@team-agent/installer 0.4.9 → 0.4.11

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.4.9"
+version = "0.4.11"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.4.9"
+version = "0.4.11"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/status_port.rs

@@ -743,7 +743,10 @@ use rusqlite::params;
             return json!({});
         };
         let mut out = Map::new();
-        for key in ["status", "provider", "activity", "last_output_at"] {
+        // 0.4.x Phase 1: add `worker_state` (canonical 5-state product
+        // surface). `activity` is preserved alongside as the deprecated
+        // legacy classifier output (CR R3 same-source contract).
+        for key in ["status", "provider", "worker_state", "activity", "last_output_at"] {
             if let Some(value) = input.get(key) {
                 out.insert(key.to_string(), value.clone());
             }

package/crates/team-agent/src/compiler.rs

@@ -26,6 +26,7 @@
 use std::fs;
 use std::path::Path;
 
+use crate::model::enums::{Provider, ProviderEffort};
 use crate::model::yaml::Value;
 use crate::model::{paths, spec, yaml, ModelError};
 
@@ -182,17 +183,35 @@ pub fn compile_team(team_dir: &Path) -> Result<Value, ModelError> {
         })
         .collect::<Vec<_>>();
 
+    // 0.4.x provider effort MVP step 2: validate TEAM.md provider_effort early
+    // (unknown literal rejects compile). Empty/absent → no team-level effort.
+    let team_provider_effort = match string_field(&team_meta, "provider_effort") {
+        Some(raw) if !raw.trim().is_empty() => {
+            let value = raw.trim();
+            let parsed = ProviderEffort::parse(value).ok_or_else(|| {
+                ModelError::Validation(format!(
+                    "{}: unknown provider_effort '{value}' (allowed: low|medium|high|xhigh|max)",
+                    team_md.display()
+                ))
+            })?;
+            Some(parsed)
+        }
+        _ => None,
+    };
+
+    let mut team_fields: Vec<(&str, Value)> = vec![
+        ("name", Value::Str(team_name.clone())),
+        ("mode", Value::Str("supervisor_worker".to_string())),
+        ("objective", Value::Str(objective)),
+        ("workspace", Value::Str(workspace_s)),
+    ];
+    if let Some(effort) = team_provider_effort {
+        team_fields.push(("provider_effort", Value::Str(effort.as_str().to_string())));
+    }
+
     let spec = map(vec![
         ("version", Value::Int(1)),
-        (
-            "team",
-            map(vec![
-                ("name", Value::Str(team_name.clone())),
-                ("mode", Value::Str("supervisor_worker".to_string())),
-                ("objective", Value::Str(objective)),
-                ("workspace", Value::Str(workspace_s)),
-            ]),
-        ),
+        ("team", map(team_fields)),
         (
             "leader",
             map(vec![
@@ -366,6 +385,56 @@ pub fn compile_role_agent(
     if let Some(profile) = string_field(&meta, "profile") {
         agent_items.push(("profile", Value::Str(profile)));
     }
+    // 0.4.x provider effort MVP step 3: resolve effort with role > team > none.
+    // Validate (unknown literal) AND check provider/effort compatibility
+    // (max is Claude-only; emit hard error for max + non-Claude here so
+    // unsupported combinations fail at compile, not at runtime).
+    let role_effort = match string_field(&meta, "effort") {
+        Some(raw) if !raw.trim().is_empty() => {
+            let value = raw.trim();
+            let parsed = ProviderEffort::parse(value).ok_or_else(|| {
+                ModelError::Validation(format!(
+                    "{}: unknown effort '{value}' (allowed: low|medium|high|xhigh|max)",
+                    role_path.display()
+                ))
+            })?;
+            Some(parsed)
+        }
+        _ => None,
+    };
+    let team_effort = match string_field(team_meta, "provider_effort") {
+        Some(raw) if !raw.trim().is_empty() => ProviderEffort::parse(raw.trim()),
+        _ => None,
+    };
+    let resolved_effort = role_effort.or(team_effort);
+    if let Some(effort) = resolved_effort {
+        // Reject max + non-Claude at compile time.
+        let provider_str = agent_items
+            .iter()
+            .find(|(k, _)| *k == "provider")
+            .and_then(|(_, v)| match v {
+                Value::Str(s) => Some(s.as_str()),
+                _ => None,
+            })
+            .unwrap_or("");
+        let provider_enum = match provider_str {
+            "claude" => Provider::Claude,
+            "claude_code" => Provider::ClaudeCode,
+            "codex" => Provider::Codex,
+            "copilot" => Provider::Copilot,
+            "gemini_cli" => Provider::GeminiCli,
+            "fake" => Provider::Fake,
+            _ => Provider::Codex, // unknown providers caught elsewhere
+        };
+        if effort.is_claude_only() && !matches!(provider_enum, Provider::Claude | Provider::ClaudeCode) {
+            return Err(ModelError::Validation(format!(
+                "{}: effort '{}' is only supported by claude/claude_code (provider: {provider_str})",
+                role_path.display(),
+                effort.as_str()
+            )));
+        }
+        agent_items.push(("effort", Value::Str(effort.as_str().to_string())));
+    }
     Ok(CompiledRole {
         id,
         role,

package/crates/team-agent/src/coordinator/tick.rs

@@ -3103,6 +3103,11 @@ fn write_activity(
         .get("last_output_at")
         .and_then(Value::as_str)
         .map(str::to_string);
+    // 0.4.x Phase 1: resolve the 5-state worker runtime state alongside the
+    // legacy `activity` write. CR R3: activity field is preserved as the
+    // deprecated surface; worker_state is the new canonical surface.
+    let worker_state =
+        resolve_worker_runtime_state_with_fg_pgrp(agent, Some(activity));
     let Some(agent_obj) = agent.as_object_mut() else {
         return previous_last_output;
     };
@@ -3115,6 +3120,10 @@ fn write_activity(
             "rationale": activity.rationale,
         }),
     );
+    agent_obj.insert(
+        "worker_state".to_string(),
+        serde_json::json!(worker_state.as_wire()),
+    );
     if output_advanced {
         let last_output_at = chrono::Utc::now().to_rfc3339();
         agent_obj.insert(
@@ -3126,6 +3135,83 @@ fn write_activity(
     previous_last_output
 }
 
+/// 0.4.x Phase 1 worker-runtime-state resolver.
+///
+/// Pure resolution from (agent JSON, optional activity classifier output).
+/// Reads `agent.pane_id`, `agent.pane_pid`, `agent.awaiting_human_confirm`,
+/// and the trust/startup approval flags. Uses
+/// `os_probe::pane_foreground_and_root_pgrp` to detect a child process
+/// occupying the terminal foreground.
+///
+/// Precedence (matches Phase 1 plan §4):
+///   1. Dead         — pane_pid exists but `getpgid` returns no process,
+///                     OR foreground probe explicitly reports the PID gone.
+///   2. Blocked      — agent.awaiting_human_confirm / startup-trust flags.
+///   3. Busy         — fg_pgrp != root_pgrp (child occupies terminal) OR
+///                     JSONL classifier reports Working.
+///   4. ProbablyIdle — JSONL classifier reports Idle AND no fg-pgrp
+///                     conflict (or probe unavailable + activity idle).
+///   5. Unknown      — missing pane_pid, probe error, or no decisive
+///                     signal. Iron law: never silently Idle.
+pub(crate) fn resolve_worker_runtime_state_with_fg_pgrp(
+    agent: &Value,
+    activity: Option<&crate::messaging::AgentActivity>,
+) -> crate::messaging::WorkerRuntimeState {
+    use crate::messaging::{ActivityStatus, WorkerRuntimeState};
+
+    // §4.2 Blocked: trust prompt / awaiting human confirm.
+    let blocked = agent
+        .get("awaiting_human_confirm")
+        .and_then(Value::as_bool)
+        .unwrap_or(false)
+        || agent
+            .get("approval")
+            .and_then(Value::as_str)
+            .is_some_and(|s| s == "pending" || s == "awaiting_trust_prompt")
+        || agent
+            .get("approval_status")
+            .and_then(Value::as_str)
+            .is_some_and(|s| s == "pending" || s == "awaiting_trust_prompt");
+    if blocked {
+        return WorkerRuntimeState::Blocked;
+    }
+
+    // §4.3 Busy via fg-pgrp probe (when pane_pid is available).
+    let pane_pid = agent.get("pane_pid").and_then(Value::as_u64).map(|p| p as u32);
+    if let Some(pid) = pane_pid {
+        match crate::os_probe::pane_foreground_and_root_pgrp(pid) {
+            Ok(Some((tpgid, pgid))) => {
+                if tpgid != pgid {
+                    return WorkerRuntimeState::Busy;
+                }
+                // Same pgrp — pane process owns foreground. Defer to
+                // JSONL/activity for finer state.
+            }
+            Ok(None) => {
+                // Probe could not read: missing PID, no controlling
+                // terminal, ps unavailable. Fall through to activity
+                // classifier; if that's also missing/uncertain, the
+                // function returns Unknown.
+            }
+            Err(_) => {
+                // Subprocess error — degrade to Unknown unless activity
+                // is decisive.
+            }
+        }
+    }
+
+    // §4.4/4.5 Activity-derived classification.
+    if let Some(activity) = activity {
+        return match activity.status {
+            ActivityStatus::Working => WorkerRuntimeState::Busy,
+            ActivityStatus::Idle => WorkerRuntimeState::ProbablyIdle,
+            ActivityStatus::Stuck | ActivityStatus::Uncertain => WorkerRuntimeState::Unknown,
+        };
+    }
+
+    WorkerRuntimeState::Unknown
+}
+
 fn activity_status_wire(status: crate::messaging::ActivityStatus) -> &'static str {
     match status {
         crate::messaging::ActivityStatus::Idle => "idle",
@@ -3144,6 +3230,16 @@ fn agent_health_status_wire(status: crate::messaging::ActivityStatus) -> &'stati
     }
 }
 
+/// 0.4.x Phase 1: read the worker_state wire string that `write_activity`
+/// persisted alongside the legacy activity. Returns None when no worker_state
+/// has been written yet (older state row pre-upgrade).
+pub(crate) fn agent_worker_state(agent: &Value) -> Option<crate::messaging::WorkerRuntimeState> {
+    agent
+        .get("worker_state")
+        .and_then(Value::as_str)
+        .map(crate::messaging::WorkerRuntimeState::parse_wire)
+}
+
 fn write_agent_health(
     store: &crate::message_store::MessageStore,
     team: &str,

package/crates/team-agent/src/leader/start.rs

@@ -61,12 +61,20 @@ pub fn leader_start_plan(
     // `managed_team_session_name(identity) = team-<team_id>` which is the
     // worker session — that co-location is the structural root of
     // E49/E51/E53/E57-3/E60.
+    // 0.4.10+ mirror-session fix v2 (option B): managed-mode session name
+    // gets a per-launch nonce so each `team-agent <provider>` entry in the
+    // same workspace creates its OWN tmux session — matching the user
+    // expectation that `tmux new-session + claude` is independent every
+    // time. Pre-fix the managed path used the workspace-keyed name (same
+    // session for every entry) and silently attached the second client →
+    // UI mirror. The external/attach paths keep the stable workspace-keyed
+    // name (per-launch nonce would break `--attach-session` reattach).
     let session_name = if external_path {
         attach_session
             .cloned()
             .or_else(|| Some(leader_session_name(provider, workspace)))
     } else {
-        Some(leader_session_name(provider, workspace))
+        Some(managed_leader_session_name(provider, workspace))
     };
     let in_tmux = std::env::var_os("TMUX").is_some();
     if !in_tmux {
@@ -266,6 +274,42 @@ pub fn leader_session_name(provider: Provider, workspace: &Path) -> SessionName
     ))
 }
 
+/// 0.4.10+ mirror-session fix v2: managed-mode session name with a
+/// per-launch nonce.
+///
+/// Format: `team-agent-leader-<provider>-<folder>-<hash>-<nonce>`.
+/// `nonce` = `<pid_hex>-<epoch_nanos_hex>`. The pid distinguishes
+/// concurrent launches; the epoch_nanos distinguishes sequential ones.
+///
+/// Each `team-agent <provider>` entry in the managed (non-tmux) path gets
+/// its OWN session, matching the user expectation that `tmux new-session
+/// + claude` is independent every time. The workspace-keyed prefix is
+/// preserved so existing leader-session-anchored protections
+/// (`LEADER_SESSION_PREFIX` matchers in shutdown/cli/mod.rs) still
+/// classify these sessions as leader sessions.
+///
+/// External / attach paths keep the stable `leader_session_name` —
+/// per-launch nonce would break `--attach-session <name>` reattach
+/// semantics.
+pub fn managed_leader_session_name(provider: Provider, workspace: &Path) -> SessionName {
+    let resolved = resolve_workspace_for_hash(workspace);
+    let folder_raw = resolved
+        .file_name()
+        .and_then(|n| n.to_str())
+        .unwrap_or("workspace");
+    let folder = sanitize_session_folder(folder_raw);
+    let hash = sha1_hex_prefix(resolved.to_string_lossy().as_bytes(), 8);
+    let pid = std::process::id();
+    let epoch_nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_nanos())
+        .unwrap_or(0);
+    SessionName::new(format!(
+        "{LEADER_SESSION_PREFIX}{}-{folder}-{hash}-{pid:x}-{epoch_nanos:x}",
+        provider_wire(provider)
+    ))
+}
+
 fn start_argv(
     mode: LeaderStartMode,
     provider: Provider,
@@ -423,31 +467,14 @@ fn ensure_managed_leader_pane(
     plan: &LeaderStartPlan,
     workspace: &Path,
 ) -> Result<SpawnResult, LeaderError> {
+    // 0.4.10+ mirror-session fix v2 (option B): each managed launch gets
+    // its OWN session name (via `managed_leader_session_name`'s nonce).
+    // The historical "session already exists → reuse pane" branch is
+    // structurally unreachable now (the per-launch session never
+    // preexists). If a caller bypasses the nonce path and reuses a name,
+    // tmux's own duplicate-session error will surface — better than
+    // silently attaching a second client.
     if transport.has_session(session).unwrap_or(false) {
-        if transport
-            .list_windows(session)
-            .unwrap_or_default()
-            .iter()
-            .any(|existing| existing.as_str() == window.as_str())
-        {
-            if let Some(existing) = transport
-                .list_targets()
-                .unwrap_or_default()
-                .into_iter()
-                .find(|pane| {
-                    pane.session.as_str() == session.as_str()
-                        && pane.window_name.as_ref().map(WindowName::as_str)
-                            == Some(window.as_str())
-                })
-            {
-                return Ok(SpawnResult {
-                    pane_id: existing.pane_id,
-                    session: session.clone(),
-                    window: window.clone(),
-                    child_pid: existing.pane_pid,
-                });
-            }
-        }
         // 0.4.x (CR C-1 + C-2): leader env_unset reuses the worker
         // provider_env_unsets (single source of truth) + spawn through the
         // leader shell wrapper so provider exit returns to a shell, not
@@ -1586,4 +1613,121 @@ mod tests {
         assert_eq!(sent[0].0, Target::Pane(PaneId::new("%0")));
         assert_eq!(sent[0].1, vec![Key::Enter]);
     }
+
+    // ═══════════════════════════════════════════════════════════════════
+    // 0.4.10+ mirror-session fix v2 (option B: independent session per launch).
+    //
+    // managed_leader_session_name appends a per-launch nonce so each
+    // `team-agent <provider>` entry in the same workspace creates its own
+    // tmux session, matching `tmux new-session + claude` semantics.
+    // ═══════════════════════════════════════════════════════════════════
+
+    #[test]
+    fn managed_leader_session_name_carries_leader_prefix() {
+        // Protection invariant: every session name returned by the
+        // managed path must still match LEADER_SESSION_PREFIX so the
+        // shutdown / cli/mod.rs prefix matchers still classify it as a
+        // leader session.
+        let workspace = std::env::temp_dir().join(format!(
+            "ta_rs_mgr_prefix_{}",
+            std::process::id()
+        ));
+        let _ = std::fs::create_dir_all(&workspace);
+        let name = super::managed_leader_session_name(Provider::ClaudeCode, &workspace);
+        assert!(
+            name.as_str().starts_with(super::super::LEADER_SESSION_PREFIX),
+            "managed session name must carry LEADER_SESSION_PREFIX (`{}`); \
+             got `{}`",
+            super::super::LEADER_SESSION_PREFIX,
+            name.as_str()
+        );
+        assert!(
+            name.as_str().contains("claude_code"),
+            "managed session name must include provider wire; got `{}`",
+            name.as_str()
+        );
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
+    #[test]
+    fn managed_leader_session_name_is_unique_per_call() {
+        // Two consecutive calls must return DIFFERENT names — the
+        // per-launch nonce defeats the mirror-session bug.
+        let workspace = std::env::temp_dir().join(format!(
+            "ta_rs_mgr_unique_{}",
+            std::process::id()
+        ));
+        let _ = std::fs::create_dir_all(&workspace);
+        let a = super::managed_leader_session_name(Provider::ClaudeCode, &workspace);
+        // Sleep > 1ns to ensure epoch_nanos advances even on coarse clocks.
+        std::thread::sleep(std::time::Duration::from_millis(1));
+        let b = super::managed_leader_session_name(Provider::ClaudeCode, &workspace);
+        assert_ne!(
+            a.as_str(),
+            b.as_str(),
+            "two managed launches in the same workspace must get \
+             DIFFERENT session names (mirror-session fix v2); got \
+             `{}` vs `{}`",
+            a.as_str(),
+            b.as_str()
+        );
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
+    #[test]
+    fn leader_session_name_is_stable_across_calls() {
+        // External / attach paths must keep the stable workspace-keyed
+        // name — `--attach-session <name>` reattach would break if the
+        // name varied per call.
+        let workspace = std::env::temp_dir().join(format!(
+            "ta_rs_lsn_stable_{}",
+            std::process::id()
+        ));
+        let _ = std::fs::create_dir_all(&workspace);
+        let a = super::leader_session_name(Provider::ClaudeCode, &workspace);
+        let b = super::leader_session_name(Provider::ClaudeCode, &workspace);
+        assert_eq!(
+            a.as_str(),
+            b.as_str(),
+            "leader_session_name must be deterministic per workspace \
+             (external/attach paths depend on stability); got `{}` vs `{}`",
+            a.as_str(),
+            b.as_str()
+        );
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
+    /// CR C-5 source grep guard: managed mode passes the nonce session
+    /// name through `leader_start_plan` so the per-launch independence
+    /// reaches `ensure_managed_leader_pane`. External/attach paths must
+    /// keep `leader_session_name`.
+    #[test]
+    fn managed_path_uses_nonce_session_name_grep_guard() {
+        let manifest = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+        let start_rs = manifest.join("src").join("leader").join("start.rs");
+        let contents =
+            std::fs::read_to_string(&start_rs).expect("read leader/start.rs");
+        // leader_start_plan must dispatch to managed_leader_session_name
+        // on the managed path.
+        let start = contents
+            .find("pub fn leader_start_plan(")
+            .expect("leader_start_plan must exist");
+        let end = contents[start + 1..]
+            .find("\npub fn ")
+            .or_else(|| contents[start + 1..].find("\nfn "))
+            .map(|p| start + 1 + p)
+            .unwrap_or(contents.len());
+        let body = &contents[start..end];
+        assert!(
+            body.contains("managed_leader_session_name(provider, workspace)"),
+            "leader_start_plan must call managed_leader_session_name on \
+             the managed path (mirror-session fix v2); body excerpt: {body}"
+        );
+        // The external_path branch must still use the stable name.
+        assert!(
+            body.contains("leader_session_name(provider, workspace)"),
+            "leader_start_plan must keep leader_session_name on the \
+             external/attach paths; body excerpt: {body}"
+        );
+    }
 }