@team-agent/installer 0.3.39 → 0.4.0

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.3.39"
+version = "0.4.0"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.3.39"
+version = "0.4.0"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/Cargo.toml

@@ -29,5 +29,12 @@ rusqlite.workspace = true       # step 3 db(bundled SQLite,静态链接)
 [dev-dependencies]
 serial_test = { version = "3", features = ["file_locks"] }
 
+# `tests/e2e/` 黑盒 E2E 框架专用 — 不需要 assert_cmd / predicates,
+# 框架内部直接用 std::process::Command + serde_json + 自写 assert_* helpers,
+# 保持 zero new external test-CLI deps(避开 crates.io 代理限制)。
+[[test]]
+name = "e2e"
+path = "tests/e2e/main.rs"
+
 [lints]
 workspace = true

package/crates/team-agent/src/cli/adapters.rs

@@ -443,7 +443,7 @@ pub fn cmd_collect_for_team(args: &CollectArgs, team: Option<&str>) -> Result<Cm
 
 /// `cmd_settle`(`commands.py:86`)。
 pub fn cmd_settle(args: &SettleArgs) -> Result<CmdResult, CliError> {
-    match settle_value(&args.workspace) {
+    match settle_value(&args.workspace, args.team.as_deref()) {
         Ok(value) => Ok(CmdResult::from_json(value, args.json)),
         Err(error) => Ok(CmdResult::from_json(
             json!({
@@ -456,10 +456,15 @@ pub fn cmd_settle(args: &SettleArgs) -> Result<CmdResult, CliError> {
     }
 }
 
-fn settle_value(workspace: &Path) -> Result<Value, CliError> {
+fn settle_value(workspace: &Path, team: Option<&str>) -> Result<Value, CliError> {
+    // Bug #6 (prerelease 0.4.0 gate review §6): pass explicit team through to
+    // resolve_active_team so settle scopes collect/status/team-state to the
+    // requested team. Without this, the selector falls back to top-level
+    // active_team_key and settle operates on the wrong team. resolve_active_team
+    // logic unchanged per 不可改项.
     let selected = crate::state::selector::resolve_active_team(
         workspace,
-        None,
+        team,
         crate::state::selector::SelectorMode::RuntimeOnly,
     )
     .map_err(|e| CliError::Runtime(e.to_string()))?;

package/crates/team-agent/src/cli/diagnose.rs

@@ -418,12 +418,21 @@ pub(crate) fn build_wait_ready_report(workspace: &std::path::Path, timeout: f64)
 }
 
 fn inject_tmux_session_present(workspace: &std::path::Path, state: &mut Value) {
+    // Bug #7 (prerelease 0.4.0 gate review §6): probe the SAME endpoint the
+    // runtime actually uses (state.tmux_endpoint / tmux_socket), not the
+    // workspace-hash socket. Otherwise readiness reports `process_started=false`
+    // even though the session is alive on the persisted socket.
     let Some(session_name) = state.get("session_name").and_then(Value::as_str).filter(|s| !s.is_empty()) else {
         return;
     };
-    let backend = crate::tmux_backend::TmuxBackend::for_workspace(workspace);
-    let present = backend
-        .has_session(&crate::transport::SessionName::new(session_name.to_string()))
+    let session_name_owned = session_name.to_string();
+    let selection = crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(
+        workspace,
+        Some(state),
+    );
+    let present = selection
+        .backend
+        .has_session(&crate::transport::SessionName::new(session_name_owned))
         .unwrap_or(false);
     if let Value::Object(map) = state {
         map.insert("tmux_session_present".to_string(), Value::Bool(present));

package/crates/team-agent/src/cli/emit.rs

@@ -1263,6 +1263,7 @@ fn settle_args(args: &[String], cwd: &Path) -> SettleArgs {
     let parsed = parse_args(args);
     SettleArgs {
         workspace: workspace(&parsed, cwd),
+        team: parsed.team.clone(),
         json: parsed.json,
     }
 }

package/crates/team-agent/src/cli/mod.rs

@@ -859,6 +859,18 @@ pub mod lifecycle_port {
             .as_ref()
             .and_then(|stopped| stopped.pid.map(|p| p.get()));
         let coordinator_pid = coordinator_pid.or(coordinator_pid_for_report);
+        // unit-2 (Stage 1) false-green guard fact:
+        //   target_session_spared = "we had a target worker session name AND
+        //                            that exact name appears in spared_sessions"
+        // Mirrors the "we asked to kill X but X is still alive" check the
+        // 0.3.39 false-green bug missed. session_name is the configured
+        // target; spared_sessions is the cleanup's "kept alive" list.
+        let target_session_spared = match session_name.as_ref() {
+            Some(target) => spared_sessions
+                .iter()
+                .any(|s| s.as_str() == target.as_str()),
+            None => false,
+        };
         let outcome = classify_shutdown_outcome(ShutdownOutcomeInput {
             kill_error: kill_error.is_some(),
             session_residuals: !session_residuals.is_empty(),
@@ -868,6 +880,7 @@ pub mod lifecycle_port {
             coordinator_timeout,
             coordinator_stop_ok: stopped.as_ref().map(|stopped| stopped.ok),
             coordinator_post_stop,
+            target_session_spared,
         });
         let ok = outcome.ok;
         let status = outcome.status;
@@ -956,6 +969,16 @@ pub mod lifecycle_port {
         pub(crate) coordinator_timeout: bool,
         pub(crate) coordinator_stop_ok: Option<bool>,
         pub(crate) coordinator_post_stop: CoordinatorStopObservation,
+        /// unit-2 (Stage 1) false-green guard:
+        /// `true` when the workspace had a target worker session name AND
+        /// the cleanup did NOT confirm kill of that name (i.e. the target
+        /// was spared, leaving the worker alive while ok/status:"ok" would
+        /// otherwise be reported — the 0.3.39 shutdown false-green shape).
+        ///
+        /// Default `false` for callers that have no target (legacy bare
+        /// shutdown on a not-yet-bound workspace) so the existing
+        /// well-defined OK branch keeps working.
+        pub(crate) target_session_spared: bool,
     }
 
     pub(crate) fn classify_shutdown_outcome(input: ShutdownOutcomeInput) -> ShutdownOutcome {
@@ -971,7 +994,12 @@ pub mod lifecycle_port {
             && !input.session_residuals
             && !input.process_residuals
             && !input.owned_file_residuals
-            && !input.cleanup_truth_degraded;
+            && !input.cleanup_truth_degraded
+            // unit-2 false-green guard: refuse OK when the configured worker
+            // session was spared (still alive). The user asked for shutdown,
+            // not "shutdown but maybe keep the session" — make the disagreement
+            // explicit instead of paint-it-green.
+            && !input.target_session_spared;
         if ok {
             return ShutdownOutcome {
                 ok,
@@ -989,6 +1017,12 @@ pub mod lifecycle_port {
             || input.owned_file_residuals
         {
             ("failed", None)
+        } else if input.target_session_spared {
+            // The worker session that was supposed to be killed survived
+            // because the cleanup decision spared it (dirty topology — e.g.
+            // 0.3.39 leader_receiver.session_name == worker session). Surface
+            // a status that names the cause instead of fall-through "partial".
+            ("dirty_state", Some("target_session_spared"))
         } else {
             ("partial", None)
         };
@@ -2713,14 +2747,209 @@ pub mod lifecycle_port {
                 unresumable,
                 allow_fresh,
                 error,
-            } => json!({
-                "ok": false,
-                "status": "refused_resume_atomicity",
-                "allow_fresh": allow_fresh,
-                "error": error,
-                "unresumable": unresumable.iter().map(|w| w.agent_id.as_str()).collect::<Vec<_>>(),
-                "reminder": crate::cli::QUICK_START_REMINDER,
-            }),
+            } => {
+                // Unit 5 + Layer 2 wire-through (leader directive 2026-06-22):
+                // `unresumable` JSON shape is now `[{agent_id, reason,
+                // session_id?, checked_paths?, recovery_hint?}, ...]` so the
+                // structured refusal class is visible to CLI consumers. The
+                // legacy string-array shape (single agent_id per entry) is
+                // available under `unresumable_ids` for tooling that still
+                // wants the cheap list.
+                let unresumable_detail: Vec<Value> = unresumable
+                    .iter()
+                    .map(|w| {
+                        let mut entry = serde_json::Map::new();
+                        entry.insert(
+                            "agent_id".to_string(),
+                            json!(w.agent_id.as_str()),
+                        );
+                        // Prefer the structured wire string when the
+                        // ResumeRefusalReason enum is populated; fall back
+                        // to the legacy free-form `reason` otherwise.
+                        let reason_wire = w
+                            .refusal_reason
+                            .as_ref()
+                            .map(|r| r.wire().to_string())
+                            .unwrap_or_else(|| w.reason.clone());
+                        entry.insert("reason".to_string(), json!(reason_wire));
+                        if let Some(sid) = &w.session_id {
+                            entry.insert(
+                                "session_id".to_string(),
+                                json!(sid.as_str()),
+                            );
+                        }
+                        if let Some(reason) = &w.refusal_reason {
+                            if let crate::provider::session::ResumeRefusalReason::SessionBackingStoreMissing {
+                                checked_paths,
+                                recovery_hint,
+                            } = reason
+                            {
+                                if !checked_paths.is_empty() {
+                                    entry.insert(
+                                        "checked_paths".to_string(),
+                                        json!(checked_paths
+                                            .iter()
+                                            .map(|p| p.to_string_lossy().into_owned())
+                                            .collect::<Vec<_>>()),
+                                    );
+                                }
+                                if let Some(hint) = recovery_hint {
+                                    let mut h = serde_json::Map::new();
+                                    h.insert(
+                                        "provider".to_string(),
+                                        json!(hint.provider),
+                                    );
+                                    if let Some(name) = &hint.provider_session_name_hint {
+                                        h.insert("name".to_string(), json!(name));
+                                    }
+                                    if let Some(cwd) = &hint.spawn_cwd {
+                                        h.insert(
+                                            "spawn_cwd".to_string(),
+                                            json!(cwd.to_string_lossy()),
+                                        );
+                                    }
+                                    h.insert(
+                                        "picker_hint".to_string(),
+                                        json!(hint.picker_hint()),
+                                    );
+                                    entry.insert(
+                                        "recovery_hint".to_string(),
+                                        Value::Object(h),
+                                    );
+                                }
+                            }
+                        }
+                        Value::Object(entry)
+                    })
+                    .collect();
+                let unresumable_ids: Vec<&str> = unresumable
+                    .iter()
+                    .map(|w| w.agent_id.as_str())
+                    .collect();
+                // Layer 2 self-healing (leader follow-up 2026-06-22): when
+                // EVERY unresumable worker shares the same structured
+                // refusal_reason wire string, refine the top-level `status`
+                // from the coarse `refused_resume_atomicity` to a class-
+                // specific label and overlay an `error` that names the
+                // specific cause + concrete recovery moves. The original
+                // `refused_resume_atomicity` status is kept as
+                // `status_class` so anything matching on the coarse label
+                // still works.
+                let distinct_wires: std::collections::BTreeSet<&'static str> = unresumable
+                    .iter()
+                    .filter_map(|w| w.refusal_reason.as_ref().map(|r| r.wire()))
+                    .collect();
+                let (status_str, error_str): (String, String) = if distinct_wires.len() == 1
+                    && distinct_wires.len() == unresumable.len()
+                {
+                    // Every entry had a structured reason and they all
+                    // agreed. Refine.
+                    let wire = *distinct_wires.iter().next().unwrap_or(&"");
+                    match wire {
+                        "session_backing_store_missing" => {
+                            // Collect a flat list of every checked path so
+                            // operators can copy/paste-grep for files that
+                            // moved. picker_hint per worker gives the
+                            // alternate-recovery one-liner.
+                            let mut probed: Vec<String> = Vec::new();
+                            let mut picker_lines: Vec<String> = Vec::new();
+                            for w in unresumable.iter() {
+                                if let Some(
+                                    crate::provider::session::ResumeRefusalReason::SessionBackingStoreMissing {
+                                        checked_paths,
+                                        recovery_hint,
+                                    },
+                                ) = w.refusal_reason.as_ref()
+                                {
+                                    for p in checked_paths {
+                                        probed.push(p.to_string_lossy().into_owned());
+                                    }
+                                    if let Some(h) = recovery_hint {
+                                        picker_lines.push(format!(
+                                            "  {}: try `{}`",
+                                            w.agent_id.as_str(),
+                                            h.picker_hint(),
+                                        ));
+                                    }
+                                }
+                            }
+                            probed.sort();
+                            probed.dedup();
+                            let mut msg = format!(
+                                "restart refused: provider session backing store missing for {} worker(s) ({}). \
+                                 Pass --allow-fresh to start a new session, or restore the backing files listed below.",
+                                unresumable.len(),
+                                unresumable_ids.join(", "),
+                            );
+                            if !probed.is_empty() {
+                                msg.push_str("\nProbed paths (none contained the expected session):");
+                                for p in &probed {
+                                    msg.push_str("\n  ");
+                                    msg.push_str(p);
+                                }
+                            }
+                            if !picker_lines.is_empty() {
+                                msg.push_str("\nProvider picker recovery hints:");
+                                for line in &picker_lines {
+                                    msg.push_str("\n");
+                                    msg.push_str(line);
+                                }
+                            }
+                            (
+                                "refused_session_backing_missing".to_string(),
+                                msg,
+                            )
+                        }
+                        "no_persisted_session_id" => (
+                            "refused_no_session_id".to_string(),
+                            format!(
+                                "restart refused: no persisted session_id for {} worker(s) ({}). Pass --allow-fresh to start fresh.",
+                                unresumable.len(),
+                                unresumable_ids.join(", "),
+                            ),
+                        ),
+                        "provider_resume_unsupported" => (
+                            "refused_provider_resume_unsupported".to_string(),
+                            format!(
+                                "restart refused: provider does not support resume for {} worker(s) ({}). Pass --allow-fresh to start fresh.",
+                                unresumable.len(),
+                                unresumable_ids.join(", "),
+                            ),
+                        ),
+                        _ => ("refused_resume_atomicity".to_string(), error.clone()),
+                    }
+                } else {
+                    // Mixed or unstructured reasons — keep the coarse
+                    // label, but augment the error so it lists each
+                    // worker's specific reason.
+                    let per_worker = unresumable
+                        .iter()
+                        .map(|w| {
+                            let reason = w
+                                .refusal_reason
+                                .as_ref()
+                                .map(|r| r.wire().to_string())
+                                .unwrap_or_else(|| w.reason.clone());
+                            format!("{} ({})", w.agent_id.as_str(), reason)
+                        })
+                        .collect::<Vec<_>>()
+                        .join(", ");
+                    (
+                        "refused_resume_atomicity".to_string(),
+                        format!("{error} Per-worker: {per_worker}."),
+                    )
+                };
+                json!({
+                    "ok": false,
+                    "status": status_str,
+                    "status_class": "refused_resume_atomicity",
+                    "allow_fresh": allow_fresh,
+                    "error": error_str,
+                    "unresumable": unresumable_detail,
+                    "unresumable_ids": unresumable_ids,
+                    "reminder": crate::cli::QUICK_START_REMINDER,
+                })
+            }
             crate::lifecycle::RestartReport::RefusedResumeNotReady {
                 missing,
                 allow_fresh,
@@ -2758,6 +2987,18 @@ pub mod lifecycle_port {
                 "invalid": invalid.iter().map(|w| w.worker_id.as_str()).collect::<Vec<_>>(),
                 "reminder": crate::cli::QUICK_START_REMINDER,
             }),
+            crate::lifecycle::RestartReport::RefusedDirtyTopology {
+                session_name,
+                reason,
+                error,
+            } => json!({
+                "ok": false,
+                "status": "refused_dirty_topology",
+                "reason": reason,
+                "session_name": session_name,
+                "error": error,
+                "reminder": crate::cli::QUICK_START_REMINDER,
+            }),
         }
     }
 

package/crates/team-agent/src/cli/send.rs

@@ -283,12 +283,15 @@ fn routing_ambiguous_value(
     if in_team {
         return None;
     }
+    // aeab1c7 follow-up: `content` is no longer emitted anywhere from `send`
+    // responses (including this refusal). Replace with `content_length_bytes`
+    // to keep the size-sanity field consistent with the normal-send shape.
     Some(json!({
         "ok": false,
         "status": "refused",
         "target": null,
         "agent_id": null,
-        "content": name,
+        "content_length_bytes": name.len(),
         "sender": opts.sender,
         "message_id": null,
         "message_status": "refused",
@@ -456,13 +459,19 @@ fn delivery_outcome_json(
     content: &str,
     opts: &SendOptions,
 ) -> Value {
+    // Pre-release 0.4.0 user directive: send result MUST NOT carry the
+    // message body — neither in human form (cli/emit.rs) NOR in --json.
+    // External consumers who need the message content read it via `inbox`,
+    // not from the send response. We surface `content_length_bytes` as a
+    // size sanity field so callers can verify the body size they intended
+    // to send arrived intact without exposing the body itself.
     let target_wire = target_json(target);
     json!({
         "ok": outcome.ok,
         "status": delivery_status_wire(outcome.status),
         "target": target_wire,
         "agent_id": first_target(target),
-        "content": content,
+        "content_length_bytes": content.len(),
         "sender": opts.sender,
         "message_id": outcome.message_id,
         "message_status": outcome.message_status.0,

package/crates/team-agent/src/cli/status_port.rs

@@ -58,14 +58,19 @@ use rusqlite::params;
                 .and_then(Value::as_str)
                 .unwrap_or("leader");
             session_name.as_str().and_then(|session| {
-                crate::tmux_backend::attach_command_for_workspace(
+                // Bug #7 (gate review §6): build the attach command from the
+                // SAME endpoint the readiness probe uses (state's persisted
+                // tmux_endpoint/tmux_socket), so the printed command matches
+                // where the session actually lives.
+                crate::tmux_backend::attach_command_for_runtime_state_or_workspace(
                     workspace,
+                    Some(state),
                     &crate::transport::SessionName::new(session.to_string()),
                     window_name,
                 )
             })
         };
-        let tmux_present = tmux_session_present(workspace, session_name.as_str());
+        let tmux_present = tmux_session_present(workspace, state, session_name.as_str());
         let mut readiness_state = state.clone();
         if let Some(obj) = readiness_state.as_object_mut() {
             obj.insert("tmux_session_present".to_string(), serde_json::json!(tmux_present));
@@ -435,7 +440,16 @@ use rusqlite::params;
         }
     }
 
-    fn tmux_session_present(workspace: &Path, session_name: Option<&str>) -> bool {
+    fn tmux_session_present(
+        workspace: &Path,
+        state: &Value,
+        session_name: Option<&str>,
+    ) -> bool {
+        // Bug #7 (prerelease 0.4.0 gate review §6): probe the SAME endpoint
+        // the runtime actually uses (state.tmux_endpoint / tmux_socket), not
+        // the workspace-hash socket. When state has no persisted endpoint,
+        // fall back to workspace — preserves legacy behavior. wait_readiness
+        // formula unchanged per 不可改项; only the input signal is fixed.
         let Some(name) = session_name else {
             return false;
         };
@@ -444,7 +458,12 @@ use rusqlite::params;
         }
         let run_ws = crate::model::paths::canonical_run_workspace(workspace)
             .unwrap_or_else(|_| workspace.to_path_buf());
-        crate::tmux_backend::TmuxBackend::for_workspace(&run_ws)
+        let selection = crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(
+            &run_ws,
+            Some(state),
+        );
+        selection
+            .backend
             .has_session(&crate::transport::SessionName::new(name))
             .unwrap_or(false)
     }
@@ -635,6 +654,22 @@ use rusqlite::params;
             "session_id",
             "captured_via",
             "attribution_confidence",
+            // RM-039-STAT-001 fix (real-machine evidence 2026-06-22): the
+            // coordinator-tick activity classifier writes activity (status,
+            // confidence, rationale) to the top-level agent state, but the
+            // status --json compact projection dropped it. Operators saw
+            // "status: running" with no working/idle signal even when the
+            // pane was clearly producing output. Add the classifier output
+            // here so the compact form surfaces it.
+            // last_output_at is the timestamp the classifier advanced when
+            // the scrollback digest changed; keeping it adjacent to activity
+            // gives the operator a one-glance "is something moving" view.
+            // interacted is enriched in enrich_agents (true|false|never)
+            // and is the canonical "leader has ever sent this worker a
+            // message" signal — also needed for status sanity at a glance.
+            "activity",
+            "last_output_at",
+            "interacted",
         ] {
             if let Some(value) = input.get(key) {
                 out.insert(key.to_string(), value.clone());