@team-agent/installer 0.4.5 → 0.4.7

package/crates/team-agent/src/provider/adapters/claude.rs

@@ -0,0 +1,106 @@
+//! Claude / ClaudeCode provider-local command builders + permission helpers.
+//!
+//! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
+//! extraction — byte-identical to the original inline forms. Scope kept
+//! small on purpose: base command + permission/disallowed-tool mapping +
+//! launch wrapper. Auth hints (`claude_auth_hint`), capture-related
+//! helpers (`claude_projects_dir_for_cwd`, `encode_claude_projects_dir`,
+//! `rollout_path_has_claude_leader_marker`,
+//! `claude_records_have_leader_marker`), and the context-aware model
+//! resolver (`claude_context_model`) stay in `adapter.rs` because they
+//! depend on adapter-private utilities (capture scanning, `command_on_path`,
+//! `ProfileLaunchContext`). A later step can move those into a session
+//! store / auth descriptor hook.
+
+use crate::model::enums::AuthMode;
+use crate::provider::adapter::{
+    next_session_token, prompt_needs_native_mcp, BasicProviderAdapter,
+};
+use crate::provider::{McpConfig, ProviderAdapter, ProviderError};
+
+pub(crate) fn claude_launch_command(
+    adapter: &BasicProviderAdapter,
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Result<Vec<String>, ProviderError> {
+    let mut argv = claude_base_command(
+        adapter,
+        auth_mode,
+        mcp_config,
+        system_prompt,
+        model,
+        tools,
+        false,
+    )?;
+    argv.push("--session-id".to_string());
+    argv.push(next_session_token());
+    Ok(argv)
+}
+
+pub(crate) fn claude_base_command(
+    adapter: &BasicProviderAdapter,
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+    managed_mcp_config: bool,
+) -> Result<Vec<String>, ProviderError> {
+    let mut argv = vec!["claude".to_string()];
+    if claude_dangerous_auto_approve(tools) {
+        argv.push("--dangerously-skip-permissions".to_string());
+    } else {
+        argv.push("--permission-mode".to_string());
+        argv.push("default".to_string());
+    }
+    if let Some(model) = model {
+        argv.push("--model".to_string());
+        argv.push(model.to_string());
+    }
+    if let Some(prompt) = system_prompt {
+        argv.push("--append-system-prompt".to_string());
+        argv.push(prompt.to_string());
+    }
+    if !managed_mcp_config
+        && (mcp_config.is_some()
+            || auth_mode == AuthMode::CompatibleApi
+            || system_prompt.is_some_and(prompt_needs_native_mcp))
+    {
+        let raw = if let Some(config) = mcp_config {
+            serde_json::json!({"mcpServers": config.raw.clone()})
+        } else {
+            serde_json::json!({"mcpServers": adapter.mcp_config(auth_mode)?.raw})
+        };
+        argv.push("--mcp-config".to_string());
+        argv.push(raw.to_string());
+    }
+    for tool in claude_disallowed_tools(tools) {
+        argv.push("--disallowedTools".to_string());
+        argv.push(tool.to_string());
+    }
+    Ok(argv)
+}
+
+pub(crate) fn claude_dangerous_auto_approve(tools: &[&str]) -> bool {
+    tools.contains(&"dangerous_auto_approve")
+}
+
+pub(crate) fn claude_disallowed_tools(tools: &[&str]) -> Vec<&'static str> {
+    let mut disallowed = Vec::new();
+    if !tools.contains(&"execute_bash") {
+        disallowed.push("Bash");
+    }
+    if !tools.contains(&"fs_read") {
+        disallowed.push("Read");
+    }
+    if !tools.contains(&"fs_write") {
+        disallowed.extend(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+    }
+    if !tools.contains(&"fs_list") {
+        disallowed.extend(["Glob", "Grep"]);
+    }
+    disallowed
+}

package/crates/team-agent/src/provider/adapters/codex.rs

@@ -0,0 +1,117 @@
+//! Codex provider-local command builder + permission/sandbox helpers.
+//!
+//! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
+//! extraction — byte-identical to the original inline forms. Shared helper
+//! `json_inline` stays in `adapter.rs` because it is also used by other
+//! sites; this file reaches it via `super::*`.
+
+use crate::model::enums::AuthMode;
+use crate::provider::adapter::json_inline;
+use crate::provider::{McpConfig, ProviderCommandOverrides};
+
+pub(crate) fn codex_base_command(
+    subcommand: Option<&str>,
+    _auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+    overrides: Option<&ProviderCommandOverrides>,
+) -> Vec<String> {
+    let mut argv = vec!["codex".to_string()];
+    if let Some(subcommand) = subcommand {
+        argv.push(subcommand.to_string());
+    }
+    argv.extend([
+        "--no-alt-screen".to_string(),
+        "--disable".to_string(),
+        "shell_snapshot".to_string(),
+        "--disable".to_string(),
+        "apps".to_string(),
+    ]);
+    if let Some(profile) = overrides.and_then(|o| o.codex_profile.as_deref()) {
+        argv.push("--profile".to_string());
+        argv.push(profile.to_string());
+    }
+    if codex_dangerous_auto_approve(tools) {
+        argv.push("--dangerously-bypass-approvals-and-sandbox".to_string());
+    } else {
+        argv.push("--sandbox".to_string());
+        argv.push(codex_sandbox_mode(tools).to_string());
+        argv.push("--ask-for-approval".to_string());
+        argv.push("on-request".to_string());
+    }
+    if let Some(model) = model {
+        argv.push("--model".to_string());
+        argv.push(model.to_string());
+    }
+    if let Some(overrides) = overrides {
+        for config in &overrides.codex_config {
+            argv.push("-c".to_string());
+            argv.push(config.clone());
+        }
+    }
+    if let Some(prompt) = system_prompt {
+        // codex.py:120 — escape order matters: backslash first, then quote, then newline.
+        let escaped = prompt
+            .replace('\\', "\\\\")
+            .replace('"', "\\\"")
+            .replace('\n', "\\n");
+        argv.push("-c".to_string());
+        argv.push(format!("developer_instructions=\"{escaped}\""));
+    }
+    if let Some(config) = mcp_config {
+        append_codex_mcp_overrides(&mut argv, &config.raw);
+    }
+    argv
+}
+
+/// Render an `McpConfig::raw` ({ name: { type, command, args, env: {...} } }) into Codex
+/// `-c mcp_servers.<name>.<field>=...` overrides. JSON values are stringified with serde
+/// so arrays/objects survive (Codex parses the right-hand side as JSON; this is what the
+/// Python golden + the live attached Codex panes do).
+pub(crate) fn append_codex_mcp_overrides(argv: &mut Vec<String>, raw: &serde_json::Value) {
+    let Some(servers) = raw.as_object() else {
+        return;
+    };
+    for (name, server) in servers {
+        let Some(obj) = server.as_object() else {
+            continue;
+        };
+        for (key, value) in obj {
+            if key == "env" {
+                if let Some(env) = value.as_object() {
+                    for (env_key, env_value) in env {
+                        argv.push("-c".to_string());
+                        argv.push(format!(
+                            "mcp_servers.{name}.env.{env_key}={}",
+                            json_inline(env_value)
+                        ));
+                    }
+                }
+                continue;
+            }
+            argv.push("-c".to_string());
+            argv.push(format!("mcp_servers.{name}.{key}={}", json_inline(value)));
+        }
+        // Every MCP server gets a 600s tool timeout so long-running
+        // team_orchestrator calls (report_result etc.) survive the codex default.
+        argv.push("-c".to_string());
+        argv.push(format!("mcp_servers.{name}.tool_timeout_sec=600.0"));
+    }
+}
+
+pub(crate) fn codex_dangerous_auto_approve(tools: &[&str]) -> bool {
+    tools.contains(&"dangerous_auto_approve")
+}
+
+pub(crate) fn codex_sandbox_mode(tools: &[&str]) -> &'static str {
+    if tools
+        .iter()
+        .any(|tool| matches!(*tool, "fs_write" | "execute_bash"))
+    {
+        "workspace-write"
+    } else {
+        "read-only"
+    }
+}

package/crates/team-agent/src/provider/adapters/copilot.rs

@@ -0,0 +1,124 @@
+//! Copilot provider-local command builders + permission helpers.
+//!
+//! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
+//! extraction — byte-identical to the original inline forms. Scope kept
+//! small: base command + resume + permission flags + MCP type→transport
+//! translation. Auth hint (`copilot_auth_hint`) and session store scan
+//! (`scan_copilot_session_store`, `copilot_candidate`) stay in
+//! `adapter.rs` because they depend on `command_on_path` /
+//! `CaptureSessionContext` / sqlite session-store helpers. Step 3 of the
+//! decoupling plan can move those into provider session store hooks.
+
+use crate::model::enums::AuthMode;
+use crate::provider::McpConfig;
+
+pub(crate) fn copilot_base_command(
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Vec<String> {
+    let _ = (auth_mode, system_prompt);
+    let mut argv = vec![
+        "copilot".to_string(),
+        // Noise control trio + disable remote control (防 GitHub web 远控 worker)
+        "--no-color".to_string(),
+        "--no-auto-update".to_string(),
+        "--no-remote".to_string(),
+        // P0: disable built-in github-mcp-server. Residual risk covered by
+        // spawn-time `copilot mcp list` scan + per-name --disable-mcp-server.
+        "--disable-builtin-mcps".to_string(),
+    ];
+    if copilot_dangerous_auto_approve(tools) {
+        argv.push("--allow-all".to_string());
+    } else {
+        for flag in copilot_permission_flags(tools) {
+            argv.push(flag);
+        }
+    }
+    // mcp_team ∈ canonical → approval-free (whole-server pattern).
+    argv.push("--allow-tool".to_string());
+    argv.push("team_orchestrator".to_string());
+    if let Some(model) = model {
+        argv.push("--model".to_string());
+        argv.push(model.to_string());
+    }
+    if let Some(config) = mcp_config {
+        // Copilot mcp config schema field is `transport` (stdio|http|sse),
+        // not the canonical `type`. McpConfig.raw is canonical; only copilot
+        // translates type→transport for --additional-mcp-config.
+        argv.push("--additional-mcp-config".to_string());
+        argv.push(copilot_translate_mcp_config(&config.raw).to_string());
+    }
+    argv
+}
+
+/// Translate `McpConfig.raw` canonical schema (`type`) into the copilot
+/// `mcp add`/`--additional-mcp-config` expected `transport` field
+/// (stdio|http|sse). Only the copilot adapter walks this translation —
+/// claude/codex paths leave canonical schema untouched.
+pub(crate) fn copilot_translate_mcp_config(raw: &serde_json::Value) -> serde_json::Value {
+    let Some(servers) = raw.as_object() else {
+        return raw.clone();
+    };
+    let mut translated = serde_json::Map::new();
+    for (name, server) in servers {
+        let Some(obj) = server.as_object() else {
+            translated.insert(name.clone(), server.clone());
+            continue;
+        };
+        let mut out = serde_json::Map::new();
+        for (key, value) in obj {
+            if key == "type" {
+                out.insert("transport".to_string(), value.clone());
+            } else {
+                out.insert(key.clone(), value.clone());
+            }
+        }
+        translated.insert(name.clone(), serde_json::Value::Object(out));
+    }
+    serde_json::Value::Object(translated)
+}
+
+/// Resume path = base + `--resume <sid>` (drop --session-id); kept separate
+/// to avoid the plan accidentally emitting --session-id and --resume in the
+/// same frame.
+pub(crate) fn copilot_base_command_resume(
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Vec<String> {
+    copilot_base_command(auth_mode, mcp_config, system_prompt, model, tools)
+}
+
+pub(crate) fn copilot_dangerous_auto_approve(tools: &[&str]) -> bool {
+    tools.contains(&"dangerous_auto_approve")
+}
+
+/// Granular deny mapping (canonical tool → copilot flag, all via
+/// `--deny-tool <kind>`; help-permissions Tool Permissions has four kinds:
+/// shell/write/mcp/url):
+///   execute_bash ∉ allowed → `--deny-tool 'shell'`
+///   fs_write     ∉ allowed → `--deny-tool 'write'`
+///   network      ∉ allowed → `--deny-tool 'url'`
+/// fs_read/fs_list have no copilot deny kind (honestly prompt_only).
+pub(crate) fn copilot_permission_flags(tools: &[&str]) -> Vec<String> {
+    let mut flags = Vec::new();
+    if !tools.contains(&"execute_bash") {
+        flags.push("--deny-tool".to_string());
+        flags.push("shell".to_string());
+    }
+    if !tools.contains(&"fs_write") {
+        flags.push("--deny-tool".to_string());
+        flags.push("write".to_string());
+    }
+    if !tools.contains(&"network") {
+        // `--deny-tool 'url'` (omit domain → match all URLs).
+        flags.push("--deny-tool".to_string());
+        flags.push("url".to_string());
+    }
+    flags
+}

package/crates/team-agent/src/provider/adapters/fake.rs

@@ -0,0 +1,17 @@
+//! Fake provider — scripted worker built into the team-agent CLI itself.
+//! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2).
+
+pub(crate) fn fake_worker_command() -> Vec<String> {
+    let exe = std::env::current_exe()
+        .ok()
+        .and_then(|p| p.into_os_string().into_string().ok())
+        .unwrap_or_else(|| "team-agent".to_string());
+    vec![
+        exe,
+        "fake-worker".to_string(),
+        "--workspace".to_string(),
+        "{workspace}".to_string(),
+        "--agent-id".to_string(),
+        "{agent_id}".to_string(),
+    ]
+}

package/crates/team-agent/src/provider/adapters/mod.rs

@@ -0,0 +1,27 @@
+//! Provider-local adapter implementations. Split from the monolithic
+//! `provider/adapter.rs` as 0.4.x decoupling step 2. Each file owns its
+//! provider's command builders, permission/sandbox/auth helpers, and
+//! anything else that varies by provider but doesn't need shared
+//! capture/scan utilities. The `ProviderAdapter` trait and the
+//! `BasicProviderAdapter` registry stay in `adapter.rs`; the trait impl
+//! dispatches into these helpers exactly as the inline forms did.
+//!
+//! Per-file scope:
+//!   * `claude` — Claude/ClaudeCode argv, dangerous-skip flag, disallowed
+//!     tools mapping, auth hint, model passthrough.
+//!   * `codex`  — Codex argv, profile/sandbox flags, MCP `-c` injection
+//!     with 600s tool_timeout, developer-instructions escaping.
+//!   * `copilot` — Copilot argv (no-color/no-remote/disable-builtin-mcps),
+//!     allow/deny flag matrix, MCP `type→transport` translation, resume
+//!     base, weak auth hint.
+//!   * `fake`   — Built-in scripted worker exec path.
+//!
+//! Behavior is byte-identical to pre-split. Future steps may move
+//! `pre_spawn_adjust_plan`, `profile_env`, `session_backing_probe`, and
+//! `session_candidates` into provider-owned hooks following the same
+//! per-file layout.
+
+pub(crate) mod claude;
+pub(crate) mod codex;
+pub(crate) mod copilot;
+pub(crate) mod fake;

package/crates/team-agent/src/provider/mod.rs

@@ -32,6 +32,9 @@
 pub use crate::model::enums::{AuthMode, Provider};
 
 pub mod adapter;
+/// 0.4.x decoupling step 2: per-provider command builders + permission/auth
+/// helpers split out of `adapter.rs`. Pure extraction — behavior unchanged.
+pub(crate) mod adapters;
 pub mod approvals;
 pub mod classify;
 pub mod command;
@@ -40,6 +43,9 @@ pub mod session;
 pub mod session_scan;
 pub mod startup_prompt;
 pub mod types;
+/// 0.4.x: provider wire-format helpers — single source of truth for
+/// `Provider` ↔ string conversions (replaces 7 hand-rolled match copies).
+pub(crate) mod wire;
 // helpers 全部原为模块私有(JSONL 解析 / 正则编译),非根可见 → 私有 mod,不参与 re-export。
 mod helpers;