@team-agent/installer 0.5.1 → 0.5.3

package/crates/team-agent/src/leader/tests/lease_api.rs

@@ -302,3 +302,182 @@ fn r8_requeued_exhausted_watchers_event_payload_golden_shape() {
     assert_eq!(payload.get("count").and_then(|v| v.as_u64()), Some(1), "count == number of requeued watchers");
     assert_eq!(payload.get("trigger").and_then(|v| v.as_str()), Some("attach_leader"));
 }
+
+// 0.5.x Windows portability Batch 5: `FakeAppServer` uses UNIX domain
+// sockets to fake the Codex app-server. Codex app-server client is
+// Unix-only (Windows returns typed `SocketUnreachable`), so these
+// tests are Unix-only too.
+#[cfg(unix)]
+#[test]
+fn app_server_attach_writes_transport_kind_tuple_and_advances_epoch() {
+    let ws = std::env::temp_dir().join(format!(
+        "ta_rs_app_attach_{}_{}",
+        std::process::id(),
+        chrono::Utc::now().timestamp_millis()
+    ));
+    std::fs::create_dir_all(&ws).unwrap();
+    crate::state::persist::save_runtime_state(
+        &ws,
+        &serde_json::json!({
+            "active_team_key": "team-a",
+            "teams": {"team-a": {"team_key": "team-a", "agents": {}}},
+        }),
+    )
+    .unwrap();
+    let fake = crate::app_server_test_support::FakeAppServer::start(
+        "attach-ok",
+        crate::app_server_test_support::FakeAppServerScript::happy(
+            "thread-live",
+            "session-live",
+            ws.to_str().unwrap(),
+        ),
+    );
+
+    let out = attach_app_server_leader(&ws, Some("team-a"), fake.endpoint(), "thread-live")
+        .expect("app-server attach should succeed");
+
+    assert_eq!(out["ok"], serde_json::json!(true));
+    assert_eq!(out["leader_receiver"]["transport_kind"], serde_json::json!("codex_app_server"));
+    assert_eq!(out["leader_receiver"]["mode"], serde_json::json!("codex_app_server"));
+    assert_eq!(
+        out["leader_receiver"]["app_server"]["thread_id"],
+        serde_json::json!("thread-live")
+    );
+    assert_eq!(
+        out["leader_receiver"]["app_server"]["session_id"],
+        serde_json::json!("session-live")
+    );
+    assert_eq!(
+        out["leader_receiver"]["app_server"]["cwd"],
+        serde_json::json!(ws.to_str().unwrap())
+    );
+
+    let saved = crate::state::projection::select_runtime_state(&ws, Some("team-a")).unwrap();
+    assert_eq!(
+        saved["leader_receiver"]["app_server"]["thread_id"],
+        serde_json::json!("thread-live")
+    );
+    assert_eq!(saved["leader_receiver"].get("pane_id"), None);
+    assert_eq!(saved["team_owner"]["transport_kind"], serde_json::json!("codex_app_server"));
+    assert_eq!(saved["owner_epoch"], serde_json::json!(1));
+}
+
+#[cfg(unix)]
+#[test]
+fn app_server_attach_rejects_world_writable_socket_without_state_write() {
+    let ws = std::env::temp_dir().join(format!(
+        "ta_rs_app_attach_badmode_{}_{}",
+        std::process::id(),
+        chrono::Utc::now().timestamp_millis()
+    ));
+    std::fs::create_dir_all(&ws).unwrap();
+    crate::state::persist::save_runtime_state(
+        &ws,
+        &serde_json::json!({"active_team_key": "team-a", "teams": {"team-a": {"agents": {}}}}),
+    )
+    .unwrap();
+    let fake = crate::app_server_test_support::FakeAppServer::start(
+        "attach-world",
+        crate::app_server_test_support::FakeAppServerScript::happy(
+            "thread-live",
+            "session-live",
+            ws.to_str().unwrap(),
+        ),
+    );
+    let mut perms = std::fs::metadata(fake.path()).unwrap().permissions();
+    use std::os::unix::fs::PermissionsExt;
+    perms.set_mode(0o777);
+    std::fs::set_permissions(fake.path(), perms).unwrap();
+
+    let err = attach_app_server_leader(&ws, Some("team-a"), fake.endpoint(), "thread-live")
+        .expect_err("world-writable app-server socket must be rejected");
+    assert!(
+        err.to_string().contains("socket_ownership_invalid"),
+        "unexpected error: {err}"
+    );
+    let saved = crate::state::projection::select_runtime_state(&ws, Some("team-a")).unwrap();
+    assert!(
+        saved.get("leader_receiver").is_none(),
+        "failed attach must not write leader_receiver: {saved}"
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn app_server_attach_rejects_missing_user_agent_without_state_write() {
+    let ws = std::env::temp_dir().join(format!(
+        "ta_rs_app_attach_no_ua_{}_{}",
+        std::process::id(),
+        chrono::Utc::now().timestamp_millis()
+    ));
+    std::fs::create_dir_all(&ws).unwrap();
+    crate::state::persist::save_runtime_state(
+        &ws,
+        &serde_json::json!({"active_team_key": "team-a", "teams": {"team-a": {"agents": {}}}}),
+    )
+    .unwrap();
+    let mut script = crate::app_server_test_support::FakeAppServerScript::happy(
+        "thread-live",
+        "session-live",
+        ws.to_str().unwrap(),
+    );
+    script.user_agent = None;
+    let fake = crate::app_server_test_support::FakeAppServer::start("attach-no-ua", script);
+
+    let err = attach_app_server_leader(&ws, Some("team-a"), fake.endpoint(), "thread-live")
+        .expect_err("missing initialize.userAgent must fail closed");
+    assert!(
+        err.to_string()
+            .contains("protocol_mismatch_missing_user_agent"),
+        "unexpected error: {err}"
+    );
+    let saved = crate::state::projection::select_runtime_state(&ws, Some("team-a")).unwrap();
+    assert!(
+        saved.get("leader_receiver").is_none(),
+        "failed attach must not write leader_receiver: {saved}"
+    );
+}
+
+#[test]
+fn app_server_delivery_paths_are_read_only_and_binding_entry_is_explicit() {
+    let delivery = include_str!("../../messaging/delivery.rs");
+    assert!(
+        !delivery.contains("write_owner(")
+            && !delivery.contains("with_leader_receiver(")
+            && !delivery.contains("with_team_owner("),
+        "MUST-12/I-RN-1: delivery may read typed leader_receiver fields but must not write ownership"
+    );
+    let lease = include_str!("../lease.rs");
+    assert!(
+        lease.contains("fn write_leader_receiver_transport("),
+        "C-5: mode and transport_kind must be stamped by a single receiver transport helper"
+    );
+    let cli = include_str!("../../cli/attach_app_server_leader.rs");
+    assert!(
+        cli.contains("attach_app_server_leader("),
+        "I-RN-2: app-server ownership mutation must be reachable through the explicit CLI entry"
+    );
+}
+
+#[test]
+fn messaging_leader_receiver_module_exports_no_ownership_writer() {
+    let leader_receiver = include_str!("../../messaging/leader_receiver.rs");
+    for forbidden in [
+        "pub fn claim_leader_receiver",
+        "write_owner(",
+        "with_leader_receiver(",
+        "with_team_owner(",
+        "save_runtime_state",
+    ] {
+        assert!(
+            !leader_receiver.contains(forbidden),
+            "MUST-12/I-RN-1: messaging/leader_receiver.rs may read receiver fields but must not expose ownership writes; forbidden={forbidden}"
+        );
+    }
+
+    let messaging_mod = include_str!("../../messaging/mod.rs");
+    assert!(
+        !messaging_mod.contains("claim_leader_receiver"),
+        "MUST-12/I-RN-2: messaging/mod.rs must not re-export ownership writer APIs"
+    );
+}

package/crates/team-agent/src/lib.rs

@@ -78,6 +78,13 @@ pub mod diagnose;
 // 富返回类型,fn body unimplemented!(),P2 porter 落实现)。lifecycle=quick-start/restart/display;
 // mcp_server=stdio MCP tool handlers;cli=clap 子命令;packaging=install/migrate/repair。
 pub mod lifecycle;
+
+// 0.5.x Windows portability Batch 0: platform abstraction layer.
+// Truth sources:
+// - Design:    `.team/artifacts/0.5.x-windows-portability-survey-design.md`
+// - CR verdict: `.team/artifacts/0.5.x-windows-portability-cr-verdict.md`
+//              (6 constraints anchored inside the module doc)
+pub mod platform;
 // 0.3.28 — unified adaptive layout manager (single source of truth for tmux
 // topology decisions). See `.team/artifacts/adaptive-layout-full-architecture-locate.md`.
 pub mod layout;
@@ -92,4 +99,33 @@ pub mod fake_worker;
 // tmux_backend — concrete tmux Transport executor (Command::new tmux via a CommandRunner seam);
 // the real spawn/capture/inject/has_session backend the daemon + launch use (step 9 shipped only
 // the trait + argv-builders). Real subprocess execution is the #[ignore] real-machine boundary.
+pub mod codex_app_server;
 pub mod tmux_backend;
+
+// 0.5.x Windows-native transport Phase 1: ConPTY backend + named-pipe
+// protocol. `protocol` is portable (pure logic, tested on all hosts);
+// `backend` compiles on all hosts and returns typed MuxUnavailable when
+// no pipe client is wired (honest degradation, not silent success).
+//
+// Truth source:
+// - Design: `.team/artifacts/0.5.x-windows-native-transport-design.md`
+//   §Transport Boundary + §Named Pipe Control Protocol + §Phase 1
+// - CR verdict: `.team/artifacts/0.5.x-windows-transport-cr-verdict.md`
+//   (7 constraints; C-1/C-2/C-3/C-5 anchor into this module)
+pub mod conpty;
+
+// 0.5.x Phase 1d Batch 0: backend assembly factory.
+// Truth sources:
+// - Design:    `.team/artifacts/0.5.x-backend-assembly-factory-design.md`
+// - CR verdict: `.team/artifacts/0.5.x-backend-factory-cr-verdict.md`
+//              (6 constraints anchored inside the module doc)
+pub mod transport_factory;
+
+// 0.5.x Windows portability Batch 5: `app_server_test_support` is a
+// Unix-domain-socket fake for the Codex app-server client. It is
+// Unix-only because the code-under-test (`codex_app_server`) is
+// Unix-only via cfg (Windows gets typed `SocketUnreachable`
+// unsupported returns). Cfg-gating the module keeps `cargo check
+// --tests --target x86_64-pc-windows-msvc` compilable.
+#[cfg(all(test, unix))]
+pub(crate) mod app_server_test_support;

package/crates/team-agent/src/lifecycle/launch.rs

@@ -2835,16 +2835,161 @@ pub fn quick_start_in_workspace_with_display(
     yes: bool,
     team_id: Option<&str>,
     open_display: bool,
+) -> Result<QuickStartReport, LifecycleError> {
+    // Legacy entrypoint: no `--backend` override. Preserves the exact
+    // tmux behavior we shipped in Phase 1c (byte-equivalent tmux path
+    // when no explicit backend is asked for).
+    quick_start_in_workspace_with_display_and_backend(
+        workspace,
+        agents_dir,
+        name,
+        yes,
+        team_id,
+        open_display,
+        None,
+    )
+}
+
+/// 0.5.x Phase 1d Batch 2: quick-start with an optional
+/// `--backend <tmux|conpty>` override. When `backend` is `None` or
+/// `Some("tmux")` the transport is the same one the legacy entrypoint
+/// built (byte-equivalent to Phase 1c), so tmux users see no
+/// behavioral change.
+///
+/// When `backend` is `Some("conpty")`, this call routes through the
+/// factory. On a host without a live shim client (i.e. every
+/// non-Windows host today), the resulting `ConPtyBackend` degrades
+/// its spawn/inject/capture calls to `TransportError::MuxUnavailable`
+/// honestly — MUST-NOT-13 + CR C-1 ①. Users see a real "conpty
+/// unavailable" error rather than a silent tmux fallback.
+pub fn quick_start_in_workspace_with_display_and_backend(
+    workspace: &Path,
+    agents_dir: &Path,
+    name: Option<&str>,
+    yes: bool,
+    team_id: Option<&str>,
+    open_display: bool,
+    backend: Option<&str>,
 ) -> Result<QuickStartReport, LifecycleError> {
     let workspace = explicit_quick_start_workspace(workspace);
-    let transport = quick_start_tmux_backend(&workspace);
+    // Default / `tmux` literal: preserve the existing tmux path
+    // BYTE-FOR-BYTE. This is the CR §Batch 2 Verification anchor:
+    // `quick-start` without `--backend` produces byte-equivalent tmux
+    // behavior.
+    let literal = backend.map(str::trim);
+    let is_tmux_or_default = matches!(literal, None | Some("") | Some("tmux") | Some("TMUX"));
+    if is_tmux_or_default {
+        let transport = quick_start_tmux_backend(&workspace);
+        return quick_start_with_transport_in_workspace_with_display(
+            &workspace,
+            agents_dir,
+            name,
+            yes,
+            team_id,
+            &transport,
+            open_display,
+        );
+    }
+    // Explicit non-tmux backend: route through the factory. Parse the
+    // literal, then delegate. On unsupported literals or refused
+    // preconditions we return `LifecycleError` — never silently pick
+    // tmux (CR C-1 ①/②).
+    let requested = crate::transport_factory::RequestedTransportBackend::parse_literal(
+        literal.unwrap_or_default(),
+    )
+    .ok_or_else(|| {
+        LifecycleError::TeamSelect(format!(
+            "unsupported --backend literal {literal:?}; expected `tmux` or `conpty` \
+             (Phase 1d does not auto-map `pty` to conpty — CR C-1 ②)"
+        ))
+    })?;
+    let team_key_for_factory = team_id;
+    // 0.5.x Windows portability Batch 8 F7 (leader msg_590b4dce0f68):
+    // shim ownership moves to the coordinator. quick-start no longer
+    // calls `spawn_shim_and_handshake` directly. Instead we ensure
+    // the coordinator daemon is running; the coordinator's boot
+    // path calls `conpty_shim::ensure_shim_running` (idempotent —
+    // spawns if no live shim, reconnects if one is recorded).
+    //
+    // Rationale (from Batch 7 gate report F7): quick-start is a
+    // one-shot process; if it owns the shim, the shim dies when
+    // quick-start exits. Moving ownership to the coord daemon
+    // gives us the "coord can die, shim survives" invariant the
+    // design's §Shim Lifecycle chapter requires.
+    //
+    // The `ensure_coordinator_running` call is idempotent per
+    // `coordinator/health.rs::start_coordinator`. On non-Windows
+    // this whole block is cfg'd out.
+    #[cfg(windows)]
+    if matches!(
+        requested,
+        crate::transport_factory::RequestedTransportBackend::ConPty
+    ) {
+        let team_key_str = team_key_for_factory.ok_or_else(|| {
+            LifecycleError::TeamSelect(
+                "team_key required for --backend conpty on Windows (Batch 9 F8)".to_string(),
+            )
+        })?;
+        // 0.5.x Windows portability Batch 9 F8 (leader msg_2a4cc1fa54c0):
+        // Batch 8's seed-state pattern (writing active_team_key +
+        // transport.kind to state.json before start_coordinator)
+        // caused downstream launch code to see "existing runtime, use
+        // restart" and skip spec compile. F8 fix: pass `--team`
+        // directly to the coord daemon via `start_coordinator_with_team`
+        // so state doesn't need pre-seeding.
+        //
+        // The coord daemon's `run_daemon_with_coordinator_and_boot_tmux`
+        // then calls `ensure_shim_running` with the CLI-supplied
+        // team_key. When quick-start's downstream code runs, state.json
+        // still has whatever it had before (empty on fresh launch), so
+        // the spec-compile + worker-spawn path runs normally.
+        let run_ws = crate::coordinator::WorkspacePath::new(workspace.clone());
+        let start_report =
+            crate::coordinator::health::start_coordinator_with_team(&run_ws, Some(team_key_str))
+                .map_err(|e| LifecycleError::TeamSelect(format!("coordinator start: {e}")))?;
+        if !start_report.ok {
+            return Err(LifecycleError::TeamSelect(format!(
+                "coordinator start failed: schema_error={:?}, action={:?}",
+                start_report.schema_error, start_report.action
+            )));
+        }
+        // Give the coordinator a beat to write its transport.shim
+        // block so the factory's `pipe_ready` gate opens on the
+        // next resolve. The coordinator's `run_daemon` calls
+        // `ensure_shim_running` inside its boot code path (see
+        // `coordinator::backoff::run_daemon`).
+        std::thread::sleep(std::time::Duration::from_millis(2500));
+    }
+    let input = crate::transport_factory::TransportFactoryInput::new(
+        &workspace,
+        crate::transport_factory::TransportPurpose::Launch,
+    )
+    .with_team_key(team_key_for_factory)
+    .with_explicit_backend(Some(requested));
+    // On Windows the factory needs to SEE the freshly-persisted
+    // `state.transport.shim.pipe_ready = true` marker so its
+    // `conpty_pipe_ready` gate opens.
+    #[cfg(windows)]
+    let state_value = std::fs::read_to_string(crate::state::persist::runtime_state_path(
+        &workspace,
+    ))
+    .ok()
+    .and_then(|t| serde_json::from_str::<serde_json::Value>(&t).ok());
+    #[cfg(windows)]
+    let input = match state_value.as_ref() {
+        Some(v) => input.with_state(Some(v)),
+        None => input,
+    };
+    let resolved = crate::transport_factory::resolve_transport(input)
+        .map_err(|e| LifecycleError::TeamSelect(e.to_string()))?;
+    // Hand the boxed backend down as `&dyn Transport`.
     quick_start_with_transport_in_workspace_with_display(
         &workspace,
         agents_dir,
         name,
         yes,
         team_id,
-        &transport,
+        &*resolved.backend,
         open_display,
     )
 }
@@ -3068,7 +3213,16 @@ pub fn quick_start_with_transport_in_workspace_with_display(
     let resolved_spec_path =
         std::fs::canonicalize(&spec_path).unwrap_or_else(|_| spec_path.clone());
     let mut state = initial_runtime_state(&spec, &resolved_spec_path, &workspace, agents_dir);
-    annotate_runtime_tmux_endpoint(&mut state, transport, &workspace);
+    // 0.5.x Phase 1d hot-path 接线(裁决1 msg_76e1d98202b8): use the
+    // generic annotator that writes `state.transport = { kind, source }`
+    // for every backend AND (for tmux) preserves the existing
+    // `tmux_endpoint`/`tmux_socket`/`tmux_socket_source` fields via the
+    // inner `annotate_runtime_tmux_endpoint` call. Source is threaded
+    // from the caller-side factory selection when available; the
+    // legacy quick-start entrypoint currently passes `None` (defaults
+    // to "unknown" in the payload) — Phase 2 refactor will thread
+    // ResolvedTransport.source through the launch signature.
+    annotate_runtime_transport(&mut state, transport, &workspace, None);
     save_launched_team_state_for_key(&workspace, &state, Some(&state_team_key))?;
     annotate_persisted_team_depth(
         &workspace,
@@ -3164,6 +3318,46 @@ pub fn quick_start_with_transport_in_workspace_with_display(
 /// the persisted endpoint synchronized with the transport they actually used,
 /// closing the silent socket-drift gap** (single state-save path; no parallel
 /// "annotate after spawn" race with coordinator).
+/// 0.5.x Phase 1d Batch 2: generic runtime-transport annotator.
+///
+/// Writes `state.transport = { kind, source }` for every backend
+/// (kind = wire string `"tmux"` | `"conpty"`; source = wire string
+/// from `ResolvedTransport.source` when known, else `"unknown"`).
+///
+/// For tmux, ALSO forwards to `annotate_runtime_tmux_endpoint` so the
+/// existing `tmux_endpoint` / `tmux_socket` / `tmux_socket_source`
+/// fields remain populated byte-equivalent to today's shape.
+///
+/// The tmux-specific fields are NOT written for ConPTY (CR C-4: no
+/// tmux-only fields under a conpty state; keeps compact status
+/// stable). ConPTY discovery fields (`pipe_name`, `shim_pid`) are
+/// added in Batch 3 when the shim boot path lands; this function just
+/// pins the top-level `transport.kind`/`source`.
+pub fn annotate_runtime_transport(
+    state: &mut serde_json::Value,
+    transport: &dyn Transport,
+    workspace: &Path,
+    source: Option<&str>,
+) {
+    use crate::transport::BackendKind;
+    let kind_wire = match transport.kind() {
+        BackendKind::Tmux => "tmux",
+        BackendKind::WezTerm => "wezterm",
+        BackendKind::ConPty => "conpty",
+    };
+    if let Some(obj) = state.as_object_mut() {
+        let transport_block = serde_json::json!({
+            "kind": kind_wire,
+            "source": source.unwrap_or("unknown"),
+        });
+        obj.insert("transport".to_string(), transport_block);
+    }
+    // Tmux: preserve the existing tmux endpoint annotation shape.
+    if matches!(transport.kind(), BackendKind::Tmux) {
+        annotate_runtime_tmux_endpoint(state, transport, workspace);
+    }
+}
+
 pub(crate) fn annotate_runtime_tmux_endpoint(
     state: &mut serde_json::Value,
     transport: &dyn Transport,
@@ -3520,102 +3714,21 @@ fn process_ancestry_argv(pid: u32) -> Vec<Vec<String>> {
     out
 }
 
-#[cfg(target_os = "linux")]
-fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
-    let bytes = std::fs::read(format!("/proc/{pid}/cmdline")).ok()?;
-    let argv_tokens = String::from_utf8_lossy(&bytes)
-        .split('\0')
-        .filter(|token| !token.is_empty())
-        .map(str::to_string)
-        .collect::<Vec<_>>();
-    (!argv_tokens.is_empty()).then_some(argv_tokens)
-}
+// 0.5.x Windows portability Batch 4: `process_argv_tokens` and
+// `process_parent_pid` route through `crate::platform::argv`. Unix
+// impls are byte-preserving (Linux `/proc/<pid>/cmdline`, macOS
+// `sysctl(KERN_PROCARGS2)`, other Unix `ps -p ... -o command=`).
+// Windows returns `None` per design §Batch 4 conservative anchor:
+// unknown argv must never infer elevated approval; callers already
+// treat `None` as "no elevation inherited" via
+// `disabled_dangerous_approval()`.
 
-#[cfg(target_os = "macos")]
 fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
-    use std::mem::size_of;
-
-    let mut mib = [
-        libc::CTL_KERN,
-        libc::KERN_PROCARGS2,
-        i32::try_from(pid).ok()?,
-    ];
-    let mut size = 0usize;
-    let rc = unsafe {
-        libc::sysctl(
-            mib.as_mut_ptr(),
-            mib.len() as u32,
-            std::ptr::null_mut(),
-            &mut size,
-            std::ptr::null_mut(),
-            0,
-        )
-    };
-    if rc != 0 || size <= size_of::<libc::c_int>() {
-        return None;
-    }
-    let mut buf = vec![0u8; size];
-    let rc = unsafe {
-        libc::sysctl(
-            mib.as_mut_ptr(),
-            mib.len() as u32,
-            buf.as_mut_ptr().cast(),
-            &mut size,
-            std::ptr::null_mut(),
-            0,
-        )
-    };
-    if rc != 0 || size <= size_of::<libc::c_int>() {
-        return None;
-    }
-    let argc = i32::from_ne_bytes(buf.get(..size_of::<libc::c_int>())?.try_into().ok()?) as usize;
-    let mut offset = size_of::<libc::c_int>();
-    while offset < size && buf[offset] != 0 {
-        offset += 1;
-    }
-    while offset < size && buf[offset] == 0 {
-        offset += 1;
-    }
-    let raw = String::from_utf8_lossy(&buf[offset..size]);
-    let argv_tokens = raw
-        .split('\0')
-        .filter(|token| !token.is_empty())
-        .take(argc)
-        .map(str::to_string)
-        .collect::<Vec<_>>();
-    (!argv_tokens.is_empty()).then_some(argv_tokens)
-}
-
-#[cfg(not(any(target_os = "linux", target_os = "macos")))]
-fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
-    let output = Command::new("ps")
-        .args(["-p", &pid.to_string(), "-o", "command="])
-        .output()
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    let text = String::from_utf8_lossy(&output.stdout);
-    let argv_tokens = text
-        .split_whitespace()
-        .filter(|token| !token.is_empty())
-        .map(str::to_string)
-        .collect::<Vec<_>>();
-    (!argv_tokens.is_empty()).then_some(argv_tokens)
+    crate::platform::argv::argv_tokens(pid)
 }
 
 fn process_parent_pid(pid: u32) -> Option<u32> {
-    let output = Command::new("ps")
-        .args(["-p", &pid.to_string(), "-o", "ppid="])
-        .output()
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    String::from_utf8_lossy(&output.stdout)
-        .trim()
-        .parse::<u32>()
-        .ok()
+    crate::platform::argv::parent_pid(pid)
 }
 
 /// `add_agent(workspace, agent_id, role_file_path, open_display, team)`

package/crates/team-agent/src/lifecycle/lock.rs

@@ -85,6 +85,16 @@ fn acquire_agent_lifecycle_lock_with_deadlines(
     timeout: Duration,
     held_long: Duration,
 ) -> Result<LifecycleLockGuard, LifecycleError> {
+    // 0.5.x Windows portability Batch 2: migrated to
+    // `crate::platform::file_lock::{try_lock_once_nonblocking, unlock}`
+    // so the same polling loop + waiter file + 5s `lock_held_long`
+    // event + 30s N38 timeout error shape works on both Unix (`flock`)
+    // and Windows (`LockFileEx`). The Batch 0 non-Unix stub that
+    // returned `lock_timeout_error` unconditionally is now gone —
+    // Windows callers get real lock behavior. Byte-preserving on Unix:
+    // the polling cadence, waiter file writes, `lock_held_long_event`
+    // emission, and error shape are all unchanged relative to the
+    // pre-Batch-2 unix branch.
     let lock_path = agent_lifecycle_lock_path(request.workspace);
     if let Some(parent) = lock_path.parent() {
         std::fs::create_dir_all(parent)
@@ -100,42 +110,38 @@ fn acquire_agent_lifecycle_lock_with_deadlines(
     let started = Instant::now();
     let mut long_event_written = false;
     let mut waiter = None;
-    #[cfg(unix)]
-    {
-        use std::os::unix::io::AsRawFd;
-        let fd = file.as_raw_fd();
-        loop {
-            let rc = unsafe { libc::flock(fd, libc::LOCK_EX | libc::LOCK_NB) };
-            if rc == 0 {
+    loop {
+        match crate::platform::file_lock::try_lock_once_nonblocking(&file) {
+            Ok(true) => {
                 write_lock_metadata(&mut file, &request, &lock_path)?;
                 return Ok(LifecycleLockGuard { file });
             }
-            let elapsed = started.elapsed();
-            if waiter.is_none() {
-                waiter = WaiterFile::create(&request, &lock_path).ok();
+            Ok(false) => {}
+            Err(e) => {
+                return Err(LifecycleError::StatePersist(format!(
+                    "lifecycle lock acquire io error at {}: {e}",
+                    lock_path.display()
+                )));
             }
-            if let Some(waiter) = waiter.as_ref() {
-                let _ = waiter.write(&request, elapsed);
-            }
-            if !long_event_written && elapsed >= held_long {
-                let _ =
-                    write_lock_held_long_event(&request, &lock_path, elapsed, held_long, timeout);
-                long_event_written = true;
-            }
-            if elapsed >= timeout {
-                return Err(lock_timeout_error(&request, &lock_path, elapsed));
-            }
-            std::thread::sleep(std::cmp::min(
-                Duration::from_millis(50),
-                timeout.saturating_sub(elapsed),
-            ));
         }
-    }
-    #[cfg(not(unix))]
-    {
-        let _ = file;
         let elapsed = started.elapsed();
-        Err(lock_timeout_error(&request, &lock_path, elapsed))
+        if waiter.is_none() {
+            waiter = WaiterFile::create(&request, &lock_path).ok();
+        }
+        if let Some(waiter) = waiter.as_ref() {
+            let _ = waiter.write(&request, elapsed);
+        }
+        if !long_event_written && elapsed >= held_long {
+            let _ = write_lock_held_long_event(&request, &lock_path, elapsed, held_long, timeout);
+            long_event_written = true;
+        }
+        if elapsed >= timeout {
+            return Err(lock_timeout_error(&request, &lock_path, elapsed));
+        }
+        std::thread::sleep(std::cmp::min(
+            Duration::from_millis(50),
+            timeout.saturating_sub(elapsed),
+        ));
     }
 }
 
@@ -293,10 +299,11 @@ impl Drop for WaiterFile {
     }
 }
 
-#[cfg(unix)]
 impl Drop for LifecycleLockGuard {
     fn drop(&mut self) {
-        use std::os::unix::io::AsRawFd;
-        unsafe { libc::flock(self.file.as_raw_fd(), libc::LOCK_UN) };
+        // Batch 2: unlock via platform primitive. Best-effort — OS
+        // releases when the file handle closes anyway. Uniform on
+        // both `flock(LOCK_UN)` (unix) and `UnlockFileEx` (windows).
+        let _ = crate::platform::file_lock::unlock(&self.file);
     }
 }