@team-agent/installer 0.3.24 → 0.3.26

package/crates/team-agent/src/messaging/delivery.rs

@@ -348,6 +348,7 @@ pub fn deliver_pending_message(
                         attempt,
                         "send_inject_exhausted",
                         &reason,
+                        None,
                     )?;
                     return Ok(DeliveryOutcome {
                         ok: false,
@@ -387,6 +388,13 @@ pub fn deliver_pending_message(
                 submit_verification_wire(inject_report.submit_verification)
             )
         };
+        // E50 PR-1 (0.3.24 P0): render forensic submit_diagnostics into the
+        // event so operators see per-attempt pane state without grepping. The
+        // legacy keys (`message_id` / `recipient` / `reason` / `attempts`)
+        // are preserved byte-for-byte for grep compatibility; new keys are
+        // ADDITIONAL.
+        let submit_attempts_detail =
+            render_submit_diagnostics(&inject_report);
         event_log.write(
             "send.unverified",
             serde_json::json!({
@@ -394,6 +402,7 @@ pub fn deliver_pending_message(
                 "recipient": message.recipient,
                 "reason": reason,
                 "attempts": inject_report.attempts,
+                "submit_attempts_detail": submit_attempts_detail,
             }),
         )?;
         if inject_report.attempts >= u32::from(SEND_RETRY_MAX_ATTEMPTS) {
@@ -407,6 +416,7 @@ pub fn deliver_pending_message(
                 inject_report.attempts,
                 "send_unverified_exhausted",
                 &reason,
+                Some(&inject_report),
             )?;
             return Ok(DeliveryOutcome {
                 ok: false,
@@ -469,7 +479,19 @@ fn inject_submit_verified(report: &InjectReport) -> bool {
         SubmitVerification::PastedContentPromptStillPresentAfterSubmit => false,
         SubmitVerification::PastedContentPromptAbsentAfterSubmit => true,
         SubmitVerification::KeySentAfterVisibleToken { .. } => true,
+        // MUST-10 preserved: EnterSentWithoutPlaceholderCheck still ⇒ delivered
+        // (provider_submit_verification_red.rs:113-159 contract). E46 narrows
+        // when transport returns this variant: it is now emitted ONLY after
+        // post-Enter input-consumption confirmation succeeds. Fresh TUI
+        // (bracketed-paste-stuck) instead returns SubmitConsumptionUnverified
+        // so this branch keeps delivered semantics intact.
         SubmitVerification::EnterSentWithoutPlaceholderCheck => true,
+        // E46 (0.3.24 bug#5): Enter was sent but post-Enter consumption was
+        // NOT observed within the bounded resend cap. Treat as not delivered
+        // (submitted_unverified / failed) — prevents the macmini假阳 where
+        // demo-director's stuck bracketed-paste swallowed the Enter and
+        // delivery still reported delivered.
+        SubmitVerification::SubmitConsumptionUnverified => false,
     }
 }
 
@@ -492,7 +514,8 @@ fn pane_readback_verified(report: &InjectReport) -> bool {
 /// [team-agent-token:{message_id}]`. The worker (fake or real provider) only builds a result_envelope
 /// when it sees this block + extracts the token — the bare content gives WORKING but never a report
 /// (rt-host-a loop #4). token == message_id (exactly-once correlation).
-fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id: &str) -> String {
+/// F1 (0.3.26): promoted to `pub` for direct pane send in cli/send.rs.
+pub fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id: &str) -> String {
     let mut header = format!("Team Agent message from {sender}");
     if let Some(task_id) = task_id.filter(|t| !t.is_empty()) {
         header.push_str(&format!(" for {task_id}"));
@@ -545,7 +568,23 @@ fn resolve_inject_target(
         .and_then(serde_json::Value::as_str)
         .filter(|s| !s.is_empty())
         .map(PaneId::new);
+    // E51 (0.3.26 P0, delivery loop guard): if the worker's cached pane_id is
+    // the SAME as leader_receiver.pane_id (the leader's handle), injecting into
+    // it would deliver the worker's message back to the leader pane — a routing
+    // loop that the macmini "hand-handle mapping 灾難" truth source exposed. Fail
+    // loud with a SessionWindow target that will surface as a structured error
+    // (the SessionWindow "leader" target trips the existing leader_not_attached
+    // guard on any subsequent delivery attempt for this message). The root fix
+    // is in lease.rs (E51 guard #1) which prevents the conflation; this is the
+    // defence-in-depth in the delivery layer.
     if let Some(pane) = cached_pane.as_ref() {
+        let leader_pane = leader_receiver_pane_id(state);
+        if leader_pane.is_some_and(|lp| lp == pane.as_str()) {
+            return Target::SessionWindow {
+                session: SessionName::new(session),
+                window: WindowName::new(format!("{recipient}_pane_conflicts_with_leader")),
+            };
+        }
         if live_targets
             .iter()
             .any(|target| target.pane_id.as_str() == pane.as_str())
@@ -743,6 +782,34 @@ fn leader_receiver_field_in_state<'a>(
         .filter(|value| !value.is_empty())
 }
 
+/// E50 PR-1 (0.3.24 P0): render `InjectReport.submit_diagnostics` as a JSON
+/// array suitable for inclusion in `send.unverified` / `send.failed` events.
+/// `null` if no diagnostics were attached (e.g. the inject went through a
+/// path that bypassed the paste-prompt + Enter instrumentation, or this is
+/// the pre-PR-2 inject-failed path with no `InjectReport`).
+fn render_submit_diagnostics(report: &InjectReport) -> serde_json::Value {
+    let Some(diag) = report.submit_diagnostics.as_ref() else {
+        return serde_json::Value::Null;
+    };
+    serde_json::Value::Array(
+        diag.attempts_detail
+            .iter()
+            .map(|obs| {
+                serde_json::json!({
+                    "attempt_index": obs.attempt_index,
+                    "matched": obs.matched,
+                    "matched_literal": obs.matched_literal,
+                    "where_in_tail": obs.where_in_tail,
+                    "pane_tail_excerpt": obs.pane_tail_excerpt,
+                    "pane_tail_lines": obs.pane_tail_lines,
+                    "elapsed_ms": obs.elapsed_ms,
+                })
+            })
+            .collect(),
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
 fn emit_send_failed_exhausted(
     workspace: &Path,
     state: &serde_json::Value,
@@ -752,7 +819,26 @@ fn emit_send_failed_exhausted(
     attempts: u32,
     failure_reason: &str,
     verification: &str,
+    inject_report: Option<&InjectReport>,
 ) -> Result<(), MessagingError> {
+    // E50 PR-1 (0.3.24 P0): forensic fields on send.failed. Legacy keys
+    // (`message_id` / `recipient` / `attempts` / `max_attempts` / `reason` /
+    // `verification`) preserved byte-for-byte for grep compatibility.
+    let submit_attempts_detail = inject_report
+        .map(render_submit_diagnostics)
+        .unwrap_or_else(|| serde_json::Value::Array(Vec::new()));
+    let total_elapsed_ms = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .map(|d| d.total_elapsed_ms)
+        .unwrap_or(0);
+    let last_matched_literal = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .and_then(|d| d.attempts_detail.last())
+        .and_then(|a| a.matched_literal.clone());
+    let last_pane_tail_excerpt = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .and_then(|d| d.attempts_detail.last())
+        .map(|a| a.pane_tail_excerpt.clone());
     event_log.write(
         "send.failed",
         serde_json::json!({
@@ -762,6 +848,10 @@ fn emit_send_failed_exhausted(
             "max_attempts": SEND_RETRY_MAX_ATTEMPTS,
             "reason": failure_reason,
             "verification": verification,
+            "submit_attempts_detail": submit_attempts_detail,
+            "total_elapsed_ms": total_elapsed_ms,
+            "last_matched_literal": last_matched_literal,
+            "last_pane_tail_excerpt": last_pane_tail_excerpt,
         }),
     )?;
     let content = format!(

package/crates/team-agent/src/messaging/helpers.rs

@@ -112,9 +112,20 @@ pub(crate) fn parse_scheduled_kind(kind: &str) -> Result<ScheduledKind, Messagin
 }
 
 pub(crate) fn working_seconds(scrollback: &str) -> Option<u64> {
-    let lower = scrollback.to_ascii_lowercase();
+    // E47 ROOT-FIX#1 (0.3.24 P0, idle/busy 假阳): the pre-fix `lower.find(...)`
+    // scanned the WHOLE scrollback (Tail(40) lines) and matched historical
+    // working markers — e.g. an old `• Working (514s · esc to interrupt)`
+    // still in the 40-line window after the worker idled. That stale token
+    // flipped a truly-idle agent to Stuck whenever the historical seconds
+    // exceeded 300. Real fix: only consult the LIVE composer / status line
+    // (last non-empty line). If the current bottom line is something like
+    // `❯ Run /review`, `Worked for 8m 34s`, or an empty composer prompt,
+    // there is no LIVE working indicator and we return None — handing off
+    // to the structural latest_prompt_signal / IRON LAW Uncertain path.
+    let last_non_empty = scrollback.lines().rev().find(|line| !line.trim().is_empty())?;
+    let lower = last_non_empty.to_ascii_lowercase();
     let start = lower.find("working (")?;
-    let rest = scrollback.get(start + "Working (".len()..)?;
+    let rest = last_non_empty.get(start + "Working (".len()..)?;
     let seconds = rest.split_once('s')?.0;
     seconds.parse::<u64>().ok()
 }
@@ -129,32 +140,61 @@ pub(crate) fn non_provider_command(command: &str) -> Option<&str> {
 }
 
 pub(crate) fn latest_prompt_signal(scrollback: &str) -> Option<AgentActivity> {
-    let lower = scrollback.to_ascii_lowercase();
-    let idle_pos = latest_idle_prompt_pos(scrollback);
-    let working_pos = [
-        "working", "thinking", "⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏",
-    ]
-    .iter()
-    .filter_map(|needle| lower.rfind(needle))
-    .max();
-    match (idle_pos, working_pos) {
-        (Some(i), Some(w)) if i > w => Some(idle_activity()),
-        (Some(_), None) => Some(idle_activity()),
-        (_, Some(_)) => Some(AgentActivity {
+    // E47 ROOT-FIX#2 (0.3.24 P0, idle/busy 假阳): limit the scan to the
+    // BOTTOM ACTIVE REGION (last 1-3 non-empty lines = composer / status
+    // line). The pre-fix `rfind` across the whole Tail(40) buffer let a
+    // historical spinner/`Working` token out-position the live `❯`/`›`
+    // composer (the rfind-recency family bug — same shape as the #320
+    // codex prompt residue). When the composer line is `❯ Run /review`
+    // (idle), a scrollback `Working (514s)` 20 lines up should NOT win.
+    //
+    // IRON LAW (activity.rs:3 / bug-071/077/085): no-signal in the bottom
+    // region must be Uncertain (caller treats None here as "no decisive
+    // signal" and surfaces Uncertain), NEVER silently flipped to Idle.
+    let active_region: Vec<&str> = scrollback
+        .lines()
+        .rev()
+        .filter(|line| !line.trim().is_empty())
+        .take(3)
+        .collect();
+    if active_region.is_empty() {
+        return None;
+    }
+    let mut has_idle_prompt = false;
+    let mut has_live_working_indicator = false;
+    for line in &active_region {
+        let lower = line.to_ascii_lowercase();
+        if line.contains('❯') || line.contains('›') {
+            has_idle_prompt = true;
+        }
+        // codex live spinner shapes (provider/adapter.rs:875-876 markers):
+        // braille spinner, `• Working (`, `Thinking`; claude `✶`/`✢` per
+        // adapter; we look for STRUCTURAL composer signals.
+        if [
+            "working (", "thinking", "⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦",
+            "⠧", "⠇", "⠏", "✶", "✢",
+        ]
+        .iter()
+        .any(|needle| lower.contains(needle))
+        {
+            has_live_working_indicator = true;
+        }
+    }
+    // Working indicator IN the active region wins over a stale `❯`/`›`
+    // (composer may show a prompt char before the live spinner refreshes).
+    if has_live_working_indicator {
+        return Some(AgentActivity {
             status: ActivityStatus::Working,
             confidence: 0.9,
             rationale: "working_indicator".to_string(),
-        }),
-        (None, None) => None,
+        });
     }
-}
-
-fn latest_idle_prompt_pos(scrollback: &str) -> Option<usize> {
-    scrollback
-        .match_indices('❯')
-        .map(|(idx, _)| idx)
-        .chain(scrollback.match_indices('›').map(|(idx, _)| idx))
-        .max()
+    if has_idle_prompt {
+        return Some(idle_activity());
+    }
+    // No structural signal in the bottom region → caller (activity.rs:184)
+    // gets None and treats as no-decisive-signal → Uncertain (IRON LAW).
+    None
 }
 
 fn idle_activity() -> AgentActivity {

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -1308,6 +1308,7 @@ impl Transport for UnverifiedInjectTransport {
                 crate::transport::SubmitVerification::PastedContentPromptStillPresentAfterSubmit,
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: u32::from(SEND_RETRY_MAX_ATTEMPTS),
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {
@@ -1467,6 +1468,7 @@ impl Transport for ReadbackMissingTransport {
             },
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _: &Target, _: &[Key]) -> Result<(), TransportError> {

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -71,7 +71,14 @@ fn p2_owner_bypass_denies_on_env_agent_id_mismatch() {
 }
 
 // P1 — classify_agent_activity must read current_command, stale last_output, multiline /
-// Codex idle prompts, and Thinking/lowercase-working (activity_detector.py:90-146).
+// Codex idle prompts, and Thinking/codex-spinner working indicators
+// (activity_detector.py:90-146). **E47 amendment (0.3.24 P0)**: the
+// working-indicator probe is now bottom-active-region scoped (last 1-3
+// non-empty lines) and looks for STRUCTURAL spinner markers (codex
+// `• Working (`/`Thinking`/braille; claude `✶`/`✢`), not bare lowercase
+// `working` anywhere in the scrollback. Pre-fix rfind across the whole
+// Tail(40) buffer is the macmini假阳 root cause (historical Working tokens
+// out-positioning a live idle composer).
 #[test]
 fn p2_classify_activity_reads_command_stale_and_prompts() {
     let st = serde_json::json!({});
@@ -85,12 +92,28 @@ fn p2_classify_activity_reads_command_stale_and_prompts() {
     // (3) embedded multiline idle prompt (Codex ❯ not on its own trimmed line) → idle 0.9.
     let c = classify_agent_activity(&st, "some line\n❯\nmore", false, None, None);
     assert_eq!((c.status, c.confidence), (ActivityStatus::Idle, 0.9));
-    // (4) 'Thinking' working indicator → working 0.9.
+    // (4) 'Thinking' working indicator in the bottom active region → working 0.9.
     let d = classify_agent_activity(&st, "Thinking about it", false, None, None);
     assert_eq!((d.status, d.confidence), (ActivityStatus::Working, 0.9));
-    // (5) lowercase 'working' indicator → working 0.9.
+    // (5) E47 amendment: bare lowercase 'working on it' is NOT a structural
+    // spinner marker; the live codex spinner is `• Working (Ns · esc to
+    // interrupt)`. Treat as no-decisive-signal → Uncertain. The pre-fix
+    // expectation here is exactly the macmini假阳 shape — a stale 'working'
+    // token (without the parenthesised seconds + esc-to-interrupt tail) is
+    // either scrollback residue or unrelated text, not a live working
+    // indicator. To assert the Working path use the structural codex shape.
     let e = classify_agent_activity(&st, "working on it", false, None, None);
-    assert_eq!((e.status, e.confidence), (ActivityStatus::Working, 0.9));
+    assert_eq!((e.status, e.confidence), (ActivityStatus::Uncertain, 0.5));
+    // (5b) E47 structural Working: a real codex live spinner in the bottom
+    // active region must still classify Working 0.9.
+    let e_struct = classify_agent_activity(
+        &st,
+        "• Working (12s · esc to interrupt)",
+        false,
+        None,
+        None,
+    );
+    assert_eq!((e_struct.status, e_struct.confidence), (ActivityStatus::Working, 0.9));
 }
 
 // P1 — scheduler dispatch must be exhaustive: an unknown kind surfaces an error, not a
@@ -150,6 +173,7 @@ impl Transport for DeliverOkTransport {
             submit_verification: crate::transport::SubmitVerification::EnterSentWithoutPlaceholderCheck,
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {
@@ -484,3 +508,133 @@ fn spine_delivery_injects_rendered_protocol_block_not_raw_content() {
          worker builds a result_envelope; got {payload:?}"
     );
 }
+
+// ═════════════════════════════════════════════════════════════════════════════
+// E47 (0.3.24 P0, idle/busy 假阳) — TUI keyword grep is structurally bounded.
+//
+// Real-machine repro (macmini): a Tail(40) capture of an idle codex worker
+// still carries historical `• Working (514s · esc to interrupt)` plus a
+// `─ Worked for 8m 34s ─` summary plus a fresh `❯ Run /review` prompt. The
+// pre-fix `working_seconds` full-buffer find matched the 514s token and
+// returned ≥300 → Stuck. The pre-fix `latest_prompt_signal` rfind let the
+// historical spinner out-position the bottom `❯` → Working. E47 narrows
+// both probes to the bottom active region (last 1-3 non-empty lines).
+//
+// The authoritative provider JSONL classify is wired in coordinator/tick.rs
+// (jsonl_activity_for_agent); these unit tests pin the TUI fallback layer.
+// ═════════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn e47_codex_idle_with_historical_working_in_scrollback_is_idle_not_stuck_or_working() {
+    // Exact macmini repro shape from the architect locate (E47).
+    let scrollback = "• Working (514s · esc to interrupt)\n\
+                      tool call 1\n\
+                      tool call 2\n\
+                      ─ Worked for 8m 34s ─\n\
+                      › Run /review\n\
+                      ❯ ";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Idle,
+        "E47 (RED-1): codex idle worker whose scrollback still carries \
+         historical `• Working (514s · esc to interrupt)` must classify IDLE \
+         (bottom active region is `❯`+`› Run /review` = idle composer). \
+         pre-fix: Stuck/Working via rfind-recency. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_past_tense_worked_for_is_not_stale_working_indicator() {
+    // RED-2: past-tense `Worked for` summary line must NOT trigger
+    // working_seconds Stuck. The pre-fix scanned the whole buffer and would
+    // match the embedded `8m 34s ─` against `working (` if formatted slightly
+    // differently — but more importantly this test pins the "past-tense
+    // summary is idle context" semantics.
+    let scrollback = "─ Worked for 8m 34s ─\n❯ ";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_ne!(
+        a.status,
+        ActivityStatus::Stuck,
+        "E47 (RED-2): past-tense `Worked for 8m 34s` must NOT trigger \
+         stale_working_indicator Stuck. Got {a:?}"
+    );
+    assert_eq!(
+        a.status,
+        ActivityStatus::Idle,
+        "E47 (RED-2): bottom `❯` composer = idle. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_claude_idle_with_historical_spinner_classifies_idle() {
+    // RED-3: claude idle worker; historical spinner shape (`✶` per
+    // adapter.rs:875-876) earlier in the buffer (>= 3 non-empty lines deep),
+    // bottom composer is idle (`›` glyph variant or `> ` claude prompt).
+    // The bottom active region (last 3 non-empty lines) has NO spinner.
+    let scrollback = "✶ Working on plan\n\
+                      tool 1\n\
+                      tool 2\n\
+                      assistant reply text\n\
+                      summary line A\n\
+                      summary line B\n\
+                      › Continue?";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Idle,
+        "E47 (RED-3): claude idle worker — historical ✶ above, idle `›` \
+         below — must classify IDLE. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_codex_live_spinner_in_bottom_active_region_classifies_working() {
+    // RED-4 (defence vs over-tightening 假阴): a TRULY busy codex worker
+    // whose bottom active region carries the live spinner must still be
+    // Working. No idle composer present.
+    let scrollback = "tool call x\nassistant response so far\n• Working (12s · esc to interrupt)";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Working,
+        "E47 (RED-4): live codex spinner in bottom active region must \
+         classify Working. Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_claude_live_working_in_bottom_active_region_classifies_working() {
+    // RED-5: a TRULY busy claude worker showing `✶ Working` at the bottom
+    // active region must be Working — even without the `(Ns)` codex shape.
+    let scrollback = "earlier output\nmore output\n✶ Working through the request";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Working,
+        "E47 (RED-5): claude ✶ Working in bottom active region → Working. \
+         Got {a:?}"
+    );
+}
+
+#[test]
+fn e47_iron_law_no_signal_in_bottom_region_stays_uncertain_not_idle() {
+    // Defence: IRON LAW (activity.rs:3 / bug-071/077/085). When the bottom
+    // active region has no spinner AND no `❯`/`›` AND no other decisive
+    // signal, classify_agent_activity falls through to no_decisive_signal →
+    // Uncertain — NEVER silently to Idle.
+    let scrollback = "some neutral text\nmore neutral text\nstill nothing decisive";
+    let st = serde_json::json!({});
+    let a = classify_agent_activity(&st, scrollback, false, None, None);
+    assert_eq!(
+        a.status,
+        ActivityStatus::Uncertain,
+        "E47 IRON LAW guard: bottom region carries no spinner and no idle \
+         composer → Uncertain, never silently Idle. Got {a:?}"
+    );
+}