@team-agent/installer 0.3.18 → 0.3.19

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.3.18"
+version = "0.3.19"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.3.18"
+version = "0.3.19"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/emit.rs

@@ -32,9 +32,10 @@ pub fn run(argv: &[String], cwd: &Path) -> ExitCode {
         return emit_missing_subcommand_usage();
     };
     if command == "codex" || command == "claude" || command == "copilot" {
-        return cmd_leader_passthrough(command, &argv[1..], cwd)
-            .map(emit_result)
-            .unwrap_or(ExitCode::Error);
+        return match cmd_leader_passthrough(command, &argv[1..], cwd) {
+            Ok(result) => emit_result(result),
+            Err(error) => emit_cli_error(command, &argv[1..], cwd, &error),
+        };
     }
     if matches!(command, "-h" | "--help" | "help") {
         println!("{}", command_help(None));

package/crates/team-agent/src/cli/leader.rs

@@ -23,7 +23,14 @@ pub fn leader_launcher_args(values: &[String]) -> Result<LeaderLauncherArgs, Cli
     while idx < values.len() {
         let token = &values[idx];
         if token == "--" {
-            out.provider_args.extend(values.iter().skip(idx).cloned());
+            for value in values.iter().skip(idx + 1) {
+                if is_leader_launcher_flag(value) {
+                    return Err(CliError::Runtime(format!(
+                        "Team Agent launcher flag {value} must appear before --"
+                    )));
+                }
+            }
+            out.provider_args.extend(values.iter().skip(idx + 1).cloned());
             break;
         } else if token == "--attach" || token == "--attach-existing" {
             out.attach_existing = true;
@@ -49,6 +56,13 @@ pub fn leader_launcher_args(values: &[String]) -> Result<LeaderLauncherArgs, Cli
     Ok(out)
 }
 
+fn is_leader_launcher_flag(value: &str) -> bool {
+    matches!(
+        value,
+        "--external-leader" | "--attach" | "--attach-existing" | "--confirm" | "--attach-session"
+    ) || value.starts_with("--attach-session=")
+}
+
 fn leader_launcher_json(values: &[String]) -> bool {
     values
         .iter()

package/crates/team-agent/src/cli/tests/base.rs

@@ -86,17 +86,18 @@ use super::*;
         assert!(!got.attach_existing);
         assert_eq!(
             got.provider_args,
-            vec!["--".to_string(), "--model".to_string(), "opus".to_string()]
+            vec!["--model".to_string(), "opus".to_string()]
         );
     }
 
     #[test]
-    fn leader_launcher_args_external_leader_after_dashdash_is_provider_arg() {
-        let got = leader_launcher_args(&["--".into(), "--external-leader".into()]).unwrap();
-        assert!(!got.external_leader);
-        assert_eq!(
-            got.provider_args,
-            vec!["--".to_string(), "--external-leader".to_string()]
+    fn leader_launcher_args_external_leader_after_dashdash_errors() {
+        let err = leader_launcher_args(&["--".into(), "--external-leader".into()])
+            .expect_err("Team Agent flags after -- must not be silently passed to provider");
+        assert!(
+            err.to_string()
+                .contains("Team Agent launcher flag --external-leader must appear before --"),
+            "unexpected error: {err}"
         );
     }
 
@@ -116,22 +117,22 @@ use super::*;
     }
 
     #[test]
-    fn leader_launcher_args_dashdash_passthrough_includes_following_flags() {
-        // golden: ["--attach","--","-x","--confirm"] ->
-        //   provider_args=["--","-x","--confirm"], attach_existing=True, confirm_attach=False
-        // (everything from `--` onward, INCLUDING the `--` token itself, is provider passthrough)
+    fn leader_launcher_args_dashdash_passthrough_strips_separator() {
+        // ["--attach","--","-x","--provider-confirm"] ->
+        //   provider_args=["-x","--provider-confirm"], attach_existing=True, confirm_attach=False
+        // Known Team Agent launcher flags after `--` are rejected by a separate guard.
         let got = leader_launcher_args(&[
             "--attach".into(),
             "--".into(),
             "-x".into(),
-            "--confirm".into(),
+            "--provider-confirm".into(),
         ])
         .unwrap();
         assert!(got.attach_existing);
-        assert!(!got.confirm_attach, "--confirm AFTER -- must NOT set confirm_attach");
+        assert!(!got.confirm_attach);
         assert_eq!(
             got.provider_args,
-            vec!["--".to_string(), "-x".to_string(), "--confirm".to_string()]
+            vec!["-x".to_string(), "--provider-confirm".to_string()]
         );
     }
 

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -415,6 +415,48 @@ fn run_send_unknown_task_renders_error_not_silent_swallow() {
     let _ = std::fs::remove_dir_all(&ws);
 }
 
+#[test]
+fn run_leader_passthrough_flag_after_dashdash_renders_error_not_silent_swallow() {
+    let ws = std::env::temp_dir().join(format!(
+        "ta-run-leaderflag-{}-{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    std::fs::create_dir_all(&ws).unwrap();
+    let argv: Vec<String> = ["codex", "--", "--external-leader"]
+        .iter()
+        .map(ToString::to_string)
+        .collect();
+
+    let code = run(&argv, &ws);
+
+    assert_eq!(
+        code,
+        ExitCode::Error,
+        "misplaced leader flag must fail before provider exec"
+    );
+    let logs_dir = ws.join(".team").join("logs");
+    let mut found = String::new();
+    if let Ok(entries) = std::fs::read_dir(&logs_dir) {
+        for entry in entries.flatten() {
+            let name = entry.file_name().to_string_lossy().to_string();
+            if name.starts_with("cli-error-") {
+                found = std::fs::read_to_string(entry.path()).unwrap_or_default();
+                break;
+            }
+        }
+    }
+    assert!(
+        found.contains("Team Agent launcher flag --external-leader must appear before --"),
+        "leader passthrough run() must render the misplaced flag error; a silent swallow leaves no \
+         cli-error log. got log body: {found:?}"
+    );
+    let _ = std::fs::remove_dir_all(&ws);
+}
+
 // R8 D6 (c-lite offline byte-lock): the CLI requeued_exhausted_watchers return projection, extracted
 // into a pure helper, must project the golden event's watcher_ids STRING list (leader/__init__.py:56) —
 // NOT the Rust `requeued` Vec<WatcherNotice> objects.

package/crates/team-agent/src/cli/types.rs

@@ -101,6 +101,12 @@ impl CliError {
                         .to_string(),
                 ]);
             }
+        } else if error.contains("Team Agent launcher flag")
+            && error.contains("must appear before --")
+        {
+            payload.action = String::from(
+                "move the Team Agent launcher flag before `--`; only provider flags belong after `--`",
+            );
         }
         payload
     }

package/crates/team-agent/src/leader/lease.rs

@@ -144,6 +144,7 @@ fn attach_leader_targets(workspace: &Path, state: &Value) -> Vec<AttachLeaderTar
     let mut targets = Vec::new();
     for endpoint in state_recorded_tmux_endpoints(state) {
         let backend = tmux_backend_for_endpoint(&endpoint);
+        let resolved_endpoint = backend.tmux_endpoint();
         targets.extend(
             backend
                 .list_targets()
@@ -151,7 +152,7 @@ fn attach_leader_targets(workspace: &Path, state: &Value) -> Vec<AttachLeaderTar
                 .into_iter()
                 .map(|info| AttachLeaderTarget {
                     info,
-                    endpoint: Some(endpoint.clone()),
+                    endpoint: resolved_endpoint.clone(),
                 }),
         );
     }
@@ -168,10 +169,8 @@ fn attach_leader_targets(workspace: &Path, state: &Value) -> Vec<AttachLeaderTar
 fn tmux_backend_for_endpoint(endpoint: &str) -> crate::tmux_backend::TmuxBackend {
     if endpoint.is_empty() || endpoint == "default" {
         crate::tmux_backend::TmuxBackend::new()
-    } else if Path::new(endpoint).is_absolute() {
-        crate::tmux_backend::TmuxBackend::for_tmux_endpoint(endpoint)
     } else {
-        crate::tmux_backend::TmuxBackend::for_socket_name(endpoint)
+        crate::tmux_backend::TmuxBackend::for_tmux_endpoint(endpoint)
     }
 }
 

package/crates/team-agent/src/leader/start.rs

@@ -196,6 +196,9 @@ pub fn execute_leader_plan(
     let detached = plan.mode == LeaderStartMode::NewTmuxSession
         && !std::io::stdin().is_terminal()
         && insert_detach_flag(&mut argv);
+    if plan.is_external_leader {
+        persist_external_leader_topology_marker(plan, workspace)?;
+    }
     let status = run_leader_argv(&argv, &plan.leader_env, plan, workspace)?;
     let code = status.code();
     if !status.success() {
@@ -205,9 +208,6 @@ pub fn execute_leader_plan(
                 .unwrap_or_else(|| "signal".to_string())
         )));
     }
-    if plan.is_external_leader {
-        persist_external_leader_topology_marker(plan, workspace)?;
-    }
     if detached {
         Ok(LeaderLaunchOutcome {
             status: LeaderLaunchStatus::Detached,
@@ -258,7 +258,7 @@ fn start_argv(
     match mode {
         LeaderStartMode::ExecProvider => {
             let mut argv = vec![provider_cmd];
-            argv.extend(provider_args.iter().cloned());
+            argv.extend(normalized_provider_args(provider_args));
             Ok(argv)
         }
         LeaderStartMode::ManagedTmuxClient => {
@@ -289,7 +289,7 @@ fn start_argv(
                 exports.push(shlex_quote(&format!("PATH={path}")));
             }
             let mut provider_argv = vec![provider_cmd];
-            provider_argv.extend(provider_args.iter().cloned());
+            provider_argv.extend(normalized_provider_args(provider_args));
             let shell = format!(
                 "cd {} && export {} && exec {}",
                 shlex_quote(&resolved_workspace.to_string_lossy()),
@@ -316,10 +316,17 @@ fn start_argv(
 
 fn provider_command_argv(provider: Provider, provider_args: &[String]) -> Vec<String> {
     let mut argv = vec![provider_command_name(provider).to_string()];
-    argv.extend(provider_args.iter().cloned());
+    argv.extend(normalized_provider_args(provider_args));
     argv
 }
 
+fn normalized_provider_args(provider_args: &[String]) -> impl Iterator<Item = String> + '_ {
+    provider_args
+        .iter()
+        .skip(usize::from(provider_args.first().is_some_and(|arg| arg == "--")))
+        .cloned()
+}
+
 fn managed_team_session_name(identity: &LeaderIdentity) -> SessionName {
     let team = identity.team_id.as_str();
     if team.starts_with("team-") {
@@ -777,7 +784,12 @@ mod tests {
     use std::path::Path;
     use std::sync::Mutex;
 
+    use crate::leader::{
+        LeaderIdentity, LeaderLaunchSocket, LeaderSessionUuidSource, LeaderStartMode,
+        LeaderStartPlan,
+    };
     use crate::model::enums::PaneLiveness;
+    use crate::model::ids::{LeaderSessionUuid, TeamKey};
     use crate::provider::{Provider, COPILOT_READY_MARKER, COPILOT_TRUST_PROMPT_MARKER};
     use crate::transport::{
         AttachOutcome, BackendKind, CaptureRange, CapturedText, InjectPayload, InjectReport,
@@ -786,7 +798,7 @@ mod tests {
         TurnVerification, WindowName,
     };
 
-    use super::handle_exec_provider_startup_prompts;
+    use super::{execute_leader_plan, handle_exec_provider_startup_prompts, shlex_quote};
 
     struct ScriptedTransport {
         screens: Mutex<Vec<String>>,
@@ -937,6 +949,57 @@ mod tests {
         }
     }
 
+    #[test]
+    fn external_exec_provider_persists_topology_before_provider_exec() {
+        let workspace = std::env::temp_dir().join(format!(
+            "ta-external-pre-exec-{}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(&workspace).unwrap();
+        let state_path = crate::state::persist::runtime_state_path(&workspace);
+        let command = format!(
+            "test -f {path} && grep -q is_external_leader {path}",
+            path = shlex_quote(&state_path.to_string_lossy())
+        );
+        let identity = LeaderIdentity {
+            leader_session_uuid: LeaderSessionUuid::derive(
+                "fp",
+                &workspace.to_string_lossy(),
+                "tester",
+                "current",
+            )
+            .unwrap(),
+            leader_session_uuid_source: LeaderSessionUuidSource::Derived,
+            machine_fingerprint: "fp".to_string(),
+            workspace_abspath: workspace.clone(),
+            os_user: "tester".to_string(),
+            team_id: TeamKey::new("current"),
+        };
+        let plan = LeaderStartPlan {
+            mode: LeaderStartMode::ExecProvider,
+            provider: Provider::Codex,
+            workspace: workspace.clone(),
+            socket: LeaderLaunchSocket::Workspace,
+            session_name: None,
+            argv: vec!["sh".to_string(), "-c".to_string(), command],
+            provider_argv: vec!["codex".to_string()],
+            leader_window: None,
+            is_external_leader: true,
+            leader_env: BTreeMap::new(),
+            identity: Some(identity),
+            detached: false,
+        };
+
+        let outcome = execute_leader_plan(&plan, &workspace)
+            .expect("external marker must be present before provider argv runs");
+
+        assert_eq!(outcome.status, crate::leader::LeaderLaunchStatus::Exited);
+        let state = crate::state::persist::load_runtime_state(&workspace).unwrap();
+        assert_eq!(state["is_external_leader"], serde_json::json!(true));
+        assert_eq!(state["teams"]["current"]["is_external_leader"], serde_json::json!(true));
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
     #[test]
     fn exec_provider_leader_startup_prompt_handler_reuses_copilot_adapter() {
         let transport = ScriptedTransport::new(vec![

package/crates/team-agent/src/leader/tests/identity.rs

@@ -108,12 +108,20 @@ use super::*;
         let ws = std::env::temp_dir().join(format!("ta_rs_lsp_external_{}", std::process::id()));
         std::fs::create_dir_all(&ws).unwrap();
 
-        let plan = leader_start_plan(Provider::Fake, &[], &ws, false, false, None, true).unwrap();
+        let provider_args = vec!["--".to_string(), "--model".to_string(), "opus".to_string()];
+        let plan = leader_start_plan(Provider::Fake, &provider_args, &ws, false, false, None, true).unwrap();
 
         assert_eq!(plan.mode, LeaderStartMode::ExecProvider);
         assert!(plan.is_external_leader);
         assert_eq!(plan.leader_window, None);
-        assert_eq!(plan.argv, vec!["fake".to_string()]);
+        assert_eq!(
+            plan.argv,
+            vec!["fake".to_string(), "--model".to_string(), "opus".to_string()]
+        );
+        assert_eq!(
+            plan.provider_argv,
+            vec!["fake".to_string(), "--model".to_string(), "opus".to_string()]
+        );
     }
 
     #[test]

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -8,6 +8,7 @@
     #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
     use std::collections::{BTreeMap, VecDeque};
+    use std::os::unix::net::UnixListener;
     use std::path::Path;
     use std::sync::{Arc, Mutex};
 
@@ -251,8 +252,20 @@
     }
 
     #[test]
+    #[serial_test::serial(env)]
     fn leader_receiver_short_endpoint_must_not_reconstruct_tmux_l_socket() {
         let endpoint = "dl9aa40c88";
+        let uid = unsafe { libc::geteuid() };
+        let tmp = std::env::temp_dir().join(format!(
+            "ta-tmux-short-endpoint-{}",
+            std::process::id()
+        ));
+        let root = tmp.join(format!("tmux-{uid}"));
+        std::fs::create_dir_all(&root).unwrap();
+        let socket_path = root.join(endpoint);
+        let _listener = UnixListener::bind(&socket_path).unwrap();
+        let socket_path = socket_path.canonicalize().unwrap();
+        let _env = EnvGuard::apply(&[("TMPDIR", Some(tmp.to_str().unwrap()))]);
         let (be, rec) = {
             let recorded = Arc::new(Mutex::new(Vec::new()));
             let runner = MockCommandRunner {
@@ -275,6 +288,14 @@
             "non-canonical leader endpoints must be rejected or left unbound, never reconstructed as \
              tmux -L <short> under the coordinator socket root; calls={calls:?}"
         );
+        assert!(
+            calls.iter().all(|call| call.starts_with(&[
+                "tmux".to_string(),
+                "-S".to_string(),
+                socket_path.to_string_lossy().to_string()
+            ])),
+            "short leader endpoints must resolve to the existing physical socket path with -S; calls={calls:?}"
+        );
     }
 
     // ── 1. has_session: exit 0 -> true, exit 1 -> false; argv = `tmux has-session -t <s>` ──────────

package/crates/team-agent/src/tmux_backend.rs

@@ -233,6 +233,12 @@ impl TmuxBackend {
                 socket: Some(TmuxSocketEndpoint::Path(endpoint.to_string())),
                 event_workspace: None,
             }
+        } else if let Some(path) = socket_path_for_name(endpoint) {
+            Self {
+                runner: Box::new(RealCommandRunner),
+                socket: Some(TmuxSocketEndpoint::Path(path.to_string_lossy().into_owned())),
+                event_workspace: None,
+            }
         } else {
             Self::new()
         }
@@ -275,6 +281,12 @@ impl TmuxBackend {
                 socket: None,
                 event_workspace: None,
             }
+        } else if let Some(path) = socket_path_for_name(endpoint) {
+            Self {
+                runner,
+                socket: Some(TmuxSocketEndpoint::Path(path.to_string_lossy().into_owned())),
+                event_workspace: None,
+            }
         } else {
             Self {
                 runner,
@@ -340,13 +352,7 @@ pub(crate) fn socket_name_for_workspace(workspace: &Path) -> String {
 }
 
 pub(crate) fn socket_path_for_workspace(workspace: &Path) -> Option<PathBuf> {
-    if let Some(existing) = existing_socket_path_for_workspace(workspace) {
-        return Some(existing);
-    }
-    let uid = unsafe { libc::geteuid() };
-    let default_root = PathBuf::from(format!("/tmp/tmux-{uid}"));
-    let default_root = default_root.canonicalize().unwrap_or(default_root);
-    Some(default_root.join(socket_name_for_workspace(workspace)))
+    socket_path_for_name(&socket_name_for_workspace(workspace))
 }
 
 pub(crate) fn socket_probe_missing_for_workspace(workspace: &Path) -> bool {
@@ -354,11 +360,27 @@ pub(crate) fn socket_probe_missing_for_workspace(workspace: &Path) -> bool {
 }
 
 fn existing_socket_path_for_workspace(workspace: &Path) -> Option<PathBuf> {
-    let socket_name = socket_name_for_workspace(workspace);
+    existing_socket_path_for_name(&socket_name_for_workspace(workspace))
+}
+
+pub(crate) fn socket_path_for_name(socket_name: &str) -> Option<PathBuf> {
+    if socket_name.is_empty() || socket_name == "default" || Path::new(socket_name).is_absolute() {
+        return None;
+    }
+    if let Some(existing) = existing_socket_path_for_name(socket_name) {
+        return Some(existing);
+    }
+    let uid = unsafe { libc::geteuid() };
+    let default_root = PathBuf::from(format!("/tmp/tmux-{uid}"));
+    let default_root = default_root.canonicalize().unwrap_or(default_root);
+    Some(default_root.join(socket_name))
+}
+
+fn existing_socket_path_for_name(socket_name: &str) -> Option<PathBuf> {
     let roots = tmux_socket_roots();
     for root in &roots {
         let root = root.canonicalize().unwrap_or_else(|_| root.clone());
-        let candidate = root.join(&socket_name);
+        let candidate = root.join(socket_name);
         if candidate.exists() {
             return Some(candidate.canonicalize().unwrap_or(candidate));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.3.18",
+  "version": "0.3.19",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.3.18",
-    "@team-agent/cli-darwin-x64": "0.3.18",
-    "@team-agent/cli-linux-x64": "0.3.18"
+    "@team-agent/cli-darwin-arm64": "0.3.19",
+    "@team-agent/cli-darwin-x64": "0.3.19",
+    "@team-agent/cli-linux-x64": "0.3.19"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",