@team-agent/installer 0.3.39 → 0.4.0

package/crates/team-agent/src/coordinator/tests/health_sync.rs

@@ -262,3 +262,159 @@ fn contract_working_worker_stays_alive_and_deliverable_in_real_tick() {
          deferred_busy (golden delivers; fake workers are permanently WORKING). got {events:?}"
     );
 }
+
+// ═══════════════════════════════════════════════════════════════════════════
+// RM-039-STAT-001 third-round RED contracts (architect verdict 2026-06-22).
+//
+// The provider JSONL classifier already recognizes Codex
+// `event_msg/task_started` as an open turn (verified at b6807ba via
+// `p2_codex_event_msg_task_started_is_open_turn`). The third-round bug is
+// in the COORDINATOR ACTIVITY REFRESH BOUNDARY: JSONL classification was
+// gated behind pane-target/window checks and warm-idle suppression, so a
+// stale pane-fallback `idle_prompt` could become the persisted activity
+// truth and then survive across ticks because warm-idle suppression
+// blocked re-classification — even when the rollout grew and the worker
+// process was alive.
+//
+// Fix: JSONL has the floor. If it returns a definite activity, write
+// activity + agent_health BEFORE any pane work and BYPASS warm-idle
+// suppression for that agent on that tick.
+// ═══════════════════════════════════════════════════════════════════════════
+
+/// Write a real-shape Codex rollout prefix to `path`. The prefix ends
+/// after `event_msg/task_started` (no `task_complete` follows), matching
+/// the architect's specification.
+fn write_codex_rollout_prefix_task_started(path: &std::path::Path) {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    // session_meta + task_started — minimal but realistic shape per
+    // architect §2 ("real rollout uses modern Codex records: session_meta,
+    // event_msg, response_item, turn_context"). The classifier needs only
+    // task_started to declare an open turn (provider/classify.rs:364-398).
+    let body = "{\"type\":\"session_meta\",\"session_id\":\"019eeda2-7e2f-77a1-bc66-f8d485c8d2c8\",\"created\":\"2026-06-22T12:41:49Z\"}\n\
+                {\"type\":\"event_msg\",\"payload\":{\"type\":\"task_started\"},\"ts\":\"2026-06-22T12:42:54Z\"}\n";
+    std::fs::write(path, body).unwrap();
+}
+
+/// Write a real-shape Codex rollout ending with `event_msg/task_complete`
+/// (full turn close). The classifier MUST return Idle with rationale
+/// `provider_jsonl:task_complete`.
+fn write_codex_rollout_task_complete(path: &std::path::Path) {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent).unwrap();
+    }
+    let body = "{\"type\":\"session_meta\",\"session_id\":\"019eeda2-7e2f-77a1-bc66-f8d485c8d2c8\",\"created\":\"2026-06-22T12:41:49Z\"}\n\
+                {\"type\":\"event_msg\",\"payload\":{\"type\":\"task_started\"},\"ts\":\"2026-06-22T12:42:54Z\"}\n\
+                {\"type\":\"event_msg\",\"payload\":{\"type\":\"task_complete\"},\"ts\":\"2026-06-22T12:46:08Z\"}\n";
+    std::fs::write(path, body).unwrap();
+}
+
+fn agent_activity_rationale(dir: &std::path::Path, agent: &str) -> Option<String> {
+    let state = crate::state::persist::load_runtime_state(dir).ok()?;
+    state
+        .get("agents")?
+        .get(agent)?
+        .get("activity")?
+        .get("rationale")?
+        .as_str()
+        .map(str::to_string)
+}
+
+// RED #2 (architect §6.2): an agent currently marked idle with
+// `coordinator_idle_capture_next_at` in the future MUST still get
+// re-classified as `working` once its rollout JSONL records
+// `event_msg/task_started`. The JSONL classifier must beat warm-idle
+// suppression.
+#[test]
+fn rm039_stat001_jsonl_overrides_warm_idle_suppression_for_open_turn() {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static N: AtomicU64 = AtomicU64::new(0);
+    let n = N.fetch_add(1, Ordering::Relaxed);
+    let rollout = std::env::temp_dir().join(format!(
+        "ta-rs-rm039-r3-rollout-open-{}-{}.jsonl",
+        std::process::id(),
+        n
+    ));
+    write_codex_rollout_prefix_task_started(&rollout);
+    // future timestamp — would have suppressed pane re-capture
+    let next_at = (chrono::Utc::now() + chrono::Duration::seconds(120)).to_rfc3339();
+    let agents = serde_json::json!({
+        "stat-worker": {
+            "provider": "codex",
+            "window": "w1",
+            "pane_id": "%1",
+            "status": "running",
+            "session_id": "019eeda2-7e2f-77a1-bc66-f8d485c8d2c8",
+            "rollout_path": rollout.to_string_lossy(),
+            "activity": {"status": "idle", "confidence": 0.9, "rationale": "idle_prompt"},
+            "coordinator_idle_capture_next_at": next_at,
+            "pane_pid_status": "pid_running:99999",
+        }
+    });
+    // Stale pane scrollback that pane-fallback would classify as idle.
+    let (coord, dir) = seeded_health_coord(agents, "previous output\n❯\n");
+    coord.tick().expect("tick");
+    let status = agent_activity_status(&dir, "stat-worker");
+    assert_eq!(
+        status.as_deref(),
+        Some("working"),
+        "RM-039-STAT-001 third-round: JSONL `task_started` must override warm-idle \
+         suppression even when the pane scrollback still shows the idle prompt; got {status:?}"
+    );
+    let rationale = agent_activity_rationale(&dir, "stat-worker");
+    assert!(
+        rationale
+            .as_deref()
+            .is_some_and(|r| r.starts_with("provider_jsonl:")),
+        "rationale must come from the provider JSONL path (provider_jsonl:*), not pane fallback; \
+         got {rationale:?}"
+    );
+}
+
+// RED #4 (architect §6.4): a full rollout ending in `event_msg/task_complete`
+// MUST return/persist idle with rationale `provider_jsonl:task_complete`.
+// This preserves the E47 stale-working fix and proves the JSONL-first
+// reorder did not regress the close-turn classification.
+#[test]
+fn rm039_stat001_jsonl_close_turn_preserves_e47_idle_classification() {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static N: AtomicU64 = AtomicU64::new(0);
+    let n = N.fetch_add(1, Ordering::Relaxed);
+    let rollout = std::env::temp_dir().join(format!(
+        "ta-rs-rm039-r3-rollout-close-{}-{}.jsonl",
+        std::process::id(),
+        n
+    ));
+    write_codex_rollout_task_complete(&rollout);
+    let agents = serde_json::json!({
+        "stat-worker": {
+            "provider": "codex",
+            "window": "w1",
+            "pane_id": "%1",
+            "status": "running",
+            "session_id": "019eeda2-7e2f-77a1-bc66-f8d485c8d2c8",
+            "rollout_path": rollout.to_string_lossy(),
+            "pane_pid_status": "pid_running:99999",
+        }
+    });
+    // The pane Tail(40) still shows the live working spinner — the E47
+    // stale-working scenario. The JSONL `task_complete` MUST close the
+    // turn anyway.
+    let (coord, dir) =
+        seeded_health_coord(agents, "Working (5s · esc to interrupt)\n• Working\n");
+    coord.tick().expect("tick");
+    let status = agent_activity_status(&dir, "stat-worker");
+    assert_eq!(
+        status.as_deref(),
+        Some("idle"),
+        "RM-039-STAT-001 third-round must preserve E47: `task_complete` closes the turn \
+         even when pane scrollback still shows a working spinner; got {status:?}"
+    );
+    let rationale = agent_activity_rationale(&dir, "stat-worker");
+    assert_eq!(
+        rationale.as_deref(),
+        Some("provider_jsonl:task_complete"),
+        "rationale must be `provider_jsonl:task_complete`, not stale pane working; got {rationale:?}"
+    );
+}

package/crates/team-agent/src/coordinator/tick.rs

@@ -99,6 +99,33 @@ pub enum TickError {
     Panic(String),
 }
 
+/// Issue 2 (Round 3b gate review §6): when the runtime state has
+/// `active_team_key` AND `teams.<key>` is a populated object, return the
+/// team-scoped projection so the coordinator's tick reads `session_name` /
+/// `agents` / `leader_receiver` from the team's nested entry rather than
+/// the top-level (often stale) view. When the projection cannot be derived,
+/// returns `None` and the tick falls back to the raw state — preserving
+/// behavior for legacy single-team workspaces and tests that don't seed
+/// `teams.<key>`. Sibling teams under `state.teams.*` are NOT touched.
+fn coordinator_team_scoped_state(
+    workspace: &std::path::Path,
+    raw_state: &Value,
+) -> Option<Value> {
+    let active = raw_state
+        .get("active_team_key")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty())?;
+    let has_team_entry = raw_state
+        .get("teams")
+        .and_then(Value::as_object)
+        .map(|teams| teams.contains_key(active))
+        .unwrap_or(false);
+    if !has_team_entry {
+        return None;
+    }
+    crate::state::projection::select_runtime_state(workspace, Some(active)).ok()
+}
+
 // ===========================================================================
 // Coordinator struct(daemon lifecycle + tick orchestration)
 // ===========================================================================
@@ -190,7 +217,18 @@ impl Coordinator {
     /// 副作用 ORDER 测试断言固定序列)。生产两者均 `None`,零开销。
     pub fn tick(&self) -> Result<TickReport, TickError> {
         self.record_step("load_state");
-        let mut state = crate::state::persist::load_runtime_state(self.workspace.as_path())?;
+        let raw_state = crate::state::persist::load_runtime_state(self.workspace.as_path())?;
+        // Issue 2 (Round 3b gate review §6): when the runtime carries
+        // `active_team_key` AND `teams.<key>` exists, project the team-scoped
+        // view (session_name / agents / leader_receiver come from the team's
+        // nested object) instead of the raw top-level state. Otherwise the
+        // coordinator would probe the wrong tmux session (e.g. stale
+        // `session_name=team-tmp` while the real team session is
+        // `team-prerelease-040-round3b`) and emit `coordinator.session_missing`
+        // even though the right session is alive. Fall back to raw state when
+        // no team scope can be derived (legacy single-team workspaces).
+        let mut state = coordinator_team_scoped_state(self.workspace.as_path(), &raw_state)
+            .unwrap_or(raw_state);
         let store = crate::message_store::MessageStore::open(self.workspace.as_path())?;
         let event_log = EventLog::new(self.workspace.as_path());
         increment_coordinator_tick_iteration_count(&self.workspace);
@@ -406,6 +444,29 @@ impl Coordinator {
             true,
             0,
         )?;
+        // RM-039-STAT-001 third-round fix (architect verdict 2026-06-22):
+        // when capture_missing_sessions assigns a new rollout_path to an
+        // agent, clear that agent's `coordinator_idle_capture_next_at` so
+        // the JSONL classifier is not gated by stale warm-idle suppression
+        // on the SAME tick that the rollout becomes readable. Without this,
+        // an agent that was IDLE before attribution would carry the old
+        // suppression timestamp into sync_agent_health and only the
+        // expensive pane Tail(40) path would observe its working state.
+        if !report.assigned.is_empty() {
+            if let Some(agents) = state
+                .get_mut("agents")
+                .and_then(serde_json::Value::as_object_mut)
+            {
+                for assigned_agent_id in &report.assigned {
+                    if let Some(agent_obj) = agents
+                        .get_mut(assigned_agent_id)
+                        .and_then(serde_json::Value::as_object_mut)
+                    {
+                        agent_obj.remove("coordinator_idle_capture_next_at");
+                    }
+                }
+            }
+        }
         for failure in report.capture_failures {
             event_log.write(
                 "coordinator.tick.capture_missing_failed",
@@ -466,6 +527,38 @@ impl Coordinator {
             if !agent_probe_base_eligible(agent) {
                 continue;
             }
+            // RM-039-STAT-001 third-round fix (architect verdict 2026-06-22):
+            // try the provider JSONL classifier FIRST, BEFORE any pane-target
+            // / window checks and BEFORE warm_idle_capture_suppressed. The
+            // historical chain ran JSONL only inside the pane-capture branch,
+            // so a stale pane-fallback `idle_prompt` could land first
+            // (before session attribution completed), then
+            // `warm_idle_capture_suppressed` would gate subsequent ticks for
+            // IDLE_HEALTH_CAPTURE_INTERVAL_SECS even after JSONL gained a
+            // `task_started` record + the worker process was alive. Now: if
+            // the JSONL classifier returns a definite activity (not Unknown),
+            // we write activity + agent_health here and bypass the warm-idle
+            // suppression for the rest of this iteration. Pane capture still
+            // runs so the CapturedRuntimeFact map stays populated for
+            // downstream runtime detectors; only the activity classify
+            // happens once.
+            let jsonl_first = jsonl_activity_for_agent(agent);
+            if let Some(activity) = jsonl_first.as_ref() {
+                remember_idle_capture_schedule(agent, activity);
+                write_activity(agent, activity, false);
+                let last_output_at_now = agent
+                    .get("last_output_at")
+                    .and_then(Value::as_str)
+                    .map(str::to_string);
+                write_agent_health(
+                    store,
+                    &team,
+                    agent_id,
+                    agent,
+                    activity,
+                    last_output_at_now.as_deref(),
+                )?;
+            }
             let Some((session, window, target)) =
                 capture_window_target(agent, session_name.as_deref())
             else {
@@ -495,7 +588,13 @@ impl Coordinator {
             if !windows.iter().any(|known| known == &window) {
                 continue;
             }
-            if warm_idle_capture_suppressed(agent, has_work_obligation) {
+            // Warm-idle suppression still gates pane fallback ONLY. When
+            // JSONL above produced a definite activity, we already wrote it,
+            // so warm-idle gating no longer matters for the activity path —
+            // but we still want CapturedRuntimeFact populated for downstream
+            // detectors, so fall through into the pane capture block below
+            // (skipping the pane-classify activity write at the bottom).
+            if jsonl_first.is_none() && warm_idle_capture_suppressed(agent, has_work_obligation) {
                 continue;
             }
             let captured = match self
@@ -544,38 +643,35 @@ impl Coordinator {
                 .get("last_output_at")
                 .and_then(Value::as_str)
                 .map(str::to_string);
-            // E47 (0.3.24 P0, idle/busy 假阳): consult the AUTHORITATIVE
-            // provider JSONL classifier BEFORE the TUI keyword scan. The
-            // scrollback Tail(40) keeps historical `• Working (...· esc to
-            // interrupt)` + spinners within the 40-line window long after a
-            // turn completed, so `classify_agent_activity`'s rfind-recency
-            // grep flips a truly-idle worker to Working/Stuck. The provider
-            // JSONL (codex task_complete / claude end_turn) is the single
-            // source of truth for "turn closed". Only fall back to TUI
-            // scanning when the JSONL is unreadable or no lifecycle fact has
-            // been written yet (TurnState::Unknown) — never silently fall
-            // through into the leaky grep on a CONFIRMED IDLE.
-            let activity_from_jsonl = jsonl_activity_for_agent(agent);
-            let activity = activity_from_jsonl.unwrap_or_else(|| {
-                crate::messaging::classify_agent_activity(
+            // E47 (0.3.24 P0, idle/busy 假阳): the provider JSONL classifier
+            // already ran at the top of this iteration. If it returned a
+            // definite fact (Some), activity + agent_health were written
+            // there; we MUST NOT classify-and-overwrite here, otherwise the
+            // pane fallback would flip the JSONL truth back to a stale
+            // idle_prompt. Only run the pane fallback when JSONL returned
+            // None (no readable rollout, TurnState::Unknown, or unparseable
+            // log). RM-039-STAT-001 third-round fix (architect verdict
+            // 2026-06-22).
+            let last_output_at = last_output_at_now;
+            if jsonl_first.is_none() {
+                let activity = crate::messaging::classify_agent_activity(
                     &snapshot,
                     &captured.text,
                     pane_in_mode,
                     current_command.as_deref(),
-                    last_output_at_now.as_deref(),
-                )
-            });
-            remember_idle_capture_schedule(agent, &activity);
-            write_activity(agent, &activity, false);
-            let last_output_at = last_output_at_now;
-            write_agent_health(
-                store,
-                &team,
-                agent_id,
-                agent,
-                &activity,
-                last_output_at.as_deref(),
-            )?;
+                    last_output_at.as_deref(),
+                );
+                remember_idle_capture_schedule(agent, &activity);
+                write_activity(agent, &activity, false);
+                write_agent_health(
+                    store,
+                    &team,
+                    agent_id,
+                    agent,
+                    &activity,
+                    last_output_at.as_deref(),
+                )?;
+            }
             let pane_info = matching_capture_pane_info(agent, &session, &window, pane_infos);
             let pane_id = pane_info
                 .as_ref()

package/crates/team-agent/src/{message_store.rs → db/message_store.rs}

@@ -1,3 +1,9 @@
+// unit-10 (Stage 4): moved from crate::message_store to crate::db::message_store.
+// The historical body uses unwrap/expect/panic for SQL-row failures; the parent
+// db/ module denies these lints, so re-allow them here so the move is a pure
+// physical relocation (zero behavior change).
+#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+
 //! step 7 · message_store — core message lifecycle over `team.db`.
 //!
 //! Truth source (READ-ONLY): `team-agent-public` @ v0.2.11,

package/crates/team-agent/src/db/mod.rs

@@ -9,6 +9,7 @@
 //! §10:db 层无 unwrap/expect/panic;rusqlite 错误经 [`DbError`] 传播。
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
+pub mod message_store;
 pub mod migration;
 pub mod schema;
 

package/crates/team-agent/src/layout/mod.rs

@@ -27,3 +27,10 @@ pub mod worker_env;
 pub mod placement;
 pub mod recovery;
 pub mod overlay;
+pub mod runtime_sessions;
+pub mod tmux_endpoint;
+
+pub use runtime_sessions::{
+    LeaderLauncherSession, LeaderLauncherSessionError, RuntimeSessionAnomaly, RuntimeSessions,
+    WorkerSession, WorkerSessionError,
+};