@team-agent/installer 0.3.39 → 0.4.0

package/crates/team-agent/src/provider/session_scan.rs

@@ -0,0 +1,63 @@
+//! unit-7 (Stage 3) — provider session-scan boundary.
+//!
+//! Dedicated home for provider transcript/backing scanning concerns
+//! (today co-located in adapter.rs around lines 511-546 and 969-1078).
+//! Created as part of the unit-7 boundary establishment; full relocation
+//! of the scanning fns is staged into follow-up commits so each diff
+//! stays reviewable.
+//!
+//! See sibling [`crate::provider::session::capture`] for the existing
+//! polling layer (moved under provider/session in unit-6).
+
+/// Marker label for which scan strategy a provider uses. The Codex jsonl
+/// scan and the Claude transcript scan share the same outer "decide what
+/// to call" hook in adapter.rs; this enum exists to name the branch.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SessionScanStrategy {
+    /// Codex rollout jsonl scan (the existing
+    /// `agent_rollout_path`-based check).
+    CodexJsonl,
+    /// Claude transcript scan (per-cwd `.claude/projects/<cwd>/*.jsonl`).
+    ClaudeTranscript,
+    /// Copilot scan (different home; provider-specific layout).
+    CopilotHome,
+    /// Provider does not require a backing scan to decide resume — the
+    /// session-id alone is the authority.
+    NotRequired,
+}
+
+impl SessionScanStrategy {
+    pub fn for_provider(provider: crate::provider::Provider) -> Self {
+        match provider {
+            crate::provider::Provider::Codex => Self::CodexJsonl,
+            crate::provider::Provider::Claude | crate::provider::Provider::ClaudeCode => {
+                Self::ClaudeTranscript
+            }
+            crate::provider::Provider::Copilot => Self::CopilotHome,
+            crate::provider::Provider::GeminiCli => Self::NotRequired,
+            crate::provider::Provider::Fake => Self::NotRequired,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::provider::Provider;
+
+    #[test]
+    fn strategy_per_provider() {
+        assert_eq!(
+            SessionScanStrategy::for_provider(Provider::Codex),
+            SessionScanStrategy::CodexJsonl
+        );
+        assert_eq!(
+            SessionScanStrategy::for_provider(Provider::Claude),
+            SessionScanStrategy::ClaudeTranscript
+        );
+        assert_eq!(
+            SessionScanStrategy::for_provider(Provider::Fake),
+            SessionScanStrategy::NotRequired
+        );
+    }
+}

package/crates/team-agent/src/provider/types.rs

@@ -342,6 +342,11 @@ pub struct ProviderCommandContext<'a> {
     pub model: Option<&'a str>,
     pub tools: &'a [&'a str],
     pub profile_launch: Option<&'a ProviderProfileLaunch>,
+    /// Optional agent id, used as a launch-time display-name hint for
+    /// providers that accept `--name <name>` (Claude, Copilot). Codex has
+    /// no `--name` CLI flag (probe verdict 2026-06-22) and ignores this
+    /// field. None = legacy callers (the field is purely additive).
+    pub agent_id_hint: Option<&'a str>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]

package/crates/team-agent/src/state/persist.rs

@@ -642,6 +642,72 @@ pub fn migrate_active_team_key(state: &mut Value) -> bool {
     true
 }
 
+/// RM-039-STAT-001 second-round compat normalizer (architect verdict
+/// 2026-06-22). When `active_team_key` names an existing `teams` entry
+/// but root `team_key` is missing, set root `team_key = active_team_key`
+/// (and mirror it into `teams[active_team_key].team_key` for callers
+/// that read the team-scoped slot). This keeps the cascade in
+/// `state::projection::team_state_key` honest: the first branch
+/// (`state.team_key`) now matches what `active_team_key` says, so
+/// coordinator tick's `save_team_scoped_state` writes activity to the
+/// SAME teams entry the status selector later reads.
+///
+/// Narrow on purpose:
+///   * Returns `false` (no-op) when root `team_key` already exists,
+///     even if it disagrees with `active_team_key`. Conflict cases
+///     stay observable; we don't silently rewrite.
+///   * Returns `false` when `active_team_key` is null/empty.
+///   * Returns `false` when `teams[active_team_key]` does not exist.
+///   * Does NOT touch any other field (no generic deep merge).
+///
+/// Returns `true` if state was mutated and the caller should persist.
+pub fn migrate_team_key_to_match_active_team(state: &mut Value) -> bool {
+    let Some(obj) = state.as_object() else {
+        return false;
+    };
+    let already_has_root = obj
+        .get("team_key")
+        .and_then(Value::as_str)
+        .is_some_and(|s| !s.is_empty());
+    if already_has_root {
+        return false;
+    }
+    let active = match obj.get("active_team_key").and_then(Value::as_str) {
+        Some(s) if !s.is_empty() => s.to_string(),
+        _ => return false,
+    };
+    let teams_has_active = obj
+        .get("teams")
+        .and_then(Value::as_object)
+        .is_some_and(|teams| teams.contains_key(&active));
+    if !teams_has_active {
+        return false;
+    }
+    let Some(obj_mut) = state.as_object_mut() else {
+        return false;
+    };
+    obj_mut.insert("team_key".to_string(), Value::String(active.clone()));
+    // Mirror inside teams[active] so any code reading the team-scoped
+    // slot sees the same canonical key. Skip if the entry isn't an
+    // object (defensive — should always be).
+    if let Some(team_entry) = obj_mut
+        .get_mut("teams")
+        .and_then(Value::as_object_mut)
+        .and_then(|teams| teams.get_mut(&active))
+        .and_then(Value::as_object_mut)
+    {
+        let needs_team_key = team_entry
+            .get("team_key")
+            .and_then(Value::as_str)
+            .map(|s| s != active)
+            .unwrap_or(true);
+        if needs_team_key {
+            team_entry.insert("team_key".to_string(), Value::String(active));
+        }
+    }
+    true
+}
+
 pub fn load_runtime_state(workspace: &Path) -> Result<Value, StateError> {
     let path = runtime_state_path(workspace);
     if !path.exists() {
@@ -657,6 +723,13 @@ pub fn load_runtime_state(workspace: &Path) -> Result<Value, StateError> {
     if migrate_active_team_key(&mut state) {
         changed = true;
     }
+    // RM-039-STAT-001 second-round compat (architect verdict 2026-06-22):
+    // for states written before the launch-side `team_key` fix landed,
+    // promote `active_team_key` into root `team_key` so coordinator tick
+    // and status selector agree on which `teams` entry to read/write.
+    if migrate_team_key_to_match_active_team(&mut state) {
+        changed = true;
+    }
     if changed {
         save_runtime_state(workspace, &state)?;
     }
@@ -1037,4 +1110,169 @@ mod tests {
             "deleted_agent_ids 豁免:被 remove 的 `gone` 不得被 preserve 复活;saved={saved}"
         );
     }
+
+    /// RM-039-STAT-001 second-round regression (architect verdict
+    /// 2026-06-22): `migrate_team_key_to_match_active_team` must
+    /// promote `team_key = active_team_key` when root `team_key` is
+    /// missing AND `teams[active_team_key]` exists, and mirror it into
+    /// the team-scoped slot. Coordinator tick then writes to the same
+    /// teams entry that status selector reads.
+    #[test]
+    fn migrate_team_key_to_match_active_team_promotes_when_missing() {
+        let mut state = json!({
+            "active_team_key": "rm039-status-working-891",
+            "session_name": "team-rm039-status-working",
+            "team_dir": "./.team/current",
+            "teams": {
+                "rm039-status-working-891": {
+                    "active_team_key": "rm039-status-working-891",
+                    "session_name": "team-rm039-status-working",
+                    "agents": {}
+                }
+            }
+        });
+        let changed = migrate_team_key_to_match_active_team(&mut state);
+        assert!(changed, "state must be mutated when team_key is missing");
+        assert_eq!(
+            state.get("team_key").and_then(Value::as_str),
+            Some("rm039-status-working-891"),
+            "root team_key must equal active_team_key after migration"
+        );
+        // mirrored into the team-scoped entry
+        assert_eq!(
+            state
+                .pointer("/teams/rm039-status-working-891/team_key")
+                .and_then(Value::as_str),
+            Some("rm039-status-working-891"),
+            "teams[active].team_key must be set as part of the migration"
+        );
+        // team_state_key cascade now agrees with active_team_key.
+        assert_eq!(
+            crate::state::projection::team_state_key(&state),
+            "rm039-status-working-891",
+            "team_state_key first branch must hit `state.team_key` and \
+             return the canonical key"
+        );
+    }
+
+    /// Conflict cases stay observable: if `team_key` already exists,
+    /// the migrator does NOT silently overwrite it, even when it
+    /// disagrees with `active_team_key`. The user/team can resolve.
+    #[test]
+    fn migrate_team_key_to_match_active_team_is_noop_when_team_key_present() {
+        let mut state = json!({
+            "team_key": "explicit-key",
+            "active_team_key": "different-active",
+            "teams": {
+                "different-active": {"agents": {}},
+                "explicit-key": {"agents": {}}
+            }
+        });
+        let changed = migrate_team_key_to_match_active_team(&mut state);
+        assert!(!changed, "existing team_key must NOT be overwritten");
+        assert_eq!(
+            state.get("team_key").and_then(Value::as_str),
+            Some("explicit-key")
+        );
+    }
+
+    /// Narrow: only promote when teams[active_team_key] actually exists.
+    /// Otherwise we'd be claiming a key for a non-existent team slot.
+    #[test]
+    fn migrate_team_key_to_match_active_team_is_noop_when_active_team_entry_missing() {
+        let mut state = json!({
+            "active_team_key": "missing-team",
+            "teams": {
+                "other": {"agents": {}}
+            }
+        });
+        let changed = migrate_team_key_to_match_active_team(&mut state);
+        assert!(
+            !changed,
+            "no migration when teams[active_team_key] does not exist"
+        );
+        assert!(state.get("team_key").is_none());
+    }
+
+    /// Null / empty active_team_key is not actionable.
+    #[test]
+    fn migrate_team_key_to_match_active_team_is_noop_when_active_team_key_absent() {
+        for active in [json!(null), json!(""), json!(serde_json::Value::Null)] {
+            let mut state = json!({
+                "active_team_key": active,
+                "teams": {}
+            });
+            assert!(
+                !migrate_team_key_to_match_active_team(&mut state),
+                "no migration when active_team_key is null/empty"
+            );
+        }
+    }
+
+    /// RM-039-STAT-001 second-round end-to-end at the persistence layer
+    /// (architect verdict 2026-06-22): loading a state file in the dirty
+    /// shape (active_team_key disagrees with team_dir basename, root
+    /// team_key absent) must persist the canonical `team_key` so the
+    /// next `save_team_scoped_state` writes the team-scoped slot at
+    /// `teams[active_team_key]`, not at `teams[team_dir_basename]`.
+    /// This is the bridging contract that decides whether coordinator
+    /// tick's activity write lands where the status selector later reads.
+    #[test]
+    fn load_runtime_state_pins_team_key_from_active_team_key_on_dirty_shape() {
+        let ws = temp_ws();
+        let active = "rm039-status-working-891";
+        let raw = json!({
+            "session_name": "team-rm039-status-working",
+            "team_dir": "./.team/current",
+            "active_team_key": active,
+            // intentionally NO root "team_key" — the dirty shape.
+            "agents": {
+                "coder": {"status": "running", "first_send_at": "2026-01-01T00:00:00Z"}
+            },
+            "teams": {
+                "current": {
+                    "active_team_key": active,
+                    "agents": {"coder": {"status": "running"}}
+                },
+                active: {
+                    "active_team_key": active,
+                    "agents": {"coder": {"status": "running"}}
+                }
+            }
+        });
+        let runtime_dir = ws.join(".team").join("runtime");
+        std::fs::create_dir_all(&runtime_dir).unwrap();
+        std::fs::write(
+            runtime_dir.join("state.json"),
+            serde_json::to_vec_pretty(&raw).unwrap(),
+        )
+        .unwrap();
+        // temp_ws() returns a unique path per call, so the cache
+        // (keyed by path) does not collide with previous tests.
+
+        let loaded = load_runtime_state(&ws).expect("loaded state");
+        assert_eq!(
+            loaded.get("team_key").and_then(Value::as_str),
+            Some(active),
+            "load_runtime_state must promote team_key=active_team_key on the dirty shape"
+        );
+        // team_state_key now cascades to state.team_key, returning the
+        // canonical key instead of the team_dir basename.
+        assert_eq!(
+            crate::state::projection::team_state_key(&loaded),
+            active,
+            "team_state_key must return the canonical key after migration"
+        );
+
+        // Re-read from disk (not cache) to confirm the migration was persisted.
+        let on_disk: Value = serde_json::from_str(
+            &std::fs::read_to_string(runtime_dir.join("state.json")).unwrap(),
+        )
+        .unwrap();
+        assert_eq!(
+            on_disk.get("team_key").and_then(Value::as_str),
+            Some(active),
+            "migration must be persisted to disk so subsequent processes see it"
+        );
+    }
 }

package/crates/team-agent/src/tmux_backend.rs

@@ -502,6 +502,31 @@ pub(crate) fn attach_command_for_workspace(
     ))
 }
 
+/// Bug #7 (prerelease 0.4.0 gate review §6): when the runtime state carries a
+/// persisted `tmux_endpoint` / `tmux_socket` (e.g. `/private/tmp/tmux-501/default`),
+/// the attach command MUST point at THAT endpoint, not the workspace-hash
+/// socket — otherwise operators are told to attach to a socket where the
+/// session does not exist. Falls back to workspace-hash when state has no
+/// persisted endpoint.
+pub(crate) fn attach_command_for_runtime_state_or_workspace(
+    workspace: &Path,
+    state: Option<&serde_json::Value>,
+    session_name: &SessionName,
+    window_name: &str,
+) -> Option<String> {
+    if let Some((endpoint, _source)) = runtime_tmux_endpoint_from_state(state) {
+        let display = endpoint.to_string();
+        // Distinguish absolute path (`-S <path>`) from short socket name (`-L <name>`).
+        let flag = if Path::new(endpoint).is_absolute() { "-S" } else { "-L" };
+        return Some(format!(
+            "tmux {flag} {display} attach -t {}:{}",
+            session_name.as_str(),
+            window_name
+        ));
+    }
+    attach_command_for_workspace(workspace, session_name, window_name)
+}
+
 pub(crate) fn attach_commands_for_windows<'a>(
     workspace: &Path,
     session_name: &SessionName,

package/npm/install.mjs

@@ -139,7 +139,11 @@ function install(argv) {
   fs.mkdirSync(runtimeRoot, { recursive: true });
   fs.rmSync(tmp, { recursive: true, force: true });
   fs.mkdirSync(path.join(tmp, "bin"), { recursive: true });
-  copyExecutable(platformBinary.path, path.join(tmp, "bin", "team-agent"));
+  const tmpBinary = path.join(tmp, "bin", "team-agent");
+  copyExecutable(platformBinary.path, tmpBinary);
+  // Sign the staged binary before swap. Failure aborts install before any
+  // rename touches the existing runtime directory.
+  prepareDarwinExecutable(tmpBinary);
 
   fs.rmSync(backup, { recursive: true, force: true });
   if (fs.existsSync(dest)) {
@@ -668,6 +672,28 @@ function copyExecutable(src, dest) {
   fs.chmodSync(dest, 0o755);
 }
 
+// Defence-in-depth: on Darwin, ad-hoc re-sign the staged binary before the
+// atomic rename swaps it into place. Atomic temp+rename already avoids the
+// classic in-place vnode/signature-cache failure, but it does not repair an
+// invalid or stale Mach-O signature that survived the npm extraction. The
+// ad-hoc signature (-) is sufficient for local execution and avoids requiring
+// a Developer ID. Fail closed before runtime swap if codesign exits non-zero.
+function prepareDarwinExecutable(dest) {
+  if (process.platform !== "darwin") {
+    return;
+  }
+  const res = spawnSync("/usr/bin/codesign", ["--force", "--sign", "-", dest], {
+    encoding: "utf8",
+  });
+  if (res.status !== 0) {
+    const stderr = (res.stderr || "").trim();
+    const signal = res.signal ? ` signal=${res.signal}` : "";
+    throw new Error(
+      `codesign failed on ${dest}: status=${res.status}${signal} stderr=${stderr || "(empty)"}`,
+    );
+  }
+}
+
 function writeExecWrapper(file, binary, fixedArgs, options = {}) {
   if (fs.existsSync(file) && !options.allowForeign && !isInstallerManagedWrapper(file)) {
     throw new Error(`refusing to overwrite non-Team Agent installer wrapper: ${file}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.3.39",
+  "version": "0.4.0",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.3.39",
-    "@team-agent/cli-darwin-x64": "0.3.39",
-    "@team-agent/cli-linux-x64": "0.3.39"
+    "@team-agent/cli-darwin-arm64": "0.4.0",
+    "@team-agent/cli-darwin-x64": "0.4.0",
+    "@team-agent/cli-linux-x64": "0.4.0"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",