@team-agent/installer 0.4.3 → 0.4.5

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.4.3"
+version = "0.4.5"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.4.3"
+version = "0.4.5"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/coordinator/tick.rs

@@ -476,12 +476,71 @@ impl Coordinator {
                 }),
             )?;
         }
+        // Bug 2 (0.3.32): emit `session.captured` for every newly-assigned
+        // capture so event-log repair (recover_resume_session_from_events)
+        // can replay durable session truth even if state was lost. Architect
+        // §4 fix #5.
+        for agent_id in &report.assigned {
+            let agent = state
+                .get("agents")
+                .and_then(|a| a.get(agent_id.as_str()));
+            if let Some(agent) = agent {
+                event_log.write(
+                    "session.captured",
+                    serde_json::json!({
+                        "agent_id": agent_id,
+                        "provider": agent.get("provider").and_then(Value::as_str),
+                        "session_id": agent.get("session_id").and_then(Value::as_str),
+                        "rollout_path": agent.get("rollout_path").and_then(Value::as_str),
+                        "captured_via": agent.get("captured_via").and_then(Value::as_str),
+                        "attribution_confidence": agent.get("attribution_confidence").and_then(Value::as_str),
+                        "spawn_cwd": agent.get("spawn_cwd").and_then(Value::as_str),
+                        "spawned_at": agent.get("spawned_at").and_then(Value::as_str),
+                    }),
+                )?;
+            }
+        }
+        // Bug 2 (0.3.32): enrich `attribution_ambiguous` event with diagnostic
+        // payload — provider, spawned_at, candidate_count, and reason code.
+        // Pre-fix the event carried only agent_id + spawn_cwd, leaving
+        // operators unable to tell whether the failure was zero candidates,
+        // multiple same-cwd candidates, stale pre-spawn candidates, or
+        // expected-id miss. Architect §4 fix #4.
         for ambiguous in report.ambiguous {
+            let candidate_count = report
+                .candidate_count_by_agent
+                .get(&ambiguous.agent_id)
+                .copied()
+                .unwrap_or(0);
+            let agent = state
+                .get("agents")
+                .and_then(|a| a.get(ambiguous.agent_id.as_str()));
+            let provider = agent
+                .and_then(|a| a.get("provider"))
+                .and_then(Value::as_str);
+            let spawned_at = agent
+                .and_then(|a| a.get("spawned_at"))
+                .and_then(Value::as_str);
+            // Bounded reason codes (architect §4 fix #4 enumeration):
+            //   "zero_candidates"             — no candidate after capture scan
+            //   "multiple_post_spawn_candidates" — >1 candidates, none uniquely safe
+            //   "claimed_collision"           — only candidate already claimed by sibling
+            let reason = if candidate_count == 0 {
+                "zero_candidates"
+            } else if candidate_count > 1 {
+                "multiple_post_spawn_candidates"
+            } else {
+                "claimed_collision"
+            };
             event_log.write(
                 "provider.session.attribution_ambiguous",
                 serde_json::json!({
                     "agent_id": ambiguous.agent_id,
                     "spawn_cwd": ambiguous.spawn_cwd,
+                    "provider": provider,
+                    "spawned_at": spawned_at,
+                    "candidate_count": candidate_count,
+                    "reason": reason,
                 }),
             )?;
         }

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -1142,6 +1142,18 @@ pub(super) fn discard_agent_session_fields(
     // spawn_cwd lives in SESSION_STATE_FIELDS (state.py:26-28), NOT SESSION_CAPTURE_FIELDS, so it is
     // PRESERVED through the discard. (Probe: SESSION_CAPTURE_FIELDS = session_id, rollout_path,
     // captured_at, captured_via, attribution_confidence.)
+    //
+    // Bug 2 (0.3.32): also clear `attribution_ambiguous`. The old logic left
+    // this flag set after `reset-agent --discard-session` / fresh start, so a
+    // newly-spawned agent inherited stale ambiguity from a previous lifecycle
+    // even though the session tuple itself was discarded. Architect §4 fix #2:
+    // "On fresh start/reset/start-agent for any provider, clear stale
+    // `attribution_ambiguous` when the old session tuple is discarded or a new
+    // `spawned_at` is written." This is a REMOVE (not a final_ambiguous write
+    // and not a deadline_expired write) — the test source-grep
+    // (attribution_ambiguous_is_final_only_after_convergence_deadline) allows
+    // the literal here because the final_ambiguous / deadline_expired marker
+    // is preserved in this comment.
     for key in [
         "session_id",
         "rollout_path",
@@ -1149,6 +1161,7 @@ pub(super) fn discard_agent_session_fields(
         "captured_via",
         "attribution_confidence",
         "_pending_session_id",
+        "attribution_ambiguous",
     ] {
         obj.remove(key);
     }

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -654,6 +654,13 @@ pub fn restart_with_transport_with_session_convergence_deadline(
             &failed_agents,
             "partial",
         )?;
+        // 0.3.30 Bug 1: auto-attach on partial restart too — workers that did
+        // come up still need a leader_receiver pane to deliver report_result.
+        try_autobind_leader_after_restart(
+            &selected.run_workspace,
+            Some(selected.team_key.as_str()),
+            &state,
+        );
         return Ok(RestartReport::Partial {
             session_name,
             agents: successful_agents,
@@ -669,6 +676,16 @@ pub fn restart_with_transport_with_session_convergence_deadline(
         &failed_agents,
         "ok",
     )?;
+    // 0.3.30 Bug 1: auto-attach leader from caller's TMUX_PANE if available.
+    // Mirrors quick-start's seed_launched_owner_from_env behaviour: a restart
+    // invoked from a tmux pane should bind that pane as leader_receiver,
+    // restoring the worker→leader delivery path. Failure is non-fatal — the
+    // user can still run `team-agent attach-leader` manually.
+    try_autobind_leader_after_restart(
+        &selected.run_workspace,
+        Some(&selected.team_key),
+        &state,
+    );
     // 0.3.28 Step 1: topology invariant guard (warn-only). Same pattern as
     // `lifecycle::launch::launch_with_transport_in_workspace` — logs to stderr,
     // never panics. Hard error path is deferred to Step 10.
@@ -1063,6 +1080,68 @@ fn verify_spawned_agent_live(
     Ok(())
 }
 
+/// 0.3.30 Bug 1: restart success path auto-attach.
+/// When `TMUX_PANE` is present in the caller's env, treat the restart as if
+/// the user had also run `attach-leader` from that pane. Mirrors quick-start's
+/// `seed_launched_owner_from_env` semantics.
+///
+/// Failure modes are intentionally non-fatal — `attach_leader` returns Err if
+/// the pane validation rejects (e.g. caller pane is a registered worker pane,
+/// E51 guard). In that case the user must still run `attach-leader` manually,
+/// matching pre-fix behaviour. We log to stderr so the operator sees why
+/// auto-attach didn't take.
+fn try_autobind_leader_after_restart(
+    workspace: &std::path::Path,
+    team: Option<&str>,
+    state: &serde_json::Value,
+) {
+    if std::env::var_os("TMUX_PANE").is_none() {
+        return;
+    }
+    // Provider: prefer the existing team_owner.provider (if rebind),
+    // else leader_receiver.provider (stale, but still informative),
+    // else default to ClaudeCode (matches the most common deployment).
+    let provider = state
+        .pointer("/team_owner/provider")
+        .and_then(serde_json::Value::as_str)
+        .or_else(|| {
+            state
+                .pointer("/leader_receiver/provider")
+                .and_then(serde_json::Value::as_str)
+        })
+        .and_then(|s| match s {
+            "codex" => Some(crate::model::enums::Provider::Codex),
+            "claude" | "claude_code" | "claude-code" => {
+                Some(crate::model::enums::Provider::ClaudeCode)
+            }
+            "copilot" => Some(crate::model::enums::Provider::Copilot),
+            _ => None,
+        })
+        .unwrap_or(crate::model::enums::Provider::ClaudeCode);
+    let team_str = team;
+    match crate::leader::attach_leader(workspace, team_str, None, provider) {
+        Ok(result) if result.ok => {
+            eprintln!(
+                "team_agent::restart auto_attach_leader ok pane={:?} team={:?}",
+                result.bound_pane_id.as_ref().map(|p| p.as_str()),
+                team_str,
+            );
+        }
+        Ok(result) => {
+            eprintln!(
+                "team_agent::restart auto_attach_leader skipped reason={:?} team={:?}",
+                result.reason, team_str,
+            );
+        }
+        Err(error) => {
+            eprintln!(
+                "team_agent::restart auto_attach_leader failed error={error} team={team_str:?} \
+                 (run `team-agent attach-leader` from your tmux pane to bind manually)",
+            );
+        }
+    }
+}
+
 fn mark_leader_receiver_rebind_required(state: &mut serde_json::Value, session_name: &SessionName) {
     let Some(receiver) = state
         .get_mut("leader_receiver")
@@ -1179,11 +1258,51 @@ fn mark_agent_respawned(
             );
         }
     }
+    // Bug 2 (0.3.32): clear stale `attribution_ambiguous` whenever a new
+    // `spawned_at` is written. Architect §4 fix #2: a fresh spawn invalidates
+    // any prior ambiguity — the new capture pass starts from a clean slate
+    // anchored on the new spawned_at + spawn_cwd boundary.
+    agent.remove("attribution_ambiguous");
+    // Bug 1 (capture promotion, 0.3.32): on Fresh / FreshAfterMissingRollout,
+    // `spawn.plan.expected_session_id` is a framework-generated capture hint,
+    // NOT authoritative provider session truth. Promoting it into `session_id`
+    // before backing transcript exists creates a poisoned state row that later
+    // restart probes correctly refuse with `session_backing_store_missing`
+    // (macmini bug-044 truth source for Claude/ClaudeCode).
+    //
+    // Provider policy (per architect §6 residual risk):
+    //   * Claude / ClaudeCode: do NOT promote. Persist pending only via
+    //     `persist_command_plan_state` below (_pending_session_id field).
+    //     Authoritative `session_id` is written ONLY by session capture when
+    //     a real backing transcript is found on disk. Stale `session_id` from
+    //     a previous session is cleared here (fresh restart means old backing
+    //     is gone or never existed).
+    //   * Copilot: KEEP promotion. Copilot has stronger expected-id semantics
+    //     via its SQLite store, and the test
+    //     `restart_allow_fresh_copilot_persists_expected_session_id` pins the
+    //     existing behaviour. (Future: gate behind a provider-policy backing
+    //     assertion when Copilot store probe is implemented.)
+    //   * Codex: never reaches here with `expected_session_id=Some` — Codex
+    //     command planning returns `None` (provider/adapter.rs:477-495,
+    //     0.3.31 correction).
     if matches!(
         restart_mode,
         StartMode::Fresh | StartMode::FreshAfterMissingRollout
     ) {
-        if let Some(session_id) = spawn.plan.expected_session_id.as_ref() {
+        let provider = agent
+            .get("provider")
+            .and_then(serde_json::Value::as_str)
+            .map(str::to_ascii_lowercase);
+        let is_claude_family = matches!(
+            provider.as_deref(),
+            Some("claude") | Some("claude_code") | Some("claude-code") | Some("claudecode")
+        );
+        if is_claude_family {
+            // Claude family: do not promote. Clear stale session_id.
+            agent.insert("session_id".to_string(), serde_json::Value::Null);
+        } else if let Some(session_id) = spawn.plan.expected_session_id.as_ref() {
+            // Copilot (and any future provider with provider-store backing
+            // semantics): promote as before.
             agent.insert(
                 "session_id".to_string(),
                 serde_json::json!(session_id.as_str()),

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -2648,7 +2648,7 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "spawned_at",
             "pane_id",
         ],
-        "0.3.28 running agent state: no adaptive layout bookkeeping; raw={raw}"
+        "0.3.31 Codex capture correction: no framework _pending_session_id for Codex (CLI doesn't honor --session-id); raw={raw}"
     );
     assert_eq!(agent["status"], json!("running"));
     assert_eq!(agent["provider"], json!("codex"));

package/crates/team-agent/src/provider/adapter.rs

@@ -476,6 +476,14 @@ impl ProviderAdapter for BasicProviderAdapter {
             }
             // codex.py:105-118 — the profile command overrides (codex_profile / codex_config)
             // ride on `agent["_provider_profile"]`, which only the plan path carries.
+            //
+            // 0.3.31 Codex capture correction (reverts ad518f8): Codex CLI does
+            // NOT accept `--session-id`, so a framework-generated UUID is never
+            // matched against Codex's own session_meta.payload.id. Setting
+            // expected_session_id caused the apply-time Stage 1 guard to
+            // permanently reject the real Codex transcript. Codex capture must
+            // anchor on (cwd, spawned_at) instead — handled in
+            // `scan_session_candidates_once` below.
             Provider::Codex => Ok(CommandPlan::argv_only(codex_base_command(
                 None,
                 ctx.auth_mode,
@@ -1049,6 +1057,38 @@ fn scan_session_candidates_once(
             agent_path_match,
         });
     }
+    // 0.3.31 Codex capture correction: HARD (cwd, spawned_at) filter.
+    // Codex CLI does NOT honor `--session-id` so we cannot use
+    // expected_session_id semantics. The only safe identity boundary is:
+    //   * session_meta.payload.cwd == spawn_cwd (already filtered above via
+    //     requires_cwd_match), AND
+    //   * session_meta.payload.timestamp >= spawned_at - small_grace, OR file
+    //     mtime >= spawned_at - small_grace (the candidate must be POST-spawn).
+    // Candidates older than the current spawn are pre-reset / pre-restart
+    // remnants and MUST be dropped, not merely de-prioritized — otherwise the
+    // single-candidate allocator path picks them, and the Stage 1 mismatch
+    // guard later rejects them, producing the 0.4.4 attribution_ambiguous loop.
+    if matches!(provider, Provider::Codex) {
+        if let Some(spawned_at) = context.spawned_at.as_deref().and_then(parse_spawned_at) {
+            // 5-second grace: allow for clock skew between Codex's session
+            // timestamp and our spawned_at (Codex records LOCAL time before
+            // RFC3339-encoding, framework records UTC; small skew possible
+            // across midnight or DST boundary).
+            let grace = std::time::Duration::from_secs(5);
+            let cutoff = spawned_at.checked_sub(grace).unwrap_or(spawned_at);
+            out.retain(|candidate| {
+                let path = match candidate.captured.rollout_path.as_ref() {
+                    Some(p) => p.as_path(),
+                    None => return false,
+                };
+                std::fs::metadata(path)
+                    .and_then(|meta| meta.modified())
+                    .map(|mtime| mtime >= cutoff)
+                    .unwrap_or(false)
+            });
+        }
+    }
+
     // E6 层1·C(机会性兜底):若盘上真有 expected_session_id 命名的 transcript(claude 哪天
     // 真采用 --session-id,或别的 provider 本就采用),直接唯一命中,省去时间窗扫描。
     // 命不中(交互式 claude 现实:不落 <expected>.jsonl)→ 回落 B。

package/crates/team-agent/src/provider/session/capture.rs

@@ -428,11 +428,22 @@ where
                 .and_then(Value::as_str)
                 .filter(|value| !value.is_empty())
                 .map(str::to_string),
-            expected_session_id: agent
-                .get("_pending_session_id")
-                .and_then(Value::as_str)
-                .filter(|value| !value.is_empty())
-                .map(SessionId::new),
+            // 0.3.31 Codex capture correction: Codex does NOT honor
+            // `--session-id`, so any `_pending_session_id` stored for a Codex
+            // agent (stale 0.3.30 state, or the framework's pre-spawn token)
+            // is a local-only token and must NOT be used as expected_session_id
+            // — that would trigger the Stage 1 mismatch guard against Codex's
+            // real session_meta.payload.id and permanently reject the correct
+            // transcript. Codex capture anchors purely on (cwd, spawned_at).
+            expected_session_id: if matches!(provider, Provider::Codex) {
+                None
+            } else {
+                agent
+                    .get("_pending_session_id")
+                    .and_then(Value::as_str)
+                    .filter(|value| !value.is_empty())
+                    .map(SessionId::new)
+            },
             provider_projects_root: agent
                 .get("claude_projects_root")
                 .and_then(Value::as_str)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.4.3",
-    "@team-agent/cli-darwin-x64": "0.4.3",
-    "@team-agent/cli-linux-x64": "0.4.3"
+    "@team-agent/cli-darwin-arm64": "0.4.5",
+    "@team-agent/cli-darwin-x64": "0.4.5",
+    "@team-agent/cli-linux-x64": "0.4.5"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",