@team-agent/installer 0.5.116 → 0.5.118

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -174,6 +174,9 @@ impl Transport for DeliverOkTransport {
     fn kind(&self) -> BackendKind {
         BackendKind::Tmux
     }
+    fn supports_owned_native_input(&self) -> bool {
+        true
+    }
     fn spawn_first(
         &self,
         _s: &SessionName,
@@ -201,6 +204,8 @@ impl Transport for DeliverOkTransport {
         _s: Key,
         _b: bool,
     ) -> Result<InjectReport, TransportError> {
+        assert!(crate::transport::native_input::current_request().is_none(),
+            "ordinary sends must use v0.5.113 direct input, not pre-paste idle admission");
         Ok(InjectReport {
             stage_reached: crate::transport::InjectStage::Submit,
             inject_verification: crate::transport::InjectVerification::CaptureContainsToken,
@@ -344,13 +349,10 @@ fn spine_delivery_skips_queued_statuses() {
     );
 }
 
-// #2 (CONTRACT, corrected) — busy recipient = LIFECYCLE status=="busy" → emit ONE send.deferred_busy
-// {recipient,reason:"recipient_busy"} and do NOT deliver (row stays 'accepted'). golden delivery.py:491
-// gates on `state.agents[recipient].status == "busy"`, NOT on turn-level agent_health=WORKING.
-// (The prior version of this test seeded agent_health=WORKING + status="running" and asserted deferral,
-//  misreading golden — that stale lock is the root of the deferred_busy regression; corrected here.)
+// Input is unconditional: native CLIs queue messages while working. Activity
+// metadata must not prevent a pending message from reaching paste + Enter.
 #[test]
-fn spine_delivery_busy_recipient_defers_with_event() {
+fn spine_delivery_busy_recipient_is_injected_without_idle_deferral() {
     let ws = tmp_ws("deliver-busy");
     let store = store_for(&ws);
     let log = EventLog::new(&ws);
@@ -361,33 +363,30 @@ fn spine_delivery_busy_recipient_defers_with_event() {
 
     let delivered = deliver_pending_messages(&ws, &state, &DeliverOkTransport, &log).unwrap();
 
-    assert!(
-        !delivered.contains(&mid),
-        "a busy recipient's message must NOT be delivered"
-    );
-    assert_eq!(
-        message_status_of(&store, &mid),
-        "accepted",
-        "the row must stay 'accepted' (no-drop, left for a later tick)"
-    );
+    assert!(delivered.contains(&mid));
+    assert_eq!(message_status_of(&store, &mid), "delivered");
     let events = read_event_log(&ws);
     let deferred: Vec<_> = events
         .iter()
         .filter(|e| e.get("event").and_then(|v| v.as_str()) == Some("send.deferred_busy"))
         .collect();
-    assert_eq!(
-        deferred.len(),
-        1,
-        "exactly one send.deferred_busy event expected; got {events:?}"
-    );
-    assert_eq!(
-        deferred[0].get("recipient").and_then(|v| v.as_str()),
-        Some("w1")
-    );
-    assert_eq!(
-        deferred[0].get("reason").and_then(|v| v.as_str()),
-        Some("recipient_busy")
-    );
+    assert!(deferred.is_empty());
+}
+
+#[test]
+fn spine_delivery_pi_cursor_uses_v113_direct_input_without_idle_scope() {
+    for provider in ["pi", "cursor_agent"] {
+        let ws = tmp_ws(&format!("direct-input-{provider}"));
+        let store = store_for(&ws);
+        let log = EventLog::new(&ws);
+        let mid = store
+            .create_message(Some("t"), "leader", "w1", "hi", None, true, None)
+            .unwrap();
+        let state = serde_json::json!({"agents": {"w1": {"provider": provider, "status": "running"}}});
+        let delivered = deliver_pending_messages(&ws, &state, &DeliverOkTransport, &log).unwrap();
+        assert!(delivered.contains(&mid), "{provider}");
+        assert_eq!(message_status_of(&store, &mid), "delivered");
+    }
 }
 
 // CONTRACT (shared-root, real-machine-driven; golden = correct-behavior baseline): an ALIVE worker

package/crates/team-agent/src/messaging/types.rs

@@ -108,6 +108,7 @@ pub enum ScheduledKind {
     Send,
     HealthPing,
     TrustRetry,
+    EnterRescue,
 }
 
 /// classifier 产物 status (card §48;消费 step 8 classifier)。

package/crates/team-agent/src/state/repository.rs

@@ -185,6 +185,53 @@ impl<'a> StateRepository<'a> {
         bounded_team_view(&committed, team_key)
     }
 
+    /// Commit a messaging delta against its exact canonical owner under state-save.
+    /// Unlike ordinary compatibility writes, owner loss cannot select raw/default
+    /// state, and a failed receiver check cannot be reapplied to another team.
+    pub(crate) fn commit_messaging_checked<F>(
+        &self,
+        intent: StateWriteIntent<'_>,
+        update: F,
+    ) -> Result<(), StateError>
+    where
+        F: FnOnce(&mut Value) -> Result<(), StateError>,
+    {
+        let StateWriteIntent::MessagingDeliveryState { owner_team_id: Some(team) } = intent else {
+            return Err(StateError::SaveFailed("checked messaging requires an owner".into()));
+        };
+        #[cfg(test)]
+        test_support::before_commit();
+        super::persist::update_runtime_state(self.workspace, |latest| {
+            if team.is_empty() || !matches!(
+                super::projection::resolve_owner_team_id(latest, team),
+                super::projection::OwnerTeamResolution::Canonical(key) if key == team
+            ) {
+                return Err(StateError::SaveConflict("messaging owner changed before commit".into()));
+            }
+            let nested = latest.get("teams").and_then(Value::as_object)
+                .is_some_and(|teams| teams.contains_key(team));
+            let mut selected = if nested {
+                super::projection::project_top_level_view(latest, team)
+            } else if legacy_single_team_state(latest)
+                && (latest.get("active_team_key").and_then(Value::as_str) == Some(team)
+                    || super::projection::team_state_key(latest) == team
+                    || latest.get("session_name").and_then(Value::as_str)
+                        .and_then(|session| session.strip_prefix("team-")) == Some(team))
+            {
+                latest.clone()
+            } else {
+                return Err(StateError::SaveConflict("messaging owner no longer exists".into()));
+            };
+            update(&mut selected)?;
+            Ok(if nested {
+                super::projection::merge_committed_team(latest, &selected, team)
+            } else {
+                selected
+            })
+        })?;
+        Ok(())
+    }
+
     /// Atomically replace only the fork target row in the selected team.
     pub(crate) fn commit_fork_agent(
         &self,

package/crates/team-agent/src/tmux_backend/native_input.rs

@@ -0,0 +1,494 @@
+//! Guarded legacy native-input effects. Shared contract parsers remain observation-only.
+
+use std::time::{Duration, Instant};
+
+use sha2::{Digest, Sha256};
+
+use super::*;
+use crate::lifecycle::pane_input_lock::{acquire_required, PaneInputLockRequest};
+use crate::model::enums::Provider;
+use crate::transport::native_input::{
+    inspect_input, pi_paste_capsule, record_evidence, EnterRescueOutcome, InputFrame,
+    NativeInputBinding, NativeInputEvidence, NativeInputPhase, NativeInputRequest,
+};
+
+#[cfg(test)]
+#[path = "native_input_tests.rs"]
+mod tests;
+
+const STABLE: Duration = Duration::from_millis(200);
+const OBSERVE: Duration = Duration::from_secs(10);
+const POLL: Duration = Duration::from_millis(50);
+
+fn refused(reason: &str) -> TransportError {
+    TransportError::NativeInputNotReady {
+        reason: reason.to_string(),
+    }
+}
+
+fn surface_unknown(error: &TransportError) -> bool {
+    matches!(
+        error,
+        TransportError::NativeInputNotReady { reason } if reason == "native_surface_unknown"
+    )
+}
+
+pub(crate) fn digest(text: &str) -> String {
+    format!("{:x}", Sha256::digest(text.as_bytes()))
+}
+
+impl TmuxBackend {
+    fn native_binding(&self, target: &Target) -> Result<NativeInputBinding, TransportError> {
+        self.query_native_binding(target, false)
+    }
+
+    fn query_native_binding(
+        &self,
+        target: &Target,
+        allow_unset_nonce: bool,
+    ) -> Result<NativeInputBinding, TransportError> {
+        let pane = pane_from_target(target);
+        let argv = self.tmux_argv(&[
+            "tmux".into(), "display-message".into(), "-p".into(), "-t".into(), pane.as_str().into(),
+            "#{socket_path}|#{pane_id}|#{pane_pid}|#{session_name}|#{window_name}|#{@team_agent_pane_binding_nonce}|#{pane_in_mode}|#{pane_height}".into(),
+        ]);
+        let output = self.runner.run(&argv)?;
+        if !output.success || output.stdout.lines().count() != 1 {
+            return Err(refused("binding_query"));
+        }
+        let fields: Vec<_> = output.stdout.trim_end().split('|').collect();
+        if fields.len() != 8 {
+            return Err(refused("binding_invalid:field_count"));
+        }
+        for (invalid, field) in [
+            (!std::path::Path::new(fields[0]).is_absolute(), "endpoint"),
+            (fields[1] != pane.as_str(), "pane"),
+            (fields[3].is_empty(), "session_empty"),
+            (fields[4].is_empty(), "window_empty"),
+            (fields[5].is_empty() && !allow_unset_nonce, "nonce_empty"),
+            (fields[6] != "0", "pane_in_mode"),
+        ] {
+            if invalid {
+                // Field class only: no argv, environment, business text or raw
+                // native metadata is copied into the existing refusal event.
+                return Err(refused(&format!("binding_invalid:{field}")));
+            }
+        }
+        let pane_height = fields[7]
+            .parse::<u32>()
+            .map_err(|_| refused("binding_height"))?;
+        if pane_height < 10 {
+            return Err(refused("binding_height"));
+        }
+        let pid = fields[2]
+            .parse::<u32>()
+            .map_err(|_| refused("binding_pid"))?;
+        let birth = team_agent_contract::host::process::process_birth_identity(pid)
+            .map_err(|_| refused("carrier_birth"))?;
+        Ok(NativeInputBinding {
+            endpoint: fields[0].into(),
+            pane_id: fields[1].into(),
+            pane_pid: pid,
+            pane_height,
+            carrier_birth: birth,
+            session: fields[3].into(),
+            window: fields[4].into(),
+            binding_nonce: fields[5].into(),
+        })
+    }
+
+    // Called only under the required input lock. A newly launched legacy worker
+    // has no Leader lease nonce producer: initialize its exact current carrier,
+    // never overwrite an existing nonce or waive the subsequent strict reads.
+    fn prepare_native_binding(
+        &self,
+        target: &Target,
+        request: &NativeInputRequest,
+    ) -> Result<NativeInputBinding, TransportError> {
+        let initial = self.query_native_binding(target, true)?;
+        if initial.pane_id != request.pane_id
+            || initial.pane_pid != request.pane_pid
+            || initial.session != request.session
+            || initial.window != request.window
+        {
+            return Err(refused("selected_binding_changed"));
+        }
+        if !initial.binding_nonce.is_empty() {
+            return Ok(initial);
+        }
+        let pane = PaneId::new(&initial.pane_id);
+        let workspace = self
+            .event_workspace
+            .as_deref()
+            .ok_or_else(|| refused("workspace_missing"))?;
+        let proposed = next_pane_binding_nonce(workspace, &initial.endpoint, &pane);
+        let nonce = self.set_pane_binding_nonce_if_unset(&pane, &proposed)?;
+        let expected = NativeInputBinding {
+            binding_nonce: nonce,
+            ..initial
+        };
+        let observed = self.native_binding(target)?;
+        if observed != expected {
+            return Err(refused("binding_changed_after_nonce"));
+        }
+        Ok(observed)
+    }
+
+    fn native_frame(&self, evidence: &NativeInputEvidence) -> Result<InputFrame, TransportError> {
+        let target = Target::Pane(PaneId::new(&evidence.binding.pane_id));
+        if self.native_binding(&target)? != evidence.binding {
+            return Err(refused("binding_changed"));
+        }
+        let capture = self.capture(&target, CaptureRange::Tail(200))?;
+        let frame = inspect_input(
+            evidence.request.provider,
+            &capture.text,
+            evidence.binding.pane_height,
+        )
+        .ok_or_else(|| refused("native_surface_unknown"))?;
+        if self.native_binding(&target)? != evidence.binding {
+            return Err(refused("binding_changed"));
+        }
+        Ok(frame)
+    }
+
+    fn native_record(&self, evidence: &NativeInputEvidence) -> Result<(), TransportError> {
+        record_evidence(evidence);
+        let workspace = self
+            .event_workspace
+            .as_deref()
+            .ok_or_else(|| refused("workspace_missing"))?;
+        crate::event_log::EventLog::new(workspace)
+            .write(
+                "native_input.evidence",
+                serde_json::to_value(evidence).map_err(std::io::Error::other)?,
+            )
+            .map(|_| ())
+            .map_err(|error| TransportError::Io(std::io::Error::other(error)))
+    }
+
+    fn stable_frame(
+        &self,
+        evidence: &NativeInputEvidence,
+        empty: bool,
+    ) -> Result<InputFrame, TransportError> {
+        let start = Instant::now();
+        let stable_window = if empty {
+            STABLE
+        } else {
+            STABLE.max(current_paste_to_submit_floor())
+        };
+        let mut eligible: Option<(InputFrame, Instant)> = None;
+        while start.elapsed() < OBSERVE {
+            let frame = match self.native_frame(evidence) {
+                Ok(frame) => frame,
+                Err(error) if surface_unknown(&error) => {
+                    // A partial redraw grants nothing and resets stability.
+                    // Binding/process/capture failures still refuse immediately.
+                    eligible = None;
+                    std::thread::sleep(POLL);
+                    continue;
+                }
+                Err(error) => return Err(error),
+            };
+            let valid = if empty {
+                frame.empty() && !frame.busy
+            } else {
+                frame.pending(evidence)
+            };
+            if valid {
+                if let Some((previous, since)) = &eligible {
+                    if previous.composer == frame.composer
+                        && previous.identity == frame.identity
+                        && previous.capsule == frame.capsule
+                        && since.elapsed() >= stable_window
+                    {
+                        return Ok(frame);
+                    }
+                    if previous.composer != frame.composer
+                        || previous.identity != frame.identity
+                        || previous.capsule != frame.capsule
+                    {
+                        eligible = Some((frame, Instant::now()));
+                    }
+                } else {
+                    eligible = Some((frame, Instant::now()));
+                }
+            } else {
+                eligible = None;
+            }
+            std::thread::sleep(POLL);
+        }
+        Err(refused(if empty {
+            "composer_not_ready"
+        } else {
+            "owned_paste_not_stable"
+        }))
+    }
+
+    fn observe_native_acceptance(
+        &self,
+        evidence: &NativeInputEvidence,
+    ) -> Result<bool, TransportError> {
+        let start = Instant::now();
+        let mut last_unknown = false;
+        while start.elapsed() < OBSERVE {
+            match self.native_frame(evidence) {
+                Ok(frame) => {
+                    last_unknown = false;
+                    if frame.accepted(evidence) {
+                        return Ok(true);
+                    }
+                }
+                Err(error) if surface_unknown(&error) => last_unknown = true,
+                Err(error) => return Err(error),
+            }
+            std::thread::sleep(POLL);
+        }
+        if last_unknown {
+            Err(refused("native_surface_unknown"))
+        } else {
+            Ok(false)
+        }
+    }
+
+    pub(super) fn inject_native_input(
+        &self,
+        target: &Target,
+        text: &str,
+        bracketed: bool,
+        request: NativeInputRequest,
+        observer: Option<&dyn SubmitObserver>,
+    ) -> Result<InjectReport, TransportError> {
+        let pane = pane_from_target(target);
+        let _lock = acquire_required(PaneInputLockRequest {
+            workspace: self.event_workspace.as_deref(),
+            target_key: pane.as_str(),
+            operation: "native_inject",
+        })
+        .ok_or_else(|| refused("input_lock"))?;
+        if !request.supported() {
+            return Err(refused("unsupported_profile"));
+        }
+        let binding = self.prepare_native_binding(target, &request)?;
+        let mut evidence = NativeInputEvidence {
+            request,
+            binding,
+            payload_sha256: digest(text),
+            ui_identity: String::new(),
+            footer_sha256: String::new(),
+            baseline_sha256: String::new(),
+            baseline_capsules: Vec::new(),
+            phase: NativeInputPhase::Ready,
+            capsule: None,
+        };
+        if evidence.binding.pane_id != evidence.request.pane_id
+            || evidence.binding.pane_pid != evidence.request.pane_pid
+            || evidence.binding.session != evidence.request.session
+            || evidence.binding.window != evidence.request.window
+        {
+            return Err(refused("selected_binding_changed"));
+        }
+        let baseline = self.stable_frame(&evidence, true)?;
+        if baseline.transcript.contains(&evidence.request.marker()) {
+            return Err(refused("marker_in_baseline"));
+        }
+        evidence.ui_identity = baseline.identity;
+        evidence.footer_sha256 = digest(&baseline.footer);
+        evidence.baseline_sha256 = digest(&baseline.transcript);
+        evidence.baseline_capsules =
+            capsule_labels(evidence.request.provider, &baseline.transcript);
+        self.native_record(&evidence)?;
+        let buffer = owned_buffer(&evidence);
+        for argv in tmux_inject_text_argv(&pane, &buffer, text, bracketed) {
+            let stage = inject_stage_for_argv(&argv);
+            if stage == InjectStage::PasteBuffer {
+                let frame = self.native_frame(&evidence)?;
+                if !frame.empty()
+                    || frame.busy
+                    || frame.identity != evidence.ui_identity
+                    || digest(&frame.footer) != evidence.footer_sha256
+                {
+                    return Err(refused("composer_changed_before_paste"));
+                }
+                evidence.phase = NativeInputPhase::MayHavePasted;
+                self.native_record(&evidence)?;
+            }
+            if stage == InjectStage::LoadBuffer {
+                self.run_inject_stage_with_stdin(&argv, stage, text)?;
+            } else {
+                self.run_inject_stage(&argv, stage)?;
+            }
+            if stage == InjectStage::PasteBuffer {
+                evidence.phase = NativeInputPhase::Pasted;
+                self.native_record(&evidence)?;
+            }
+        }
+        // A capsule becomes owned only after this empty-baseline, single-paste transition.
+        let start = Instant::now();
+        while start.elapsed() < OBSERVE {
+            let frame = match self.native_frame(&evidence) {
+                Ok(frame) => frame,
+                Err(error) if surface_unknown(&error) => {
+                    std::thread::sleep(POLL);
+                    continue;
+                }
+                Err(error) => return Err(error),
+            };
+            if frame.identity == evidence.ui_identity
+                && digest(&frame.footer) == evidence.footer_sha256
+                && !frame.busy
+            {
+                if let Some(capsule) = &frame.capsule {
+                    if evidence.capsule.is_none() && !evidence.baseline_capsules.contains(capsule) {
+                        evidence.capsule = Some(capsule.clone());
+                        // Bind the empty-baseline, single-owned-paste transition
+                        // before stability waiting can fail. This is still
+                        // Pasted, not Seen or permission to submit a key.
+                        self.native_record(&evidence)?;
+                    }
+                }
+                if frame.pending(&evidence) {
+                    break;
+                }
+            }
+            std::thread::sleep(POLL);
+        }
+        self.stable_frame(&evidence, false)?;
+        evidence.phase = NativeInputPhase::Seen;
+        self.native_record(&evidence)?;
+        self.native_submit(&mut evidence, observer)?;
+        let accepted = self.observe_native_acceptance(&evidence)?;
+        if accepted {
+            evidence.phase = NativeInputPhase::Accepted;
+            self.native_record(&evidence)?;
+        }
+        Ok(InjectReport {
+            stage_reached: InjectStage::Submit,
+            inject_verification: if evidence.capsule.is_some() {
+                InjectVerification::CaptureContainsNewPastedContentPrompt
+            } else {
+                InjectVerification::CaptureContainsToken
+            },
+            submit_verification: if accepted {
+                SubmitVerification::EnterSentWithoutPlaceholderCheck
+            } else {
+                SubmitVerification::SubmitConsumptionUnverified
+            },
+            turn_verification: TurnVerification::NotRequired,
+            attempts: 1,
+            submit_diagnostics: None,
+        })
+    }
+
+    fn native_submit(
+        &self,
+        evidence: &mut NativeInputEvidence,
+        observer: Option<&dyn SubmitObserver>,
+    ) -> Result<(), TransportError> {
+        let frame = self.native_frame(evidence)?;
+        if !frame.pending(evidence) {
+            return Err(refused("composer_changed_before_enter"));
+        }
+        evidence.phase = NativeInputPhase::MayHaveSubmitted;
+        self.native_record(evidence)?;
+        self.run_inject_stage(
+            &tmux_send_submit_argv(&PaneId::new(&evidence.binding.pane_id), Key::Enter),
+            InjectStage::Submit,
+        )?;
+        notify_submit_observer(observer);
+        evidence.phase = NativeInputPhase::Submitted;
+        self.native_record(evidence)
+    }
+
+    pub(super) fn rescue_native_input(
+        &self,
+        evidence: &NativeInputEvidence,
+        authorize: &dyn Fn() -> bool,
+        observer: Option<&dyn SubmitObserver>,
+    ) -> Result<EnterRescueOutcome, TransportError> {
+        let _lock = match acquire_required(PaneInputLockRequest {
+            workspace: self.event_workspace.as_deref(),
+            target_key: &evidence.binding.pane_id,
+            operation: "enter_rescue",
+        }) {
+            Some(lock) => lock,
+            None => {
+                return Ok(EnterRescueOutcome::NoEffect {
+                    reason: "input_lock",
+                    reobserve: true,
+                })
+            }
+        };
+        if !evidence.request.supported() || evidence.phase < NativeInputPhase::Pasted {
+            return Ok(EnterRescueOutcome::NoEffect {
+                reason: "proof_missing",
+                reobserve: false,
+            });
+        }
+        let frame = self.native_frame(evidence)?;
+        if frame.accepted(evidence) {
+            return Ok(EnterRescueOutcome::Consumed);
+        }
+        if frame.busy {
+            return Ok(EnterRescueOutcome::NoEffect {
+                reason: "busy",
+                reobserve: true,
+            });
+        }
+        if !frame.pending(evidence) {
+            return Ok(EnterRescueOutcome::NoEffect {
+                reason: "residue_mismatch",
+                reobserve: false,
+            });
+        }
+        self.stable_frame(evidence, false)?;
+        if !authorize() {
+            return Ok(EnterRescueOutcome::NoEffect {
+                reason: "canonical_changed",
+                reobserve: false,
+            });
+        }
+        let mut current = evidence.clone();
+        current.phase = NativeInputPhase::Seen;
+        self.native_record(&current)?;
+        self.native_submit(&mut current, observer)?;
+        let accepted = self.observe_native_acceptance(&current)?;
+        if accepted {
+            current.phase = NativeInputPhase::Accepted;
+            self.native_record(&current)?;
+        }
+        Ok(EnterRescueOutcome::Entered { accepted })
+    }
+}
+
+fn owned_buffer(evidence: &NativeInputEvidence) -> String {
+    format!(
+        "ta-owned-{}-{}",
+        evidence.request.message_id,
+        digest(&format!(
+            "{}:{}:{}",
+            evidence.binding.binding_nonce, evidence.binding.pane_id, evidence.payload_sha256
+        ))
+    )
+}
+
+fn capsule_labels(provider: Provider, text: &str) -> Vec<String> {
+    if provider == Provider::Pi {
+        return text
+            .match_indices("[paste #")
+            .filter_map(|(start, _)| {
+                let end = text[start..].find(']')? + start;
+                pi_paste_capsule(&text[start..=end]).map(str::to_owned)
+            })
+            .collect();
+    }
+    text.lines()
+        .filter_map(|line| {
+            let start = line.find("[Pasted text #")?;
+            let end = line[start..].find(']')? + start;
+            let label = &line[start..=end];
+            (label.len() <= 80).then(|| label.to_string())
+        })
+        .collect()
+}