@team-agent/installer 0.5.1 → 0.5.3

package/crates/team-agent/src/coordinator/health.rs

@@ -53,6 +53,21 @@ pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
 /// `start_coordinator`(`lifecycle.py:49-121`):幂等 — 已健康 no-op(AlreadyRunning);metadata 不兼容
 /// 先 stop 再起;schema 不兼容拒启 + hint;否则 spawn `team-agent coordinator --workspace <ws>`。
 pub fn start_coordinator(workspace: &WorkspacePath) -> Result<StartReport, StartError> {
+    start_coordinator_with_team(workspace, None)
+}
+
+/// 0.5.x Windows portability Batch 9 F8 (leader msg_2a4cc1fa54c0):
+/// forward `--team` to the spawned coord daemon so it doesn't have
+/// to derive team_key from `state.active_team_key` at boot. The
+/// derivation stays as fallback (see `coordinator::backoff::run_daemon`),
+/// so Unix daemons and pre-existing test harnesses are byte-preserving.
+///
+/// Callers that CAN pass team_key (Batch 9 quick-start Windows path)
+/// SHOULD — that avoids Batch 8's F8 seed-state trap.
+pub fn start_coordinator_with_team(
+    workspace: &WorkspacePath,
+    team_key: Option<&str>,
+) -> Result<StartReport, StartError> {
     let health = coordinator_health(workspace);
     if health.ok {
         return Ok(StartReport {
@@ -101,7 +116,13 @@ pub fn start_coordinator(workspace: &WorkspacePath) -> Result<StartReport, Start
     let mut command = Command::new(std::env::current_exe()?);
     command
         .args(["coordinator", "--workspace"])
-        .arg(workspace.as_path())
+        .arg(workspace.as_path());
+    if let Some(tk) = team_key {
+        if !tk.is_empty() {
+            command.args(["--team", tk]);
+        }
+    }
+    command
         .stdin(Stdio::null())
         .stdout(Stdio::from(log))
         .stderr(Stdio::from(log_err));
@@ -135,7 +156,23 @@ fn detach_daemon_child(command: &mut Command) {
     }
 }
 
-#[cfg(not(unix))]
+#[cfg(windows)]
+fn detach_daemon_child(command: &mut Command) {
+    // 0.5.x Windows portability Batch 8 F7 (leader msg_590b4dce0f68):
+    // detach the coordinator daemon on Windows via
+    // `DETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB` creation flags,
+    // matching what `coordinator::conpty_shim::spawn_shim_and_handshake`
+    // does for the shim. Without these flags, an SSH-launched
+    // quick-start blocks waiting for the coord daemon's process
+    // tree to exit (never happens — daemon runs forever), and the
+    // quick-start caller sees a hung command.
+    use std::os::windows::process::CommandExt;
+    const DETACHED_PROCESS: u32 = 0x00000008;
+    const CREATE_BREAKAWAY_FROM_JOB: u32 = 0x01000000;
+    command.creation_flags(DETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB);
+}
+
+#[cfg(not(any(unix, windows)))]
 fn detach_daemon_child(_command: &mut Command) {}
 
 /// `stop_coordinator`(`lifecycle.py:228-247`):SIGTERM pid + 清 pid/meta → typed report。
@@ -272,16 +309,32 @@ fn coordinator_command_matches_workspace(command: &str, workspaces: &[String]) -
 }
 
 fn terminate_pid(pid: Pid) -> bool {
+    // 0.5.x Windows portability Batch 3: routes signal delivery through
+    // `platform::process::terminate_pid`. Unix keeps
+    // SIGTERM → 5s grace → SIGKILL semantics byte-for-byte
+    // (`SignalKind::TerminateGraceful` → SIGTERM,
+    // `SignalKind::TerminateForce` → SIGKILL). Windows performs
+    // `TerminateProcess` for both kinds; the `TerminationOutcome::ForceOnly`
+    // return on the graceful call is what a future audit-event
+    // emitter (CR C-6) will trigger `platform.terminate_force_only`
+    // on. For this batch the return value is discarded, matching the
+    // current inline `let _ = send_signal(...)` pattern.
     if pid_is_running(pid).ok() == Some(false) {
         return true;
     }
     let pids = process_tree_pids(pid);
     for child in pids.iter().rev() {
-        let _ = send_signal(*child, libc::SIGTERM);
+        let _ = crate::platform::process::terminate_pid(
+            child.get(),
+            crate::platform::process::SignalKind::TerminateGraceful,
+        );
     }
     if !wait_until_all_not_running(&pids, Duration::from_secs(5)) {
         for child in pids.iter().rev() {
-            let _ = send_signal(*child, libc::SIGKILL);
+            let _ = crate::platform::process::terminate_pid(
+                child.get(),
+                crate::platform::process::SignalKind::TerminateForce,
+            );
         }
     }
     wait_until_all_not_running(&pids, Duration::from_secs(5))
@@ -348,16 +401,17 @@ fn wait_until_all_not_running(pids: &[Pid], timeout: Duration) -> bool {
 }
 
 fn reap_child_if_possible(pid: Pid) {
-    let Ok(pid_t) = libc::pid_t::try_from(pid.get()) else {
-        return;
-    };
-    let mut status = 0;
-    unsafe {
-        libc::waitpid(pid_t, &mut status, libc::WNOHANG);
-    }
+    // Batch 3: routed through `platform::process`. Unix `waitpid
+    // (WNOHANG)`; Windows no-op (no zombie model).
+    crate::platform::process::reap_child_if_possible(pid.get());
 }
 
+#[cfg(unix)]
+#[allow(dead_code)]
 fn send_signal(pid: Pid, signal: libc::c_int) -> bool {
+    // Retained (dead code post-Batch-3) as a Unix-only helper for any
+    // future non-standard signal delivery. All product paths now use
+    // `crate::platform::process::terminate_pid` with `SignalKind`.
     let Ok(pid_t) = libc::pid_t::try_from(pid.get()) else {
         return false;
     };
@@ -383,6 +437,21 @@ fn wait_until_not_running(pid: Pid, timeout: Duration) -> bool {
 
 /// `pid_is_running`(`metadata.py:16-25`):`os.kill(pid, 0)` + `ps -o stat=` 查 zombie(Z* → 不算活)。
 /// §10 fallible:进程探测 I/O 可失败 → Result。
+///
+/// 0.5.x Windows portability Batch 4: this function has UNIQUE
+/// coordinator-metadata semantics — it treats `EPERM` as "not
+/// running" (different from `platform::process::pid_liveness` which
+/// treats `EPERM` as Live) because the coordinator only owns
+/// processes it can signal, and uses `ps -o stat=` for zombie
+/// detection. The `ps` shellout is Unix-only.
+///
+/// On Windows the coordinator-metadata identity check runs through
+/// `platform::process::pid_liveness` instead (Windows has no zombie
+/// state — a process is either Live or Dead — so the additional
+/// `ps stat=` step has no analogue). This preserves the coordinator's
+/// "am I the owner" check without silently reporting stale pids as
+/// alive.
+#[cfg(unix)]
 pub fn pid_is_running(pid: Pid) -> Result<bool, std::io::Error> {
     let Ok(pid_t) = libc::pid_t::try_from(pid.get()) else {
         return Ok(false);
@@ -407,6 +476,23 @@ pub fn pid_is_running(pid: Pid) -> Result<bool, std::io::Error> {
     Ok(!stat.is_empty() && !stat.starts_with('Z'))
 }
 
+/// Windows shim: no `ps stat=` zombie detection needed (Windows has
+/// no zombie state — a process is either Live or Dead). Route through
+/// `platform::process::pid_liveness` and map to bool. The EPERM
+/// semantic ("we can't signal → treat as not running") maps to
+/// Windows `ERROR_ACCESS_DENIED` which the platform layer already
+/// treats as `Live`; so on Windows the coordinator sees a process
+/// it can't query as still-running (safer than pretending it's gone
+/// and losing the ownership handle).
+#[cfg(not(unix))]
+pub fn pid_is_running(pid: Pid) -> Result<bool, std::io::Error> {
+    match crate::platform::process::pid_liveness(pid.get())? {
+        crate::platform::process::ProcessLiveness::Live => Ok(true),
+        crate::platform::process::ProcessLiveness::Dead => Ok(false),
+        crate::platform::process::ProcessLiveness::Unknown { .. } => Ok(false),
+    }
+}
+
 /// `read_coordinator_metadata`(`metadata.py:28-34`)。读 `coordinator.json`;损坏/缺失/非 dict → `None`。
 pub fn read_coordinator_metadata(workspace: &WorkspacePath) -> Option<CoordinatorMetadata> {
     let text = std::fs::read_to_string(coordinator_meta_path(workspace)).ok()?;

package/crates/team-agent/src/coordinator/mod.rs

@@ -62,6 +62,14 @@ use crate::provider::{ProviderAdapter, TurnId, TurnState};
 use serde_json::Value;
 
 pub mod backoff;
+// 0.5.x Windows portability Batch 6 Option A: shim lifecycle
+// manager. Windows-only per design §Shim Lifecycle (the shim binary
+// exists only on Windows; Unix uses tmux). Cfg-gated at the module
+// level so callers can `crate::coordinator::conpty_shim::...`
+// uniformly on Windows and get a compile error (rather than a
+// silent no-op) on Unix — Unix code paths never reach for the shim.
+#[cfg(windows)]
+pub mod conpty_shim;
 pub mod health;
 pub mod orphan;
 pub mod runtime_detectors;

package/crates/team-agent/src/coordinator/tests/daemon.rs

@@ -87,7 +87,7 @@ fn start_coordinator_fresh_workspace_decides_started() {
 fn run_daemon_once_writes_boot_metadata_and_returns_ok() {
     let (wp, dir) = daemon_ws();
     crate::state::persist::save_runtime_state(&dir, &serde_json::json!({"session_name": "team-x", "agents": {}})).unwrap();
-    let r = run_daemon(DaemonArgs { workspace: wp.clone(), once: true, tick_interval_sec: None });
+    let r = run_daemon(DaemonArgs { workspace: wp.clone(), once: true, tick_interval_sec: None, team_key: None });
     assert!(r.is_ok(), "run_daemon --once must return Ok; got {r:?}");
     assert!(coordinator_meta_path(&wp).exists(), "run_daemon must write the coordinator boot metadata");
 }
@@ -438,6 +438,7 @@ fn run_daemon_backs_off_on_transient_tick_err_then_recovers_without_exiting() {
         workspace: WorkspacePath::new(dir.clone()),
         once: false,
         tick_interval_sec: Some(0.01), // tiny backoff so the test is fast
+        team_key: None,
     };
     let result = run_daemon_with_coordinator(&args, &coord);
     assert!(

package/crates/team-agent/src/coordinator/tests/tick_core.rs

@@ -192,6 +192,12 @@ fn p2_tick_skips_tmux_gate_when_session_name_absent() {
 
 // P1 — pid_is_running must use os.kill(pid,0) first: a pid owned by another user (pid 1 /
 // launchd, root) is EPERM → not signalable → False. Current only `ps -p` (rc=0) → True.
+//
+// 0.5.x Windows portability Batch 5: this test's PREMISE is Unix
+// specific (pid 1 = init/launchd, EPERM semantics). On Windows,
+// pid_is_running routes through `platform::process::pid_liveness` which
+// has different accessible-pid semantics. Unix-only test.
+#[cfg(unix)]
 #[test]
 fn p2_pid_is_running_false_for_cross_user_pid() {
     // The cross-user semantics only hold for a non-root caller (root CAN signal pid 1).

package/crates/team-agent/src/diagnose/orphans.rs

@@ -10,7 +10,8 @@ use crate::coordinator::health::{
     coordinator_metadata_ok, pid_is_running, read_coordinator_metadata, terminate_pid_tree,
 };
 use crate::coordinator::types::{OrphanReason, Pid, WorkspacePath};
-use crate::tmux_backend::TmuxBackend;
+// Phase 1d Batch 6: `TmuxBackend` import removed — all sites now use
+// `transport_factory::tmux_socket_name_transport` for grep-visibility.
 use crate::transport::{SessionName, Transport};
 
 #[derive(Debug, Clone)]
@@ -341,18 +342,33 @@ fn tmux_socket_names() -> Vec<String> {
 }
 
 fn tmux_socket_roots() -> Vec<PathBuf> {
-    let uid = unsafe { libc::geteuid() };
-    let mut roots = vec![PathBuf::from(format!("/tmp/tmux-{uid}"))];
-    if let Some(tmpdir) = std::env::var_os("TMPDIR") {
-        roots.push(PathBuf::from(tmpdir).join(format!("tmux-{uid}")));
+    // 0.5.x Windows portability Batch 1: tmux orphan scan is Unix-only
+    // (design §Layering Strategy — "ConPTY orphan diagnostics should be
+    // a separate shim registry command later"). On Windows return
+    // empty so the caller loops zero times honestly.
+    #[cfg(unix)]
+    {
+        let uid = unsafe { libc::geteuid() };
+        let mut roots = vec![PathBuf::from(format!("/tmp/tmux-{uid}"))];
+        if let Some(tmpdir) = std::env::var_os("TMPDIR") {
+            roots.push(PathBuf::from(tmpdir).join(format!("tmux-{uid}")));
+        }
+        roots.sort();
+        roots.dedup();
+        roots
+    }
+    #[cfg(not(unix))]
+    {
+        Vec::new()
     }
-    roots.sort();
-    roots.dedup();
-    roots
 }
 
 fn tmux_list_panes(socket: &str) -> Vec<TmuxPaneRow> {
-    TmuxBackend::for_socket_name(socket)
+    // Phase 1d Batch 6: factory tmux-socket-name helper for
+    // grep-visibility. Tmux-only orphan scanner (enumerates tmux socket
+    // roots); ConPTY orphan diagnostics are a separate shim registry
+    // command, not routed here.
+    crate::transport_factory::tmux_socket_name_transport(socket)
         .list_targets()
         .unwrap_or_default()
         .into_iter()
@@ -664,7 +680,10 @@ fn kill_tmux_session(orphan: &OrphanRecord) -> bool {
     let (Some(socket), Some(session)) = (&orphan.tmux_socket, &orphan.session) else {
         return false;
     };
-    TmuxBackend::for_socket_name(socket)
+    // Phase 1d Batch 6: factory tmux-socket-name helper. Explicit
+    // tmux-only kill; conpty shim orphans are NOT routed here (design
+    // §Batch 6).
+    crate::transport_factory::tmux_socket_name_transport(socket)
         .kill_session(&SessionName::new(session.clone()))
         .is_ok()
 }

package/crates/team-agent/src/leader/lease.rs

@@ -134,6 +134,58 @@ pub fn attach_leader(
     })
 }
 
+/// Explicit app-server leader binding. Validates the supplied socket/thread tuple
+/// before writing the typed physical-channel anchor through the lease primitive.
+pub fn attach_app_server_leader(
+    workspace: &Path,
+    team: Option<&str>,
+    socket: &str,
+    thread_id: &str,
+) -> Result<Value, LeaderError> {
+    let binding = crate::codex_app_server::attach_probe(socket, thread_id)
+        .map_err(|error| LeaderError::Validation(error.to_string()))?;
+    let event_log = crate::event_log::EventLog::new(workspace);
+    let scoped_team = team.filter(|value| !value.is_empty());
+    let mut state = if scoped_team.is_some() {
+        crate::state::projection::select_runtime_state(workspace, scoped_team)?
+    } else {
+        crate::state::persist::load_runtime_state(workspace)?
+    };
+    if !state.is_object() {
+        state = json!({});
+    }
+    if let Some(team) = scoped_team {
+        state["active_team_key"] = json!(team);
+    }
+    let team_key = canonical_owner_write_key(&state);
+    let next_epoch = OwnerEpoch(current_owner_epoch(&state).0.saturating_add(1));
+    let receiver = app_server_receiver_value(&binding, next_epoch);
+    let owner = app_server_owner_value(next_epoch);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(receiver.clone())
+        .with_team_owner(owner.clone())
+        .with_owner_epoch(next_epoch.0);
+    crate::state::ownership::write_owner(&mut state, &team_key, record);
+    write_claim_state(workspace, &state, scoped_team, Some(&team_key))?;
+    event_log.write(
+        super::LeaderEvent::ReceiverAttached.name(),
+        json!({
+            "transport_kind": "codex_app_server",
+            "thread_id": binding.thread_id,
+            "owner_epoch": next_epoch.0,
+            "team": team_key,
+        }),
+    )?;
+    Ok(json!({
+        "ok": true,
+        "status": "claimed",
+        "team": team_key,
+        "owner_epoch": next_epoch.0,
+        "leader_receiver": receiver,
+        "team_owner": owner,
+    }))
+}
+
 #[derive(Clone)]
 struct AttachLeaderTarget {
     info: PaneInfo,
@@ -156,8 +208,11 @@ fn attach_leader_targets(workspace: &Path, state: &Value) -> Vec<AttachLeaderTar
                 }),
         );
     }
+    // Phase 1d Batch 6: factory tmux workspace helper for
+    // grep-visibility. Semantics unchanged; leader lease discovery is
+    // tmux-only (caller pane = tmux pane, MUST-12 anchor).
     targets.extend(
-        crate::tmux_backend::TmuxBackend::for_workspace(workspace)
+        crate::transport_factory::tmux_workspace_transport(workspace)
             .list_targets()
             .unwrap_or_default()
             .into_iter()
@@ -167,10 +222,12 @@ fn attach_leader_targets(workspace: &Path, state: &Value) -> Vec<AttachLeaderTar
 }
 
 fn tmux_backend_for_endpoint(endpoint: &str) -> crate::tmux_backend::TmuxBackend {
+    // Phase 1d Batch 6: factory tmux channel helpers for grep-visibility.
+    // Same tmux-only semantics as before.
     if endpoint.is_empty() || endpoint == "default" {
-        crate::tmux_backend::TmuxBackend::new()
+        crate::transport_factory::tmux_default_transport()
     } else {
-        crate::tmux_backend::TmuxBackend::for_tmux_endpoint(endpoint)
+        crate::transport_factory::tmux_endpoint_transport(endpoint)
     }
 }
 
@@ -320,11 +377,13 @@ pub fn claim_leader(
         .unwrap_or_default();
     let raw_state = crate::state::persist::load_runtime_state(workspace)?;
     let event_log = crate::event_log::EventLog::new(workspace);
-    let mut targets = crate::tmux_backend::TmuxBackend::for_workspace(workspace)
+    // Phase 1d Batch 6: factory tmux channel helpers for grep-visibility.
+    // Tmux-only leader-claim path (caller pane enumeration).
+    let mut targets = crate::transport_factory::tmux_workspace_transport(workspace)
         .list_targets()
         .unwrap_or_default();
     targets.extend(
-        crate::tmux_backend::TmuxBackend::new()
+        crate::transport_factory::tmux_default_transport()
             .list_targets()
             .unwrap_or_default(),
     );
@@ -1055,7 +1114,7 @@ fn write_binding_to_state(
     }
     let team_key = canonical_owner_write_key(state);
     let record = crate::state::ownership::OwnershipWrite::new()
-        .with_leader_receiver(serde_json::to_value(receiver)?)
+        .with_leader_receiver(tmux_receiver_value(receiver)?)
         .with_team_owner(serde_json::to_value(owner)?)
         .with_owner_epoch(owner.owner_epoch.0);
     crate::state::ownership::write_owner(state, &team_key, record);
@@ -1074,11 +1133,89 @@ fn write_receiver_to_state(
     }
     let team_key = canonical_owner_write_key(state);
     let record = crate::state::ownership::OwnershipWrite::new()
-        .with_leader_receiver(serde_json::to_value(receiver)?);
+        .with_leader_receiver(tmux_receiver_value(receiver)?);
     crate::state::ownership::write_owner(state, &team_key, record);
     Ok(())
 }
 
+fn tmux_receiver_value(receiver: &LeaderReceiver) -> Result<Value, LeaderError> {
+    Ok(write_leader_receiver_transport(
+        serde_json::to_value(receiver)?,
+        "direct_tmux",
+    ))
+}
+
+fn app_server_receiver_value(
+    binding: &crate::codex_app_server::AppServerBinding,
+    epoch: OwnerEpoch,
+) -> Value {
+    write_leader_receiver_transport(
+        json!({
+            "status": "attached",
+            "provider": "codex",
+            "owner_epoch": epoch.0,
+            "app_server": {
+                "socket": binding.socket,
+                "thread_id": binding.thread_id,
+                "session_id": binding.session_id,
+                "cwd": binding.cwd,
+                "cli_version": binding.cli_version,
+                "bound_at": binding.bound_at,
+                "source": "app-server"
+            }
+        }),
+        "codex_app_server",
+    )
+}
+
+fn app_server_owner_value(epoch: OwnerEpoch) -> Value {
+    json!({
+        "provider": "codex",
+        "transport_kind": "codex_app_server",
+        "owner_epoch": epoch.0,
+        "claimed_at": now_ts(),
+        "claimed_via": "attach-app-server-leader",
+        "os_user": std::env::var("USER")
+            .or_else(|_| std::env::var("USERNAME"))
+            .unwrap_or_default(),
+    })
+}
+
+fn write_leader_receiver_transport(mut receiver: Value, transport_kind: &str) -> Value {
+    if let Some(obj) = receiver.as_object_mut() {
+        obj.insert("mode".to_string(), json!(transport_kind));
+        match transport_kind {
+            "codex_app_server" => {
+                obj.insert("transport_kind".to_string(), json!(transport_kind));
+                for legacy in [
+                    "pane_id",
+                    "tmux_socket",
+                    "session_name",
+                    "window_index",
+                    "window_name",
+                    "pane_index",
+                    "pane_tty",
+                    "pane_current_command",
+                    "fingerprint",
+                    "leader_session_uuid",
+                    "attached_at",
+                    "discovery",
+                    "requested_provider",
+                    "warning",
+                ] {
+                    obj.remove(legacy);
+                }
+            }
+            "direct_tmux" => {
+                obj.remove("app_server");
+                obj.remove("transport_kind");
+            }
+            _ => {}
+        }
+    }
+    receiver
+}
+
 /// Stage 3 owner persist fix (architect direction 2026-06-24): determine
 /// the canonical team_key for an in-memory ownership write. When the state
 /// carries an `active_team_key` (set by `project_top_level_view` whenever

package/crates/team-agent/src/leader/owner_bind.rs

@@ -262,7 +262,9 @@ fn family_a_identity(
 }
 
 fn tmux_pane_current_command(workspace: &Path, pane: &str) -> Result<String, LeaderError> {
-    TmuxBackend::for_workspace(workspace)
+    // Phase 1d Batch 6: factory tmux workspace helper for grep-visibility.
+    // Tmux-only owner-bind (caller pane = tmux pane).
+    crate::transport_factory::tmux_workspace_transport(workspace)
         .query(
             &Target::Pane(PaneId::new(pane)),
             PaneField::PaneCurrentCommand,
@@ -273,7 +275,8 @@ fn tmux_pane_current_command(workspace: &Path, pane: &str) -> Result<String, Lea
 
 fn tmux_pane_info(workspace: &Path, pane: &str) -> Option<PaneInfo> {
     let target = PaneId::new(pane);
-    TmuxBackend::for_workspace(workspace)
+    // Phase 1d Batch 6: same as above.
+    crate::transport_factory::tmux_workspace_transport(workspace)
         .list_targets()
         .ok()?
         .into_iter()

package/crates/team-agent/src/leader/provider_attribution.rs

@@ -98,44 +98,29 @@ fn provider_wire_for_command_attribution(provider: Provider) -> &'static str {
     }
 }
 
-#[cfg(target_os = "linux")]
+// 0.5.x Windows portability Batch 4: process command-line + environ
+// probes route through `crate::platform::argv`. Unix keeps
+// byte-preserving semantics (Linux `/proc/<pid>/cmdline` + `environ`;
+// other Unix `ps -p ... -o command=`; macOS environ is `None` because
+// the pre-batch code also returned `None` on non-Linux). Windows
+// returns `None` per design §Batch 4 conservative anchor (unknown
+// argv must never infer elevated approval).
+//
+// The command-line format expected by the caller is a
+// whitespace-joined single string, so we join the argv tokens after
+// the platform probe. On the non-Linux Unix `ps` fallback path the
+// tokens come already whitespace-split from `ps -o command=`; joining
+// them back with spaces reproduces the exact pre-batch shape.
 fn process_command_line(pid: u32) -> Option<String> {
-    let bytes = std::fs::read(format!("/proc/{pid}/cmdline")).ok()?;
-    let parts = bytes
-        .split(|byte| *byte == 0)
-        .filter(|part| !part.is_empty())
-        .map(|part| String::from_utf8_lossy(part).to_string())
-        .collect::<Vec<_>>();
-    (!parts.is_empty()).then(|| parts.join(" "))
-}
-
-#[cfg(target_os = "linux")]
-fn process_environment(pid: u32) -> Option<String> {
-    String::from_utf8(std::fs::read(format!("/proc/{pid}/environ")).ok()?).ok()
-}
-
-#[cfg(not(target_os = "linux"))]
-fn process_command_line(pid: u32) -> Option<String> {
-    let output = crate::os_probe::bounded_command_output_with_probe(
-        Command::new("ps")
-            .arg("-p")
-            .arg(pid.to_string())
-            .args(["-o", "command="]),
-        "provider_argv",
-        Some(pid),
-    )
-    .ok()?;
-    output
-        .status
-        .success()
-        .then(|| String::from_utf8_lossy(&output.stdout).trim().to_string())
-        .filter(|text| !text.is_empty())
+    let argv = crate::platform::argv::argv_tokens(pid)?;
+    if argv.is_empty() {
+        return None;
+    }
+    Some(argv.join(" "))
 }
 
-#[cfg(not(target_os = "linux"))]
 fn process_environment(pid: u32) -> Option<String> {
-    let _ = pid;
-    None
+    crate::platform::argv::environ_text(pid)
 }
 
 #[cfg(test)]

package/crates/team-agent/src/leader/start.rs

@@ -434,7 +434,12 @@ fn execute_managed_leader_plan(
     let Some(window) = plan.leader_window.as_ref() else {
         return Err(LeaderError::Start("managed leader window missing".to_string()));
     };
-    let transport = TmuxBackend::for_workspace(workspace);
+    // 0.5.x Phase 1d Batch 6: use the factory tmux channel helper
+    // (thin wrapper over `TmuxBackend::for_workspace`) for
+    // grep-visibility of every intentional tmux-only leader-launcher
+    // site. Semantics unchanged; managed leader hosting stays
+    // tmux-only per design §Batch 6.
+    let transport = crate::transport_factory::tmux_workspace_transport(workspace);
     let spawned = ensure_managed_leader_pane(&transport, session, window, plan, workspace)?;
     persist_managed_leader_binding(plan, workspace, &spawned)?;
     spawn_managed_provider_startup_prompt_handler(
@@ -1029,7 +1034,9 @@ fn spawn_managed_provider_startup_prompt_handler(
     pane_id: String,
 ) {
     std::thread::spawn(move || {
-        let transport = TmuxBackend::for_workspace(&workspace);
+        // Phase 1d Batch 6: factory tmux workspace helper for
+        // grep-visibility. Semantics unchanged.
+        let transport = crate::transport_factory::tmux_workspace_transport(&workspace);
         let _ = handle_exec_provider_startup_prompts(
             provider,
             &workspace,
@@ -1042,9 +1049,13 @@ fn spawn_managed_provider_startup_prompt_handler(
 }
 
 fn tmux_transport_for_current_pane() -> TmuxBackend {
+    // Phase 1d Batch 6: factory tmux channel helpers for
+    // grep-visibility. Semantics unchanged; this is intentionally
+    // tmux-only (caller pane = tmux `$TMUX` endpoint or default socket,
+    // MUST-12 anchor).
     crate::tmux_backend::socket_name_from_tmux_env()
-        .map(|endpoint| TmuxBackend::for_tmux_endpoint(&endpoint))
-        .unwrap_or_else(TmuxBackend::new)
+        .map(|endpoint| crate::transport_factory::tmux_endpoint_transport(&endpoint))
+        .unwrap_or_else(crate::transport_factory::tmux_default_transport)
 }
 
 pub fn handle_exec_provider_startup_prompts(
@@ -1113,7 +1124,9 @@ fn provider_command_name(provider: Provider) -> &'static str {
 }
 
 fn tmux_session_exists(workspace: &Path, session: &SessionName) -> Result<bool, LeaderError> {
-    TmuxBackend::for_workspace(workspace)
+    // Phase 1d Batch 6: factory tmux workspace helper for
+    // grep-visibility. Tmux-only anchor (managed leader session lookup).
+    crate::transport_factory::tmux_workspace_transport(workspace)
         .has_session(session)
         .map_err(|e| LeaderError::Start(format!("tmux has-session failed: {e}")))
 }