@team-agent/installer 0.5.113 → 0.5.115

package/crates/team-agent/Cargo.toml

@@ -28,6 +28,9 @@ chrono.workspace = true
 libc.workspace = true
 rusqlite.workspace = true       # step 3 db(bundled SQLite,静态链接)
 
+[target.'cfg(unix)'.dependencies]
+team-agent-contract = { path = "../team-agent-contract" }
+
 # 0.5.x Windows portability Batch 2/3: uses the same `windows = "0.61"`
 # crate as `win-conpty-phase0` so the workspace shares a single
 # Windows-API crate + already-locked Cargo.lock version.

package/crates/team-agent/src/cli/adapters.rs

@@ -7,6 +7,9 @@ use super::*;
 
 /// `cmd_quick_start`(`commands.py:18`)。`--json` 或 `!ok` → 整 dict;否则 `result["summary"]`。
 pub fn cmd_quick_start(args: &QuickStartArgs) -> Result<CmdResult, CliError> {
+    #[cfg(unix)]
+    crate::contract_runtime::config::read_team(args)
+        .map_err(|error| CliError::Runtime(error.to_string()))?;
     let mut value = lifecycle_port::quick_start(
         &args.workspace,
         &args.agents_dir,
@@ -158,7 +161,10 @@ fn quick_start_config_guidance(value: &mut Value, args: &QuickStartArgs) -> Opti
 /// E13:quick-start "team 起了" 人类输出 = summary + attach 块。所有成功出口共用(别每分支手拷)。
 /// attach_commands 缺/空 → 只 summary(向后兼容)。
 fn quickstart_human(value: &Value) -> String {
-    let summary = value.get("summary").and_then(Value::as_str).unwrap_or("Team started.");
+    let summary = value
+        .get("summary")
+        .and_then(Value::as_str)
+        .unwrap_or("Team started.");
     let attach: Vec<&str> = value
         .get("attach_commands")
         .and_then(Value::as_array)
@@ -1088,19 +1094,13 @@ mod tests {
         let value = json!({"summary": "quick-start complete"});
         assert_eq!(
             quickstart_human(&value),
-            format!(
-                "quick-start complete\n{}",
-                crate::cli::QUICK_START_REMINDER
-            )
+            format!("quick-start complete\n{}", crate::cli::QUICK_START_REMINDER)
         );
         // 空数组也只显示人类摘要与下一步，不凭空编造连接方式。
         let value2 = json!({"summary": "s", "attach_commands": []});
         assert_eq!(
             quickstart_human(&value2),
-            format!(
-                "s\n{}",
-                crate::cli::QUICK_START_REMINDER
-            )
+            format!("s\n{}", crate::cli::QUICK_START_REMINDER)
         );
     }
 
@@ -1219,7 +1219,11 @@ mod tests {
 
     #[test]
     fn quick_start_human_preserves_typed_refusals_without_error_field() {
-        for status in ["existing_runtime", "preflight_blocked", "leader_binding_refused"] {
+        for status in [
+            "existing_runtime",
+            "preflight_blocked",
+            "leader_binding_refused",
+        ] {
             let value = json!({
                 "ok": false,
                 "status": status,
@@ -1232,10 +1236,16 @@ mod tests {
             });
             let result = finish_quick_start(value.clone(), &quick_start_args(false)).unwrap();
             assert_eq!(result.exit, ExitCode::Error);
-            let CmdOutput::Human(text) = result.output else { panic!("expected human report") };
-            let rendered: Value = serde_json::from_str(text.strip_prefix("quick-start report:\n").unwrap()).unwrap();
+            let CmdOutput::Human(text) = result.output else {
+                panic!("expected human report")
+            };
+            let rendered: Value =
+                serde_json::from_str(text.strip_prefix("quick-start report:\n").unwrap()).unwrap();
             assert_eq!(rendered, value, "human projection lost fields for {status}");
-            assert!(!text.contains("team-agent doctor"), "must not replace actual actions");
+            assert!(
+                !text.contains("team-agent doctor"),
+                "must not replace actual actions"
+            );
             let json_result = finish_quick_start(value.clone(), &quick_start_args(true)).unwrap();
             assert_eq!(json_result.exit, ExitCode::Error);
             assert_eq!(json_result.output, CmdOutput::Json(value));
@@ -1252,8 +1262,11 @@ mod tests {
         });
         let result = finish_quick_start(value.clone(), &quick_start_args(false)).unwrap();
         assert_eq!(result.exit, ExitCode::Error);
-        let CmdOutput::Human(text) = result.output else { panic!("expected human report") };
-        let rendered: Value = serde_json::from_str(text.strip_prefix("quick-start report:\n").unwrap()).unwrap();
+        let CmdOutput::Human(text) = result.output else {
+            panic!("expected human report")
+        };
+        let rendered: Value =
+            serde_json::from_str(text.strip_prefix("quick-start report:\n").unwrap()).unwrap();
         assert_eq!(rendered, value);
     }
 

package/crates/team-agent/src/cli/diagnose.rs

@@ -342,7 +342,13 @@ pub(crate) fn diagnose_runtime_for_workspace(
         &mut repairs,
     );
     append_legacy_snapshot_issue(workspace, state, &mut issues);
-    append_coordinator_health_issue(workspace, state, coordinator_health, &mut issues, &mut repairs);
+    append_coordinator_health_issue(
+        workspace,
+        state,
+        coordinator_health,
+        &mut issues,
+        &mut repairs,
+    );
     append_runtime_bindings_stale_after_boot_issue(workspace, state, &mut issues, &mut repairs);
     (issues, repairs)
 }
@@ -373,7 +379,9 @@ pub(crate) fn workspace_has_existing_team_runtime(
         let terminal = team_state
             .get("status")
             .and_then(Value::as_str)
-            .is_some_and(|status| matches!(status, "stopped" | "shutdown" | "archived" | "terminal"));
+            .is_some_and(|status| {
+                matches!(status, "stopped" | "shutdown" | "archived" | "terminal")
+            });
         if terminal {
             return false;
         }
@@ -695,14 +703,13 @@ pub(crate) fn append_registry_channel_unbound_to_report(
     repairs.push(recovery_hint(&team_key, issue_id, repair));
     object.insert("issues".to_string(), Value::Array(issues));
     object.insert("suggested_repairs".to_string(), Value::Array(repairs));
-    let is_healthy_unattached_host =
-        class == crate::lifecycle::launch::LeaderBindingClass::Unbound
-            && object.get("ok").and_then(Value::as_bool) == Some(true)
-            && object
-                .get("profile_smoke")
-                .and_then(|profile| profile.get("checks"))
-                .and_then(Value::as_array)
-                .is_some_and(|checks| !checks.is_empty());
+    let is_healthy_unattached_host = class == crate::lifecycle::launch::LeaderBindingClass::Unbound
+        && object.get("ok").and_then(Value::as_bool) == Some(true)
+        && object
+            .get("profile_smoke")
+            .and_then(|profile| profile.get("checks"))
+            .and_then(Value::as_array)
+            .is_some_and(|checks| !checks.is_empty());
     if !is_healthy_unattached_host {
         object.insert("ok".to_string(), Value::Bool(false));
     }
@@ -1054,8 +1061,7 @@ mod tests {
                 pane_pid: None,
                 leader_env: Default::default(),
             }]);
-        let Some((_, repair)) =
-            live_leader_workspace_mismatch(&workspace, &state, &transport)
+        let Some((_, repair)) = live_leader_workspace_mismatch(&workspace, &state, &transport)
         else {
             panic!("workspace mismatch repair required");
         };
@@ -1109,7 +1115,8 @@ mod tests {
                 .as_nanos()
         ));
         std::fs::create_dir_all(&workspace).unwrap();
-        let state = json!({"agents": {}, "tasks": [], "session_name": null, "active_team_key": null});
+        let state =
+            json!({"agents": {}, "tasks": [], "session_name": null, "active_team_key": null});
         let mut issues = json!([]);
         let mut repairs = json!([]);
         append_registry_channel_unbound_issue(
@@ -1574,6 +1581,22 @@ pub(crate) fn provider_doctor_checks() -> Value {
             }),
         );
     }
+    #[cfg(unix)]
+    for descriptor in crate::contract_runtime::registry::descriptors() {
+        let identity = &descriptor.identity;
+        // Inventory only: finding the launcher is not an engine, auth or readiness probe.
+        providers.insert(
+            identity.id.to_string(),
+            json!({
+                "auth": crate::provider::AuthHintStatus::Unknown,
+                "command": identity.binary,
+                "installed": crate::contract_runtime::discovery::executable(identity.binary).is_ok(),
+                "version": "unknown",
+                "probe_status": "not_run",
+                "provider_probe_status": "not_run",
+            }),
+        );
+    }
     Value::Object(providers)
 }
 

package/crates/team-agent/src/cli/emit.rs

@@ -68,6 +68,9 @@ pub fn run(argv: &[String], cwd: &Path) -> ExitCode {
     if command == "route" {
         return super::route::run(&argv[1..]);
     }
+    if command == "leader-prompt" {
+        return super::leader_prompt::run(&argv[1..]);
+    }
     if is_leader_passthrough_command(command) {
         return match cmd_leader_passthrough(command, &argv[1..], cwd) {
             Ok(result) => emit_result(result),
@@ -212,6 +215,9 @@ fn dispatch(command: &str, args: &[String], cwd: &Path) -> Result<ExitCode, CliE
     if command == "route" {
         return Ok(super::route::run(args));
     }
+    if command == "leader-prompt" {
+        return Ok(super::leader_prompt::run(args));
+    }
     // Keep the removed flag harmless for older scripts and persisted command
     // lines; the default tmux backend is already the only runtime path.
     let filtered_args: Vec<String> = args
@@ -290,6 +296,7 @@ fn dispatch(command: &str, args: &[String], cwd: &Path) -> Result<ExitCode, CliE
         // delivery path — no separate route authority.
         "leaders" => cmd_leaders(&leaders_args(args, cwd)?).map(emit_result),
         "models" => cmd_models(&models_args(args)?).map(emit_result),
+        "kiro" => Ok(emit_result(cmd_kiro_leader(args))),
 
         "install-skill" => cmd_install_skill(&install_skill_args(args)?).map(emit_result),
         "profile" => cmd_profile(&profile_args(args, cwd)?).map(emit_result),
@@ -300,10 +307,7 @@ fn dispatch(command: &str, args: &[String], cwd: &Path) -> Result<ExitCode, CliE
 
 // Script compatibility is deliberately outside the human catalog and suggestions.
 fn is_machine_command(command: &str) -> bool {
-    matches!(
-        command,
-        "wait" | "coordinator" | "attach-app-server-leader"
-    )
+    matches!(command, "wait" | "coordinator" | "attach-app-server-leader")
 }
 
 fn dispatch_machine(command: &str, args: &[String], cwd: &Path) -> Result<ExitCode, CliError> {
@@ -365,7 +369,11 @@ pub(crate) fn default_help() -> String {
         "Observation and collaboration",
         &["leaders", "doctor", "approvals"],
     );
-    append_help_section(&mut out, "Configuration", &["route", "profile", "install-skill"]);
+    append_help_section(
+        &mut out,
+        "Configuration",
+        &["route", "leader-prompt", "profile", "install-skill"],
+    );
     append_help_section(
         &mut out,
         "Guided recovery",
@@ -374,7 +382,7 @@ pub(crate) fn default_help() -> String {
     append_help_section(
         &mut out,
         "Leader launch",
-        &["pi", "codex", "claude", "copilot", "grok", "cursor"],
+        &["pi", "codex", "claude", "copilot", "grok", "cursor", "kiro"],
     );
     out.push_str("\nCommand arguments and examples: team-agent <command> --help");
     out
@@ -425,6 +433,9 @@ pub(super) fn command_help(command: Option<&str>) -> String {
     if name == "route" {
         return super::route::HELP.to_string();
     }
+    if name == "leader-prompt" {
+        return super::leader_prompt::HELP.to_string();
+    }
     let (details, examples, next) = match name {
         "quick-start" => (
             "TEAMDIR contains TEAM.md and agents/; --workspace selects the runtime project.\n--name sets the team name; --team/--team-id selects the team; --yes retains compatibility; --detail includes full diagnostics.\nProviders must be installed and signed in. Declare provider/model/effort in role files; permission bypass defaults to false.\n--backend tmux is for POSIX; conpty requires a Windows host and an installed ConPTY shim.",
@@ -437,8 +448,8 @@ pub(super) fn command_help(command: Option<&str>) -> String {
             "team-agent inbox leader -n 3\nteam-agent inbox worker --limit 5\nteam-agent inbox leader --workspace . --team help-demo --json", "Wait for a natural reply, then check team-agent status if needed. Do not inspect worker terminal content."),
         "status" => ("Optional <agent> selects one agent. --summary/--detail retain compatibility and do not add fields.\nNine fields: name/provider/model/effort/runtime_status/activity/health/session_name/tmux_command.\nRuntime, activity and health are distinct. unknown means insufficient evidence; null means unset. No default model is guessed.",
             "team-agent status\nteam-agent status worker\nteam-agent status --workspace . --team help-demo --json", "Read replies with team-agent inbox leader -n 3; diagnose problems with team-agent doctor --workspace ."),
-        "models" => ("--provider selects the provider, default pi. QUERY or --search performs keyword search; they are mutually exclusive.\nUse cursor_agent for Cursor. Copilot has no model discovery entrypoint here. Results come from the native catalog, not guesses.",
-            "team-agent models --provider pi\nteam-agent models --provider pi --search luna\nteam-agent models --provider cursor_agent --json", "Use the exact returned model name in a role file or add-agent --model before launch."),
+        "models" => ("--provider selects the provider, default pi. QUERY or --search performs keyword search; they are mutually exclusive.\nUse cursor for the contract-native Cursor catalog; cursor_agent retains the legacy entrypoint. Copilot has no model discovery entrypoint here. Results come from the native catalog, not guesses.",
+            "team-agent models --provider pi\nteam-agent models --provider pi --search luna\nteam-agent models --provider cursor --json", "Use the exact returned model name in a role file or add-agent --model before launch."),
         "restart" => ("WORKSPACE defaults to the current project; saved sessions are preferred.\nUse --allow-fresh only after explicit authorization to lose saved context. --session-converge-deadline sets the wait in seconds.",
             "team-agent restart .\nteam-agent restart . --team help-demo --json", "Check status after restart. Obtain authorization before creating a fresh session; takeover is not a substitute for restart."),
         "shutdown" => ("Shuts down only the selected workspace/team. Logs are retained by default; --keep-logs remains compatible.\n--json reports scope, degradation and owned residuals. Success does not mean other teams were shut down.",
@@ -473,6 +484,8 @@ pub(super) fn command_help(command: Option<&str>) -> String {
             "team-agent takeover --workspace . --team help-demo --confirm\nteam-agent takeover --workspace . --team help-demo --confirm --json", "Verify leader/team ownership before confirmation. Check status/doctor afterwards; do not take over someone else's team."),
         "attach-leader" => ("PANE must be a verified leader terminal, not a guessed pane id.\n--provider selects the actual provider; --confirm authorizes attachment to an existing leader. Use only when doctor recommends it.",
             "team-agent attach-leader --pane \"$PANE\" --provider pi --workspace .\nteam-agent attach-leader --pane \"$PANE\" --provider pi --workspace . --team help-demo --confirm --json", "Set PANE to the verified terminal. Confirm attachment with doctor before sending a task."),
+        "kiro" => ("Kiro leader launching is not admitted by this candidate. This entry returns the stable capability refusal kiro_leader_not_admitted (exit 1).\nNo native process, leader binding, attach or provider fallback is attempted. --help/-h is read-only and exits 0.",
+            "team-agent kiro\nteam-agent kiro --json", "Use provider: kiro in a worker role with team-agent quick-start; worker support does not grant leader capability."),
         _ => ("Install the provider and complete native sign-in first. The current directory is the workspace.\nUse --attach-existing/--confirm only after verifying leader ownership and receiving authorization; --attach-session selects a verified session.\n--external-leader selects an external leader; --allow-nested-attach requires explicit authorization for nested terminals.\nArguments after -- pass through unchanged. Bare --help/-h displays this help without starting the provider.",
             "", "Run team-agent quick-start in the opened leader's tool context, not in an ordinary worker conversation."),
     };
@@ -486,12 +499,17 @@ pub(super) fn command_help(command: Option<&str>) -> String {
     } else {
         examples.to_string()
     };
-    let scope = if matches!(spec.kind, CommandKind::LeaderPassthrough { .. }) {
+    let scope = if name == "kiro" {
+        "Use --json for the structured capability refusal. Native arguments and attach options cannot enable this capability."
+    } else if matches!(spec.kind, CommandKind::LeaderPassthrough { .. }) {
         "Use --json for structured output. --workspace/--team are not launcher options here; they pass to the native provider."
     } else {
         "Use --json for structured output. --workspace selects the project; supported commands use --team to select the team."
     };
-    let mut out = format!("Purpose:\n{}.\nUsage: {}\n\nOptions:\n{}\n{}\nExamples:\n{}\n\nNext Action:\n{}", spec.summary, spec.usage, details, scope, examples, next);
+    let mut out = format!(
+        "Purpose:\n{}.\nUsage: {}\n\nOptions:\n{}\n{}\nExamples:\n{}\n\nNext Action:\n{}",
+        spec.summary, spec.usage, details, scope, examples, next
+    );
     if name == "quick-start" {
         out.push_str(&format!("\n\nMinimal two-file configuration (create manually; not written automatically):\nTEAM.md:\n{TEAM_TEMPLATE}\nagents/worker.md:\n{WORKER_TEMPLATE}"));
     }
@@ -499,7 +517,9 @@ pub(super) fn command_help(command: Option<&str>) -> String {
         out.push_str("\nDiscover models with team-agent models --provider cursor_agent.");
     }
     if name == "copilot" {
-        out.push_str("\nCopilot has no team-agent models entrypoint; consult native provider help.");
+        out.push_str(
+            "\nCopilot has no team-agent models entrypoint; consult native provider help.",
+        );
     }
     out
 }
@@ -1250,16 +1270,20 @@ fn warn_send_legacy_delivery_flags(args: &[String]) {
         "--message-id",
     ];
     let spec = command_spec("send");
-    let sunset = spec.and_then(|spec| spec.sunset).unwrap_or("a future compatibility release");
-    let action = spec
-        .and_then(|spec| spec.action)
-        .unwrap_or("Use team-agent send <agent> 'task message'; select scope with --workspace/--team");
+    let sunset = spec
+        .and_then(|spec| spec.sunset)
+        .unwrap_or("a future compatibility release");
+    let action = spec.and_then(|spec| spec.action).unwrap_or(
+        "Use team-agent send <agent> 'task message'; select scope with --workspace/--team",
+    );
     for flag in FLAGS {
         if args
             .iter()
             .any(|arg| arg == flag || arg.starts_with(&format!("{flag}=")))
         {
-            eprintln!("Warning: {flag} is deprecated and will be removed in {sunset}. Next: {action}");
+            eprintln!(
+                "Warning: {flag} is deprecated and will be removed in {sunset}. Next: {action}"
+            );
         }
     }
 }
@@ -2074,7 +2098,11 @@ mod tests {
             .filter(|spec| spec.default_help)
             .map(|spec| spec.name)
             .collect();
-        assert_eq!(expected.len(), 29, "the public catalog is Human29");
+        assert_eq!(
+            expected.len(),
+            31,
+            "the public catalog includes Leader prompt management and the Kiro capability gate"
+        );
         for spec_name in &expected {
             assert!(
                 visible.iter().any(|command| command == spec_name),
@@ -2088,7 +2116,7 @@ mod tests {
         expected_sorted.sort();
         assert_eq!(
             actual, expected_sorted,
-            "default help must match the exact Human29 public spec set, not a slack threshold; got {visible:?}"
+            "default help must match the exact public spec set, not a slack threshold; got {visible:?}"
         );
         assert!(
             top_help.contains("copilot"),
@@ -2145,7 +2173,10 @@ mod tests {
                 !is_machine_command(command),
                 "retired Machine route: {command}"
             );
-            assert!(!is_known_subcommand(command), "retired help gate: {command}");
+            assert!(
+                !is_known_subcommand(command),
+                "retired help gate: {command}"
+            );
         }
     }
 
@@ -2332,9 +2363,13 @@ mod tests {
             assert_english(&command_help(Some(spec.name)));
         }
         for text in [
-            TEAM_TEMPLATE, WORKER_TEMPLATE, HUMAN_NAVIGATION,
-            crate::cli::route::HELP, crate::cli::COMMS_BOUNDARY_TEXT,
-            crate::cli::QUICK_START_REMINDER, crate::cli::SEND_REMINDER,
+            TEAM_TEMPLATE,
+            WORKER_TEMPLATE,
+            HUMAN_NAVIGATION,
+            crate::cli::route::HELP,
+            crate::cli::COMMS_BOUNDARY_TEXT,
+            crate::cli::QUICK_START_REMINDER,
+            crate::cli::SEND_REMINDER,
             crate::cli::STATUS_REMINDER,
         ] {
             assert_english(text);

package/crates/team-agent/src/cli/leader.rs

@@ -116,6 +116,22 @@ pub fn cmd_leader_passthrough(
     Ok(CmdResult::from_json(value, as_json))
 }
 
+/// Public capability gate, not a legacy passthrough or a native launch attempt.
+pub(crate) fn cmd_kiro_leader(args: &[String]) -> CmdResult {
+    CmdResult::from_json(
+        json!({
+            "schema_version": "leader_launch.v1",
+            "ok": false,
+            "provider": "kiro",
+            "capability": "leader_launch",
+            "reason": "kiro_leader_not_admitted",
+            "error": "Kiro leader launching is not admitted by this candidate; no native process was started.",
+            "action": "Use provider: kiro in a worker role with team-agent quick-start. Worker support does not grant leader capability.",
+        }),
+        leader_launcher_json(args),
+    )
+}
+
 /// Closed-set verb → Provider. `None` = not a passthrough verb (must not become ClaudeCode).
 pub(crate) fn leader_passthrough_provider(command: &str) -> Option<crate::model::enums::Provider> {
     use crate::model::enums::Provider;