@team-agent/installer 0.4.2 → 0.4.4

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.4.2"
+version = "0.4.4"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.4.2"
+version = "0.4.4"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/lifecycle/launch.rs

@@ -4850,6 +4850,16 @@ fn spec_agents(spec: &Value) -> Vec<AgentId> {
         .collect()
 }
 
+/// Bug 1 (0.4.2): expose spec agent id set so the restart path can filter
+/// state.agents to only the agents currently defined in the rebuilt spec.
+/// Returns a `BTreeSet<String>` for O(log n) membership checks.
+pub(crate) fn spec_agent_id_set(spec: &Value) -> std::collections::BTreeSet<String> {
+    spec_agent_values(spec)
+        .into_iter()
+        .filter_map(|agent| agent.get("id").and_then(Value::as_str).map(str::to_string))
+        .collect()
+}
+
 fn spec_agent_values(spec: &Value) -> Vec<&Value> {
     spec.get("agents")
         .and_then(Value::as_list)

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -142,6 +142,41 @@ pub fn restart_with_transport_with_session_convergence_deadline(
         LifecycleError::TeamSelect("active team spec workspace not found".to_string())
     })?;
     let safety = crate::lifecycle::launch::effective_runtime_config(&spec)?;
+    // Bug 1 (0.4.2 P0): the rebuilt spec is the single source of truth for the
+    // active roster. Any agent in state.agents that is NOT in the rebuilt
+    // spec is a stale leftover (role doc was deleted between sessions) and
+    // must NOT be restarted — otherwise a `team-agent restart` would re-spawn
+    // a removed worker from stale state. Prune state.agents in-place before
+    // convergence/plan/spawn so every downstream step (resume validation,
+    // event log, spawn loop) sees the bounded roster.
+    let spec_agent_ids = crate::lifecycle::launch::spec_agent_id_set(&spec);
+    if let Some(agents_obj) = state.get_mut("agents").and_then(|v| v.as_object_mut()) {
+        let stale_ids: Vec<String> = agents_obj
+            .keys()
+            .filter(|id| !spec_agent_ids.contains(id.as_str()))
+            .cloned()
+            .collect();
+        for stale_id in &stale_ids {
+            agents_obj.remove(stale_id);
+            let _ = crate::event_log::EventLog::new(&selected.run_workspace).write(
+                "restart.agent_skipped_not_in_spec",
+                serde_json::json!({
+                    "agent_id": stale_id,
+                    "team_key": selected.team_key.as_str(),
+                    "reason": "agent present in state.agents but absent from rebuilt spec; \
+                               role doc was removed — restart will not respawn removed workers",
+                    "action": format!(
+                        "to permanently remove run `team-agent remove-agent {stale_id}`; \
+                         to re-add restore the role doc under agents/<id>.md and run \
+                         `team-agent restart`"
+                    ),
+                }),
+            );
+        }
+        if !stale_ids.is_empty() {
+            save_restart_state(&selected.run_workspace, &mut state, &selected.team_key)?;
+        }
+    }
     let mut convergence = converge_missing_provider_sessions(
         &mut state,
         session_convergence_deadline(session_converge_deadline_ms),
@@ -619,6 +654,13 @@ pub fn restart_with_transport_with_session_convergence_deadline(
             &failed_agents,
             "partial",
         )?;
+        // 0.3.30 Bug 1: auto-attach on partial restart too — workers that did
+        // come up still need a leader_receiver pane to deliver report_result.
+        try_autobind_leader_after_restart(
+            &selected.run_workspace,
+            Some(selected.team_key.as_str()),
+            &state,
+        );
         return Ok(RestartReport::Partial {
             session_name,
             agents: successful_agents,
@@ -634,6 +676,16 @@ pub fn restart_with_transport_with_session_convergence_deadline(
         &failed_agents,
         "ok",
     )?;
+    // 0.3.30 Bug 1: auto-attach leader from caller's TMUX_PANE if available.
+    // Mirrors quick-start's seed_launched_owner_from_env behaviour: a restart
+    // invoked from a tmux pane should bind that pane as leader_receiver,
+    // restoring the worker→leader delivery path. Failure is non-fatal — the
+    // user can still run `team-agent attach-leader` manually.
+    try_autobind_leader_after_restart(
+        &selected.run_workspace,
+        Some(&selected.team_key),
+        &state,
+    );
     // 0.3.28 Step 1: topology invariant guard (warn-only). Same pattern as
     // `lifecycle::launch::launch_with_transport_in_workspace` — logs to stderr,
     // never panics. Hard error path is deferred to Step 10.
@@ -1028,6 +1080,68 @@ fn verify_spawned_agent_live(
     Ok(())
 }
 
+/// 0.3.30 Bug 1: restart success path auto-attach.
+/// When `TMUX_PANE` is present in the caller's env, treat the restart as if
+/// the user had also run `attach-leader` from that pane. Mirrors quick-start's
+/// `seed_launched_owner_from_env` semantics.
+///
+/// Failure modes are intentionally non-fatal — `attach_leader` returns Err if
+/// the pane validation rejects (e.g. caller pane is a registered worker pane,
+/// E51 guard). In that case the user must still run `attach-leader` manually,
+/// matching pre-fix behaviour. We log to stderr so the operator sees why
+/// auto-attach didn't take.
+fn try_autobind_leader_after_restart(
+    workspace: &std::path::Path,
+    team: Option<&str>,
+    state: &serde_json::Value,
+) {
+    if std::env::var_os("TMUX_PANE").is_none() {
+        return;
+    }
+    // Provider: prefer the existing team_owner.provider (if rebind),
+    // else leader_receiver.provider (stale, but still informative),
+    // else default to ClaudeCode (matches the most common deployment).
+    let provider = state
+        .pointer("/team_owner/provider")
+        .and_then(serde_json::Value::as_str)
+        .or_else(|| {
+            state
+                .pointer("/leader_receiver/provider")
+                .and_then(serde_json::Value::as_str)
+        })
+        .and_then(|s| match s {
+            "codex" => Some(crate::model::enums::Provider::Codex),
+            "claude" | "claude_code" | "claude-code" => {
+                Some(crate::model::enums::Provider::ClaudeCode)
+            }
+            "copilot" => Some(crate::model::enums::Provider::Copilot),
+            _ => None,
+        })
+        .unwrap_or(crate::model::enums::Provider::ClaudeCode);
+    let team_str = team;
+    match crate::leader::attach_leader(workspace, team_str, None, provider) {
+        Ok(result) if result.ok => {
+            eprintln!(
+                "team_agent::restart auto_attach_leader ok pane={:?} team={:?}",
+                result.bound_pane_id.as_ref().map(|p| p.as_str()),
+                team_str,
+            );
+        }
+        Ok(result) => {
+            eprintln!(
+                "team_agent::restart auto_attach_leader skipped reason={:?} team={:?}",
+                result.reason, team_str,
+            );
+        }
+        Err(error) => {
+            eprintln!(
+                "team_agent::restart auto_attach_leader failed error={error} team={team_str:?} \
+                 (run `team-agent attach-leader` from your tmux pane to bind manually)",
+            );
+        }
+    }
+}
+
 fn mark_leader_receiver_rebind_required(state: &mut serde_json::Value, session_name: &SessionName) {
     let Some(receiver) = state
         .get_mut("leader_receiver")

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -2648,7 +2648,7 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "spawned_at",
             "pane_id",
         ],
-        "0.3.28 running agent state: no adaptive layout bookkeeping; raw={raw}"
+        "0.3.31 Codex capture correction: no framework _pending_session_id for Codex (CLI doesn't honor --session-id); raw={raw}"
     );
     assert_eq!(agent["status"], json!("running"));
     assert_eq!(agent["provider"], json!("codex"));

package/crates/team-agent/src/provider/adapter.rs

@@ -476,6 +476,14 @@ impl ProviderAdapter for BasicProviderAdapter {
             }
             // codex.py:105-118 — the profile command overrides (codex_profile / codex_config)
             // ride on `agent["_provider_profile"]`, which only the plan path carries.
+            //
+            // 0.3.31 Codex capture correction (reverts ad518f8): Codex CLI does
+            // NOT accept `--session-id`, so a framework-generated UUID is never
+            // matched against Codex's own session_meta.payload.id. Setting
+            // expected_session_id caused the apply-time Stage 1 guard to
+            // permanently reject the real Codex transcript. Codex capture must
+            // anchor on (cwd, spawned_at) instead — handled in
+            // `scan_session_candidates_once` below.
             Provider::Codex => Ok(CommandPlan::argv_only(codex_base_command(
                 None,
                 ctx.auth_mode,
@@ -1049,6 +1057,38 @@ fn scan_session_candidates_once(
             agent_path_match,
         });
     }
+    // 0.3.31 Codex capture correction: HARD (cwd, spawned_at) filter.
+    // Codex CLI does NOT honor `--session-id` so we cannot use
+    // expected_session_id semantics. The only safe identity boundary is:
+    //   * session_meta.payload.cwd == spawn_cwd (already filtered above via
+    //     requires_cwd_match), AND
+    //   * session_meta.payload.timestamp >= spawned_at - small_grace, OR file
+    //     mtime >= spawned_at - small_grace (the candidate must be POST-spawn).
+    // Candidates older than the current spawn are pre-reset / pre-restart
+    // remnants and MUST be dropped, not merely de-prioritized — otherwise the
+    // single-candidate allocator path picks them, and the Stage 1 mismatch
+    // guard later rejects them, producing the 0.4.4 attribution_ambiguous loop.
+    if matches!(provider, Provider::Codex) {
+        if let Some(spawned_at) = context.spawned_at.as_deref().and_then(parse_spawned_at) {
+            // 5-second grace: allow for clock skew between Codex's session
+            // timestamp and our spawned_at (Codex records LOCAL time before
+            // RFC3339-encoding, framework records UTC; small skew possible
+            // across midnight or DST boundary).
+            let grace = std::time::Duration::from_secs(5);
+            let cutoff = spawned_at.checked_sub(grace).unwrap_or(spawned_at);
+            out.retain(|candidate| {
+                let path = match candidate.captured.rollout_path.as_ref() {
+                    Some(p) => p.as_path(),
+                    None => return false,
+                };
+                std::fs::metadata(path)
+                    .and_then(|meta| meta.modified())
+                    .map(|mtime| mtime >= cutoff)
+                    .unwrap_or(false)
+            });
+        }
+    }
+
     // E6 层1·C(机会性兜底):若盘上真有 expected_session_id 命名的 transcript(claude 哪天
     // 真采用 --session-id,或别的 provider 本就采用),直接唯一命中,省去时间窗扫描。
     // 命不中(交互式 claude 现实:不落 <expected>.jsonl)→ 回落 B。
@@ -1072,6 +1112,12 @@ fn scan_session_candidates_once(
         // identity match (TEAM_AGENT_ID literal in the transcript head, or
         // path-encoded agent_id). If none, return empty — capture stays
         // pending/ambiguous, which is safer than misattribution.
+        //
+        // Bug 2 (0.4.2 P0) reinforcement: even when positive-identity
+        // filtering returns no candidates, do NOT let downstream
+        // time-window narrowing run for Claude when expected_session_id
+        // misses — that's exactly the leader-session-leak symptom the
+        // architect cataloged in .team/artifacts/bug-042-restart-scope-and-session.md.
         if matches!(provider, Provider::Claude | Provider::ClaudeCode) {
             let positive_only: Vec<CapturedSessionCandidate> = out
                 .iter()
@@ -2044,6 +2090,50 @@ mod e6_session_attribution_tests {
         f.set_modified(when).unwrap();
     }
 
+    /// Bug 2 (0.4.2 P0): when expected_session_id is set (restart --allow-fresh
+    /// pre-allocates a UUID via --session-id) but the Claude CLI didn't adopt
+    /// it (no <expected>.jsonl on disk), capture must NOT fall back to
+    /// time-window narrowing over leader transcripts sharing the same cwd.
+    /// Pre-fix: leader transcript with later mtime would be silently picked
+    /// up as the worker session. Post-fix: empty list returned (caller treats
+    /// as session-not-yet-captured and retries on next tick).
+    #[test]
+    fn scan_expected_session_id_miss_refuses_to_pick_leader_sibling() {
+        let base = tmp_root("strict-no-leader-fallback");
+        let cwd = base.join("ws");
+        std::fs::create_dir_all(&cwd).unwrap();
+        let proj = base.join("projects");
+        // Simulate the leader's transcript and a stale earlier transcript in
+        // the same cwd. NEITHER matches expected_session_id.
+        let leader = write_transcript(&proj, "11111111-1111-4111-8111-111111111111", &cwd);
+        let stale = write_transcript(&proj, "22222222-2222-4222-8222-222222222222", &cwd);
+        let _ = (leader, stale);
+        let ctx = CaptureSessionContext {
+            agent_id: "claude-worker".to_string(),
+            spawn_cwd: cwd.clone(),
+            pane_id: None,
+            pane_pid: None,
+            spawned_at: Some("2020-01-01T00:00:00+00:00".to_string()),
+            // Worker was spawned with --session-id <expected> but Claude
+            // didn't write <expected>.jsonl.
+            expected_session_id: Some(SessionId::new(
+                "99999999-9999-4999-8999-999999999999",
+            )),
+            provider_projects_root: Some(proj.clone()),
+        };
+        let out = scan_session_candidates_once(Provider::ClaudeCode, &ctx).unwrap();
+        assert!(
+            out.is_empty(),
+            "expected_session_id set + no exact match → must NOT fall back to \
+             time-window narrowing (would grab leader's transcript). \
+             got={:?}",
+            out.iter()
+                .filter_map(|c| c.captured.session_id.as_ref().map(|s| s.as_str().to_string()))
+                .collect::<Vec<_>>()
+        );
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
     // ── E11 层1:copilot session 归因(expected-id 优先,不抓 leader latest)──
     struct HomeGuard {
         prev: Option<std::ffi::OsString>,

package/crates/team-agent/src/provider/session/capture.rs

@@ -428,11 +428,22 @@ where
                 .and_then(Value::as_str)
                 .filter(|value| !value.is_empty())
                 .map(str::to_string),
-            expected_session_id: agent
-                .get("_pending_session_id")
-                .and_then(Value::as_str)
-                .filter(|value| !value.is_empty())
-                .map(SessionId::new),
+            // 0.3.31 Codex capture correction: Codex does NOT honor
+            // `--session-id`, so any `_pending_session_id` stored for a Codex
+            // agent (stale 0.3.30 state, or the framework's pre-spawn token)
+            // is a local-only token and must NOT be used as expected_session_id
+            // — that would trigger the Stage 1 mismatch guard against Codex's
+            // real session_meta.payload.id and permanently reject the correct
+            // transcript. Codex capture anchors purely on (cwd, spawned_at).
+            expected_session_id: if matches!(provider, Provider::Codex) {
+                None
+            } else {
+                agent
+                    .get("_pending_session_id")
+                    .and_then(Value::as_str)
+                    .filter(|value| !value.is_empty())
+                    .map(SessionId::new)
+            },
             provider_projects_root: agent
                 .get("claude_projects_root")
                 .and_then(Value::as_str)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.4.2",
-    "@team-agent/cli-darwin-x64": "0.4.2",
-    "@team-agent/cli-linux-x64": "0.4.2"
+    "@team-agent/cli-darwin-arm64": "0.4.4",
+    "@team-agent/cli-darwin-x64": "0.4.4",
+    "@team-agent/cli-linux-x64": "0.4.4"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",