@team-agent/installer 0.5.118 → 0.5.119

package/crates/team-agent/src/messaging/enter_rescue.rs

@@ -1,9 +1,9 @@
-//! Durable Enter-only recovery. A claimed/unknown job is never replayed as a paste.
+//! Durable independent Enter-only watchdog. An uncertain effect is never replayed.
 
 use std::path::Path;
 
 use chrono::{DateTime, Duration, Utc};
-use rusqlite::{params, OptionalExtension};
+use rusqlite::{params, OptionalExtension, Transaction};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 
@@ -11,7 +11,7 @@ use super::delivery::{render_message, top_level_state_matches_owner_team};
 use super::MessagingError;
 use crate::event_log::EventLog;
 use crate::message_store::MessageStore;
-use crate::transport::native_input::{EnterRescueOutcome, NativeInputEvidence, NativeInputPhase};
+use crate::transport::enter_rescue::{EnterRescueContext, EnterRescueOutcome};
 use crate::transport::Transport;
 
 #[cfg(test)]
@@ -23,7 +23,9 @@ const EXPIRE_SECONDS: i64 = 120;
 
 #[derive(Debug, Serialize, Deserialize)]
 struct RescueJob {
-    evidence: NativeInputEvidence,
+    schema: u8,
+    context: EnterRescueContext,
+    registered_at: String,
     expires_at: String,
 }
 
@@ -31,105 +33,134 @@ fn digest(text: &str) -> String {
     format!("{:x}", Sha256::digest(text.as_bytes()))
 }
 
-fn expiration(job: &RescueJob) -> Result<DateTime<Utc>, MessagingError> {
-    DateTime::parse_from_rfc3339(&job.expires_at)
+fn timestamp(value: &str) -> Result<DateTime<Utc>, MessagingError> {
+    DateTime::parse_from_rfc3339(value)
         .map(|value| value.with_timezone(&Utc))
-        .map_err(|_| MessagingError::Validation("enter_rescue: invalid expiry".into()))
+        .map_err(|_| MessagingError::Validation("enter_rescue: invalid timestamp".into()))
 }
 
-/// The claim consumed no physical attempt. Never use this after a paste intent.
-pub(super) fn release_no_effect(
-    store: &MessageStore,
+/// Called in the message-status transaction, even when no carrier/proof exists.
+/// One original registration survives duplicates, unknown effects and restarts.
+pub(crate) fn schedule_in_tx(
+    tx: &Transaction<'_>,
     message_id: &str,
-    attempt: u32,
-) -> Result<(), MessagingError> {
-    let conn = crate::db::schema::open_db(store.db_path())?;
-    conn.execute(
-        "update messages set error='native_input_not_ready', delivery_attempts=delivery_attempts-1, updated_at=?3
-         where message_id=?1 and status='target_resolved' and error is null and delivery_attempts=?2",
-        params![message_id, attempt, Utc::now().to_rfc3339()],
-    )?;
-    Ok(())
-}
-
-/// Original uncertainty and its one job are committed together under the same CAS.
-pub(super) fn park(
-    store: &MessageStore,
-    evidence: &NativeInputEvidence,
-    attempt: u32,
-    reason: &str,
-    log: &EventLog,
-) -> Result<(), MessagingError> {
-    park_at(store, evidence, attempt, reason, log, Utc::now())
-}
-
-fn park_at(
-    store: &MessageStore,
-    evidence: &NativeInputEvidence,
-    attempt: u32,
-    reason: &str,
-    log: &EventLog,
     now: DateTime<Utc>,
-) -> Result<(), MessagingError> {
-    if !evidence.request.supported() || evidence.phase < NativeInputPhase::MayHavePasted {
-        return Err(MessagingError::Validation(
-            "enter_rescue: owned proof missing".into(),
-        ));
-    }
-    let mut conn = crate::db::schema::open_db(store.db_path())?;
-    let tx = conn.transaction()?;
-    let changed = tx.execute(
-        "update messages set status='submitted_unverified', error=?4, updated_at=?5
-         where message_id=?1 and owner_team_id=?2 and recipient=?3
-           and status='target_resolved' and error is null and delivery_attempts=?6",
-        params![
-            evidence.request.message_id,
-            evidence.request.owner_team_id,
-            evidence.request.recipient,
-            reason,
-            now.to_rfc3339(),
-            attempt
-        ],
-    )?;
-    if changed != 1 {
-        return Err(MessagingError::Validation(
-            "enter_rescue: claim changed".into(),
-        ));
-    }
+) -> Result<(), rusqlite::Error> {
+    let row = tx.query_row(
+        "select owner_team_id,coalesce(recipient,''),coalesce(sender,''),task_id,coalesce(content,'')
+         from messages where message_id=?1 and status='submitted_unverified'",
+        [message_id],
+        |row| Ok((row.get::<_, Option<String>>(0)?, row.get::<_, String>(1)?,
+            row.get::<_, String>(2)?, row.get::<_, Option<String>>(3)?, row.get::<_, String>(4)?)),
+    ).optional()?;
+    let Some((owner, recipient, sender, task, content)) = row else {
+        return Ok(());
+    };
     let job = RescueJob {
-        evidence: evidence.clone(),
+        schema: 1,
+        context: EnterRescueContext {
+            message_id: message_id.into(),
+            owner_team_id: owner.clone().unwrap_or_default(),
+            recipient: recipient.clone(),
+            payload_sha256: digest(&render_message(
+                &sender,
+                task.as_deref(),
+                &content,
+                message_id,
+            )),
+            target: None,
+            proof: None,
+        },
+        registered_at: now.to_rfc3339(),
         expires_at: (now + Duration::seconds(EXPIRE_SECONDS)).to_rfc3339(),
     };
+    let payload = serde_json::to_string(&job)
+        .map_err(|error| rusqlite::Error::ToSqlConversionFailure(Box::new(error)))?;
     tx.execute(
-        "insert into scheduled_events(kind,target,payload_json,due_at,status,owner_team_id,created_at) values('enter_rescue',?1,?2,?3,'pending',?4,?5)",
-        params![evidence.request.recipient, serde_json::to_string(&job)?,
-            (now + Duration::seconds(DELAY_SECONDS)).to_rfc3339(), evidence.request.owner_team_id, now.to_rfc3339()],
+        "insert into scheduled_events(kind,target,payload_json,due_at,status,owner_team_id,created_at)
+         select 'enter_rescue',?1,?2,?3,'pending',?4,?5 where not exists(
+           select 1 from scheduled_events where kind='enter_rescue' and case when json_valid(payload_json)
+           then coalesce(json_extract(payload_json,'$.context.message_id'),json_extract(payload_json,'$.evidence.request.message_id')) end=?6)",
+        params![recipient, payload, (now + Duration::seconds(DELAY_SECONDS)).to_rfc3339(), owner,
+            now.to_rfc3339(), message_id],
     )?;
-    tx.commit()?;
-    log.write("enter_rescue.scheduled", serde_json::json!({
-        "message_id": evidence.request.message_id, "recipient": evidence.request.recipient,
-        "phase": evidence.phase, "delay_seconds": DELAY_SECONDS, "expire_seconds": EXPIRE_SECONDS,
-    }))?;
     Ok(())
 }
 
+/// Supplement the original job at the original delivery boundary, never at fire.
+/// This cannot change its scope, message digest, initial clock, or a bound carrier.
+pub(crate) fn bind_pending_context(
+    store: &MessageStore,
+    context: &EnterRescueContext,
+) -> Result<bool, MessagingError> {
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    let row = conn.query_row(
+        "select id,payload_json from scheduled_events where kind='enter_rescue' and status='pending'
+         and case when json_valid(payload_json) then json_extract(payload_json,'$.context.message_id') end=?1",
+        [&context.message_id], |row| Ok((row.get::<_, i64>(0)?, row.get::<_, String>(1)?)),
+    ).optional()?;
+    let Some((id, previous)) = row else {
+        return Ok(false);
+    };
+    let mut job: RescueJob = serde_json::from_str(&previous)?;
+    if job.schema != 1
+        || job.context.message_id != context.message_id
+        || job.context.owner_team_id != context.owner_team_id
+        || job.context.recipient != context.recipient
+        || job.context.payload_sha256 != context.payload_sha256
+        || job.context.target.as_ref().is_some_and(|target| {
+            !context
+                .target
+                .as_ref()
+                .is_some_and(|next| target.same_selection(next))
+                || (target.bound() && job.context != *context)
+        })
+    {
+        return Ok(false);
+    }
+    job.context = context.clone();
+    Ok(conn.execute(
+        "update scheduled_events set payload_json=?2 where id=?1 and status='pending' and payload_json=?3
+         and exists(select 1 from messages where message_id=?4 and status='submitted_unverified'
+             and owner_team_id=?5 and recipient=?6)",
+        params![id, serde_json::to_string(&job)?, previous, context.message_id,
+            context.owner_team_id, context.recipient],
+    )? == 1)
+}
+
 fn canonical_valid(
     workspace: &Path,
     store: &MessageStore,
     job: &RescueJob,
 ) -> Result<bool, MessagingError> {
-    let evidence = &job.evidence;
-    let request = &evidence.request;
-    if Utc::now() > expiration(job)? || !request.supported() {
+    let context = &job.context;
+    let registered = timestamp(&job.registered_at)?;
+    let expires = timestamp(&job.expires_at)?;
+    let now = Utc::now();
+    if job.schema != 1
+        || !context.valid_message()
+        || expires != registered + Duration::seconds(EXPIRE_SECONDS)
+        || now < registered + Duration::seconds(DELAY_SECONDS)
+        || now > expires
+    {
         return Ok(false);
     }
     let conn = crate::db::schema::open_db(store.db_path())?;
-    let original = conn.query_row(
-        "select sender, task_id, content, created_at from messages
-         where message_id=?1 and owner_team_id=?2 and recipient=?3 and status='submitted_unverified'",
-        params![request.message_id, request.owner_team_id, request.recipient],
-        |row| Ok((row.get::<_, String>(0)?, row.get::<_, Option<String>>(1)?, row.get::<_, String>(2)?, row.get::<_, String>(3)?)),
-    ).optional()?;
+    let original = conn
+        .query_row(
+            "select sender,task_id,content,created_at from messages where message_id=?1
+         and owner_team_id=?2 and recipient=?3 and status='submitted_unverified'",
+            params![context.message_id, context.owner_team_id, context.recipient],
+            |row| {
+                Ok((
+                    row.get::<_, String>(0)?,
+                    row.get::<_, Option<String>>(1)?,
+                    row.get::<_, String>(2)?,
+                    row.get::<_, String>(3)?,
+                ))
+            },
+        )
+        .optional()?;
     let Some((sender, task, content, created_at)) = original else {
         return Ok(false);
     };
@@ -137,8 +168,8 @@ fn canonical_valid(
         &sender,
         task.as_deref(),
         &content,
-        &request.message_id,
-    )) != evidence.payload_sha256
+        &context.message_id,
+    )) != context.payload_sha256
     {
         return Ok(false);
     }
@@ -146,9 +177,9 @@ fn canonical_valid(
         "select exists(select 1 from messages where owner_team_id=?1 and recipient=?2
          and message_id<>?3 and created_at>=?4 and delivery_attempts>0)",
         params![
-            request.owner_team_id,
-            request.recipient,
-            request.message_id,
+            context.owner_team_id,
+            context.recipient,
+            context.message_id,
             created_at
         ],
         |row| row.get(0),
@@ -157,56 +188,59 @@ fn canonical_valid(
         return Ok(false);
     }
     let raw = crate::state::persist::load_runtime_state(workspace)?;
-    if !matches!(crate::state::projection::resolve_owner_team_id(&raw, &request.owner_team_id),
-        crate::state::projection::OwnerTeamResolution::Canonical(team) if team == request.owner_team_id)
+    if !matches!(crate::state::projection::resolve_owner_team_id(&raw, &context.owner_team_id),
+        crate::state::projection::OwnerTeamResolution::Canonical(team) if team == context.owner_team_id)
     {
         return Ok(false);
     }
     let state = if raw
         .get("teams")
         .and_then(serde_json::Value::as_object)
-        .is_some_and(|teams| teams.contains_key(&request.owner_team_id))
+        .is_some_and(|teams| teams.contains_key(&context.owner_team_id))
     {
-        crate::state::projection::project_top_level_view(&raw, &request.owner_team_id)
-    } else if top_level_state_matches_owner_team(&raw, &request.owner_team_id) {
+        crate::state::projection::project_top_level_view(&raw, &context.owner_team_id)
+    } else if top_level_state_matches_owner_team(&raw, &context.owner_team_id) {
         raw
     } else {
         return Ok(false);
     };
     let Some(agent) = state
         .get("agents")
-        .and_then(|agents| agents.get(&request.recipient))
+        .and_then(|agents| agents.get(&context.recipient))
     else {
         return Ok(false);
     };
+    if agent.get("status").and_then(serde_json::Value::as_str) != Some("running")
+        || agent
+            .get("explicit_stop")
+            .and_then(serde_json::Value::as_bool)
+            == Some(true)
+    {
+        return Ok(false);
+    }
+    // An unbound job is still an observable scheduled job, but never key authority.
+    let Some(target) = context.target.as_ref() else {
+        return Ok(true);
+    };
     Ok(
-        agent.get("status").and_then(serde_json::Value::as_str) == Some("running")
-            && agent
-                .get("explicit_stop")
-                .and_then(serde_json::Value::as_bool)
-                != Some(true)
-            && agent.get("pane_id").and_then(serde_json::Value::as_str)
-                == Some(request.pane_id.as_str())
+        agent.get("pane_id").and_then(serde_json::Value::as_str) == Some(target.pane_id.as_str())
             && agent.get("pane_pid").and_then(serde_json::Value::as_u64)
-                == Some(u64::from(request.pane_pid))
-            && request.pane_pid == evidence.binding.pane_pid
+                == Some(u64::from(target.pane_pid))
             && state
                 .get("session_name")
                 .and_then(serde_json::Value::as_str)
-                == Some(request.session.as_str())
+                == Some(target.session.as_str())
             && agent
                 .get("window")
                 .and_then(serde_json::Value::as_str)
-                .unwrap_or(&request.recipient)
-                == request.window
+                .unwrap_or(&context.recipient)
+                == target.window
             && agent.get("provider").cloned().and_then(|value| {
                 serde_json::from_value::<crate::model::enums::Provider>(value).ok()
-            }) == Some(request.provider),
+            }) == Some(target.provider),
     )
 }
 
-/// Called only for due jobs. CAS precedes every possible effect; stale `claimed`
-/// rows intentionally remain unknown after a crash, rather than becoming runnable.
 pub(super) fn fire(
     workspace: &Path,
     store: &MessageStore,
@@ -215,56 +249,39 @@ pub(super) fn fire(
     id: i64,
     payload: &str,
 ) -> Result<bool, MessagingError> {
-    fire_with(
-        workspace,
-        store,
-        log,
-        id,
-        payload,
-        &|evidence, authorize| {
-            super::delivery::with_rescue_submit_observer(
-                workspace,
-                store,
-                evidence,
-                log,
-                |observer| {
-                    transport
-                        .rescue_enter(evidence, authorize, Some(observer))
-                        .map_err(Into::into)
-                },
-            )
-        },
-    )
+    fire_with(workspace, store, log, id, payload, &|context, authorize| {
+        super::delivery::with_rescue_submit_observer(workspace, store, context, log, |observer| {
+            transport
+                .rescue_enter_guarded(context, authorize, Some(observer))
+                .map_err(Into::into)
+        })
+    })
 }
 
+type Executor<'a> = dyn Fn(&EnterRescueContext, &dyn Fn() -> bool) -> Result<EnterRescueOutcome, MessagingError>
+    + 'a;
+
 fn fire_with(
     workspace: &Path,
     store: &MessageStore,
     log: &EventLog,
     id: i64,
     payload: &str,
-    execute: &dyn Fn(
-        &NativeInputEvidence,
-        &dyn Fn() -> bool,
-    ) -> Result<EnterRescueOutcome, MessagingError>,
+    execute: &Executor<'_>,
 ) -> Result<bool, MessagingError> {
     let conn = crate::db::schema::open_db(store.db_path())?;
     if conn.execute(
-        "update scheduled_events set status='claimed', fired_at=?2
-         where id=?1 and kind='enter_rescue' and status='pending' and due_at<=?2 and payload_json=?3",
+        "update scheduled_events set status='claimed',fired_at=?2 where id=?1 and kind='enter_rescue'
+         and status='pending' and due_at<=?2 and payload_json=?3",
         params![id, Utc::now().to_rfc3339(), payload],
     )? != 1 { return Ok(false); }
-    log.write("enter_rescue.claimed", serde_json::json!({"event_id": id}))?;
+    log.write("enter_rescue.claimed", serde_json::json!({"event_id":id}))?;
     let result = (|| -> Result<(String, serde_json::Value, Option<String>), MessagingError> {
         let job: RescueJob = serde_json::from_str(payload)?;
+        let context = &job.context;
         let scope_matches: bool = conn.query_row(
-            "select owner_team_id=?2 and target=?3 from scheduled_events where id=?1",
-            params![
-                id,
-                job.evidence.request.owner_team_id,
-                job.evidence.request.recipient
-            ],
-            |row| row.get(0),
+            "select coalesce(owner_team_id,'')=?2 and target=?3 and created_at=?4 from scheduled_events where id=?1",
+            params![id, context.owner_team_id, context.recipient, job.registered_at], |row| row.get(0),
         )?;
         if !scope_matches {
             return Ok((
@@ -280,12 +297,26 @@ fn fire_with(
                 None,
             ));
         }
-        let authorize = || canonical_valid(workspace, store, &job).unwrap_or(false);
-        let outcome = execute(&job.evidence, &authorize)?;
-        match outcome {
+        if !context.target.as_ref().is_some_and(|target| target.bound()) || !context.valid_proof() {
+            return Ok((
+                "refused".into(),
+                serde_json::json!({"reason":"proof_missing","effect":"none"}),
+                None,
+            ));
+        }
+        let authorize = || {
+            let still_claimed: bool = conn.query_row(
+                "select exists(select 1 from scheduled_events where id=?1 and kind='enter_rescue'
+                 and status='claimed' and payload_json=?2 and owner_team_id=?3 and target=?4)",
+                params![id, payload, context.owner_team_id, context.recipient], |row| row.get(0),
+            ).unwrap_or(false);
+            still_claimed && canonical_valid(workspace, store, &job).unwrap_or(false)
+        };
+        match execute(context, &authorize)? {
             EnterRescueOutcome::NoEffect { reason, reobserve } => {
                 let next = Utc::now() + Duration::seconds(5);
-                let due = (reobserve && next <= expiration(&job)?).then(|| next.to_rfc3339());
+                let due =
+                    (reobserve && next <= timestamp(&job.expires_at)?).then(|| next.to_rfc3339());
                 Ok((
                     if due.is_some() { "pending" } else { "refused" }.into(),
                     serde_json::json!({"reason":reason,"effect":"none"}),
@@ -293,12 +324,10 @@ fn fire_with(
                 ))
             }
             EnterRescueOutcome::Consumed | EnterRescueOutcome::Entered { accepted: true } => {
-                // Row-level CAS cannot downgrade an acknowledgement/other terminal owner.
                 let changed = conn.execute(
                     "update messages set status='delivered',delivered_at=?2,updated_at=?2,error=null
                      where message_id=?1 and status='submitted_unverified' and owner_team_id=?3 and recipient=?4",
-                    params![job.evidence.request.message_id, Utc::now().to_rfc3339(),
-                        job.evidence.request.owner_team_id, job.evidence.request.recipient],
+                    params![context.message_id, Utc::now().to_rfc3339(), context.owner_team_id, context.recipient],
                 )?;
                 Ok((
                     "done".into(),
@@ -313,14 +342,13 @@ fn fire_with(
             )),
         }
     })();
-    let (status, result, due) = match result {
-        Ok(result) => result,
-        Err(error) => (
+    let (status, result, due) = result.unwrap_or_else(|error| {
+        (
             "unknown".into(),
             serde_json::json!({"error":error.to_string(),"retry":false}),
             None,
-        ),
-    };
+        )
+    });
     conn.execute(
         "update scheduled_events set status=?2,result_json=?3,due_at=coalesce(?4,due_at)
          where id=?1 and kind='enter_rescue' and status='claimed'",