@team-agent/installer 0.3.21 → 0.3.22

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -107,8 +107,21 @@ fn p2_scheduler_unknown_kind_surfaces_error() {
     )
     .unwrap();
     let log = EventLog::new(&ws);
-    let r = fire_due_scheduled_events(&ws, &store, &NoopTransport, &log);
-    assert!(r.is_err(), "an unknown scheduled event kind must surface an error, not a silent ok=false");
+    // U1 #5: unknown kind is isolated to its own row (marked terminal 'failed' +
+    // scheduler.event_failed), NOT propagated as a pass-level Err that would halt the
+    // batch. Failure stays loud (evented) but does not take the whole scheduler down.
+    let fired = fire_due_scheduled_events(&ws, &store, &NoopTransport, &log)
+        .expect("an unknown scheduled event kind must be isolated to its row, not halt the pass");
+    assert_eq!(fired.len(), 1);
+    assert_eq!(scheduled_status_of(&store, fired[0]), "failed");
+    let events = log.tail(0).unwrap();
+    assert!(
+        events.iter().any(|event| {
+            event.get("event").and_then(serde_json::Value::as_str) == Some("scheduler.event_failed")
+                && event.get("event_id").and_then(serde_json::Value::as_i64) == Some(fired[0])
+        }),
+        "unknown scheduled event kind must leave scheduler.event_failed; events={events:?}"
+    );
 }
 
 // ═════════════════════════════════════════════════════════════════════════
@@ -313,6 +326,42 @@ fn spine_scheduler_marks_failed_when_result_not_ok() {
     );
 }
 
+// U1 #5 (RED) — a single poison scheduled event (malformed payload_json that errors at
+// `serde_json::from_str?`) must NOT halt the whole pass: it must be marked terminal 'failed'
+// + emit `scheduler.event_failed`, and a healthy event seeded AFTER it must still fire.
+// Today the bare `?` aborts `fire_due_scheduled_events`, the healthy event never fires → RED.
+#[test]
+fn spine_scheduler_poison_event_does_not_halt_batch() {
+    let ws = tmp_ws("sched-poison");
+    let store = store_for(&ws);
+    let log = EventLog::new(&ws);
+    // earlier due_at → selected first; malformed JSON payload errors at from_str.
+    let poison = seed_event_due(&store, "send", "2000-01-01T00:00:00+00:00", "{not valid json");
+    // later due_at → selected after poison; healthy.
+    let healthy = seed_event_due(&store, "health_ping", "2000-01-02T00:00:00+00:00", "{}");
+
+    let fired = fire_due_scheduled_events(&ws, &store, &NoopTransport, &log)
+        .expect("a poison event must not propagate as a pass-level Err (must isolate + continue)");
+
+    // poison marked terminal failed (not re-fired every tick).
+    assert_eq!(
+        scheduled_status_of(&store, poison),
+        "failed",
+        "U1 #5: a poison scheduled event must be marked terminal 'failed', not halt the pass"
+    );
+    // healthy event AFTER the poison still fired.
+    assert!(
+        fired.contains(&healthy),
+        "U1 #5: a healthy event after a poison one must still fire (batch not halted); fired={fired:?}"
+    );
+    // failure is loud: scheduler.event_failed event emitted for the poison.
+    let events = read_event_log(&ws);
+    assert!(
+        events.iter().any(|e| e.get("event").and_then(|v| v.as_str()) == Some("scheduler.event_failed")),
+        "U1 #5: a poison event must emit scheduler.event_failed (failure must be loud, not silent)"
+    );
+}
+
 // #6b — due events fire in (due_at, id) order (core.py due_scheduled_events), not id order.
 #[test]
 fn spine_scheduler_orders_due_events_by_due_at_then_id() {

package/crates/team-agent/src/session_capture.rs

@@ -19,9 +19,16 @@ pub struct CapturePassReport {
     pub pending: Vec<String>,
     pub assigned: Vec<String>,
     pub ambiguous: Vec<AmbiguousSessionCapture>,
+    pub capture_failures: Vec<SessionCaptureFailure>,
     pub candidate_count_by_agent: BTreeMap<String, usize>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SessionCaptureFailure {
+    pub agent_id: String,
+    pub error: String,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AmbiguousSessionCapture {
     pub agent_id: String,
@@ -140,13 +147,24 @@ where
         return Ok(CapturePassReport::default());
     };
     let mut pending = Vec::new();
+    let mut capture_failures = Vec::new();
     let mut candidates_by_agent = BTreeMap::new();
     for (agent_id, agent) in agent_map {
         let Some(capture) = pending_session_capture(agent_id, agent, adapter_for) else {
             continue;
         };
         let adapter = adapter_for(capture.provider);
-        let candidates = adapter.capture_session_candidates(&capture.context, timeout_s)?;
+        let candidates = match adapter.capture_session_candidates(&capture.context, timeout_s) {
+            Ok(candidates) => candidates,
+            Err(error) => {
+                capture_failures.push(SessionCaptureFailure {
+                    agent_id: capture.agent_id.clone(),
+                    error: error.to_string(),
+                });
+                pending.push(capture);
+                continue;
+            }
+        };
         candidates_by_agent.insert(capture.agent_id.clone(), candidates);
         pending.push(capture);
     }
@@ -164,6 +182,7 @@ where
     };
     let mut report = CapturePassReport {
         pending: pending.iter().map(|item| item.agent_id.clone()).collect(),
+        capture_failures,
         candidate_count_by_agent: candidates_by_agent
             .iter()
             .map(|(agent_id, candidates)| (agent_id.clone(), candidates.len()))
@@ -615,3 +634,244 @@ fn parse_provider(raw: &str) -> Option<Provider> {
         _ => None,
     }
 }
+
+#[cfg(test)]
+pub(crate) mod test_support {
+    use super::*;
+
+    #[derive(Clone)]
+    pub(crate) struct CaptureCandidatesAdapter {
+        provider: Provider,
+        fail_agent_id: Option<String>,
+        error: String,
+    }
+
+    impl CaptureCandidatesAdapter {
+        pub(crate) fn new(provider: Provider, fail_agent_id: Option<&str>, error: &str) -> Self {
+            Self {
+                provider,
+                fail_agent_id: fail_agent_id.map(str::to_string),
+                error: error.to_string(),
+            }
+        }
+    }
+
+    impl ProviderAdapter for CaptureCandidatesAdapter {
+        fn provider(&self) -> Provider {
+            self.provider
+        }
+
+        fn caps(&self) -> crate::provider::ProviderCaps {
+            crate::provider::ProviderCaps {
+                resume: true,
+                fork: false,
+                native_mcp_config: false,
+                writes_global_settings: false,
+            }
+        }
+
+        fn is_installed(&self) -> bool {
+            true
+        }
+
+        fn version(&self) -> Result<String, ProviderError> {
+            Ok("test".to_string())
+        }
+
+        fn auth_hint(
+            &self,
+            _auth_mode: crate::provider::AuthMode,
+        ) -> crate::provider::AuthHintStatus {
+            crate::provider::AuthHintStatus::Unknown
+        }
+
+        fn build_command(
+            &self,
+            _auth_mode: crate::provider::AuthMode,
+            _mcp_config: Option<&crate::provider::McpConfig>,
+            _system_prompt: Option<&str>,
+            _model: Option<&str>,
+        ) -> Result<Vec<String>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn build_command_with_tools(
+            &self,
+            _auth_mode: crate::provider::AuthMode,
+            _mcp_config: Option<&crate::provider::McpConfig>,
+            _system_prompt: Option<&str>,
+            _model: Option<&str>,
+            _tools: &[&str],
+        ) -> Result<Vec<String>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn capture_session_id(
+            &self,
+            _agent_id: &str,
+            _spawn_cwd: &std::path::Path,
+            _timeout_s: u64,
+        ) -> Result<Option<CapturedSession>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn capture_session_candidates(
+            &self,
+            context: &CaptureSessionContext,
+            _timeout_s: u64,
+        ) -> Result<Vec<CapturedSessionCandidate>, ProviderError> {
+            if self.fail_agent_id.as_deref() == Some(context.agent_id.as_str()) {
+                return Err(ProviderError::Io(self.error.clone()));
+            }
+            Ok(Vec::new())
+        }
+
+        fn recover_session_id(
+            &self,
+            _agent_id: &str,
+            _spawn_cwd: &std::path::Path,
+        ) -> Result<Option<SessionId>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn session_is_resumable(
+            &self,
+            _session_id: Option<&SessionId>,
+            _auth_mode: crate::provider::AuthMode,
+        ) -> Result<bool, ProviderError> {
+            Ok(true)
+        }
+
+        fn build_resume_command(
+            &self,
+            _session_id: Option<&SessionId>,
+            _auth_mode: crate::provider::AuthMode,
+            _mcp_config: Option<&crate::provider::McpConfig>,
+        ) -> Result<Vec<String>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn build_resume_command_with_context(
+            &self,
+            _session_id: Option<&SessionId>,
+            _auth_mode: crate::provider::AuthMode,
+            _mcp_config: Option<&crate::provider::McpConfig>,
+            _system_prompt: Option<&str>,
+            _model: Option<&str>,
+            _tools: &[&str],
+        ) -> Result<Vec<String>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn fork(
+            &self,
+            _session_id: Option<&SessionId>,
+            _auth_mode: crate::provider::AuthMode,
+            _mcp_config: Option<&crate::provider::McpConfig>,
+        ) -> Result<Vec<String>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn fork_with_context(
+            &self,
+            _session_id: Option<&SessionId>,
+            _auth_mode: crate::provider::AuthMode,
+            _mcp_config: Option<&crate::provider::McpConfig>,
+            _system_prompt: Option<&str>,
+            _model: Option<&str>,
+            _tools: &[&str],
+        ) -> Result<Vec<String>, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn mcp_config(
+            &self,
+            _auth_mode: crate::provider::AuthMode,
+        ) -> Result<crate::provider::McpConfig, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn install_mcp(&self, _config: &crate::provider::McpConfig) -> Result<(), ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn status_patterns(&self) -> Result<crate::provider::StatusPatterns, ProviderError> {
+            Err(ProviderError::CapabilityUnsupported(
+                "test adapter".to_string(),
+            ))
+        }
+
+        fn validate_model(&self, _model: &str) -> Result<bool, ProviderError> {
+            Ok(true)
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod u1_tests {
+    use super::*;
+
+    #[test]
+    fn capture_pass_keeps_pending_agent_when_one_adapter_capture_fails() {
+        let mut state = serde_json::json!({
+            "agents": {
+                "bad": {
+                    "provider": "codex",
+                    "status": "running",
+                    "spawn_cwd": "/tmp/u1-bad"
+                },
+                "good": {
+                    "provider": "codex",
+                    "status": "running",
+                    "spawn_cwd": "/tmp/u1-good"
+                }
+            }
+        });
+        let mut adapter_for = |provider| {
+            Box::new(test_support::CaptureCandidatesAdapter::new(
+                provider,
+                Some("bad"),
+                "capture exploded",
+            )) as Box<dyn ProviderAdapter>
+        };
+
+        let report = capture_missing_provider_sessions_once(&mut state, &mut adapter_for, true, 0)
+            .expect("one agent capture failure must not abort the whole pass");
+
+        assert_eq!(report.pending, vec!["bad".to_string(), "good".to_string()]);
+        assert_eq!(report.assigned, Vec::<String>::new());
+        assert_eq!(
+            report.candidate_count_by_agent.get("good"),
+            Some(&0),
+            "the non-failing agent must still be probed"
+        );
+        assert_eq!(
+            report.capture_failures,
+            vec![SessionCaptureFailure {
+                agent_id: "bad".to_string(),
+                error: "provider io error: capture exploded".to_string(),
+            }]
+        );
+    }
+}

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -349,6 +349,81 @@
         assert_eq!(result.pane_id.as_str(), "%4");
     }
 
+    #[test]
+    fn spawn_split_selects_even_horizontal_not_tiled() {
+        let (be, rec) = backend_with(
+            MockResp::Out(ok("")),
+            vec![MockResp::Out(ok("%5")), MockResp::Out(ok(""))],
+        );
+        let s = SessionName::new("teamsess");
+        let w = WindowName::new("team-w1");
+        let result = be
+            .spawn_split_with_env_unset(
+                &s,
+                &w,
+                &svec(&["provider-bin"]),
+                Path::new("/work/dir"),
+                &BTreeMap::new(),
+                &[],
+            )
+            .expect("spawn_split");
+        assert_eq!(result.pane_id.as_str(), "%5");
+        let calls = rec.lock().unwrap().clone();
+        assert_eq!(
+            calls[0][0..4],
+            svec(&["tmux", "split-window", "-t", "teamsess:team-w1"])
+        );
+        assert_eq!(
+            calls[1],
+            svec(&[
+                "tmux",
+                "select-layout",
+                "-t",
+                "teamsess:team-w1",
+                "even-horizontal",
+            ])
+        );
+        assert!(
+            !calls.iter().flatten().any(|arg| arg == "tiled"),
+            "adaptive split must not leave tmux tiled layout in the command stream: {calls:?}"
+        );
+    }
+
+    #[test]
+    fn configure_adaptive_pane_title_sets_border_and_pane_title() {
+        let (be, rec) = backend_with(MockResp::Out(ok("")), vec![]);
+        be.configure_adaptive_pane_title(
+            &SessionName::new("teamsess"),
+            &WindowName::new("team-w1"),
+            &PaneId::new("%7"),
+            "builder",
+        )
+        .expect("configure title");
+        let calls = rec.lock().unwrap().clone();
+        assert_eq!(
+            calls,
+            vec![
+                svec(&[
+                    "tmux",
+                    "set-window-option",
+                    "-t",
+                    "teamsess:team-w1",
+                    "pane-border-status",
+                    "bottom",
+                ]),
+                svec(&[
+                    "tmux",
+                    "set-window-option",
+                    "-t",
+                    "teamsess:team-w1",
+                    "pane-border-format",
+                    " #{pane_title} ",
+                ]),
+                svec(&["tmux", "select-pane", "-t", "%7", "-T", "builder"]),
+            ]
+        );
+    }
+
     // ── 3. set_session_env: argv = `tmux set-environment -t <s> <k> <v>`; success -> Applied ───────
     #[test]
     fn set_session_env_argv_and_applied_outcome() {
@@ -414,8 +489,10 @@
 
     #[test]
     fn inject_large_text_load_buffer_writes_stdin_and_token_report() {
-        let (be, rec, stdin_rec) = backend_with_stdin(MockResp::Out(ok("")), vec![]);
         let text = format!("{}{}", "x".repeat(16 * 1024), " [team-agent-token:abc]");
+        // U1 #7: the pre-submit readback captures the pane; a pane that ECHOES the token
+        // back (default capture returns the text) → CaptureContainsToken (true positive).
+        let (be, rec, stdin_rec) = backend_with_stdin(MockResp::Out(ok(&text)), vec![]);
         let report = be
             .inject(&Target::Pane(PaneId::new("%7")), &InjectPayload::Text(text.clone()), Key::Down, true)
             .expect("inject large text");
@@ -430,6 +507,25 @@
         assert_eq!(stdin_rec.lock().unwrap()[0], text);
     }
 
+    // U1 #7 (RED→GREEN) — pre-submit pane readback: a token payload whose token is NOT
+    // visible in the pane before submit (paste silently dropped) must report
+    // CaptureMissingToken, not the static false-positive CaptureContainsToken.
+    #[test]
+    fn inject_token_not_visible_in_pane_reports_capture_missing_token() {
+        let text = format!("{}{}", "x".repeat(16 * 1024), " [team-agent-token:zzz]");
+        // default capture returns empty → token not visible → readback says missing.
+        let (be, _rec, _stdin) = backend_with_stdin(MockResp::Out(ok("")), vec![]);
+        let report = be
+            .inject(&Target::Pane(PaneId::new("%9")), &InjectPayload::Text(text), Key::Down, true)
+            .expect("inject runs");
+        assert_eq!(
+            report.inject_verification,
+            InjectVerification::CaptureMissingToken,
+            "U1 #7: a token that never appeared in the pane must read back as \
+CaptureMissingToken, not the static CaptureContainsToken false-positive"
+        );
+    }
+
     #[test]
     fn send_keys_cancel_mode_queries_mode_and_dispatches_cancel_argv() {
         let (be, rec) = backend_with(

package/crates/team-agent/src/tmux_backend.rs

@@ -669,7 +669,7 @@ impl TmuxBackend {
             "select-layout".to_string(),
             "-t".to_string(),
             target,
-            "tiled".to_string(),
+            "even-horizontal".to_string(),
         ];
         self.run_ok(&layout_argv)?;
         Ok(SpawnResult {
@@ -816,6 +816,90 @@ fn inject_verification_for_payload(payload: &InjectPayload) -> InjectVerificatio
     }
 }
 
+/// U1 #7: the exact delivery-token marker a token payload carries
+/// (`[team-agent-token:<id>]`). Use the full marker, not only the prefix, so an old
+/// scrollback token cannot verify a new message.
+fn payload_token_marker(payload: &InjectPayload) -> Option<&str> {
+    match payload {
+        InjectPayload::Text(text) => {
+            let start = text.find("[team-agent-token:")?;
+            let marker = &text[start..];
+            let end = marker.find(']')?;
+            Some(&marker[..=end])
+        }
+        _ => None,
+    }
+}
+
+fn token_visible_in_capture(
+    backend: &TmuxBackend,
+    target: &Target,
+    payload: &InjectPayload,
+) -> Result<Option<bool>, TransportError> {
+    match payload_token_marker(payload) {
+        None => Ok(None),
+        Some(marker) => {
+            let captured = backend.capture(target, CaptureRange::Tail(80))?;
+            Ok(Some(captured.text.contains(marker)))
+        }
+    }
+}
+
+/// U1 #7: capture the pane just before submit and report whether the just-pasted
+/// token marker is actually visible. `Ok(None)` for non-token payloads (nothing to
+/// check). `Ok(Some(false))` means the paste silently dropped — a false-positive that
+/// the static `inject_verification_for_payload` would have reported as success.
+fn pre_submit_token_visible(
+    backend: &TmuxBackend,
+    target: &Target,
+    payload: &InjectPayload,
+) -> Result<Option<bool>, TransportError> {
+    token_visible_in_capture(backend, target, payload)
+}
+
+const TOKEN_POST_SUBMIT_READBACK_POLLS: u32 = 5;
+
+/// Some non-echo panes, including the integration harness' `stty -echo; cat`, only
+/// render the injected line after the submit key. If pre-submit readback missed the
+/// token, do a bounded post-submit check before reporting `CaptureMissingToken`.
+fn post_submit_token_visible(
+    backend: &TmuxBackend,
+    target: &Target,
+    payload: &InjectPayload,
+) -> Result<Option<bool>, TransportError> {
+    if payload_token_marker(payload).is_none() {
+        return Ok(None);
+    }
+    for attempt in 0..TOKEN_POST_SUBMIT_READBACK_POLLS {
+        if let Some(true) = token_visible_in_capture(backend, target, payload)? {
+            return Ok(Some(true));
+        }
+        if attempt + 1 < TOKEN_POST_SUBMIT_READBACK_POLLS {
+            std::thread::sleep(Duration::from_millis(25));
+        }
+    }
+    Ok(Some(false))
+}
+
+/// U1 #7: downgrade the static token verification to `CaptureMissingToken` when the
+/// pre-submit readback did not see the token in the pane. A `None` readback (non-token
+/// payload, or capture unavailable) falls back to the static verification.
+fn inject_verification_after_readback(
+    payload: &InjectPayload,
+    token_visible_before_submit: Option<bool>,
+) -> InjectVerification {
+    match (payload, token_visible_before_submit) {
+        (_, Some(visible)) if payload_token_marker(payload).is_some() => {
+            if visible {
+                InjectVerification::CaptureContainsToken
+            } else {
+                InjectVerification::CaptureMissingToken
+            }
+        }
+        _ => inject_verification_for_payload(payload),
+    }
+}
+
 fn submit_verification_for_key(key: Key) -> SubmitVerification {
     match key {
         Key::Enter => SubmitVerification::EnterSentWithoutPlaceholderCheck,
@@ -960,6 +1044,8 @@ impl Transport for TmuxBackend {
         bracketed: bool,
     ) -> Result<InjectReport, TransportError> {
         let pane = pane_from_target(target);
+        // U1 #7: pane readback signal for the non-pasted-prompt text path.
+        let mut token_visible_for_report: Option<bool> = None;
         match payload {
             InjectPayload::Empty => {
                 let argv = tmux_empty_inject_argv(&pane, submit);
@@ -1010,12 +1096,28 @@ impl Transport for TmuxBackend {
                         attempts,
                     });
                 }
+                // U1 #7 (efd189b redo, canonical-native): around the final submit, read
+                // back the pane and confirm the just-pasted token is actually visible.
+                // The static `inject_verification_for_payload` returns CaptureContainsToken
+                // for any token payload WITHOUT checking the pane — a false positive when
+                // the paste silently dropped. A no-echo pane may only render after Enter,
+                // so a pre-submit miss gets one bounded post-submit readback before we
+                // downgrade to CaptureMissingToken.
+                token_visible_for_report =
+                    pre_submit_token_visible(self, target, payload).unwrap_or(None);
                 self.run_inject_stage(&submit_argv, InjectStage::Submit)?;
+                if matches!(token_visible_for_report, Some(false)) {
+                    token_visible_for_report =
+                        post_submit_token_visible(self, target, payload).unwrap_or(Some(false));
+                }
             }
         }
         Ok(InjectReport {
             stage_reached: InjectStage::Submit,
-            inject_verification: inject_verification_for_payload(payload),
+            inject_verification: inject_verification_after_readback(
+                payload,
+                token_visible_for_report,
+            ),
             submit_verification: submit_verification_for_key(submit),
             turn_verification: match payload {
                 InjectPayload::Empty => TurnVerification::NotRequired,
@@ -1207,6 +1309,40 @@ impl Transport for TmuxBackend {
             .collect())
     }
 
+    fn configure_adaptive_pane_title(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        pane: &PaneId,
+        title: &str,
+    ) -> Result<(), TransportError> {
+        let target = format!("{}:{}", session.as_str(), window.as_str());
+        self.run_ok(&[
+            "tmux".to_string(),
+            "set-window-option".to_string(),
+            "-t".to_string(),
+            target.clone(),
+            "pane-border-status".to_string(),
+            "bottom".to_string(),
+        ])?;
+        self.run_ok(&[
+            "tmux".to_string(),
+            "set-window-option".to_string(),
+            "-t".to_string(),
+            target,
+            "pane-border-format".to_string(),
+            " #{pane_title} ".to_string(),
+        ])?;
+        self.run_ok(&[
+            "tmux".to_string(),
+            "select-pane".to_string(),
+            "-t".to_string(),
+            pane.as_str().to_string(),
+            "-T".to_string(),
+            title.to_string(),
+        ])
+    }
+
     fn set_session_env(
         &self,
         session: &SessionName,