@team-agent/installer 0.4.6 → 0.4.8

package/crates/team-agent/src/provider/adapters/copilot.rs

@@ -0,0 +1,124 @@
+//! Copilot provider-local command builders + permission helpers.
+//!
+//! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
+//! extraction — byte-identical to the original inline forms. Scope kept
+//! small: base command + resume + permission flags + MCP type→transport
+//! translation. Auth hint (`copilot_auth_hint`) and session store scan
+//! (`scan_copilot_session_store`, `copilot_candidate`) stay in
+//! `adapter.rs` because they depend on `command_on_path` /
+//! `CaptureSessionContext` / sqlite session-store helpers. Step 3 of the
+//! decoupling plan can move those into provider session store hooks.
+
+use crate::model::enums::AuthMode;
+use crate::provider::McpConfig;
+
+pub(crate) fn copilot_base_command(
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Vec<String> {
+    let _ = (auth_mode, system_prompt);
+    let mut argv = vec![
+        "copilot".to_string(),
+        // Noise control trio + disable remote control (防 GitHub web 远控 worker)
+        "--no-color".to_string(),
+        "--no-auto-update".to_string(),
+        "--no-remote".to_string(),
+        // P0: disable built-in github-mcp-server. Residual risk covered by
+        // spawn-time `copilot mcp list` scan + per-name --disable-mcp-server.
+        "--disable-builtin-mcps".to_string(),
+    ];
+    if copilot_dangerous_auto_approve(tools) {
+        argv.push("--allow-all".to_string());
+    } else {
+        for flag in copilot_permission_flags(tools) {
+            argv.push(flag);
+        }
+    }
+    // mcp_team ∈ canonical → approval-free (whole-server pattern).
+    argv.push("--allow-tool".to_string());
+    argv.push("team_orchestrator".to_string());
+    if let Some(model) = model {
+        argv.push("--model".to_string());
+        argv.push(model.to_string());
+    }
+    if let Some(config) = mcp_config {
+        // Copilot mcp config schema field is `transport` (stdio|http|sse),
+        // not the canonical `type`. McpConfig.raw is canonical; only copilot
+        // translates type→transport for --additional-mcp-config.
+        argv.push("--additional-mcp-config".to_string());
+        argv.push(copilot_translate_mcp_config(&config.raw).to_string());
+    }
+    argv
+}
+
+/// Translate `McpConfig.raw` canonical schema (`type`) into the copilot
+/// `mcp add`/`--additional-mcp-config` expected `transport` field
+/// (stdio|http|sse). Only the copilot adapter walks this translation —
+/// claude/codex paths leave canonical schema untouched.
+pub(crate) fn copilot_translate_mcp_config(raw: &serde_json::Value) -> serde_json::Value {
+    let Some(servers) = raw.as_object() else {
+        return raw.clone();
+    };
+    let mut translated = serde_json::Map::new();
+    for (name, server) in servers {
+        let Some(obj) = server.as_object() else {
+            translated.insert(name.clone(), server.clone());
+            continue;
+        };
+        let mut out = serde_json::Map::new();
+        for (key, value) in obj {
+            if key == "type" {
+                out.insert("transport".to_string(), value.clone());
+            } else {
+                out.insert(key.clone(), value.clone());
+            }
+        }
+        translated.insert(name.clone(), serde_json::Value::Object(out));
+    }
+    serde_json::Value::Object(translated)
+}
+
+/// Resume path = base + `--resume <sid>` (drop --session-id); kept separate
+/// to avoid the plan accidentally emitting --session-id and --resume in the
+/// same frame.
+pub(crate) fn copilot_base_command_resume(
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Vec<String> {
+    copilot_base_command(auth_mode, mcp_config, system_prompt, model, tools)
+}
+
+pub(crate) fn copilot_dangerous_auto_approve(tools: &[&str]) -> bool {
+    tools.contains(&"dangerous_auto_approve")
+}
+
+/// Granular deny mapping (canonical tool → copilot flag, all via
+/// `--deny-tool <kind>`; help-permissions Tool Permissions has four kinds:
+/// shell/write/mcp/url):
+///   execute_bash ∉ allowed → `--deny-tool 'shell'`
+///   fs_write     ∉ allowed → `--deny-tool 'write'`
+///   network      ∉ allowed → `--deny-tool 'url'`
+/// fs_read/fs_list have no copilot deny kind (honestly prompt_only).
+pub(crate) fn copilot_permission_flags(tools: &[&str]) -> Vec<String> {
+    let mut flags = Vec::new();
+    if !tools.contains(&"execute_bash") {
+        flags.push("--deny-tool".to_string());
+        flags.push("shell".to_string());
+    }
+    if !tools.contains(&"fs_write") {
+        flags.push("--deny-tool".to_string());
+        flags.push("write".to_string());
+    }
+    if !tools.contains(&"network") {
+        // `--deny-tool 'url'` (omit domain → match all URLs).
+        flags.push("--deny-tool".to_string());
+        flags.push("url".to_string());
+    }
+    flags
+}

package/crates/team-agent/src/provider/adapters/fake.rs

@@ -0,0 +1,17 @@
+//! Fake provider — scripted worker built into the team-agent CLI itself.
+//! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2).
+
+pub(crate) fn fake_worker_command() -> Vec<String> {
+    let exe = std::env::current_exe()
+        .ok()
+        .and_then(|p| p.into_os_string().into_string().ok())
+        .unwrap_or_else(|| "team-agent".to_string());
+    vec![
+        exe,
+        "fake-worker".to_string(),
+        "--workspace".to_string(),
+        "{workspace}".to_string(),
+        "--agent-id".to_string(),
+        "{agent_id}".to_string(),
+    ]
+}

package/crates/team-agent/src/provider/adapters/mod.rs

@@ -0,0 +1,27 @@
+//! Provider-local adapter implementations. Split from the monolithic
+//! `provider/adapter.rs` as 0.4.x decoupling step 2. Each file owns its
+//! provider's command builders, permission/sandbox/auth helpers, and
+//! anything else that varies by provider but doesn't need shared
+//! capture/scan utilities. The `ProviderAdapter` trait and the
+//! `BasicProviderAdapter` registry stay in `adapter.rs`; the trait impl
+//! dispatches into these helpers exactly as the inline forms did.
+//!
+//! Per-file scope:
+//!   * `claude` — Claude/ClaudeCode argv, dangerous-skip flag, disallowed
+//!     tools mapping, auth hint, model passthrough.
+//!   * `codex`  — Codex argv, profile/sandbox flags, MCP `-c` injection
+//!     with 600s tool_timeout, developer-instructions escaping.
+//!   * `copilot` — Copilot argv (no-color/no-remote/disable-builtin-mcps),
+//!     allow/deny flag matrix, MCP `type→transport` translation, resume
+//!     base, weak auth hint.
+//!   * `fake`   — Built-in scripted worker exec path.
+//!
+//! Behavior is byte-identical to pre-split. Future steps may move
+//! `pre_spawn_adjust_plan`, `profile_env`, `session_backing_probe`, and
+//! `session_candidates` into provider-owned hooks following the same
+//! per-file layout.
+
+pub(crate) mod claude;
+pub(crate) mod codex;
+pub(crate) mod copilot;
+pub(crate) mod fake;

package/crates/team-agent/src/provider/mod.rs

@@ -32,6 +32,9 @@
 pub use crate::model::enums::{AuthMode, Provider};
 
 pub mod adapter;
+/// 0.4.x decoupling step 2: per-provider command builders + permission/auth
+/// helpers split out of `adapter.rs`. Pure extraction — behavior unchanged.
+pub(crate) mod adapters;
 pub mod approvals;
 pub mod classify;
 pub mod command;
@@ -40,6 +43,9 @@ pub mod session;
 pub mod session_scan;
 pub mod startup_prompt;
 pub mod types;
+/// 0.4.x: provider wire-format helpers — single source of truth for
+/// `Provider` ↔ string conversions (replaces 7 hand-rolled match copies).
+pub(crate) mod wire;
 // helpers 全部原为模块私有(JSONL 解析 / 正则编译),非根可见 → 私有 mod,不参与 re-export。
 mod helpers;
 

package/crates/team-agent/src/provider/session/capture.rs

@@ -296,7 +296,24 @@ where
                 .get("rollout_path")
                 .and_then(Value::as_str)
                 .is_some_and(|s| !s.is_empty());
-        if has_session {
+        // S1-CAPTURE-001 (0.4.8): a pending_session_id that differs from the
+        // on-row session_id means a fresh respawn is in flight — the prior
+        // worker's session_id may still be on the row (concurrent capture race,
+        // delayed persist, or persist-backfill replay) but the NEW worker has
+        // not yet been bound. Stamping capture_state=captured here would
+        // falsely declare the OLD session authoritative for the NEW worker
+        // pane — the leader/unassigned mis-attribution surfaced in S1-CAPTURE-001
+        // gate evidence. Only stamp `captured` when session_id agrees with
+        // _pending_session_id (or _pending is absent, meaning no rebind in
+        // flight).
+        let pending_mismatch = match (
+            agent_obj.get("_pending_session_id").and_then(Value::as_str).filter(|s| !s.is_empty()),
+            agent_obj.get("session_id").and_then(Value::as_str).filter(|s| !s.is_empty()),
+        ) {
+            (Some(pending), Some(current)) => pending != current,
+            _ => false,
+        };
+        if has_session && !pending_mismatch {
             // Captured already — fix state field if drifted.
             if agent_obj
                 .get("capture_state")
@@ -684,6 +701,29 @@ fn agent_session_complete(agent: &Value) -> bool {
     if !session_id_ok {
         return false;
     }
+    // S1-CAPTURE-001 (0.4.8, CR M3 provider-agnostic): pending mismatch guard.
+    // When fresh-start has written a new `_pending_session_id` but the old
+    // authoritative `session_id` is still present and differs, the tuple is
+    // STALE — the new process has a different session that has not been
+    // captured yet. Returning true here would let capture skip this agent
+    // and keep treating the old transcript as authoritative (the gate's
+    // observed mis-attribution). Force re-capture by reporting incomplete.
+    // The fresh-tuple clear in mark_agent_started (lifecycle/restart/agent.rs)
+    // is the primary fix; this guard handles historical poison state where
+    // both fields already coexist from a prior version.
+    let pending = agent
+        .get("_pending_session_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    let current = agent
+        .get("session_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    if let (Some(pending), Some(current)) = (pending, current) {
+        if pending != current {
+            return false;
+        }
+    }
     let rollout_path = match agent
         .get("rollout_path")
         .and_then(Value::as_str)
@@ -1002,6 +1042,16 @@ fn apply_captured_session(
         serde_json::to_value(captured.attribution_confidence).unwrap_or(Value::Null),
     );
     agent_obj.remove("attribution_ambiguous");
+    // S1-CAPTURE-001 (0.4.8): after writing the authoritative tuple, the
+    // `_pending_session_id` placeholder is no longer needed — remove it so
+    // future reads don't trip the pending-mismatch guard in
+    // agent_session_complete. Also stamp capture_state="captured" for
+    // diagnose/status observability.
+    agent_obj.remove("_pending_session_id");
+    agent_obj.insert(
+        "capture_state".to_string(),
+        serde_json::json!("captured"),
+    );
     true
 }
 
@@ -1784,4 +1834,84 @@ mod u1_tests {
         let _ = std::fs::remove_dir_all(workspace.join(".team"));
         let _ = std::fs::remove_dir_all(&workspace);
     }
+
+    /// S1-CAPTURE-001 (0.4.8): pending mismatch guard. When fresh-start has
+    /// written a new `_pending_session_id` but the old authoritative
+    /// `session_id` is still present and differs, `agent_session_complete`
+    /// must return false so capture re-runs and re-binds to the new process.
+    /// Without this, the historical poison state (old + new coexist) lets
+    /// the stale rollout look authoritative.
+    #[test]
+    fn agent_session_complete_returns_false_on_pending_mismatch() {
+        let dir = std::env::temp_dir().join(format!(
+            "ta-pending-mismatch-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::create_dir_all(&dir);
+        let rollout = dir.join("old.jsonl");
+        std::fs::write(&rollout, "{\"type\":\"assistant\"}\n").unwrap();
+
+        let agent = serde_json::json!({
+            "provider": "claude",
+            "session_id": "old",
+            "rollout_path": rollout.to_string_lossy(),
+            "captured_at": "2026-01-01T00:00:00+00:00",
+            "captured_via": "fs_watch",
+            "_pending_session_id": "new",
+        });
+
+        assert!(
+            !super::agent_session_complete(&agent),
+            "S1-CAPTURE-001: pending != session_id must force incomplete \
+             (capture must re-attribute to new session)"
+        );
+
+        // Sanity: when they match, complete is true.
+        let agent_match = serde_json::json!({
+            "provider": "claude",
+            "session_id": "new",
+            "rollout_path": rollout.to_string_lossy(),
+            "captured_at": "2026-01-01T00:00:00+00:00",
+            "captured_via": "fs_watch",
+            "_pending_session_id": "new",
+        });
+        assert!(
+            super::agent_session_complete(&agent_match),
+            "pending == session_id (in-progress capture confirmed): must be complete"
+        );
+
+        let _ = std::fs::remove_file(&rollout);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// S1-CAPTURE-001 (0.4.8): apply_captured_session clears
+    /// `_pending_session_id` and stamps `capture_state="captured"` so the
+    /// pending-mismatch guard doesn't fire on subsequent reads.
+    #[test]
+    fn apply_captured_session_clears_pending_and_stamps_capture_state() {
+        let mut agent = serde_json::Map::new();
+        agent.insert(
+            "_pending_session_id".to_string(),
+            serde_json::json!("new-sess"),
+        );
+        let captured = CapturedSession {
+            session_id: Some(SessionId::new("new-sess")),
+            rollout_path: Some(RolloutPath::new(PathBuf::from("/tmp/new.jsonl"))),
+            captured_via: CaptureVia::FsWatch,
+            attribution_confidence: Confidence::High,
+            spawn_cwd: PathBuf::from("/tmp/cwd"),
+        };
+        let written = super::apply_captured_session(&mut agent, &captured);
+        assert!(written, "apply must return true for valid captured");
+        assert!(
+            agent.get("_pending_session_id").is_none(),
+            "S1-CAPTURE-001: _pending_session_id must be removed after capture \
+             (agent={agent:?})"
+        );
+        assert_eq!(
+            agent.get("capture_state").and_then(serde_json::Value::as_str),
+            Some("captured"),
+            "S1-CAPTURE-001: capture_state must be stamped 'captured'"
+        );
+    }
 }

package/crates/team-agent/src/provider/wire.rs

@@ -0,0 +1,139 @@
+//! Provider wire-format helpers — the single source of truth for converting
+//! `Provider` ↔ string forms used across state JSON, CLI args, log fields,
+//! and the workers we shell out to.
+//!
+//! This module replaces 7 hand-rolled copies of these match arms that lived
+//! in `leader/helpers.rs`, `coordinator/tick.rs` (×2), `lifecycle/restart/common.rs`,
+//! `lifecycle/profile_launch.rs`, `lifecycle/launch.rs`, `provider/adapter.rs`,
+//! and `lifecycle/restart/rebuild.rs`. Centralising them removes the kind of
+//! drift that left `restart/rebuild.rs` with a `claude-code` alias the other
+//! sites silently dropped, and shrinks the surface area when a new provider
+//! is added.
+//!
+//! Wire-format invariants (do not change without a coordinated migration):
+//!   * `provider_wire(Provider)` returns the canonical snake_case string used
+//!     in state JSON. These values are persisted on disk and read by older
+//!     runtimes — changing them is a breaking change.
+//!   * `parse_provider(&str)` accepts the canonical form AND every historical
+//!     alias we have ever written. New aliases go in `aliases()` and become
+//!     a parse target automatically.
+//!   * `command_name(Provider)` returns the binary name we exec for that
+//!     provider. `Claude` and `ClaudeCode` both shell out to `claude` —
+//!     they are distinct state values but share an executable.
+
+use crate::model::enums::Provider;
+
+/// Canonical snake_case wire string for `Provider`. Used for state JSON,
+/// log fields, and any cross-process serialization. Stable: do not change
+/// existing values.
+pub(crate) fn provider_wire(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Fake => "fake",
+    }
+}
+
+/// Parse a wire string back to `Provider`. Accepts the canonical
+/// `provider_wire` output AND every historical alias listed by `aliases()`.
+/// Returns `None` for unknown strings.
+pub(crate) fn parse_provider(raw: &str) -> Option<Provider> {
+    for &provider in ALL_PROVIDERS {
+        for alias in aliases(provider) {
+            if *alias == raw {
+                return Some(provider);
+            }
+        }
+    }
+    None
+}
+
+/// All aliases (including the canonical wire form) that parse to `provider`.
+/// The canonical wire form is always the first entry, so callers that need
+/// the "primary" string can take `aliases(p)[0]` — though most code should
+/// use `provider_wire(p)` directly for clarity.
+pub(crate) fn aliases(provider: Provider) -> &'static [&'static str] {
+    match provider {
+        Provider::Claude => &["claude"],
+        // `claude-code` (kebab) is a historical alias that appeared in
+        // restart/rebuild.rs:1186-1194 only. Keeping it parseable means
+        // legacy state files still load.
+        Provider::ClaudeCode => &["claude_code", "claude-code"],
+        Provider::Codex => &["codex"],
+        Provider::Copilot => &["copilot"],
+        Provider::GeminiCli => &["gemini_cli"],
+        Provider::Fake => &["fake"],
+    }
+}
+
+/// Executable name we exec for the worker. `Claude` and `ClaudeCode` both
+/// resolve to `claude` — the distinction is in state semantics
+/// (`ClaudeCode` is the canonical CLI; `Claude` is a legacy alias kept for
+/// older specs).
+pub(crate) fn command_name(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude | Provider::ClaudeCode => "claude",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini",
+        Provider::Fake => "team-agent",
+    }
+}
+
+const ALL_PROVIDERS: &[Provider] = &[
+    Provider::Claude,
+    Provider::ClaudeCode,
+    Provider::Codex,
+    Provider::Copilot,
+    Provider::GeminiCli,
+    Provider::Fake,
+];
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn wire_round_trip_for_every_provider() {
+        for &p in ALL_PROVIDERS {
+            let wire = provider_wire(p);
+            assert_eq!(parse_provider(wire), Some(p), "round-trip {p:?}");
+        }
+    }
+
+    #[test]
+    fn claude_code_kebab_alias_parses() {
+        // Historical alias preserved from restart/rebuild.rs:1186-1194.
+        assert_eq!(parse_provider("claude-code"), Some(Provider::ClaudeCode));
+    }
+
+    #[test]
+    fn unknown_string_returns_none() {
+        assert_eq!(parse_provider(""), None);
+        assert_eq!(parse_provider("openai"), None);
+        assert_eq!(parse_provider("CLAUDE"), None); // case-sensitive
+    }
+
+    #[test]
+    fn aliases_first_entry_is_canonical_wire() {
+        for &p in ALL_PROVIDERS {
+            assert_eq!(aliases(p)[0], provider_wire(p), "canonical first for {p:?}");
+        }
+    }
+
+    #[test]
+    fn command_name_claude_and_claude_code_both_resolve_to_claude_binary() {
+        assert_eq!(command_name(Provider::Claude), "claude");
+        assert_eq!(command_name(Provider::ClaudeCode), "claude");
+    }
+
+    #[test]
+    fn command_name_covers_every_provider() {
+        for &p in ALL_PROVIDERS {
+            assert!(!command_name(p).is_empty(), "{p:?} has no command name");
+        }
+    }
+}

package/crates/team-agent/src/state/paths.rs

@@ -160,10 +160,14 @@ pub enum CommandScope {
     /// Caller passed `--team X` explicitly (or there's only one alive team
     /// and we resolved it). Carries the canonical team_key.
     Resolved(String),
-    /// No `--team` and multiple alive teams. Destructive commands MUST
-    /// refuse with this list of candidates so the operator chooses
-    /// explicitly. Read-only commands may still proceed (their scope is
-    /// "all teams" by default).
+    /// No `--team` and multiple alive teams. Destructive commands AND
+    /// selected-team commands (status, etc.) MUST refuse with this list
+    /// of candidates so the operator chooses explicitly. Only true
+    /// all-team aggregation commands may proceed without --team.
+    /// (S4QR-001 0.4.8: status was previously documented as a read-only
+    /// command that could proceed; in fact it projects a single team's
+    /// view and silently defaulting to the active team caused gate
+    /// failures when multiple alive teams existed.)
     Ambiguous(Vec<String>),
     /// No `--team` and no teams alive yet (fresh workspace) — bare
     /// commands fall through to legacy single-team behaviour.

package/crates/team-agent/src/state/persist.rs

@@ -560,6 +560,23 @@ fn backfill_capture_fields(incoming_agent: &mut Value, latest_agent: &Value) {
     if !latest_complete {
         return;
     }
+    // S1-CAPTURE-001 (0.4.8) Rule 5: a fresh restart marker (`_pending_session_id`
+    // present on incoming) signals the worker just respawned and the prior
+    // tuple was intentionally cleared. The capture scanner is the only path
+    // permitted to promote `_pending_session_id` into the authoritative tuple
+    // after it confirms backing. Persist-side backfill MUST NOT revive the
+    // latest tuple in this state — doing so resurrects the previous worker's
+    // session/rollout pair and delivered tokens land in the OLD transcript
+    // (the leader/unassigned mis-attribution surfaced in S1-CAPTURE-001 gate
+    // evidence). Refuse backfill regardless of whether incoming session_id
+    // is null vs latest's value: the pending marker is authoritative intent.
+    let incoming_pending = incoming_row
+        .get("_pending_session_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    if incoming_pending.is_some() {
+        return;
+    }
     // Rule 2: incoming carries a DIFFERENT non-null session_id → do not mix.
     let incoming_session = incoming_row.get("session_id").and_then(Value::as_str);
     let latest_session = latest_agent.get("session_id").and_then(Value::as_str);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.4.6",
-    "@team-agent/cli-darwin-x64": "0.4.6",
-    "@team-agent/cli-linux-x64": "0.4.6"
+    "@team-agent/cli-darwin-arm64": "0.4.8",
+    "@team-agent/cli-darwin-x64": "0.4.8",
+    "@team-agent/cli-linux-x64": "0.4.8"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",

package/skills/team-agent/SKILL.md

@@ -18,6 +18,12 @@ team-agent claude
 
 Pass provider flags after the provider name, for example `team-agent codex --dangerously-bypass-approvals-and-sandbox`. Existing tmux layouts are valid too, including Finder/Ghostty launchers, as long as `team-agent quick-start` is invoked from the leader's current tmux pane. Do not start a real team from a naked terminal that Team Agent cannot address through tmux.
 
+## Leader Role
+
+Invoking this skill turns the current agent into the team leader. The leader **orchestrates**: read reports, set direction, decompose work, dispatch tasks to teammates, review results, and decide. The leader does **not** execute hands-on work — no `cargo test`, no product-code edits, no `git push`, no build/verify cycles. Those belong to teammates. If the leader catches themselves running tests, editing source files, or pushing commits, they have stepped out of role; stop and re-dispatch.
+
+When the user has been communicating in Chinese throughout the conversation, all leader↔teammate messaging (`send`, `report_result`, MCP messages, task descriptions) must also be in Chinese. The leader dispatches in Chinese, the worker reports back in Chinese. Switch back to the user's language only at the user-facing boundary.
+
 ## Minimal Copy-Paste Team
 
 ```bash