@team-agent/installer 0.5.104 → 0.5.106

package/crates/team-agent/src/transport/tests/wire.rs

@@ -366,16 +366,45 @@ fn inject_empty_payload_reports_empty_text_send_keys_and_turn_not_required() {
     assert_eq!(report.attempts, 1);
 }
 
+#[cfg(unix)]
+#[test]
+#[ignore = "requires native tmux 3.5+ and python3; owns an isolated socket/session"]
+fn submit_key_protocol_native_tmux_is_return_in_legacy_and_extended_modes() {
+    let fixture = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("tests/fixtures/submit_key_protocol_probe.py");
+    let output = std::process::Command::new("python3")
+        .arg(fixture)
+        .args([
+            "--submit-key",
+            crate::transport::tmux_submit_key_name(Key::Enter),
+        ])
+        .output()
+        .expect("run isolated raw-PTY submit diagnostic");
+    assert!(
+        output.status.success(),
+        "production submit key is not Return: stdout={} stderr={}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr),
+    );
+    assert!(String::from_utf8_lossy(&output.stdout)
+        .contains("ProductionSubmitReturn=verified-three-modes"));
+}
+
 #[test]
 fn empty_inject_is_single_direct_send_keys_never_buffer() {
     // 命令构造 golden(STEP-9):空文本禁走 buffer,只发一条 send-keys 提交键
     // (tmux_io.py:42 —— tmux 拒空 buffer 会卡 trust prompt)。
-    // golden empty_inject_calls 仅 1 条:send-keys -t %7 C-m（锁定阳性 CR）。
+    // Return 与 Ctrl-M 只在 legacy 模式等价；提交必须保持逻辑 Enter。
     assert_eq!(
         tmux_empty_inject_argv(&PaneId::new("%7"), Key::Enter),
-        vec!["tmux", "send-keys", "-t", "%7", "C-m"]
+        vec!["tmux", "send-keys", "-t", "%7", "Enter"]
+    );
+    assert_eq!(
+        crate::transport::tmux_send_submit_argv(&PaneId::new("%7"), Key::Enter),
+        vec!["tmux", "send-keys", "-t", "%7", "Enter"]
     );
-    assert_eq!(crate::transport::tmux_submit_key_name(Key::Enter), "C-m");
+    assert_eq!(crate::transport::tmux_submit_key_name(Key::Enter), "Enter");
+    assert_eq!(crate::transport::tmux_submit_key_name(Key::Down), "Down");
 }
 
 #[test]

package/crates/team-agent/src/transport.rs

@@ -13,7 +13,7 @@
 //!     - name: tmux_inject_text_argv
 //!       what: 文本注入三步 argv(装 buffer→paste→删 buffer)的唯一构造点
 //!     - name: tmux_send_submit_argv
-//!       what: 提交键 argv 的唯一构造点,Enter 锁定为 C-m
+//!       what: 提交键 argv 的唯一构造点,Enter 保持逻辑 Return 而非 Ctrl-M
 //!     - name: tmux_capture_argv
 //!       what: capture-pane argv 的唯一构造点
 //!     - name: tmux_query_argv
@@ -994,6 +994,12 @@ pub trait Transport: Send + Sync {
         Ok(None)
     }
 
+    /// Native dead-pane observation. Only Some(true) proves no live pane
+    /// process; a missing/unsupported sample must remain unknown.
+    fn pane_is_dead(&self, _pane: &PaneId) -> Result<Option<bool>, TransportError> {
+        Ok(None)
+    }
+
     /// Cheap direct pane existence check when a backend can prove it. `Ok(None)`
     /// preserves the existing Unknown boundary.
     fn has_pane(&self, pane: &PaneId) -> Result<Option<bool>, TransportError> {
@@ -1085,6 +1091,17 @@ pub trait Transport: Send + Sync {
 
     // —— LIFECYCLE(SL)——
 
+    /// Before stopping a seat, preserve its session if removing these targets
+    /// would otherwise destroy it. This is not called by team shutdown/restart.
+    /// Backends whose sessions outlive their panes need no special handling.
+    fn preserve_session_before_stop(
+        &self,
+        _session: &SessionName,
+        _targets: &[Target],
+    ) -> Result<(), TransportError> {
+        Ok(())
+    }
+
     fn kill_server(&self) -> Result<(), TransportError> {
         Ok(())
     }
@@ -1199,21 +1216,18 @@ pub fn tmux_send_keys_argv(pane: &PaneId, keys: &[Key]) -> Vec<String> {
 
 /// 投递提交键的 tmux 拼写。
 ///
-/// ledger.p0enter 锁定对：`C-j`/LF 5/5 不成回合，`C-m`/CR 5/5 成回合。
-/// `send-keys Enter` 在 raw PTY 上也是 `0d`，但提交路径只发锁定阳性名
-/// `C-m`，避免落到 LF 族。菜单 `send_keys([Down, Enter])` 不走这里。
+/// `Enter` 必须保持逻辑 Return，不能替换成控制组合 `C-m`。
+/// legacy PTY 中两者都是 CR，但启用 extended keys 后 `C-m` 会成为
+/// CSI-u / modifyOtherKeys Ctrl-M，Pi 不把它当提交；`Enter` 仍发送 CR。
 /// ---
-/// purpose: 投递提交键的 tmux 拼写:Enter 锁定为 C-m(CR),其余键回落通用翻译
+/// purpose: 投递提交键复用通用逻辑键翻译,避免协议相关的控制键别名
 /// params:
-///   key: 提交键;只有 Enter 有专门拼写
-/// returns: 提交用键名;非 Enter 与 tmux_key_name 同值(含空串情形)
+///   key: 逻辑提交键
+/// returns: 与 tmux_key_name 同值(含空串情形)
 /// boundary: 只管拼写,不管何时提交、提交是否成功;不发送、不验证
 /// ---
 pub fn tmux_submit_key_name(key: Key) -> &'static str {
-    match key {
-        Key::Enter => "C-m",
-        other => tmux_key_name(other),
-    }
+    tmux_key_name(key)
 }
 
 /// 投递提交：`send-keys -t <pane> <submit-spelling>`。
@@ -1478,7 +1492,7 @@ pub fn tmux_inject_text_argv(
 
 /// 空文本 inject:纯 `send-keys -t <target> <submit_key>`,**禁** buffer 路径
 /// (tmux 拒空 buffer 会卡 trust prompt;tmux_io.py:42)。
-/// `Key::Enter` 在此译成锁定阳性 `C-m`，不是菜单用的 `Enter`。
+/// `Key::Enter` 保持逻辑 `Enter`，不会在 extended keys 下误发 Ctrl-M。
 /// ---
 /// purpose: 空载荷注入(唤醒/ping)的 argv:只发提交键,不碰 buffer
 /// params:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.104",
+  "version": "0.5.106",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.104",
-    "@team-agent/cli-darwin-x64": "0.5.104",
-    "@team-agent/cli-linux-x64": "0.5.104"
+    "@team-agent/cli-darwin-arm64": "0.5.106",
+    "@team-agent/cli-darwin-x64": "0.5.106",
+    "@team-agent/cli-linux-x64": "0.5.106"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",

package/skills/team-agent/SKILL.md

@@ -7,48 +7,83 @@ requires_team_agent: ">=0.5.0"
 
 The current assistant is the **leader**. Workers use separate role files and report through Team Agent. Start from a tmux-addressable terminal or supported agent pane, in the workspace root (the parent of the team directory).
 
+## Decide before creating a team
+
+**The user decides each worker's provider and permission bypass. Do not silently choose Pi, true, or false.** Reuse an explicit user policy when it covers the worker; otherwise explain the choices and ask before starting.
+
+Use existing resources rather than establishing new accounts: `team-agent doctor --workspace . --json` reports discovered tools, but installed does not mean authenticated and an absent entry or unknown auth is not proof of unavailability. For providers supported by `models`, use `team-agent models --provider NAME` to check exact model IDs. Do not inspect credentials, automatically log in, or silently substitute a provider after a failed probe.
+
+| Choice | What to explain |
+|---|---|
+| Pi | One Agent tool can use several model catalogs; explicit models require a qualified ID such as `openai-codex/gpt-6-luna` |
+| Codex | The user's existing Codex workflow, native tools, permissions and resumable sessions |
+| Claude / Claude Code | The user's existing Claude workflow, models, native tools and session behavior |
+| Bypass `true` | Fewer permission interruptions, but broader automatic execution authority |
+| Bypass `false` | Keep the selected tool's native permissions; human confirmation may interrupt unattended work |
+
+False is **not** a read-only or sandbox guarantee. Native permission capabilities differ between tools. Suggest combinations based on the user's installed tools, subscriptions and task: for example, an explicitly chosen Codex implementer and Claude reviewer, or two Pi workers when those are the available resources. Different workers may use different providers; an existing worker cannot change provider.
+
 ## Create and start
 
-A team can be plain text; no YAML frontmatter is required:
+Keep the goal in `TEAM.md` and each worker's instructions in `agents/*.md`. The filename stem is the worker's in-team short name.
 
 ```text
 .team/current/
-  TEAM.md                 # the team's goal
-  agents/reviewer.md      # the worker's instructions
+  TEAM.md
+  agents/reviewer.md
 ```
 
-Put the goal in `TEAM.md` and the worker's instructions in each `agents/*.md` body. Use the filename stem as the worker id and in-team short name in commands such as `send` and `inbox`.
+For a **new plan**, record the user's two decisions in every role. This example assumes the user selected Pi and bypass false; it is not a default:
+
+```markdown
+---
+provider: pi
+dangerously_skip_permissions: false
+---
+Review the change and report concrete regression risks.
+```
 
 ```sh
 team-agent quick-start .team/current
 team-agent send reviewer "Review this change"
 team-agent inbox reviewer -n 3
-team-agent add-agent analyst --role-file /absolute/path/to/analyst.md
-team-agent shutdown --workspace .
 ```
 
-The `reviewer` argument is an in-team short name; use `<workspace>::<team>/<agent>` when the recipient needs a fully qualified identity. A successful `send` may mean only queued; it is not the worker's reply. Wait for a natural response or result before treating the task as complete.
+Traditional file-based quick-start/compile behavior remains supported, including legacy minimal role documents; no conversion to CLI-created roles is required. Legacy interpretation is not permission to silently choose settings for a new user plan. Model and effort may remain unset; preserve the existing file compiler's native/default interpretation rather than inventing a model or effort.
 
-## Role defaults
+To add a **new** seat to an existing team, provider and bypass must be explicitly defined in the CLI or role file. A complete traditional role file needs no repeated flags. If both sources define a field, equal values are accepted and **conflicting values are rejected before any write or startup**:
 
-All role metadata is optional. With no overrides:
+```sh
+# These values must be the user's choices, not inferred defaults.
+team-agent add-agent analyst --provider pi --bypass true --prompt "Analyze the proposed change"
+# auditor.md already contains the user's provider and bypass decisions.
+team-agent add-agent auditor --role-file /absolute/path/to/auditor.md
+```
 
-| Setting | Default |
-|---|---|
-| Provider | `pi` |
-| Model | unset; let the provider choose |
-| Effort | unset; let the provider choose |
-| Permission bypass | `false`; keep provider-native permissions |
+Add creates and immediately starts the seat. Ordinary add rejects an occupied ID, including stopped seats. Disaster recovery has one explicit exception: `add-agent ID --role-file FILE --force` may reuse the existing force-recreate lifecycle only when the registered old pane is positively confirmed dead and no live target cohort exists. A live seat or unknown/missing death proof is refused; force is not a routine configuration-update shortcut. External role files are imported into the team's `agents/ID.md` and left untouched. A file already at that path is used in place, without copying itself.
+
+## Change and start an existing worker
+
+**Stop first if it is running.** Start never implicitly kills or restarts a running worker:
+
+```sh
+team-agent stop-agent reviewer
+team-agent start-agent reviewer --effort high --bypass true
+team-agent stop-agent reviewer
+team-agent start-agent reviewer --prompt "Review only regression risks; do not change product code"
+```
+
+Start updates the same role file and recompiles it before normal startup. Omitted options preserve the file's values and body; `--prompt` replaces the permanent role body, not a one-time task message. `--bypass true` and `--bypass false` are explicit values, not bare switches. Model, effort and an existing profile can also be set. Direct file edits followed by start use the same reload path.
 
-Add frontmatter only when a role needs an override. Supported fields include `agent_id` (legacy alias: `name`), `role`, `provider`, `model`, `effort`, `auth_mode`, `profile`, `dangerously_skip_permissions`, and `communication_mode`. Old `tools`, `permission_mode`, and `label` role keys do not configure a worker.
+A different `--provider`, including a manually edited role provider, is rejected before launch. A matching provider is allowed. Create a separate ID to use a different engine. If startup fails, the role file and runtime spec are restored to their pre-command contents; the command reports failure, not an applied update.
 
-Profiles keep provider authentication, endpoint, and custom-model settings local. Never put secrets in `TEAM.md` or a role file. See [the operator reference](references/team-agent-operator.md) for profile setup and field details.
+Profiles keep provider authentication, endpoints and custom-model settings local. Imported roles use this team's/workspace's `profiles`, never the original external directory. Prepare a named profile locally through the public profile commands; do not search for or copy external credentials. Never put secrets in `TEAM.md` or a role file. See [the operator reference](references/team-agent-operator.md) for existing profile and field details. Supported metadata also includes `agent_id` (legacy `name`), `role`, `auth_mode`, and `communication_mode`; old `tools`, `permission_mode`, and `label` keys do not configure a worker.
 
-## Inspect
+## Inspect and stop
 
-Use `team-agent status --json` for readiness and `team-agent --help` for current command syntax. `ok: true` with `ready: false` means the command succeeded but the team is not ready; follow the reported action.
+Use `team-agent status --json` for readiness and the installed command's `--help` for syntax. `ok: true` with `ready: false` means the team is not ready; follow the reported action. Accepted/queued send is not the worker's reply: wait for a natural response or result. Use `<workspace>::<team>/<agent>` when a fully qualified recipient is needed.
 
-Worker MCP provides `send_message`, `report_result`, and `get_team_status`. Lifecycle actions remain on the authorized CLI. See [nested teams](references/team-in-team.md) only when the task needs them.
+Worker MCP provides `send_message`, `report_result`, and `get_team_status`. Lifecycle actions remain on the authorized CLI. See [nested teams](references/team-in-team.md) only when needed. Stop the selected team with `team-agent shutdown --workspace .` when authorized.
 
 ---
 This skill is a concise public guide. Do not infer a tested version from package metadata; verify the installed CLI with `team-agent --version` when version-specific behavior matters.

package/skills/team-agent/references/recovery-runbook.md

@@ -54,7 +54,7 @@ Diagnosis:
 
 ```bash
 team-agent status --workspace "$WORKSPACE" --json --detail
-team-agent collect --workspace "$WORKSPACE" --json
+team-agent inbox "$AGENT_ID" --workspace "$WORKSPACE" --team "$TEAM" -n 3 --json
 ```
 
 What to look for:
@@ -167,7 +167,7 @@ Validate:
 
 ```bash
 team-agent status --workspace "$WORKSPACE" --json --detail
-team-agent collect --workspace "$WORKSPACE" --json
+team-agent inbox "$AGENT_ID" --workspace "$WORKSPACE" --team "$TEAM" -n 3 --json
 ```
 
 The expected result is `status="restarted"` or an equivalent running projection without duplicate-session errors. Do not treat a partial failure on one worker as permission to reset the whole team.

package/skills/team-agent/references/team-agent-operator.md

@@ -20,15 +20,16 @@ From a tmux-addressable terminal or supported agent pane, run commands in the wo
 team-agent quick-start my-team
 team-agent send reviewer "Review the current change and report the main risk."
 team-agent inbox reviewer -n 3
+# The role file already records the user's provider and bypass choices.
 team-agent add-agent analyst --role-file /absolute/path/to/analyst.md
 team-agent shutdown --workspace .
 ```
 
 A successful `send` can mean only accepted or queued. Wait for the worker's actual reply/result; acceptance is not completion. Use `team-agent status --json` to inspect readiness. `ok: true` with `ready: false` means the command succeeded but the team is not ready; follow the reported action.
 
-## Defaults and optional role fields
+## User decisions and legacy compatibility
 
-No role frontmatter is required. With no explicit overrides, Team Agent uses:
+For a new team plan, explicitly record each user's provider and bypass decisions; do not silently select either. Existing file-based compilation remains compatible, including minimal documents. The following table describes legacy interpretation, not defaults to choose on the user's behalf:
 
 | Setting | Default behavior |
 |---|---|
@@ -37,21 +38,27 @@ No role frontmatter is required. With no explicit overrides, Team Agent uses:
 | `effort` | Unset by Team Agent; leave effort selection to the provider |
 | `dangerously_skip_permissions` | `false`; preserve native permissions |
 
-Do not write `model: null`, `effort: max`, or a bypass setting just to restate a default. The absence of a model or effort override is not a promise about what the provider's own UI eventually displays. Team Agent does not fill role model from TEAM-level defaults. An unspecified role effort defaults to None (native); for non-Pi roles, a legacy explicit TEAM provider_effort remains supported for compatibility.
+Do not invent `model: null` or `effort: max`. Record the user's bypass decision explicitly in a new role, even when it is false. The absence of a model or effort override is not a promise about what the provider's own UI eventually displays. Team Agent does not fill role model from TEAM-level defaults. An unspecified role effort defaults to None (native); for non-Pi roles, a legacy explicit TEAM provider_effort remains supported for compatibility.
 
 Optional supported role metadata:
 
 - `agent_id` (or legacy `name`) and `role` for identity.
 - `provider`, `model`, and `effort` to explicitly choose supported provider settings.
 - `auth_mode` and `profile` to use a provider profile.
-- `dangerously_skip_permissions: true` only when the user explicitly wants the provider-supported bypass behavior. The default is false.
+- `dangerously_skip_permissions: true` or `false` records the user's explicit permission choice. False preserves native permissions; it is not a read-only or sandbox guarantee.
 - `communication_mode` to select a supported worker communication contract.
 
 Unknown and historical role keys are ignored, not used as a way to restrict tools or permissions. In particular, `tools`, `permission_mode`, and `label` do not configure a worker through role frontmatter.
 
+## Add and start
+
+`add-agent ID --provider NAME --bypass true|false` creates and starts a new seat without a prepared file. A traditional `add-agent ID --role-file FILE` needs no repeated flags when the file already defines provider and boolean bypass. Missing decisions may be supplied by CLI; equal file/CLI values are accepted, but conflicting definitions (including model, effort, prompt and profile) are rejected before writing or startup. Model, effort, prompt and profile remain optional. External role-file inputs are imported into the selected team's `agents/ID.md`; the original stays untouched. A file already there is used in place. Ordinary add rejects occupied IDs. Explicit `--force` is restricted to disaster recovery: the registered old pane must be positively confirmed dead and the target must have no live cohort. Live or unknown targets remain refused; the existing force-recreate transaction is reused, not a general update/implicit-restart path.
+
+`start-agent ID` starts an existing stopped seat; it refuses a running seat, so use `stop-agent ID` first. Optional model, effort, bypass, prompt and profile update that same role document. Omitted fields and body are preserved; prompt replaces the body. A matching provider is allowed; any engine change, including manual file edits, is refused. Startup failure restores role and runtime spec bytes, and reports failure. File edits followed by start use the same compiler reload path.
+
 ## Profiles and custom models
 
-A profile keeps provider credentials, endpoint settings, and optional model settings outside role text. This supports subscription profiles and custom/third-party API models, including Claude Code-compatible providers.
+A profile keeps provider credentials, endpoint settings, and optional model settings outside role text. This supports subscription profiles and custom/third-party API models, including Claude Code-compatible providers. Once an external role is imported, profile lookup uses the current team's/workspace's `profiles`, not the external source directory. Prepare the profile locally through public commands; do not discover or copy external credentials.
 
 Create a local profile, then edit its generated file on the user's machine:
 
@@ -64,6 +71,7 @@ Reference it without copying secrets into Markdown:
 ```yaml
 ---
 provider: claude_code
+dangerously_skip_permissions: false
 auth_mode: compatible_api
 profile: my-api
 ---
@@ -76,4 +84,4 @@ The profile can supply its model when the role has no explicit `model`; an expli
 
 Use `team-agent --help` or a command's `--help` for the installed CLI syntax. Worker MCP exposes `send_message`, `report_result`, and `get_team_status`; workers use `report_result` to return completion. Nested-team guidance is in [team-in-team.md](team-in-team.md).
 
-Keep role instructions in Markdown. Add metadata only for an intentional override; do not copy internal state fields or old frontmatter templates into new roles.
+Keep role instructions in Markdown. Record explicit provider/bypass decisions for new plans, and add other metadata only for intentional settings; do not copy internal state fields into roles.