@team-agent/installer 0.3.23 → 0.3.25

package/crates/team-agent/src/messaging/delivery.rs

@@ -203,8 +203,42 @@ pub fn deliver_pending_message(
     let delivery_transport =
         delivery_transport_for_recipient(workspace, transport, state, &message.recipient);
     let transport = delivery_transport.as_transport();
+    // U1-B: probe `list_targets()` ONCE per delivery and DEFER on Err. The prior
+    // `.unwrap_or_default()` coerced server jitter (Err = subprocess fork failed)
+    // to an empty vec, and the downstream cache-reuse branch
+    // (`live_targets.is_empty() && !known_dead`) would then inject into a
+    // never-validated cached pane on every tmux hiccup. Err is OBSERVED here as
+    // jitter and the delivery is deferred (status stays `target_resolved`, no
+    // inject attempted) so the next tick gets a fresh probe.
+    let live_targets = match transport.list_targets() {
+        Ok(targets) => targets,
+        Err(err) => {
+            let reason = format!("list_targets_server_jitter:{err}");
+            event_log.write(
+                "delivery.deferred_list_targets_jitter",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "recipient": message.recipient,
+                    "reason": reason,
+                }),
+            )?;
+            store.mark(message_id, "target_resolved", Some(&reason))?;
+            return Ok(DeliveryOutcome {
+                ok: false,
+                status: DeliveryStatus::Degraded,
+                message_status: MessageStatusShadow("target_resolved".to_string()),
+                message_id: Some(message_id.to_string()),
+                verification: Some(reason),
+                stage: None,
+                reason: None,
+                channel: None,
+            });
+        }
+    };
     // Do not inject queued leader messages into a synthetic "leader" window.
-    if message.recipient == "leader" && !leader_receiver_pane_is_usable(transport, state) {
+    if message.recipient == "leader"
+        && !leader_receiver_pane_is_usable(transport, state, &live_targets)
+    {
         store.mark(message_id, "failed", Some("leader_not_attached"))?;
         event_log.write(
             "leader_receiver.delivery_blocked",
@@ -227,7 +261,7 @@ pub fn deliver_pending_message(
             channel: Some("rebind_required".to_string()),
         });
     }
-    let target = resolve_inject_target(state, &message.recipient, transport);
+    let target = resolve_inject_target(state, &message.recipient, transport, &live_targets);
     // Contract B / MUST-10 / N31/N32: physical paste+Enter into a startup trust/update
     // menu is NOT provider delivery — the menu consumes the Enter and the task text
     // is lost (PROBE-2 root-cause). Before injection, peek at the recipient's pane for
@@ -435,7 +469,19 @@ fn inject_submit_verified(report: &InjectReport) -> bool {
         SubmitVerification::PastedContentPromptStillPresentAfterSubmit => false,
         SubmitVerification::PastedContentPromptAbsentAfterSubmit => true,
         SubmitVerification::KeySentAfterVisibleToken { .. } => true,
+        // MUST-10 preserved: EnterSentWithoutPlaceholderCheck still ⇒ delivered
+        // (provider_submit_verification_red.rs:113-159 contract). E46 narrows
+        // when transport returns this variant: it is now emitted ONLY after
+        // post-Enter input-consumption confirmation succeeds. Fresh TUI
+        // (bracketed-paste-stuck) instead returns SubmitConsumptionUnverified
+        // so this branch keeps delivered semantics intact.
         SubmitVerification::EnterSentWithoutPlaceholderCheck => true,
+        // E46 (0.3.24 bug#5): Enter was sent but post-Enter consumption was
+        // NOT observed within the bounded resend cap. Treat as not delivered
+        // (submitted_unverified / failed) — prevents the macmini假阳 where
+        // demo-director's stuck bracketed-paste swallowed the Enter and
+        // delivery still reported delivered.
+        SubmitVerification::SubmitConsumptionUnverified => false,
     }
 }
 
@@ -473,12 +519,24 @@ fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id
 ///
 /// Leader delivery uses the bound leader receiver pane. The leader is not a worker agent and
 /// must not fall through to a synthetic `SessionWindow{window="leader"}` target.
+///
+/// `live_targets` is passed in BY THE CALLER (probed ONCE per delivery — see U1-B); this fn is
+/// pure w.r.t. transport state. The caller must DEFER on `list_targets()` Err and never coerce
+/// to an empty vec.
+///
+/// **0.3.24 excision (U1-A real-machine RED v2, macmini fixture res_e4b40473d36f)**:
+/// the wave-2 LEADER drift fallback chain (session+window probe) was removed — see
+/// `.team/artifacts/u1-a-realmachine-v2-fix-or-excise.md` for the root-cause analysis.
+/// Drift now fails loudly as `leader_not_attached` rather than silently selecting a stale
+/// pane. U1-A real-machine fix is deferred to v0.3.25 (writer-shape + projection +
+/// rediscover-writer triad). U1-B jitter defer at try_deliver_message:213-237 and
+/// U1-C-Tail at the startup-prompt peek site are unchanged.
 fn resolve_inject_target(
     state: &serde_json::Value,
     recipient: &str,
     transport: &dyn Transport,
+    live_targets: &[PaneInfo],
 ) -> Target {
-    let live_targets = transport.list_targets().unwrap_or_default();
     if recipient == "leader" {
         if let Some(pane_id) = leader_receiver_pane_id(state) {
             return Target::Pane(PaneId::new(pane_id));
@@ -507,7 +565,7 @@ fn resolve_inject_target(
             return Target::Pane(pane.clone());
         }
     }
-    if let Some(live_pane) = live_pane_for_session_window(&live_targets, session, window) {
+    if let Some(live_pane) = live_pane_for_session_window(live_targets, session, window) {
         return Target::Pane(live_pane);
     }
     if let Some(pane) = cached_pane {
@@ -552,16 +610,21 @@ fn leader_receiver_pane_id(state: &serde_json::Value) -> Option<&str> {
         .or_else(|| only_team_entry(state).and_then(leader_receiver_pane_id_in_state))
 }
 
-fn leader_receiver_pane_is_usable(transport: &dyn Transport, state: &serde_json::Value) -> bool {
+/// `state` is "usable" for leader delivery when the bound `leader_receiver.pane_id`
+/// is present and alive (in `live_targets` or `liveness` probe returns not-Dead).
+///
+/// **0.3.24 excision (U1-A real-machine RED v2)**: the wave-2 session+window drift
+/// fallback was removed. Drift now fails loudly as `leader_not_attached` —
+/// see resolve_inject_target and `.team/artifacts/u1-a-realmachine-v2-fix-or-excise.md`.
+fn leader_receiver_pane_is_usable(
+    transport: &dyn Transport,
+    state: &serde_json::Value,
+    live_targets: &[PaneInfo],
+) -> bool {
     let Some(pane_id) = leader_receiver_pane_id(state) else {
         return false;
     };
-    if transport
-        .list_targets()
-        .unwrap_or_default()
-        .iter()
-        .any(|target| target.pane_id.as_str() == pane_id)
-    {
+    if live_targets.iter().any(|target| target.pane_id.as_str() == pane_id) {
         return true;
     }
     !matches!(
@@ -956,8 +1019,16 @@ fn recipient_pane_has_actionable_startup_prompt(
     if matches!(startup_prompts, Some("handled" | "complete")) {
         return false;
     }
+    // U1-C wave-2: Tail(80) instead of Full. The peek is the DELIVERY-SITE pre-check
+    // (NOT the startup-prompts dismissal phase, which legitimately needs the full
+    // scrollback to anchor recency). Limiting to the visible screen avoids matching
+    // residual already-answered trust modals that scrolled off — while a live trust
+    // modal would still appear in the last 80 lines because Codex pins it to the
+    // visible region until dismissed. Pair this with the U1-C recency guard in
+    // `has_actionable_trust_shape`: either fix alone covers the symptom; both
+    // together defend against both scrollback-residue AND pre-render pathologies.
     let captured = match std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
-        transport.capture(target, crate::transport::CaptureRange::Full)
+        transport.capture(target, crate::transport::CaptureRange::Tail(80))
     })) {
         Ok(Ok(captured)) => captured.text,
         _ => return false,
@@ -1351,27 +1422,15 @@ pub(crate) fn normalize_owner_team_id_rows(
     if requested == canonical {
         return Ok(());
     }
-    let store = MessageStore::open(workspace)?;
-    let conn = crate::db::schema::open_db(store.db_path())?;
-    for table in [
-        "messages",
-        "results",
-        "scheduled_events",
-        "agent_health",
-        "result_watchers",
-        "leader_notification_log",
-    ] {
-        let sql =
-            format!("update or ignore {table} set owner_team_id = ?1 where owner_team_id = ?2");
-        conn.execute(&sql, params![canonical, requested])?;
-    }
     if let Some(event_log) = event_log {
         event_log.write(
-            "owner_team_id.compatibility_alias_migrated",
+            "owner_team_id.compatibility_alias_detected",
             serde_json::json!({
                 "requested_owner_team_id": requested,
                 "canonical_owner_team_id": canonical,
                 "message_id": message_id,
+                "action": "read_only_no_db_update",
+                "workspace": workspace.to_string_lossy().to_string(),
             }),
         )?;
     }

package/crates/team-agent/src/messaging/helpers.rs

@@ -112,9 +112,20 @@ pub(crate) fn parse_scheduled_kind(kind: &str) -> Result<ScheduledKind, Messagin
 }
 
 pub(crate) fn working_seconds(scrollback: &str) -> Option<u64> {
-    let lower = scrollback.to_ascii_lowercase();
+    // E47 ROOT-FIX#1 (0.3.24 P0, idle/busy 假阳): the pre-fix `lower.find(...)`
+    // scanned the WHOLE scrollback (Tail(40) lines) and matched historical
+    // working markers — e.g. an old `• Working (514s · esc to interrupt)`
+    // still in the 40-line window after the worker idled. That stale token
+    // flipped a truly-idle agent to Stuck whenever the historical seconds
+    // exceeded 300. Real fix: only consult the LIVE composer / status line
+    // (last non-empty line). If the current bottom line is something like
+    // `❯ Run /review`, `Worked for 8m 34s`, or an empty composer prompt,
+    // there is no LIVE working indicator and we return None — handing off
+    // to the structural latest_prompt_signal / IRON LAW Uncertain path.
+    let last_non_empty = scrollback.lines().rev().find(|line| !line.trim().is_empty())?;
+    let lower = last_non_empty.to_ascii_lowercase();
     let start = lower.find("working (")?;
-    let rest = scrollback.get(start + "Working (".len()..)?;
+    let rest = last_non_empty.get(start + "Working (".len()..)?;
     let seconds = rest.split_once('s')?.0;
     seconds.parse::<u64>().ok()
 }
@@ -129,32 +140,61 @@ pub(crate) fn non_provider_command(command: &str) -> Option<&str> {
 }
 
 pub(crate) fn latest_prompt_signal(scrollback: &str) -> Option<AgentActivity> {
-    let lower = scrollback.to_ascii_lowercase();
-    let idle_pos = latest_idle_prompt_pos(scrollback);
-    let working_pos = [
-        "working", "thinking", "⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏",
-    ]
-    .iter()
-    .filter_map(|needle| lower.rfind(needle))
-    .max();
-    match (idle_pos, working_pos) {
-        (Some(i), Some(w)) if i > w => Some(idle_activity()),
-        (Some(_), None) => Some(idle_activity()),
-        (_, Some(_)) => Some(AgentActivity {
+    // E47 ROOT-FIX#2 (0.3.24 P0, idle/busy 假阳): limit the scan to the
+    // BOTTOM ACTIVE REGION (last 1-3 non-empty lines = composer / status
+    // line). The pre-fix `rfind` across the whole Tail(40) buffer let a
+    // historical spinner/`Working` token out-position the live `❯`/`›`
+    // composer (the rfind-recency family bug — same shape as the #320
+    // codex prompt residue). When the composer line is `❯ Run /review`
+    // (idle), a scrollback `Working (514s)` 20 lines up should NOT win.
+    //
+    // IRON LAW (activity.rs:3 / bug-071/077/085): no-signal in the bottom
+    // region must be Uncertain (caller treats None here as "no decisive
+    // signal" and surfaces Uncertain), NEVER silently flipped to Idle.
+    let active_region: Vec<&str> = scrollback
+        .lines()
+        .rev()
+        .filter(|line| !line.trim().is_empty())
+        .take(3)
+        .collect();
+    if active_region.is_empty() {
+        return None;
+    }
+    let mut has_idle_prompt = false;
+    let mut has_live_working_indicator = false;
+    for line in &active_region {
+        let lower = line.to_ascii_lowercase();
+        if line.contains('❯') || line.contains('›') {
+            has_idle_prompt = true;
+        }
+        // codex live spinner shapes (provider/adapter.rs:875-876 markers):
+        // braille spinner, `• Working (`, `Thinking`; claude `✶`/`✢` per
+        // adapter; we look for STRUCTURAL composer signals.
+        if [
+            "working (", "thinking", "⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦",
+            "⠧", "⠇", "⠏", "✶", "✢",
+        ]
+        .iter()
+        .any(|needle| lower.contains(needle))
+        {
+            has_live_working_indicator = true;
+        }
+    }
+    // Working indicator IN the active region wins over a stale `❯`/`›`
+    // (composer may show a prompt char before the live spinner refreshes).
+    if has_live_working_indicator {
+        return Some(AgentActivity {
             status: ActivityStatus::Working,
             confidence: 0.9,
             rationale: "working_indicator".to_string(),
-        }),
-        (None, None) => None,
+        });
     }
-}
-
-fn latest_idle_prompt_pos(scrollback: &str) -> Option<usize> {
-    scrollback
-        .match_indices('❯')
-        .map(|(idx, _)| idx)
-        .chain(scrollback.match_indices('›').map(|(idx, _)| idx))
-        .max()
+    if has_idle_prompt {
+        return Some(idle_activity());
+    }
+    // No structural signal in the bottom region → caller (activity.rs:184)
+    // gets None and treats as no-decisive-signal → Uncertain (IRON LAW).
+    None
 }
 
 fn idle_activity() -> AgentActivity {

package/crates/team-agent/src/messaging/tests/mod.rs

@@ -295,3 +295,4 @@ mod e23;
 mod main_preserved;
 mod runtime;
 mod spine;
+mod wave2;

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -71,7 +71,14 @@ fn p2_owner_bypass_denies_on_env_agent_id_mismatch() {
 }
 
 // P1 — classify_agent_activity must read current_command, stale last_output, multiline /
-// Codex idle prompts, and Thinking/lowercase-working (activity_detector.py:90-146).
+// Codex idle prompts, and Thinking/codex-spinner working indicators
+// (activity_detector.py:90-146). **E47 amendment (0.3.24 P0)**: the
+// working-indicator probe is now bottom-active-region scoped (last 1-3
+// non-empty lines) and looks for STRUCTURAL spinner markers (codex
+// `• Working (`/`Thinking`/braille; claude `✶`/`✢`), not bare lowercase
+// `working` anywhere in the scrollback. Pre-fix rfind across the whole
+// Tail(40) buffer is the macmini假阳 root cause (historical Working tokens
+// out-positioning a live idle composer).
 #[test]
 fn p2_classify_activity_reads_command_stale_and_prompts() {
     let st = serde_json::json!({});
@@ -85,12 +92,28 @@ fn p2_classify_activity_reads_command_stale_and_prompts() {
     // (3) embedded multiline idle prompt (Codex ❯ not on its own trimmed line) → idle 0.9.
     let c = classify_agent_activity(&st, "some line\n❯\nmore", false, None, None);
     assert_eq!((c.status, c.confidence), (ActivityStatus::Idle, 0.9));
-    // (4) 'Thinking' working indicator → working 0.9.
+    // (4) 'Thinking' working indicator in the bottom active region → working 0.9.
     let d = classify_agent_activity(&st, "Thinking about it", false, None, None);
     assert_eq!((d.status, d.confidence), (ActivityStatus::Working, 0.9));
-    // (5) lowercase 'working' indicator → working 0.9.
+    // (5) E47 amendment: bare lowercase 'working on it' is NOT a structural
+    // spinner marker; the live codex spinner is `• Working (Ns · esc to
+    // interrupt)`. Treat as no-decisive-signal → Uncertain. The pre-fix
+    // expectation here is exactly the macmini假阳 shape — a stale 'working'
+    // token (without the parenthesised seconds + esc-to-interrupt tail) is
+    // either scrollback residue or unrelated text, not a live working
+    // indicator. To assert the Working path use the structural codex shape.
     let e = classify_agent_activity(&st, "working on it", false, None, None);
-    assert_eq!((e.status, e.confidence), (ActivityStatus::Working, 0.9));
+    assert_eq!((e.status, e.confidence), (ActivityStatus::Uncertain, 0.5));
+    // (5b) E47 structural Working: a real codex live spinner in the bottom
+    // active region must still classify Working 0.9.
+    let e_struct = classify_agent_activity(
+        &st,
+        "• Working (12s · esc to interrupt)",
+        false,
+        None,
+        None,
+    );
+    assert_eq!((e_struct.status, e_struct.confidence), (ActivityStatus::Working, 0.9));
 }
 
 // P1 — scheduler dispatch must be exhaustive: an unknown kind surfaces an error, not a
@@ -484,3 +507,133 @@ fn spine_delivery_injects_rendered_protocol_block_not_raw_content() {
          worker builds a result_envelope; got {payload:?}"
     );
 }
+
+// ═════════════════════════════════════════════════════════════════════════════
+// E47 (0.3.24 P0, idle/busy 假阳) — TUI keyword grep is structurally bounded.
+//
+// Real-machine repro (macmini): a Tail(40) capture of an idle codex worker
+// still carries historical `• Working (514s · esc to interrupt)` plus a
+// `─ Worked for 8m 34s ─` summary plus a fresh `❯ Run /review` prompt. The
+// pre-fix `working_seconds` full-buffer find matched the 514s token and
+// returned ≥300 → Stuck. The pre-fix `latest_prompt_signal` rfind let the
+// historical spinner out-position the bottom `❯` → Working. E47 narrows
+// both probes to the bottom active region (last 1-3 non-empty lines).
+//
+// The authoritative provider JSONL classify is wired in coordinator/tick.rs
+// (jsonl_activity_for_agent); these unit tests pin the TUI fallback layer.
+// ═════════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn e47_codex_idle_with_historical_working_in_scrollback_is_idle_not_stuck_or_working() {
+    // Exact macmini repro shape from the architect locate (E47).
+    let scrollback = "• Working (514s · esc to interrupt)\n\
+                      tool call 1\n\
+                      tool call 2\n\
+                      ─ Worked for 8m 34s ─\n\
+                      › Run /review\n\
+                      ❯ ";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Idle,
+        "E47 (RED-1): codex idle worker whose scrollback still carries \
+         historical `• Working (514s · esc to interrupt)` must classify IDLE \
+         (bottom active region is `❯`+`› Run /review` = idle composer). \
+         pre-fix: Stuck/Working via rfind-recency. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_past_tense_worked_for_is_not_stale_working_indicator() {
+    // RED-2: past-tense `Worked for` summary line must NOT trigger
+    // working_seconds Stuck. The pre-fix scanned the whole buffer and would
+    // match the embedded `8m 34s ─` against `working (` if formatted slightly
+    // differently — but more importantly this test pins the "past-tense
+    // summary is idle context" semantics.
+    let scrollback = "─ Worked for 8m 34s ─\n❯ ";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_ne!(
+        a.status,
+        ActivityStatus::Stuck,
+        "E47 (RED-2): past-tense `Worked for 8m 34s` must NOT trigger \
+         stale_working_indicator Stuck. Got {a:?}"
+    );
+    assert_eq!(
+        a.status,
+        ActivityStatus::Idle,
+        "E47 (RED-2): bottom `❯` composer = idle. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_claude_idle_with_historical_spinner_classifies_idle() {
+    // RED-3: claude idle worker; historical spinner shape (`✶` per
+    // adapter.rs:875-876) earlier in the buffer (>= 3 non-empty lines deep),
+    // bottom composer is idle (`›` glyph variant or `> ` claude prompt).
+    // The bottom active region (last 3 non-empty lines) has NO spinner.
+    let scrollback = "✶ Working on plan\n\
+                      tool 1\n\
+                      tool 2\n\
+                      assistant reply text\n\
+                      summary line A\n\
+                      summary line B\n\
+                      › Continue?";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Idle,
+        "E47 (RED-3): claude idle worker — historical ✶ above, idle `›` \
+         below — must classify IDLE. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_codex_live_spinner_in_bottom_active_region_classifies_working() {
+    // RED-4 (defence vs over-tightening 假阴): a TRULY busy codex worker
+    // whose bottom active region carries the live spinner must still be
+    // Working. No idle composer present.
+    let scrollback = "tool call x\nassistant response so far\n• Working (12s · esc to interrupt)";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Working,
+        "E47 (RED-4): live codex spinner in bottom active region must \
+         classify Working. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_claude_live_working_in_bottom_active_region_classifies_working() {
+    // RED-5: a TRULY busy claude worker showing `✶ Working` at the bottom
+    // active region must be Working — even without the `(Ns)` codex shape.
+    let scrollback = "earlier output\nmore output\n✶ Working through the request";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Working,
+        "E47 (RED-5): claude ✶ Working in bottom active region → Working. \
+         Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_iron_law_no_signal_in_bottom_region_stays_uncertain_not_idle() {
+    // Defence: IRON LAW (activity.rs:3 / bug-071/077/085). When the bottom
+    // active region has no spinner AND no `❯`/`›` AND no other decisive
+    // signal, classify_agent_activity falls through to no_decisive_signal →
+    // Uncertain — NEVER silently to Idle.
+    let scrollback = "some neutral text\nmore neutral text\nstill nothing decisive";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Uncertain,
+        "E47 IRON LAW guard: bottom region carries no spinner and no idle \
+         composer → Uncertain, never silently Idle. Got {a:?}"
+    );
+}