@team-agent/installer 0.3.23 → 0.3.24

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.3.23"
+version = "0.3.24"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.3.23"
+version = "0.3.24"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/leader/lease.rs

@@ -2,7 +2,7 @@
 //! + 双写 / 分叉检测。
 
 use std::collections::BTreeSet;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use serde_json::{json, Value};
 
@@ -1024,14 +1024,27 @@ fn state_owner(state: &Value) -> Option<TeamOwner> {
 pub fn write_lease_dual_state(workspace: &Path, state: &Value) -> Result<(), LeaderError> {
     crate::state::persist::save_runtime_state(workspace, state)?;
     if let Some(session_name) = state.get("session_name").and_then(Value::as_str) {
-        let snap_path = crate::model::paths::runtime_dir(workspace)
-            .join("teams")
-            .join(session_name)
-            .join("state.json");
-        if let Some(parent) = snap_path.parent() {
-            std::fs::create_dir_all(parent)?;
-        }
-        std::fs::write(snap_path, serde_json::to_string_pretty(state)?)?;
+        write_team_snapshot_atomic(workspace, session_name, state)?;
+    }
+    Ok(())
+}
+
+fn write_team_snapshot_atomic(
+    workspace: &Path,
+    session_name: &str,
+    state: &Value,
+) -> Result<(), LeaderError> {
+    let snap_path = crate::lifecycle::helpers::team_snapshot_path(workspace, session_name);
+    let parent = snap_path
+        .parent()
+        .ok_or_else(|| LeaderError::Validation("team snapshot path has no parent".to_string()))?;
+    std::fs::create_dir_all(parent)?;
+    let tmp = parent.join(format!("state.json.tmp-{}", std::process::id()));
+    let data = serde_json::to_vec_pretty(state)?;
+    std::fs::write(&tmp, data)?;
+    if let Err(error) = std::fs::rename(&tmp, &snap_path) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(error.into());
     }
     Ok(())
 }
@@ -1113,10 +1126,7 @@ pub fn detect_dual_state_divergence(
     let Some(session_name) = state.get("session_name").and_then(Value::as_str) else {
         return Ok(None);
     };
-    let snap_path = crate::model::paths::runtime_dir(workspace)
-        .join("teams")
-        .join(session_name)
-        .join("state.json");
+    let snap_path = readable_team_snapshot_path(workspace, session_name);
     if !snap_path.exists() {
         return Ok(None);
     }
@@ -1150,6 +1160,17 @@ pub fn detect_dual_state_divergence(
     })))
 }
 
+fn readable_team_snapshot_path(workspace: &Path, session_name: &str) -> PathBuf {
+    let safe_path = crate::lifecycle::helpers::team_snapshot_path(workspace, session_name);
+    if safe_path.exists() {
+        return safe_path;
+    }
+    crate::model::paths::runtime_dir(workspace)
+        .join("teams")
+        .join(session_name)
+        .join("state.json")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

package/crates/team-agent/src/leader/tests/lease_api.rs

@@ -145,6 +145,85 @@ use super::*;
         );
     }
 
+    #[test]
+    fn lease_divergence_reads_restart_snapshot_for_special_session_names() {
+        let ws = std::env::temp_dir().join(format!("ta_rs_dual_special_{}", std::process::id()));
+        std::fs::create_dir_all(&ws).unwrap();
+        let state = serde_json::json!({
+            "session_name": "team:proj-中文",
+            "team_owner": {"pane_id": "%1", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
+            "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
+        });
+        write_lease_dual_state(&ws, &state).unwrap();
+        let safe_path = crate::lifecycle::helpers::team_snapshot_path(&ws, "team:proj-中文");
+        let raw_path = crate::model::paths::runtime_dir(&ws)
+            .join("teams")
+            .join("team:proj-中文")
+            .join("state.json");
+        assert!(
+            safe_path.exists(),
+            "lease snapshot must use the restart-safe path: {}",
+            safe_path.display()
+        );
+        assert!(
+            !raw_path.exists(),
+            "new lease writes must not create the legacy raw session path: {}",
+            raw_path.display()
+        );
+
+        let restart_state = serde_json::json!({
+            "session_name": "team:proj-中文",
+            "team_owner": {"pane_id": "%9", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
+            "leader_receiver": {"pane_id": "%9", "owner_epoch": 2},
+        });
+        let restart_path = crate::lifecycle::save_team_runtime_snapshot(&ws, &restart_state).unwrap();
+        assert_eq!(restart_path, safe_path);
+        assert!(
+            restart_path.exists(),
+            "restart snapshot must be written to a real file: {}",
+            restart_path.display()
+        );
+
+        let d = detect_dual_state_divergence(&ws, &state)
+            .unwrap()
+            .expect("divergence detector must read the restart-written snapshot");
+        assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
+        assert_eq!(d["team_owner_pane"], serde_json::json!("%9"));
+        assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
+        assert_eq!(d["team_receiver_pane"], serde_json::json!("%9"));
+    }
+
+    #[test]
+    fn detect_dual_state_divergence_reads_legacy_raw_snapshot_when_safe_absent() {
+        let ws = std::env::temp_dir().join(format!("ta_rs_dual_legacy_{}", std::process::id()));
+        std::fs::create_dir_all(&ws).unwrap();
+        let state = serde_json::json!({
+            "session_name": "team:legacy-中文",
+            "team_owner": {"pane_id": "%1", "leader_session_uuid": "uuuu", "owner_epoch": 2},
+            "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
+        });
+        let safe_path = crate::lifecycle::helpers::team_snapshot_path(&ws, "team:legacy-中文");
+        assert!(!safe_path.exists(), "test setup requires safe path absent");
+        let raw_dir = crate::model::paths::runtime_dir(&ws)
+            .join("teams")
+            .join("team:legacy-中文");
+        std::fs::create_dir_all(&raw_dir).unwrap();
+        let snap = serde_json::json!({
+            "session_name": "team:legacy-中文",
+            "team_owner": {"pane_id": "%8", "leader_session_uuid": "uuuu", "owner_epoch": 2},
+            "leader_receiver": {"pane_id": "%8", "owner_epoch": 2},
+        });
+        std::fs::write(raw_dir.join("state.json"), serde_json::to_string(&snap).unwrap()).unwrap();
+
+        let d = detect_dual_state_divergence(&ws, &state)
+            .unwrap()
+            .expect("legacy raw snapshot fallback must preserve old teams");
+        assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
+        assert_eq!(d["team_owner_pane"], serde_json::json!("%8"));
+        assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
+        assert_eq!(d["team_receiver_pane"], serde_json::json!("%8"));
+    }
+
     // detect_dual_state_divergence:无 session_name → None(__init__.py:560-561);unimplemented → RED。
     #[test]
     fn detect_dual_state_divergence_none_without_session_name() {

package/crates/team-agent/src/lifecycle/helpers.rs

@@ -16,14 +16,15 @@ pub fn save_team_runtime_snapshot(
         .get("session_name")
         .and_then(|v| v.as_str())
         .ok_or_else(|| LifecycleError::StatePersist("session_name is required".to_string()))?;
-    let safe = safe_snapshot_name(session_name);
     // golden restart/snapshot.py:46-47 — team_runtime_snapshot_dir = runtime_dir(workspace)/teams/<safe>,
     // and paths.py:25-26 runtime_dir = workspace/.team/runtime. Use the crate path helper so the snapshot
     // lands at <ws>/.team/runtime/teams/<safe>, matching golden AND the rest of the crate (not the
     // ".team"-less <ws>/runtime/teams that the original port wrote).
-    let dir = crate::model::paths::runtime_dir(workspace).join("teams").join(safe);
+    let path = team_snapshot_path(workspace, session_name);
+    let dir = path
+        .parent()
+        .ok_or_else(|| LifecycleError::StatePersist("snapshot path has no parent".to_string()))?;
     fs::create_dir_all(&dir).map_err(|e| persist_err("create snapshot dir", &e))?;
-    let path = dir.join("state.json");
     let tmp = dir.join("state.json.tmp");
     let data = serde_json::to_vec_pretty(state)
         .map_err(|e| LifecycleError::StatePersist(format!("serialize snapshot: {e}")))?;
@@ -32,6 +33,13 @@ pub fn save_team_runtime_snapshot(
     Ok(path)
 }
 
+pub fn team_snapshot_path(workspace: &Path, session_name: &str) -> PathBuf {
+    crate::model::paths::runtime_dir(workspace)
+        .join("teams")
+        .join(safe_snapshot_name(session_name))
+        .join("state.json")
+}
+
 fn persist_err(action: &str, err: &io::Error) -> LifecycleError {
     LifecycleError::StatePersist(format!("{action}: {err}"))
 }

package/crates/team-agent/src/lifecycle/launch.rs

@@ -213,8 +213,7 @@ fn spawn_agents(
             safety,
         )?;
         let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
-        let mcp_team_id =
-            runtime_active_team_key_for_spawn(workspace, spec_path, spec, session_name);
+        let mcp_team_id = runtime_team_key_for_spec(spec_path, spec, session_name);
         let mcp_config = adapter
             .mcp_config(auth_mode)
             .map_err(|e| LifecycleError::Provider(e.to_string()))?;
@@ -724,8 +723,7 @@ fn persist_spawn_agent_state(
     } else {
         serde_json::json!({"agents": {}})
     };
-    let team_id = explicit_active_team_key(&state)
-        .unwrap_or_else(|| runtime_team_key_for_spec(spec_path, spec, session_name));
+    let team_id = runtime_team_key_for_spec(spec_path, spec, session_name);
     let worker_tmux_socket = launched_worker_tmux_socket(transport, workspace);
     drop_worker_pane_seeded_owner(&mut state, &team_id, started, worker_tmux_socket.as_deref());
     // Only persist running state for agents whose spawn still has a live target.
@@ -2330,18 +2328,6 @@ fn spec_team_id(spec: &Value) -> Option<String> {
         .or_else(|| spec.get("name").and_then(Value::as_str).map(str::to_string))
 }
 
-fn runtime_active_team_key_for_spawn(
-    workspace: &Path,
-    spec_path: &Path,
-    spec: &Value,
-    session_name: &SessionName,
-) -> String {
-    load_runtime_state(workspace)
-        .ok()
-        .and_then(|state| explicit_active_team_key(&state))
-        .unwrap_or_else(|| runtime_team_key_for_spec(spec_path, spec, session_name))
-}
-
 fn explicit_active_team_key(state: &serde_json::Value) -> Option<String> {
     state
         .get("active_team_key")

package/crates/team-agent/src/messaging/delivery.rs

@@ -203,8 +203,42 @@ pub fn deliver_pending_message(
     let delivery_transport =
         delivery_transport_for_recipient(workspace, transport, state, &message.recipient);
     let transport = delivery_transport.as_transport();
+    // U1-B: probe `list_targets()` ONCE per delivery and DEFER on Err. The prior
+    // `.unwrap_or_default()` coerced server jitter (Err = subprocess fork failed)
+    // to an empty vec, and the downstream cache-reuse branch
+    // (`live_targets.is_empty() && !known_dead`) would then inject into a
+    // never-validated cached pane on every tmux hiccup. Err is OBSERVED here as
+    // jitter and the delivery is deferred (status stays `target_resolved`, no
+    // inject attempted) so the next tick gets a fresh probe.
+    let live_targets = match transport.list_targets() {
+        Ok(targets) => targets,
+        Err(err) => {
+            let reason = format!("list_targets_server_jitter:{err}");
+            event_log.write(
+                "delivery.deferred_list_targets_jitter",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "recipient": message.recipient,
+                    "reason": reason,
+                }),
+            )?;
+            store.mark(message_id, "target_resolved", Some(&reason))?;
+            return Ok(DeliveryOutcome {
+                ok: false,
+                status: DeliveryStatus::Degraded,
+                message_status: MessageStatusShadow("target_resolved".to_string()),
+                message_id: Some(message_id.to_string()),
+                verification: Some(reason),
+                stage: None,
+                reason: None,
+                channel: None,
+            });
+        }
+    };
     // Do not inject queued leader messages into a synthetic "leader" window.
-    if message.recipient == "leader" && !leader_receiver_pane_is_usable(transport, state) {
+    if message.recipient == "leader"
+        && !leader_receiver_pane_is_usable(transport, state, &live_targets)
+    {
         store.mark(message_id, "failed", Some("leader_not_attached"))?;
         event_log.write(
             "leader_receiver.delivery_blocked",
@@ -227,7 +261,7 @@ pub fn deliver_pending_message(
             channel: Some("rebind_required".to_string()),
         });
     }
-    let target = resolve_inject_target(state, &message.recipient, transport);
+    let target = resolve_inject_target(state, &message.recipient, transport, &live_targets);
     // Contract B / MUST-10 / N31/N32: physical paste+Enter into a startup trust/update
     // menu is NOT provider delivery — the menu consumes the Enter and the task text
     // is lost (PROBE-2 root-cause). Before injection, peek at the recipient's pane for
@@ -473,12 +507,24 @@ fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id
 ///
 /// Leader delivery uses the bound leader receiver pane. The leader is not a worker agent and
 /// must not fall through to a synthetic `SessionWindow{window="leader"}` target.
+///
+/// `live_targets` is passed in BY THE CALLER (probed ONCE per delivery — see U1-B); this fn is
+/// pure w.r.t. transport state. The caller must DEFER on `list_targets()` Err and never coerce
+/// to an empty vec.
+///
+/// **0.3.24 excision (U1-A real-machine RED v2, macmini fixture res_e4b40473d36f)**:
+/// the wave-2 LEADER drift fallback chain (session+window probe) was removed — see
+/// `.team/artifacts/u1-a-realmachine-v2-fix-or-excise.md` for the root-cause analysis.
+/// Drift now fails loudly as `leader_not_attached` rather than silently selecting a stale
+/// pane. U1-A real-machine fix is deferred to v0.3.25 (writer-shape + projection +
+/// rediscover-writer triad). U1-B jitter defer at try_deliver_message:213-237 and
+/// U1-C-Tail at the startup-prompt peek site are unchanged.
 fn resolve_inject_target(
     state: &serde_json::Value,
     recipient: &str,
     transport: &dyn Transport,
+    live_targets: &[PaneInfo],
 ) -> Target {
-    let live_targets = transport.list_targets().unwrap_or_default();
     if recipient == "leader" {
         if let Some(pane_id) = leader_receiver_pane_id(state) {
             return Target::Pane(PaneId::new(pane_id));
@@ -507,7 +553,7 @@ fn resolve_inject_target(
             return Target::Pane(pane.clone());
         }
     }
-    if let Some(live_pane) = live_pane_for_session_window(&live_targets, session, window) {
+    if let Some(live_pane) = live_pane_for_session_window(live_targets, session, window) {
         return Target::Pane(live_pane);
     }
     if let Some(pane) = cached_pane {
@@ -552,16 +598,21 @@ fn leader_receiver_pane_id(state: &serde_json::Value) -> Option<&str> {
         .or_else(|| only_team_entry(state).and_then(leader_receiver_pane_id_in_state))
 }
 
-fn leader_receiver_pane_is_usable(transport: &dyn Transport, state: &serde_json::Value) -> bool {
+/// `state` is "usable" for leader delivery when the bound `leader_receiver.pane_id`
+/// is present and alive (in `live_targets` or `liveness` probe returns not-Dead).
+///
+/// **0.3.24 excision (U1-A real-machine RED v2)**: the wave-2 session+window drift
+/// fallback was removed. Drift now fails loudly as `leader_not_attached` —
+/// see resolve_inject_target and `.team/artifacts/u1-a-realmachine-v2-fix-or-excise.md`.
+fn leader_receiver_pane_is_usable(
+    transport: &dyn Transport,
+    state: &serde_json::Value,
+    live_targets: &[PaneInfo],
+) -> bool {
     let Some(pane_id) = leader_receiver_pane_id(state) else {
         return false;
     };
-    if transport
-        .list_targets()
-        .unwrap_or_default()
-        .iter()
-        .any(|target| target.pane_id.as_str() == pane_id)
-    {
+    if live_targets.iter().any(|target| target.pane_id.as_str() == pane_id) {
         return true;
     }
     !matches!(
@@ -956,8 +1007,16 @@ fn recipient_pane_has_actionable_startup_prompt(
     if matches!(startup_prompts, Some("handled" | "complete")) {
         return false;
     }
+    // U1-C wave-2: Tail(80) instead of Full. The peek is the DELIVERY-SITE pre-check
+    // (NOT the startup-prompts dismissal phase, which legitimately needs the full
+    // scrollback to anchor recency). Limiting to the visible screen avoids matching
+    // residual already-answered trust modals that scrolled off — while a live trust
+    // modal would still appear in the last 80 lines because Codex pins it to the
+    // visible region until dismissed. Pair this with the U1-C recency guard in
+    // `has_actionable_trust_shape`: either fix alone covers the symptom; both
+    // together defend against both scrollback-residue AND pre-render pathologies.
     let captured = match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
-        transport.capture(target, crate::transport::CaptureRange::Full)
+        transport.capture(target, crate::transport::CaptureRange::Tail(80))
     })) {
         Ok(Ok(captured)) => captured.text,
         _ => return false,
@@ -1351,27 +1410,15 @@ pub(crate) fn normalize_owner_team_id_rows(
     if requested == canonical {
         return Ok(());
     }
-    let store = MessageStore::open(workspace)?;
-    let conn = crate::db::schema::open_db(store.db_path())?;
-    for table in [
-        "messages",
-        "results",
-        "scheduled_events",
-        "agent_health",
-        "result_watchers",
-        "leader_notification_log",
-    ] {
-        let sql =
-            format!("update or ignore {table} set owner_team_id = ?1 where owner_team_id = ?2");
-        conn.execute(&sql, params![canonical, requested])?;
-    }
     if let Some(event_log) = event_log {
         event_log.write(
-            "owner_team_id.compatibility_alias_migrated",
+            "owner_team_id.compatibility_alias_detected",
             serde_json::json!({
                 "requested_owner_team_id": requested,
                 "canonical_owner_team_id": canonical,
                 "message_id": message_id,
+                "action": "read_only_no_db_update",
+                "workspace": workspace.to_string_lossy().to_string(),
             }),
         )?;
     }

package/crates/team-agent/src/messaging/tests/mod.rs

@@ -295,3 +295,4 @@ mod e23;
 mod main_preserved;
 mod runtime;
 mod spine;
+mod wave2;