@team-agent/installer 0.2.1 → 0.2.3

package/src/team_agent/messaging/leader_panes.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import hashlib
+
 from team_agent.messaging.deps import (
     EventLog,
     RuntimeError,
@@ -9,6 +11,7 @@ from team_agent.messaging.deps import (
     _tmux_current_client_pane_info as _runtime_tmux_current_client_pane_info,
     _tmux_list_panes as _runtime_tmux_list_panes,
     _tmux_pane_info as _runtime_tmux_pane_info,
+    _tmux_inject_text,
     core_list_targets,
     datetime,
     os,
@@ -20,6 +23,8 @@ from team_agent.messaging.deps import (
 from pathlib import Path
 from typing import Any
 
+_AMBIGUOUS_DEBOUNCE_SECONDS = 60
+
 def _resolve_leader_pane(
     pane: str | None,
     provider: str,
@@ -208,17 +213,40 @@ def _target_fingerprint(pane_info: dict[str, Any]) -> str:
     )
 
 
+def is_bound_pane_still_valid(state: dict[str, Any], store: Any | None = None) -> dict[str, Any]:
+    receiver = dict(state.get("leader_receiver") or {})
+    owner = state.get("team_owner") if isinstance(state.get("team_owner"), dict) else {}
+    if owner and owner.get("leader_session_uuid") and not receiver.get("leader_session_uuid"):
+        receiver["leader_session_uuid"] = owner["leader_session_uuid"]
+    return _validate_leader_receiver(receiver)
+
+
 def _rediscover_leader_receiver(
     receiver: dict[str, Any],
     event_log: EventLog,
     owner_identity: dict[str, Any] | None = None,
+    invalidation_reason: str | None = None,
+    team_id: str | None = None,
 ) -> dict[str, Any]:
     provider = str(receiver.get("provider") or "codex")
-    if provider != "codex":
-        return {"status": "missing", "reason": "rediscovery_only_for_codex"}
+    if provider == "fake":
+        return {"status": "missing", "reason": "rediscovery_not_supported_for_fake"}
     targets = core_list_targets()
     if not targets.get("ok"):
         event_log.write("leader_receiver.rediscover_failed", provider=provider, error=targets.get("error"))
+        # Stage 15 CI fix: when the tmux target scan itself fails (no server, no daemon,
+        # CI env without tmux), the caller has no way to recover unless we also emit
+        # rebind_required. Without this, _refresh_leader_receiver_or_flag_rebind silently
+        # returns and report_result queues against the stale pane with zero audit signal.
+        event_log.write(
+            "leader_receiver.rebind_required",
+            old_pane_id=receiver.get("pane_id"),
+            reason=invalidation_reason,
+            provider=provider,
+            team_id=team_id,
+            rediscovery_status="failed",
+            error=targets.get("error"),
+        )
         return {"status": "failed", "error": targets.get("error")}
     candidates = [
         target
@@ -228,16 +256,26 @@ def _rediscover_leader_receiver(
     if owner_identity:
         owner_candidates = [target for target in candidates if _target_matches_owner_identity(target, owner_identity)]
         if len(owner_candidates) == 1:
-            return _rediscovered_receiver(receiver, provider, owner_candidates[0], event_log, owner_identity)
+            return _rediscovered_receiver(receiver, provider, owner_candidates[0], event_log, owner_identity, invalidation_reason)
         if len(owner_candidates) > 1:
+            incident = _broadcast_ambiguous_candidates(
+                receiver,
+                provider,
+                owner_candidates,
+                event_log,
+                owner_identity,
+                team_id,
+            )
             event_log.write(
                 "leader_receiver.rediscover_ambiguous",
                 provider=provider,
                 old_target=receiver.get("pane_id"),
                 candidates=[target.get("pane_id") for target in owner_candidates],
                 owner_identity=owner_identity,
+                incident_id=incident.get("incident_id"),
+                deduped=incident.get("deduped"),
             )
-            return {"status": "ambiguous", "candidates": owner_candidates, "owner_identity": owner_identity}
+            return {"status": "ambiguous", "candidates": owner_candidates, "owner_identity": owner_identity, **incident}
         event_log.write(
             "leader_receiver.rediscover_missing",
             provider=provider,
@@ -245,9 +283,19 @@ def _rediscover_leader_receiver(
             owner_identity=owner_identity,
             candidate_count=len(candidates),
         )
+        event_log.write(
+            "leader_receiver.rebind_required",
+            old_pane_id=receiver.get("pane_id"),
+            reason=invalidation_reason,
+            provider=provider,
+            team_id=team_id,
+            uuid_prefix=_uuid_prefix(owner_identity),
+            owner_identity=owner_identity,
+            recovery_action="open the owning leader pane or run team-agent claim-leader --confirm from a matching pane",
+        )
         return {"status": "missing", "owner_identity": owner_identity}
     if len(candidates) == 1:
-        return _rediscovered_receiver(receiver, provider, candidates[0], event_log, None)
+        return _rediscovered_receiver(receiver, provider, candidates[0], event_log, None, invalidation_reason)
     if len(candidates) > 1:
         event_log.write(
             "leader_receiver.rediscover_ambiguous",
@@ -255,12 +303,19 @@ def _rediscover_leader_receiver(
             old_target=receiver.get("pane_id"),
             candidates=[target.get("pane_id") for target in candidates],
         )
+        event_log.write("leader_receiver.rebind_required", old_pane_id=receiver.get("pane_id"), reason=invalidation_reason, provider=provider, team_id=team_id, rediscovery_status="ambiguous")
         return {"status": "ambiguous", "candidates": candidates}
     event_log.write("leader_receiver.rediscover_missing", provider=provider, old_target=receiver.get("pane_id"))
+    event_log.write("leader_receiver.rebind_required", old_pane_id=receiver.get("pane_id"), reason=invalidation_reason, provider=provider, team_id=team_id, rediscovery_status="missing")
     return {"status": "missing"}
 
 
 def _target_matches_owner_identity(target: dict[str, Any], owner_identity: dict[str, Any]) -> bool:
+    expected_uuid = owner_identity.get("leader_session_uuid")
+    if expected_uuid:
+        actual_uuid = _target_leader_session_uuid(target)
+        if actual_uuid:
+            return actual_uuid == expected_uuid
     env = target.get("leader_env") if isinstance(target.get("leader_env"), dict) else {}
     return (
         env.get("TEAM_AGENT_LEADER_PANE_ID") == (owner_identity.get("pane_id") or "")
@@ -269,14 +324,31 @@ def _target_matches_owner_identity(target: dict[str, Any], owner_identity: dict[
     )
 
 
-def _rediscovered_receiver(
-    receiver: dict[str, Any],
-    provider: str,
-    target: dict[str, Any],
-    event_log: EventLog,
-    owner_identity: dict[str, Any] | None,
-) -> dict[str, Any]:
-    updated = {
+def _target_leader_session_uuid(target: dict[str, Any]) -> str:
+    env = target.get("leader_env") if isinstance(target.get("leader_env"), dict) else {}
+    return str(target.get("leader_session_uuid") or env.get("TEAM_AGENT_LEADER_SESSION_UUID") or "")
+
+
+def _leader_uuid_for_bound_pane(receiver: dict[str, Any], pane_info: dict[str, Any]) -> str:
+    direct = _target_leader_session_uuid(pane_info) or _target_leader_session_uuid(receiver)
+    if direct:
+        return direct
+    targets = core_list_targets()
+    if not targets.get("ok"):
+        return ""
+    pane_id = pane_info.get("pane_id")
+    for target in targets.get("targets", []):
+        if target.get("pane_id") == pane_id:
+            return _target_leader_session_uuid(target)
+    return ""
+
+
+def _uuid_prefix(owner_identity: dict[str, Any] | None) -> str:
+    return str((owner_identity or {}).get("leader_session_uuid") or "")[:8]
+
+
+def _receiver_from_target(target: dict[str, Any], provider: str, leader_uuid: str | None, owner_epoch: int | None = None) -> dict[str, Any]:
+    receiver = {
         "mode": "direct_tmux",
         "status": "attached",
         "provider": provider,
@@ -289,8 +361,83 @@ def _rediscovered_receiver(
         "pane_current_command": target["pane_current_command"],
         "fingerprint": target.get("fingerprint") or _target_fingerprint(target),
         "attached_at": datetime.now(timezone.utc).isoformat(),
-        "discovery": "stale_rediscovery_owner_identity" if owner_identity else "stale_rediscovery_unique_candidate",
     }
+    if leader_uuid:
+        receiver["leader_session_uuid"] = leader_uuid
+    if owner_epoch is not None:
+        receiver["owner_epoch"] = owner_epoch
+    return receiver
+
+
+def _broadcast_ambiguous_candidates(
+    receiver: dict[str, Any],
+    provider: str,
+    candidates: list[dict[str, Any]],
+    event_log: EventLog,
+    owner_identity: dict[str, Any],
+    team_id: str | None,
+) -> dict[str, Any]:
+    candidate_ids = sorted(str(candidate.get("pane_id")) for candidate in candidates)
+    bucket = _ambiguous_debounce_bucket()
+    incident_id = hashlib.sha256("\0".join([str(team_id or ""), *candidate_ids, bucket]).encode("utf-8")).hexdigest()[:16]
+    if any(event.get("event") == "leader_receiver.ambiguous_candidates" and event.get("incident_id") == incident_id for event in event_log.tail(200)):
+        return {"incident_id": incident_id, "deduped": True}
+    prompt = _ambiguous_candidate_prompt(team_id, len(candidates))
+    event_log.write(
+        "leader_receiver.ambiguous_candidates",
+        incident_id=incident_id,
+        old_pane_id=receiver.get("pane_id"),
+        candidates=candidate_ids,
+        provider=provider,
+        team_id=team_id,
+        uuid_prefix=_uuid_prefix(owner_identity),
+        debounce_bucket=bucket,
+    )
+    for candidate in candidates:
+        pane_id = str(candidate.get("pane_id") or "")
+        injected = _tmux_inject_text(
+            pane_id,
+            prompt,
+            "Enter",
+            f"team-agent-leader-ambiguous-{incident_id}-{pane_id.strip('%')}",
+            provider=provider,
+        )
+        event_log.write(
+            "leader_receiver.ambiguous_candidate_queued",
+            incident_id=incident_id,
+            pane_id=pane_id,
+            ok=bool(injected.get("ok")),
+            error=injected.get("error"),
+        )
+    return {"incident_id": incident_id, "deduped": False}
+
+
+def _ambiguous_debounce_bucket() -> str:
+    now = datetime.now(timezone.utc)
+    epoch = int(now.timestamp() // _AMBIGUOUS_DEBOUNCE_SECONDS) * _AMBIGUOUS_DEBOUNCE_SECONDS
+    return datetime.fromtimestamp(epoch, timezone.utc).isoformat()
+
+
+def _ambiguous_candidate_prompt(team_id: str | None, candidate_count: int) -> str:
+    others = max(candidate_count - 1, 0)
+    return (
+        f"Team `{team_id or 'current'}` has no bound leader. This window and {others} other window(s) all qualify. "
+        "To claim this window as the team leader, run: `team-agent claim-leader --confirm`. "
+        "Only the first such call wins; subsequent calls from other windows will be refused."
+    )
+
+
+def _rediscovered_receiver(
+    receiver: dict[str, Any],
+    provider: str,
+    target: dict[str, Any],
+    event_log: EventLog,
+    owner_identity: dict[str, Any] | None,
+    invalidation_reason: str | None = None,
+) -> dict[str, Any]:
+    leader_uuid = _target_leader_session_uuid(target) or (owner_identity or {}).get("leader_session_uuid") or receiver.get("leader_session_uuid")
+    updated = _receiver_from_target(target, provider, leader_uuid)
+    updated["discovery"] = "stale_rediscovery_owner_identity" if owner_identity else "stale_rediscovery_unique_candidate"
     event_log.write(
         "leader_receiver.rediscovered",
         provider=provider,
@@ -299,6 +446,14 @@ def _rediscovered_receiver(
         candidate_count=1,
         owner_identity=owner_identity,
     )
+    event_log.write(
+        "leader_receiver.rebind_applied",
+        old_pane_id=receiver.get("pane_id"),
+        new_pane_id=updated["pane_id"],
+        reason=invalidation_reason,
+        owner_identity=owner_identity,
+        uuid_prefix=_uuid_prefix(owner_identity),
+    )
     return {"status": "updated", "receiver": updated, "owner_identity": owner_identity}
 
 
@@ -306,6 +461,26 @@ def _validate_leader_receiver(receiver: dict[str, Any]) -> dict[str, Any]:
     pane_info = _runtime_tmux_pane_info(receiver.get("pane_id"))
     if not pane_info:
         return {"ok": False, "reason": "leader_pane_missing", "error": "tmux pane does not exist"}
+    provider = str(receiver.get("provider") or "codex")
+    if not _leader_command_looks_usable(pane_info.get("pane_current_command", ""), provider):
+        return {
+            "ok": False,
+            "reason": "leader_pane_wrong_command",
+            "error": f"pane command {pane_info.get('pane_current_command')!r} is not a leader host",
+            "pane": pane_info,
+        }
+    expected_uuid = receiver.get("leader_session_uuid")
+    if expected_uuid:
+        actual_uuid = _leader_uuid_for_bound_pane(receiver, pane_info)
+        if not actual_uuid:
+            return {"ok": False, "reason": "leader_uuid_missing", "error": "bound pane has no TEAM_AGENT_LEADER_SESSION_UUID", "pane": pane_info}
+        if actual_uuid != expected_uuid:
+            return {
+                "ok": False,
+                "reason": "leader_uuid_mismatch",
+                "error": "bound pane TEAM_AGENT_LEADER_SESSION_UUID does not match stored team owner",
+                "pane": pane_info,
+            }
     capture = run_cmd(["tmux", "capture-pane", "-p", "-S", "-40", "-t", pane_info["pane_id"]], timeout=5)
     if capture.returncode != 0:
         return {
@@ -314,14 +489,7 @@ def _validate_leader_receiver(receiver: dict[str, Any]) -> dict[str, Any]:
             "error": capture.stderr.strip() or "tmux capture-pane failed",
             "pane": pane_info,
         }
-    warning = None
-    provider = str(receiver.get("provider") or "codex")
-    if not _leader_command_looks_usable(pane_info.get("pane_current_command", ""), provider):
-        warning = (
-            f"pane command {pane_info.get('pane_current_command')!r} is not a typical {provider} host; "
-            "continuing because tmux capture works"
-        )
-    return {"ok": True, "pane": pane_info, "capture": capture.stdout, "warning": warning}
+    return {"ok": True, "pane": pane_info, "capture": capture.stdout, "warning": None}
 
 
 def _leader_command_looks_usable(command: str, provider: str) -> bool:
@@ -330,7 +498,209 @@ def _leader_command_looks_usable(command: str, provider: str) -> bool:
     command_name = Path(command).name
     if provider == "codex":
         return command_name in {"codex", "node", "nodejs"}
-    return bool(command_name)
+    if provider in {"claude", "claude_code"}:
+        return command_name in {"claude", "claude.exe"}
+    return command_name in {"codex", "node", "nodejs", "claude", "claude.exe"}
+
+
+def attempt_trust_auto_answer(
+    workspace: Path,
+    pane_id: str | None,
+    pane_capture_tail: str,
+    event_log: EventLog,
+    *,
+    spec: dict[str, Any] | None = None,
+    state: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Gap 29 (Slice 2 Stage 2) — opt-in auto-answer of the codex first-run trust prompt.
+
+    Called by the inject path when developer's structured envelope reports
+    detected=='codex_trust_prompt'. Auto-answers ONLY when both:
+      (1) runtime is opted in. The PREFERRED opt-in is the per-session env var
+          TEAM_AGENT_AUTO_TRUST_OWN_WORKSPACE in {1,true,yes,on}. The legacy
+          spec.runtime.auto_trust_own_workspace=True path is still honoured for
+          backwards compatibility but is DEPRECATED (constitution-reviewer F3:
+          a YAML field permanently erases the trust prompt's cognitive moment
+          across all sessions, defeating its purpose). The spec path will be
+          removed in 0.3.0.
+      (2) the trust-prompt pane capture references this workspace's absolute path
+          (so a worker can only trust its own dir, never some arbitrary path).
+
+    On match, sends '1' + Enter to the pane and emits
+    leader_panes.trust_auto_answered. Default is opt-out — every refusal returns
+    answered=False with a structured reason and the existing failure envelope
+    bubbles up unchanged.
+
+    Return: {"ok": bool, "answered": bool, "reason": str, ...}
+    """
+    if spec is None and state is not None:
+        spec_path_str = state.get("spec_path")
+        if spec_path_str:
+            try:
+                from team_agent.spec import load_spec as _load_spec
+                spec = _load_spec(Path(spec_path_str))
+            except Exception:
+                spec = None
+    if not _auto_trust_opt_in(spec, event_log=event_log):
+        # Spark LOW #6: emit a structured event so the not-opted-in branch is
+        # as observable as the workspace_dir_mismatch / tmux_send_keys_failed
+        # branches. Keeps the decision matrix uniformly auditable.
+        event_log.write(
+            "leader_panes.trust_auto_answer_skipped",
+            pane_id=pane_id,
+            workspace=str(workspace),
+            reason="not_opted_in",
+        )
+        return {"ok": False, "answered": False, "reason": "not_opted_in"}
+    if not pane_id:
+        event_log.write(
+            "leader_panes.trust_auto_answer_skipped",
+            pane_id=None,
+            workspace=str(workspace),
+            reason="pane_id_missing",
+        )
+        return {"ok": False, "answered": False, "reason": "pane_id_missing"}
+    if not _capture_tail_references_workspace(pane_capture_tail, workspace):
+        event_log.write(
+            "leader_panes.trust_auto_answer_refused",
+            pane_id=pane_id,
+            workspace=str(workspace),
+            reason="workspace_dir_mismatch",
+        )
+        return {"ok": False, "answered": False, "reason": "workspace_dir_mismatch"}
+    answer = _tmux_inject_text(
+        str(pane_id),
+        "1",
+        "Enter",
+        f"team-agent-trust-auto-answer-{str(pane_id).strip('%') or 'pane'}",
+        attempts=1,
+        provider="fake",
+        bypass_non_input_gate=True,
+    )
+    if not answer.get("ok"):
+        error = answer.get("error") or "tmux send-keys failed"
+        event_log.write(
+            "leader_panes.trust_auto_answer_failed",
+            pane_id=pane_id,
+            workspace=str(workspace),
+            error=error,
+        )
+        return {"ok": False, "answered": False, "reason": "tmux_send_keys_failed", "error": error}
+    event_log.write(
+        "leader_panes.trust_auto_answered",
+        pane_id=pane_id,
+        workspace=str(workspace),
+        opted_in=True,
+    )
+    return {"ok": True, "answered": True, "reason": "trust_auto_answered"}
+
+
+_SPEC_OPT_IN_DEPRECATION_MESSAGE = (
+    "WARNING: spec.runtime.auto_trust_own_workspace is deprecated. "
+    "Use env TEAM_AGENT_AUTO_TRUST_OWN_WORKSPACE=1 per session instead. "
+    "Spec-field will be removed in 0.3.0."
+)
+
+
+def _auto_trust_opt_in(spec: dict[str, Any] | None, *, event_log: EventLog | None = None) -> bool:
+    """Constitution-reviewer F3 (2026-05-26): env-var per-session opt-in is the
+    preferred path. spec.runtime.auto_trust_own_workspace remains honoured for
+    backwards compatibility but emits a one-shot stderr deprecation warning AND
+    a structured trust_auto_answer_spec_opt_in_deprecated event so a normalized
+    YAML field is auditable from a fresh log."""
+    spec_opted_in = (
+        isinstance(spec, dict)
+        and bool((spec.get("runtime") or {}).get("auto_trust_own_workspace"))
+    )
+    if spec_opted_in:
+        _emit_spec_opt_in_deprecation(event_log)
+    env = os.environ.get("TEAM_AGENT_AUTO_TRUST_OWN_WORKSPACE", "").strip().lower()
+    env_opted_in = env in {"1", "true", "yes", "on"}
+    return env_opted_in or spec_opted_in
+
+
+def _emit_spec_opt_in_deprecation(event_log: EventLog | None) -> None:
+    """Emit the deprecation warning once per process. The structured event still
+    fires per call so an audit log captures every yaml-driven decision."""
+    import sys
+    global _SPEC_OPT_IN_DEPRECATION_WARNED
+    if not _SPEC_OPT_IN_DEPRECATION_WARNED:
+        try:
+            print(_SPEC_OPT_IN_DEPRECATION_MESSAGE, file=sys.stderr, flush=True)
+        except Exception:
+            pass
+        _SPEC_OPT_IN_DEPRECATION_WARNED = True
+    if event_log is not None:
+        try:
+            event_log.write(
+                "trust_auto_answer_spec_opt_in_deprecated",
+                preferred_opt_in="env:TEAM_AGENT_AUTO_TRUST_OWN_WORKSPACE",
+                deprecated_field="spec.runtime.auto_trust_own_workspace",
+                removal_target_version="0.3.0",
+            )
+        except Exception:
+            pass
+
+
+_SPEC_OPT_IN_DEPRECATION_WARNED = False
+
+
+def _reset_spec_opt_in_deprecation_state() -> None:
+    """Test-only helper: reset the per-process one-shot guard so multiple cases
+    in the same interpreter can each observe the warning. Not part of the
+    public API."""
+    global _SPEC_OPT_IN_DEPRECATION_WARNED
+    _SPEC_OPT_IN_DEPRECATION_WARNED = False
+
+
+def _capture_tail_references_workspace(tail: str, workspace: Path) -> bool:
+    """Spark MEDIUM #5: a raw substring match accepted '/repo' inside
+    '/repo-backup' and rejected symlinked / trailing-slash spellings. We now
+    canonicalize the workspace via Path.resolve, parse candidate absolute paths
+    out of the prompt tail (one token per line after stripping codex box-drawing
+    glyphs), canonicalize each candidate the same way, and only return True on
+    boundary-safe canonical equality."""
+    if not tail:
+        return False
+    workspace_canonical = _canonicalize_path(workspace)
+    if not workspace_canonical:
+        return False
+    for candidate in _candidate_paths_from_prompt(tail):
+        if _canonicalize_path(Path(candidate)) == workspace_canonical:
+            return True
+    return False
+
+
+_PATH_LINE_RE = re.compile(r"(/[\w\-./~+@]+)")
+
+
+def _candidate_paths_from_prompt(tail: str) -> list[str]:
+    """Pull every absolute-path-shaped token out of the prompt's tail. Codex
+    renders the trust prompt's directory inside box-drawing glyphs and on its
+    own line; strip leading/trailing whitespace and glyph noise before matching."""
+    paths: list[str] = []
+    for raw_line in tail.splitlines():
+        line = raw_line.strip()
+        # Codex draws box-glyph prefixes (▌ ▎ │) that need to be stripped.
+        for glyph in ("▌", "▎", "│"):
+            line = line.lstrip(glyph).strip()
+        if not line:
+            continue
+        for match in _PATH_LINE_RE.finditer(line):
+            token = match.group(1).rstrip("/")
+            if token and token not in paths:
+                paths.append(token)
+    return paths
+
+
+def _canonicalize_path(p: Path | str) -> str:
+    try:
+        resolved = Path(p).expanduser().resolve(strict=False)
+    except OSError:
+        return ""
+    text = resolved.as_posix()
+    # Strip a trailing slash so boundary-safe equality holds.
+    return text.rstrip("/") if text != "/" else "/"
 
 
 def _choose_leader_submit_key(provider: str, capture_text: str) -> tuple[str, str]: