@team-agent/installer 0.5.1 → 0.5.3

package/crates/team-agent/src/conpty/mod.rs

@@ -0,0 +1,32 @@
+//! 0.5.x Windows-native transport Phase 1: ConPTY backend.
+//!
+//! Wire protocol + portable shim state machine live in the
+//! `conpty-transport` crate (portable, no team-agent runtime deps —
+//! consumed directly by the Windows `windows-shim` binary). This
+//! module wires that portable machinery into team-agent's `Transport`
+//! trait via `ConPtyBackend`.
+//!
+//! Truth sources (READ-ONLY):
+//! - Design:    `.team/artifacts/0.5.x-windows-native-transport-design.md`
+//! - CR verdict: `.team/artifacts/0.5.x-windows-transport-cr-verdict.md`
+//!
+//! CR anchors:
+//! - **C-1 pipe_token**: only lives in `ConPtyBackend.pipe_token`
+//!   (Mutex) and the shim's in-memory state; never persisted. Grep
+//!   guard test (`conpty_pipe_token_no_persist_guard.rs`) locks this.
+//! - **C-2 kill_server**: forwards to `Op::Shutdown` per-team, not
+//!   global. See CR pre-check in the gate report.
+//! - **C-3 stale event**: emitted by the backend when `state.shim_pid`
+//!   disagrees with the shim's `hello` response.
+//! - **C-5 pipe_token_mismatch**: `ProtocolError::PipeTokenMismatch`
+//!   maps to `TransportError::MuxUnavailable`, NEVER silent retry.
+
+pub mod backend;
+
+pub use backend::{ConPtyBackend, PipeClientAdapter, PipeClientTrait};
+// Re-export the portable protocol + shim types from the standalone
+// crate so downstream code can `use team_agent::conpty::{Shim,
+// FakePaneRuntime, ...}` without a second dependency.
+pub use conpty_transport::{
+    protocol, shim, FakePaneRuntime, LocalShimClient, PaneRuntime, PipeClient, Shim,
+};

package/crates/team-agent/src/coordinator/backoff.rs

@@ -27,6 +27,14 @@ pub struct DaemonArgs {
     pub once: bool,
     /// `--tick-interval`(`__main__.py:29`)。`None` → 读 spec `runtime.tick_interval_sec`。
     pub tick_interval_sec: Option<f64>,
+    /// 0.5.x Windows portability Batch 9 F8 (leader msg_2a4cc1fa54c0):
+    /// team_key passed via `--team` CLI so the coordinator daemon
+    /// doesn't have to derive from state at boot time. That derivation
+    /// (Batch 7 F5) got trapped by Batch 8's seed-state pattern
+    /// (F8 root cause). Preserving the derivation as a fallback when
+    /// `team_key` is None keeps Unix daemons and pre-existing test
+    /// harnesses byte-preserving.
+    pub team_key: Option<String>,
 }
 
 /// daemon 主循环(`main`,`__main__.py:25-98`)。写 pid/meta(source=boot)、装信号→STOP、孤儿自检、
@@ -36,19 +44,82 @@ pub fn run_daemon(args: DaemonArgs) -> Result<(), DaemonError> {
     // CP-1: the daemon's whole tick surface (has_session / capture / inject / list_windows / kill)
     // runs through this backend. Prefer the persisted runtime endpoint so attached explicit-socket
     // teams are checked on the same socket as lifecycle worker operations.
+    //
+    // 0.5.x Phase 1d Batch 3: coordinator boot now routes through
+    // `transport_factory::resolve_transport` so `state.transport.kind =
+    // conpty` boots the ConPTY backend, not a tmux backend that would
+    // fake `has_session()`. Tmux behavior is byte-equivalent (Layer 3
+    // legacy `tmux_endpoint` → same `tmux_backend_for_runtime_state_or_workspace`
+    // shape inside the factory's `build_tmux`).
     let state = crate::state::persist::load_runtime_state(args.workspace.as_path()).ok();
-    let tmux_selection = crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(
+    // 0.5.x Windows portability Batch 9 F8 (leader msg_2a4cc1fa54c0):
+    // team_key priority is now `args.team_key` (from `--team` CLI)
+    // > `state.active_team_key` fallback. The Batch 7 F5 derivation
+    // stays as the fallback so pre-Batch-9 tests + Unix daemons
+    // continue byte-preserving. Callers that CAN pass `--team`
+    // (Batch 9 quick-start on Windows) do — that avoids the F8
+    // seed-state trap where writing active_team_key to state ahead
+    // of coord spawn made downstream launch code think "existing
+    // runtime, use restart" and skip spec compile.
+    let team_key_from_state = args
+        .team_key
+        .clone()
+        .filter(|s| !s.is_empty())
+        .or_else(|| {
+            state
+                .as_ref()
+                .and_then(|s| s.get("active_team_key"))
+                .and_then(|v| v.as_str())
+                .filter(|s| !s.is_empty())
+                .map(str::to_string)
+        });
+    let mut factory_input = crate::transport_factory::TransportFactoryInput::new(
         args.workspace.as_path(),
-        state.as_ref(),
-    );
+        crate::transport_factory::TransportPurpose::Coordinator,
+    )
+    .with_state(state.as_ref());
+    if let Some(ref team_key) = team_key_from_state {
+        factory_input = factory_input.with_team_key(Some(team_key));
+    }
+    let resolved = match crate::transport_factory::resolve_transport(factory_input) {
+        Ok(resolved) => resolved,
+        Err(e) => {
+            // Fail-closed honest degradation: coordinator boots with a
+            // tmux-workspace backend so it doesn't crash, but records
+            // the assembly refusal in the boot metadata source so the
+            // event log shows the reason. This preserves the daemon
+            // liveness path while making the failure explicit.
+            eprintln!(
+                "coordinator: transport_factory refused ({e}); falling back to tmux workspace for daemon liveness"
+            );
+            let sel = crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(
+                args.workspace.as_path(),
+                state.as_ref(),
+            );
+            let metadata = DaemonTmuxEndpointMetadata {
+                tmux_endpoint_used: sel.tmux_endpoint_used.clone(),
+                tmux_endpoint_source: "factory_refused_fallback",
+            };
+            let coord = Coordinator::new(
+                args.workspace.clone(),
+                Box::new(RealProviderRegistry),
+                Box::new(sel.backend),
+            );
+            return run_daemon_with_coordinator_and_boot_tmux(&args, &coord, Some(metadata));
+        }
+    };
+    // Preserve tmux boot metadata byte-equivalent for tmux teams.
+    // ConPTY teams get their source string but no tmux endpoint (design
+    // §Behavior Equivalence: same `tmux_endpoint_used` for tmux; None
+    // + honest source for conpty).
     let tmux_metadata = DaemonTmuxEndpointMetadata {
-        tmux_endpoint_used: tmux_selection.tmux_endpoint_used.clone(),
-        tmux_endpoint_source: tmux_selection.tmux_endpoint_source.as_str(),
+        tmux_endpoint_used: resolved.tmux_endpoint_used.clone(),
+        tmux_endpoint_source: resolved.source,
     };
     let coordinator = Coordinator::new(
         args.workspace.clone(),
         Box::new(RealProviderRegistry),
-        Box::new(tmux_selection.backend),
+        resolved.backend,
     );
     run_daemon_with_coordinator_and_boot_tmux(&args, &coordinator, Some(tmux_metadata))
 }
@@ -98,6 +169,57 @@ fn run_daemon_with_coordinator_and_boot_tmux(
         }
     }
     event_log.write("coordinator.boot", boot_event)?;
+
+    // 0.5.x Windows portability Batch 8 F7 (leader msg_590b4dce0f68):
+    // coordinator takes ownership of shim lifecycle. Idempotent:
+    // spawns a fresh shim if none is recorded, reconnects if
+    // `state.transport.shim.pid` names a living shim (post-crash
+    // restart path). Failures are non-fatal for the coord daemon —
+    // the tick loop's transport calls will surface honest
+    // MuxUnavailable errors and `mark_transport_unavailable`
+    // emits the C-3 stale-family event.
+    //
+    // On non-Windows this call is cfg'd out (there's no shim
+    // concept on Unix).
+    #[cfg(windows)]
+    {
+        let state_for_team_key =
+            crate::state::persist::load_runtime_state(args.workspace.as_path()).ok();
+        let team_key_opt = state_for_team_key
+            .as_ref()
+            .and_then(|s| s.get("active_team_key"))
+            .and_then(|v| v.as_str())
+            .filter(|s| !s.is_empty())
+            .map(str::to_string);
+        if let Some(team_key) = team_key_opt {
+            let workspace_hash =
+                crate::tmux_backend::workspace_short_hash_pub(args.workspace.as_path());
+            match crate::coordinator::conpty_shim::ensure_shim_running(
+                args.workspace.as_path(),
+                &team_key,
+                &workspace_hash,
+            ) {
+                Ok(handle) => {
+                    // Detach so the shim survives beyond this
+                    // coordinator instance (F7 core invariant).
+                    let _shim_pid = handle.detach();
+                    eprintln!("coordinator: shim ensured (pid={_shim_pid})");
+                }
+                Err(e) => {
+                    // Honest degradation: emit the stale-family
+                    // event, coord continues without a shim. Tick
+                    // loop will surface `mux_unavailable` on any
+                    // transport call.
+                    eprintln!("coordinator: shim ensure failed: {e}");
+                    let _ = crate::coordinator::conpty_shim::mark_transport_unavailable(
+                        args.workspace.as_path(),
+                        &format!("boot_ensure_failed: {e}"),
+                    );
+                }
+            }
+        }
+    }
+
     let tick_interval = match args.tick_interval_sec {
         Some(v) if v > 0.0 => v,
         _ => resolve_tick_interval(&args.workspace)?,
@@ -215,8 +337,11 @@ fn panic_payload_message(payload: &(dyn std::any::Any + Send)) -> String {
 }
 
 /// 当前 ppid(`os.getppid()`,孤儿自检输入)。
+///
+/// 0.5.x Windows portability Batch 3: uses `platform::process::current_parent_pid`
+/// so Windows sees a real Toolhelp32-derived ppid instead of `0`.
 fn current_ppid() -> u32 {
-    u32::try_from(unsafe { libc::getppid() }).unwrap_or(0)
+    crate::platform::process::current_parent_pid().unwrap_or(0)
 }
 
 /// 计算 tick 间隔(`_tick_interval`,`__main__.py:104-115`)。读 spec `runtime.tick_interval_sec`,