +77,8 @@ def build_system_prompt(
             "\n\n## 委派策略: explicit\n"
             "仅当用户明确要求委派、并行或使用子智能体时, 才可调用子智能体工具。"
             "创建后调用 wait_subagents 一次等待结果; 禁止循环调用 list_subagents。"
+            "写任务使用基于当前 HEAD 的独立 Git Worktree; 不得为创建子智能体而暂存、提交、"
+            "还原、移动或删除父工作区的未提交修改。"
             "子智能体可按运行网络策略和权限审批访问外部网络。"
         )
     elif delegation_mode is DelegationMode.PROACTIVE:
@@ -84,6 +86,8 @@ def build_system_prompt(
             "\n\n## 委派策略: proactive\n"
             "可在任务确实独立且适合并行时主动委派; 必须保持任务有界、状态可见并统一汇总。"
             "创建后调用 wait_subagents 一次等待结果; 禁止循环调用 list_subagents。"
+            "写任务使用基于当前 HEAD 的独立 Git Worktree; 不得为创建子智能体而暂存、提交、"
+            "还原、移动或删除父工作区的未提交修改。"
             "子智能体可按运行网络策略和权限审批访问外部网络。"
         )
     if memory_enabled:

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/runtime/subagents/coordinator.py

@@ -46,7 +46,7 @@ from windcode.runtime.subagents.approvals import ApprovalRouter
 from windcode.runtime.subagents.budgets import AggregateBudget
 from windcode.runtime.subagents.factory import ChildRuntime, ChildRuntimeFactory
 from windcode.runtime.subagents.verification import VerificationRunner
-from windcode.worktrees import GitBaseline, WorktreeLease, WorktreeManager
+from windcode.worktrees import GitBaseline, WorktreeError, WorktreeLease, WorktreeManager
 
 
 class SubagentCoordinatorError(RuntimeError):
@@ -98,6 +98,7 @@ class SubagentCoordinator:
         self._runtimes: dict[str, ChildRuntime] = {}
         self._tasks: dict[str, asyncio.Task[None]] = {}
         self._completion: dict[str, asyncio.Future[SubagentResult]] = {}
+        self._startup: dict[str, asyncio.Future[None]] = {}
         self._usage: dict[str, Usage] = {}
         self._queue: deque[str] = deque()
         self._active = 0
@@ -168,7 +169,10 @@ class SubagentCoordinator:
             baseline: GitBaseline | None = None
             if any(spec.kind is SubagentTaskKind.WRITE for spec in specs):
                 try:
-                    baseline = await self.worktrees.validate_parent(self.workspace)
+                    baseline = await self.worktrees.validate_parent(
+                        self.workspace,
+                        require_clean=False,
+                    )
                 except Exception as exc:
                     raise SubagentCoordinatorError("write_workspace_blocked", str(exc)) from exc
 
@@ -190,12 +194,22 @@ class SubagentCoordinator:
                 )
                 self._records[record.subagent_id] = record
                 self._completion[record.subagent_id] = loop.create_future()
+                self._startup[record.subagent_id] = loop.create_future()
                 self._queue.append(record.subagent_id)
                 await self._persist(record)
                 await self._publish_record_event(record, SubagentQueued)
                 created.append(record)
             self._schedule_locked()
-            return tuple(created)
+            scheduled_ids = tuple(
+                record.subagent_id for record in created if record.subagent_id in self._tasks
+            )
+        # Do not report a successful spawn while every child is merely a queued
+        # record. Yield outside the coordinator lock until each scheduled task has
+        # either published its running state or reached a terminal failure.
+        await asyncio.gather(
+            *(asyncio.shield(self._startup[subagent_id]) for subagent_id in scheduled_ids)
+        )
+        return tuple(self._records[record.subagent_id] for record in created)
 
     def _schedule_locked(self) -> None:
         while self._queue and self._active < self.config.max_concurrent:
@@ -309,7 +323,10 @@ class SubagentCoordinator:
                     "",
                     record.base_commit,
                 )
-                validated = await self.worktrees.validate_parent(self.workspace)
+                validated = await self.worktrees.validate_parent(
+                    self.workspace,
+                    require_clean=False,
+                )
                 baseline = replace(
                     baseline, repository=validated.repository, branch=validated.branch
                 )
@@ -339,6 +356,9 @@ class SubagentCoordinator:
                 summary="subagent started",
                 workspace=str(workspace),
             )
+            startup = self._startup[subagent_id]
+            if not startup.done():
+                startup.set_result(None)
             forwarding = asyncio.create_task(self._forward_child_events(runtime))
             try:
                 run_result = await runtime.loop.run(runtime.prompt, runtime.workspace)
@@ -429,6 +449,9 @@ class SubagentCoordinator:
             if record.status in {SubagentStatus.QUEUED, SubagentStatus.RUNNING}:
                 await self._finish_failed(record, type(exc).__name__, str(exc))
         finally:
+            startup = self._startup.get(subagent_id)
+            if startup is not None and not startup.done():
+                startup.set_result(None)
             self._runtimes.pop(subagent_id, None)
             self.approvals.cancel(subagent_id)
             async with self._lock:
@@ -566,7 +589,14 @@ class SubagentCoordinator:
             raise SubagentCoordinatorError(
                 "not_integratable", "subagent must be a completed clean write task"
             )
-        integration = await self.worktrees.integrate(self._leases[subagent_id], self.workspace)
+        try:
+            integration = await self.worktrees.integrate(self._leases[subagent_id], self.workspace)
+        except WorktreeError as exc:
+            raise SubagentCoordinatorError(
+                "integration_workspace_blocked",
+                "subagent work is safely committed in its Worktree, but integration is blocked: "
+                f"{exc}",
+            ) from exc
         if not integration.integrated:
             conflict = await self._transition(record, SubagentStatus.CONFLICT)
             result = replace(

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/runtime/subagents/factory.py

@@ -135,12 +135,19 @@ class ChildRuntime:
 def build_child_prompt(record: SubagentRecord) -> str:
     spec = record.spec
     verification = "\n".join(f"- {item}" for item in spec.verification)
+    delivery = (
+        "This is a read-only task. Return all findings in your final response for the parent "
+        "agent to consume. Do not create, edit, or save a report file, including through shell."
+        if spec.kind is SubagentTaskKind.READ
+        else "Complete file changes in the assigned worktree and commit them before responding."
+    )
     return (
         f"Task: {spec.task_name}\n"
         f"Goal: {spec.goal}\n\n"
         f"Context:\n{spec.context}\n\n"
         f"Expected output:\n{spec.expected_output}\n\n"
         f"Verification requirements:\n{verification}\n\n"
+        f"Delivery constraint:\n{delivery}\n\n"
         "Complete only this task. Do not delegate and do not ask the user questions."
     )
 

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/runtime/subagents/roles.py

@@ -65,10 +65,19 @@ def resolve_role_tools(
         if "__" in name
         or name in {"list_mcp_servers", "search_mcp_tools", "read_mcp_resource", "get_mcp_prompt"}
     )
-    allowed_tools = policy.default_tools | network_tools
-    if requested_tools is not None:
-        unknown = requested_tools - allowed_tools
-        if unknown:
-            raise ValueError(f"requested tools exceed role policy: {', '.join(sorted(unknown))}")
-    selected = allowed_tools if requested_tools is None else requested_tools
+    # Task kind is an independent capability boundary. In particular, a worker
+    # may perform either kind of task, but a worker/read task must remain just as
+    # read-only as researcher/read and verifier/read.
+    kind_tools = (
+        policy.default_tools & _READ_TOOLS
+        if kind is SubagentTaskKind.READ
+        else policy.default_tools
+    )
+    allowed_tools = kind_tools | network_tools
+    # ``requested_tools`` is model-authored input, so treat it as a narrowing
+    # hint rather than a second policy boundary. A model can accidentally copy a
+    # write tool into a read-only researcher task; denying that tool is enough to
+    # preserve the role boundary and should not prevent the remaining research
+    # tools from starting.
+    selected = allowed_tools if requested_tools is None else requested_tools & allowed_tools
     return selected & parent_tools

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/sdk.py

@@ -34,6 +34,7 @@ from windcode.extensions.commands import CommandRoute
 from windcode.extensions.hooks.models import HookContext, HookEvent
 from windcode.extensions.mcp.catalog import McpToolDefinition
 from windcode.extensions.mcp.tools import (
+    SearchMcpToolsTool,
     register_mcp_management_tools,
     register_mcp_status_tool,
 )
@@ -239,6 +240,12 @@ class Windcode:
             project_root = self.workspace / project_root
         return project_root.resolve()
 
+    def _user_storage_root(self) -> Path:
+        configured = self.config.storage.user_storage_root
+        if configured is not None:
+            return self._configured_state_path(configured)
+        return user_state_path("windcode").expanduser().resolve()
+
     @classmethod
     def open(
         cls,
@@ -712,6 +719,10 @@ class Windcode:
                 continue
             policy.restore_session_approval(tool_name, effects)
         child_tools = run_registry.clone()
+        if "search_mcp_tools" in run_registry.names():
+            search_mcp_tools = run_registry.get("search_mcp_tools")
+            if isinstance(search_mcp_tools, SearchMcpToolsTool):
+                search_mcp_tools.add_registry(child_tools)
         instructions = load_instructions(workspace, workspace_root=workspace)
         run_memory = (
             MemoryService(self.state_root, workspace) if self.config.memory.enabled else None
@@ -793,7 +804,10 @@ class Windcode:
             config=self.config.subagents,
             event_bus=bus,
             factory=factory,
-            worktrees=WorktreeManager(worktrees_root=self.state_root / "worktrees"),
+            worktrees=WorktreeManager(
+                worktrees_root=self.state_root / "worktrees",
+                fallback_worktrees_root=self._user_storage_root() / "worktrees",
+            ),
             verification=VerificationRunner(
                 sandbox=sandbox,
                 timeout_seconds=self.config.budgets.shell_timeout_seconds,

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/tools/subagents/spawn.py

@@ -14,13 +14,26 @@ class SubagentTaskInput(BaseModel):
     model_config = ConfigDict(extra="forbid", frozen=True)
 
     task_name: str = Field(pattern=r"^[a-z0-9]+(?:_[a-z0-9]+)*$")
-    role: SubagentRole
-    kind: SubagentTaskKind
+    role: SubagentRole = Field(
+        description=(
+            "researcher and verifier are read-only; use worker only when the child itself must "
+            "modify files"
+        )
+    )
+    kind: SubagentTaskKind = Field(
+        description="Use read for research/verification and write only for a worker editing files."
+    )
     goal: str = Field(min_length=1)
     context: str = Field(min_length=1)
     expected_output: str = Field(min_length=1)
     verification: tuple[str, ...] = Field(min_length=1)
-    allowed_tools: frozenset[str] | None = None
+    allowed_tools: frozenset[str] | None = Field(
+        default=None,
+        description=(
+            "Optional tool restriction. Omit it to use role defaults. Never request write_file, "
+            "edit_file, or apply_patch for researcher/verifier read tasks."
+        ),
+    )
     model: str | None = None
     requires_network: bool = Field(
         default=False,
@@ -51,8 +64,14 @@ class SpawnSubagentsInput(BaseModel):
 class SpawnSubagentsTool:
     name = "spawn_subagents"
     description = (
-        "Create bounded temporary subagents. Declare requires_network for network-dependent "
-        "tasks; network access follows the parent run's network policy and permission workflow."
+        "Create bounded temporary subagents. Researchers and verifiers are read-only and return "
+        "their findings to the parent; use a worker/write task only when that child must edit "
+        "files. Write tasks use an isolated Git Worktree based on the current parent HEAD, so "
+        "never stash, commit, revert, move, or discard parent workspace changes before spawning; "
+        "uncommitted parent changes are intentionally not copied into the child Worktree. Omit "
+        "allowed_tools unless a narrower tool set is required. Declare "
+        "requires_network for network-dependent tasks; network access follows the parent run's "
+        "network policy and permission workflow."
     )
     input_model = SpawnSubagentsInput
     effects = frozenset({ToolEffect.PROCESS, ToolEffect.WORKSPACE_WRITE})

{windcode-0.1.2 → windcode-0.1.3}/src/windcode/worktrees/manager.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import asyncio
+import hashlib
 import re
 from pathlib import Path
 
@@ -42,12 +43,50 @@ class WorktreeManager:
         *,
         runner: GitRunner | None = None,
         worktrees_root: Path | None = None,
+        fallback_worktrees_root: Path | None = None,
     ) -> None:
         self.runner = runner or GitRunner()
         self.worktrees_root = _resolve(worktrees_root) if worktrees_root else None
+        self.fallback_worktrees_root = (
+            _resolve(fallback_worktrees_root) if fallback_worktrees_root else None
+        )
         self._lock = asyncio.Lock()
 
-    async def validate_parent(self, workspace: Path) -> GitBaseline:
+    def _effective_root(self, repository: Path) -> Path:
+        default = repository.parent / f".{repository.name}-windcode-worktrees"
+        primary = self.worktrees_root
+        fallback = self.fallback_worktrees_root
+        if primary is not None and fallback is None:
+            return primary
+        if primary is not None and primary != fallback and primary.is_dir():
+            return primary
+        if fallback is not None:
+            digest = hashlib.sha256(str(repository).encode()).hexdigest()[:12]
+            project = _safe_component(repository.name)
+            return fallback / f"{project}-{digest}"
+        return default
+
+    async def _validate_nested_root(self, root: Path, repository: Path) -> None:
+        if not root.is_relative_to(repository):
+            return
+        probe = root / ".windcode-ignore-probe"
+        ignored = await self.runner.run(
+            ("check-ignore", "--quiet", "--no-index", str(probe)),
+            cwd=repository,
+            check=False,
+        )
+        if ignored.returncode != 0:
+            raise WorktreeError(
+                GitErrorCategory.INVALID_PATH,
+                "a nested subagent Worktree root must be ignored by the parent repository",
+            )
+
+    async def validate_parent(
+        self,
+        workspace: Path,
+        *,
+        require_clean: bool = True,
+    ) -> GitBaseline:
         workspace = _resolve(workspace)
         try:
             repository_result = await self.runner.run(
@@ -68,17 +107,18 @@ class WorktreeManager:
             )
         commit = (await self.runner.run(("rev-parse", "HEAD"), cwd=repository)).stdout.strip()
         await self.runner.run(("worktree", "list", "--porcelain"), cwd=repository)
-        status = (
-            await self.runner.run(
-                ("status", "--porcelain=v1", "--untracked-files=all"), cwd=repository
-            )
-        ).stdout
-        if status.strip():
-            details = ", ".join(line.strip() for line in status.splitlines()[:5])
-            raise WorktreeError(
-                GitErrorCategory.DIRTY_WORKSPACE,
-                f"parent workspace is not clean: {details}",
-            )
+        if require_clean:
+            status = (
+                await self.runner.run(
+                    ("status", "--porcelain=v1", "--untracked-files=all"), cwd=repository
+                )
+            ).stdout
+            if status.strip():
+                details = ", ".join(line.strip() for line in status.splitlines()[:5])
+                raise WorktreeError(
+                    GitErrorCategory.DIRTY_WORKSPACE,
+                    f"parent workspace is not clean: {details}",
+                )
         return GitBaseline(
             repository=repository, branch=branch_result.stdout.strip(), commit=commit
         )
@@ -95,15 +135,9 @@ class WorktreeManager:
         safe_task = _safe_component(task_name)
         safe_id = _safe_component(subagent_id)
         branch = f"windcode/subagents/{safe_run}/{safe_task}-{safe_id[:12]}"
-        root = self.worktrees_root or (
-            baseline.repository.parent / f".{baseline.repository.name}-windcode-worktrees"
-        )
+        root = self._effective_root(baseline.repository)
         path = _resolve(root / f"{safe_task}-{safe_id[:12]}")
-        if path.is_relative_to(baseline.repository):
-            raise WorktreeError(
-                GitErrorCategory.INVALID_PATH,
-                "subagent Worktree must be outside the parent repository",
-            )
+        await self._validate_nested_root(root, baseline.repository)
         async with self._lock:
             _mkdir(root)
             if _exists(path):

{windcode-0.1.2 → windcode-0.1.3}/uv.lock

@@ -1498,7 +1498,7 @@ wheels = [
 
 [[package]]
 name = "windcode"
-version = "0.1.2"
+version = "0.1.3"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },