@team-agent/installer 0.2.1 → 0.2.2

package/src/team_agent/state.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import hashlib
 import json
 import os
 import copy
@@ -23,6 +24,14 @@ SESSION_STATE_FIELDS = [
     *SESSION_CAPTURE_FIELDS,
     "spawn_cwd",
 ]
+_UUID_SEPARATOR = "\0"
+
+
+def derive_leader_session_uuid(machine_fingerprint: str, workspace_abspath: str, os_user: str, team_id: str) -> str:
+    parts = [machine_fingerprint, workspace_abspath, os_user, team_id]
+    if any(_UUID_SEPARATOR in part for part in parts):
+        raise ValueError("leader_session_uuid inputs must not contain NUL")
+    return hashlib.sha256(_UUID_SEPARATOR.join(parts).encode("utf-8")).hexdigest()[:32]
 
 
 def runtime_state_path(workspace: Path) -> Path:
@@ -45,6 +54,8 @@ def load_runtime_state(workspace: Path) -> dict[str, Any]:
         return {"agents": {}, "tasks": [], "session_name": None}
     state = json.loads(path.read_text(encoding="utf-8"))
     normalize_agent_session_state(state)
+    if _migrate_state_identity(state, workspace):
+        save_runtime_state(workspace, state)
     return state
 
 
@@ -163,11 +174,75 @@ def resolve_team_scoped_state(
         }
 
 
-def _caller_identity_from_env() -> dict[str, str]:
+def _identity_workspace_abspath(state: dict[str, Any], workspace: Path | None = None) -> str:
+    if state.get("workspace"):
+        return str(Path(str(state["workspace"])).resolve())
+    if state.get("team_dir"):
+        return str(Path(str(state["team_dir"])).resolve().parent.parent)
+    if state.get("spec_path"):
+        spec_path = Path(str(state["spec_path"])).resolve()
+        return str(spec_path.parent.parent.parent if spec_path.parent.parent.name == ".team" else spec_path.parent)
+    return str((workspace or Path(os.environ.get("TEAM_AGENT_WORKSPACE") or os.getcwd())).resolve())
+
+
+def _identity_os_user() -> str:
+    return os.environ.get("USER") or os.environ.get("USERNAME") or ""
+
+
+def _identity_machine_fingerprint(state: dict[str, Any]) -> str:
+    for record in (state.get("team_owner"), state.get("leader_receiver")):
+        if isinstance(record, dict) and record.get("machine_fingerprint"):
+            return str(record["machine_fingerprint"])
+    return os.environ.get("TEAM_AGENT_MACHINE_FINGERPRINT") or ""
+
+
+def _leader_session_uuid_for_state(state: dict[str, Any], workspace: Path | None = None, team_id: str | None = None) -> str:
+    return derive_leader_session_uuid(
+        _identity_machine_fingerprint(state),
+        _identity_workspace_abspath(state, workspace),
+        _identity_os_user(),
+        team_id or team_state_key(state),
+    )
+
+
+def _migrate_team_identity(state: dict[str, Any], workspace: Path, team_id: str | None = None) -> bool:
+    leader_uuid = _leader_session_uuid_for_state(state, workspace, team_id)
+    changed = False
+    for key in ("team_owner", "leader_receiver"):
+        record = state.get(key)
+        if isinstance(record, dict) and not record.get("leader_session_uuid"):
+            record["leader_session_uuid"] = leader_uuid
+            changed = True
+    return changed
+
+
+def _migrate_state_identity(state: dict[str, Any], workspace: Path) -> bool:
+    changed = _migrate_team_identity(state, workspace) if state.get("session_name") else False
+    teams = state.get("teams")
+    if isinstance(teams, dict):
+        for team_id, team_state in teams.items():
+            if isinstance(team_state, dict):
+                changed = _migrate_team_identity(team_state, workspace, str(team_id)) or changed
+    return changed
+
+
+def _caller_identity_from_env(state: dict[str, Any] | None = None, team_id: str | None = None, workspace: Path | None = None) -> dict[str, str]:
+    state = state or {}
+    machine_fingerprint = os.environ.get("TEAM_AGENT_MACHINE_FINGERPRINT") or ""
+    override = os.environ.get("TEAM_AGENT_LEADER_SESSION_UUID_OVERRIDE") or ""
+    env_uuid = os.environ.get("TEAM_AGENT_LEADER_SESSION_UUID") or ""
+    leader_uuid = override or env_uuid or derive_leader_session_uuid(
+        machine_fingerprint,
+        _identity_workspace_abspath(state, workspace),
+        _identity_os_user(),
+        team_id or os.environ.get("TEAM_AGENT_TEAM_ID") or team_state_key(state),
+    )
     return {
         "pane_id": os.environ.get("TEAM_AGENT_LEADER_PANE_ID") or "",
         "provider": os.environ.get("TEAM_AGENT_LEADER_PROVIDER") or "",
-        "machine_fingerprint": os.environ.get("TEAM_AGENT_MACHINE_FINGERPRINT") or "",
+        "machine_fingerprint": machine_fingerprint,
+        "leader_session_uuid": leader_uuid,
+        "leader_session_uuid_source": "explicit-override" if override else ("env" if env_uuid else "derived"),
     }
 
 
@@ -175,19 +250,22 @@ def check_team_owner(state: dict[str, Any]) -> dict[str, Any] | None:
     owner = state.get("team_owner") or {}
     if not owner:
         return None
-    caller = _caller_identity_from_env()
-    if (
-        caller["pane_id"] == (owner.get("pane_id") or "")
-        and caller["provider"] == (owner.get("provider") or "")
-        and caller["machine_fingerprint"] == (owner.get("machine_fingerprint") or "")
-    ):
+    _migrate_team_identity(state, Path(_identity_workspace_abspath(state)), team_state_key(state))
+    caller = _caller_identity_from_env(state, team_state_key(state))
+    owner_uuid = str(owner.get("leader_session_uuid") or "")
+    caller_uuid = caller["leader_session_uuid"]
+    owner_pane = str(owner.get("pane_id") or "")
+    caller_pane = caller.get("pane_id") or ""
+    if caller_uuid == owner_uuid and (not caller_pane or caller_pane == owner_pane):
         return None
+    same_uuid = caller_uuid == owner_uuid
     return {
         "ok": False,
         "status": "refused",
         "reason": "team_owner_mismatch",
+        "reason_kind": "sticky_bind_collision" if same_uuid else "owner_takeover_required",
         "error": "not_owner",
-        "action": "use team-agent takeover --confirm",
+        "action": "team-agent claim-leader --confirm" if same_uuid else "team-agent takeover --confirm",
         "team_owner": owner,
         "caller": caller,
     }
@@ -209,14 +287,16 @@ def worker_sender_bypasses_owner_gate(state: dict[str, Any], sender: str | None)
 
 def populate_team_owner_from_env(state: dict[str, Any], source: str = "autopopulate") -> dict[str, Any] | None:
     if state.get("team_owner"):
+        _migrate_team_identity(state, Path(_identity_workspace_abspath(state)), team_state_key(state))
         return state["team_owner"]
-    caller = _caller_identity_from_env()
+    caller = _caller_identity_from_env(state, team_state_key(state))
     if not caller["pane_id"]:
         return None
     owner = {
         "pane_id": caller["pane_id"],
         "provider": caller["provider"],
         "machine_fingerprint": caller["machine_fingerprint"],
+        "leader_session_uuid": caller["leader_session_uuid"],
         "claimed_at": datetime.now(timezone.utc).isoformat(),
         "claimed_via": source,
     }
@@ -224,7 +304,70 @@ def populate_team_owner_from_env(state: dict[str, Any], source: str = "autopopul
     return owner
 
 
+def apply_first_time_leader_binding(
+    workspace: Path,
+    state: dict[str, Any],
+    receiver: dict[str, Any],
+    pane_info: dict[str, Any],
+    identity: dict[str, Any],
+    source: str,
+) -> dict[str, Any]:
+    from team_agent.messaging.leader_panes import _leader_command_looks_usable
+    command = pane_info.get("pane_current_command", "")
+    provider = str(receiver.get("provider") or "")
+    if not _leader_command_looks_usable(command, provider):
+        return {"ok": False, "reason": "leader_pane_wrong_command", "error": f"pane command {command!r} is not a leader host", "pane": pane_info}
+    current_path = pane_info.get("pane_current_path")
+    if not current_path or os.path.realpath(current_path) != os.path.realpath(str(workspace.resolve())):
+        return {"ok": False, "reason": "leader_pane_wrong_workspace", "error": f"pane cwd {current_path!r} does not match workspace {str(workspace.resolve())!r}", "pane": pane_info}
+    receiver.update({
+        "leader_session_uuid": identity["leader_session_uuid"],
+        "machine_fingerprint": identity["machine_fingerprint"],
+        "owner_epoch": 0,
+    })
+    state["team_owner"] = {
+        "pane_id": receiver["pane_id"],
+        "provider": provider,
+        "machine_fingerprint": identity["machine_fingerprint"],
+        "leader_session_uuid": identity["leader_session_uuid"],
+        "owner_epoch": 0,
+        "claimed_at": datetime.now(timezone.utc).isoformat(),
+        "claimed_via": source,
+    }
+    state["leader_receiver"] = receiver
+    return {"ok": True, "pane": pane_info, "warning": None, "first_time": True}
+
+
+def leader_env_exports(receiver: dict[str, Any], identity: dict[str, Any]) -> dict[str, str]:
+    return {
+        "TEAM_AGENT_LEADER_PANE_ID": str(receiver.get("pane_id") or ""),
+        "TEAM_AGENT_LEADER_PROVIDER": str(receiver.get("provider") or ""),
+        "TEAM_AGENT_LEADER_SESSION_UUID": str(identity.get("leader_session_uuid") or ""),
+        "TEAM_AGENT_MACHINE_FINGERPRINT": str(identity.get("machine_fingerprint") or ""),
+        "TEAM_AGENT_WORKSPACE": str(identity.get("workspace_abspath") or ""),
+        "TEAM_AGENT_TEAM_ID": str(identity.get("team_id") or ""),
+    }
+
+
+def validate_leader_uuid_from_targets(receiver: dict[str, Any], targets: dict[str, Any]) -> dict[str, Any]:
+    expected_uuid = str(receiver.get("leader_session_uuid") or "")
+    if not expected_uuid or receiver.get("provider") == "fake":
+        return {"ok": True}
+    if not targets.get("ok"):
+        return {"ok": False, "reason": "leader_uuid_lookup_failed", "error": targets.get("error") or "tmux target scan failed"}
+    pane_id = receiver.get("pane_id")
+    target = next((item for item in targets.get("targets", []) if item.get("pane_id") == pane_id), None)
+    env = target.get("leader_env") if isinstance((target or {}).get("leader_env"), dict) else {}
+    actual_uuid = str((target or {}).get("leader_session_uuid") or env.get("TEAM_AGENT_LEADER_SESSION_UUID") or "")
+    if not actual_uuid:
+        return {"ok": False, "reason": "leader_uuid_missing", "error": "bound pane has no TEAM_AGENT_LEADER_SESSION_UUID", "pane": target}
+    if actual_uuid != expected_uuid:
+        return {"ok": False, "reason": "leader_uuid_mismatch", "error": "bound pane TEAM_AGENT_LEADER_SESSION_UUID does not match stored team owner", "pane": target}
+    return {"ok": True}
+
+
 def save_runtime_state(workspace: Path, state: dict[str, Any]) -> None:
+    _migrate_state_identity(state, workspace)
     path = runtime_state_path(workspace)
     path.parent.mkdir(parents=True, exist_ok=True)
     tmp_path = path.with_name(f"{path.name}.{os.getpid()}.{uuid.uuid4().hex}.tmp")

package/src/team_agent/status/inbox.py

@@ -1,24 +1,54 @@
 from __future__ import annotations
 
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 
 from team_agent.message_store import MessageStore
 
 
-def inbox(workspace: Path, agent_id: str, limit: int = 20) -> dict[str, Any]:
+def _parse_since(since: str | None) -> datetime | None:
+    if not since:
+        return None
+    try:
+        dt = datetime.fromisoformat(since.replace("Z", "+00:00"))
+    except (ValueError, AttributeError):
+        return None
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt
+
+
+def _filter_since(rows: list[dict[str, Any]], since: str | None) -> list[dict[str, Any]]:
+    cutoff = _parse_since(since)
+    if cutoff is None:
+        return rows
+    filtered: list[dict[str, Any]] = []
+    for row in rows:
+        ts_raw = str(row.get("created_at") or "")
+        ts = _parse_since(ts_raw)
+        if ts and ts >= cutoff:
+            filtered.append(row)
+    return filtered
+
+
+def inbox(workspace: Path, agent_id: str, limit: int = 20, since: str | None = None) -> dict[str, Any]:
     rows = MessageStore(workspace).inbox(agent_id, limit=limit)
-    return {"ok": True, "agent_id": agent_id, "messages": rows}
+    rows = _filter_since(rows, since)
+    return {"ok": True, "agent_id": agent_id, "messages": rows, "since": since}
 
 
-def format_inbox(workspace: Path, agent_id: str, limit: int = 20) -> str:
+def format_inbox(workspace: Path, agent_id: str, limit: int = 20, since: str | None = None) -> str:
     store = MessageStore(workspace)
     rows = store.inbox(agent_id, limit=limit)
+    rows = _filter_since(rows, since)
     result_counts = store.result_counts()
     note = "final results are not in inbox; use team-agent collect"
     if result_counts.get("uncollected", 0):
         note += f" ({result_counts['uncollected']} uncollected result(s) pending)"
     if not rows:
+        if since:
+            return f"{agent_id}: no messages since {since}\n{note}"
         return f"{agent_id}: no messages\n{note}"
     lines = [
         f"{row['created_at']} {row['sender']} -> {row['recipient']} {row['status']}: {row['content']}"