@team-agent/installer 0.5.2 → 0.5.3

package/Cargo.lock

@@ -100,6 +100,7 @@ version = "0.1.0"
 dependencies = [
  "serde",
  "serde_json",
+ "windows",
 ]
 
 [[package]]
@@ -574,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.2"
+version = "0.5.3"
 dependencies = [
  "anyhow",
  "chrono",
@@ -587,6 +588,7 @@ dependencies = [
  "serial_test",
  "sha2",
  "thiserror",
+ "windows",
 ]
 
 [[package]]

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.2"
+version = "0.5.3"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/Cargo.toml

@@ -27,6 +27,26 @@ chrono.workspace = true
 libc.workspace = true
 rusqlite.workspace = true       # step 3 db(bundled SQLite,静态链接)
 
+# 0.5.x Windows portability Batch 2/3: uses the same `windows = "0.61"`
+# crate as `win-conpty-phase0` so the workspace shares a single
+# Windows-API crate + already-locked Cargo.lock version.
+#
+# - Batch 2 (`platform::file_lock`): `Win32_Storage_FileSystem`
+#   (`LockFileEx`/`UnlockFileEx`) + `Win32_System_IO::OVERLAPPED`.
+# - Batch 3 (`platform::process`): `Win32_System_Threading`
+#   (`OpenProcess`, `TerminateProcess`, `GetExitCodeProcess`,
+#   `GetCurrentProcessId`) + `Win32_System_Diagnostics_ToolHelp`
+#   (Toolhelp snapshot for parent-pid discovery).
+[target.'cfg(windows)'.dependencies.windows]
+version = "0.61"
+features = [
+    "Win32_Foundation",
+    "Win32_Storage_FileSystem",
+    "Win32_System_IO",
+    "Win32_System_Threading",
+    "Win32_System_Diagnostics_ToolHelp",
+]
+
 [dev-dependencies]
 serial_test = { version = "3", features = ["file_locks"] }
 

package/crates/team-agent/src/cli/emit.rs

@@ -1517,10 +1517,15 @@ fn peek_args(args: &[String], cwd: &Path) -> Result<PeekArgs, CliError> {
 fn run_coordinator(args: &[String], cwd: &Path) -> Result<ExitCode, CliError> {
     let parsed = parse_args(args);
     let workspace = crate::coordinator::WorkspacePath::new(workspace(&parsed, cwd));
+    // 0.5.x Windows portability Batch 9 F8: pass `--team` through
+    // to the daemon so it doesn't have to derive from state at
+    // boot time. `parse_args` already recognizes `--team`; we just
+    // thread the value into `DaemonArgs::team_key`.
     crate::coordinator::run_daemon(crate::coordinator::DaemonArgs {
         workspace,
         once: parsed.once,
         tick_interval_sec: parsed.tick_interval,
+        team_key: parsed.team.clone(),
     })
     .map(|()| ExitCode::Ok)
     .map_err(|e| CliError::Runtime(e.to_string()))

package/crates/team-agent/src/cli/mod.rs

@@ -943,7 +943,17 @@ pub mod lifecycle_port {
                 }),
             )
             .map_err(|e| CliError::Runtime(e.to_string()))?;
-        Ok(json!({
+        // 0.5.x Windows portability Batch 6 Option A (leader
+        // constraint 3): if a ConPTY shim was recorded in
+        // `state.transport.shim.pid`, terminate it explicitly via
+        // `platform::process::terminate_pid`.
+        //
+        // Batch 7 refinement: the field is emitted into the shutdown
+        // JSON only on Windows so Unix golden fixtures stay
+        // byte-preserving. The Unix behavior is a no-op (no shim
+        // concept there); adding a placeholder key would just noise
+        // up the fixtures.
+        let mut response = json!({
             "ok": ok,
             "status": status,
             "phase": phase,
@@ -966,8 +976,59 @@ pub mod lifecycle_port {
             "coordinator": {
                 "status": coordinator_status,
                 "pid": coordinator_pid,
+            },
+        });
+        #[cfg(windows)]
+        {
+            if let Some(obj) = response.as_object_mut() {
+                obj.insert(
+                    "conpty_shim".to_string(),
+                    shutdown_conpty_shim(&run_workspace),
+                );
             }
-        }))
+        }
+        #[cfg(not(windows))]
+        {
+            let _ = &run_workspace;
+        }
+        Ok(response)
+    }
+
+    /// 0.5.x Windows portability Batch 6 Option A: locate and
+    /// terminate the ConPTY shim if `state.transport.shim.pid` is
+    /// recorded. Returns a JSON blob for the shutdown response so
+    /// operators can distinguish "no shim was ever launched" from
+    /// "shim terminated cleanly" from "shim already gone".
+    ///
+    /// Windows-only; caller (`shutdown_with_transport_and_state`)
+    /// only invokes on Windows. Unix has no shim concept.
+    #[cfg(windows)]
+    fn shutdown_conpty_shim(workspace: &Path) -> serde_json::Value {
+        let Some(pid) = crate::coordinator::conpty_shim::recorded_shim_pid(workspace) else {
+            return json!({ "action": "no_shim_recorded" });
+        };
+        // Prefer graceful termination — Windows maps this to
+        // `TerminationOutcome::ForceOnly` (Batch 3 anchor: no
+        // SIGTERM equivalent for non-console child), which
+        // surfaces the honest audit signal in the JSON.
+        let outcome = crate::platform::process::terminate_pid(
+            pid,
+            crate::platform::process::SignalKind::TerminateForce,
+        );
+        match outcome {
+            Ok(crate::platform::process::TerminationOutcome::Requested) => {
+                json!({ "pid": pid, "action": "terminated" })
+            }
+            Ok(crate::platform::process::TerminationOutcome::AlreadyGone) => {
+                json!({ "pid": pid, "action": "already_gone" })
+            }
+            Ok(crate::platform::process::TerminationOutcome::ForceOnly { reason }) => {
+                json!({ "pid": pid, "action": "terminated_force_only", "reason": reason })
+            }
+            Err(e) => {
+                json!({ "pid": pid, "action": "terminate_failed", "reason": e.to_string() })
+            }
+        }
     }
 
     /// T5 (harvest §1 / A2): the bounded stop RETAINS the JoinHandle and reclaims the
@@ -1353,34 +1414,48 @@ pub mod lifecycle_port {
             return;
         }
         for pid in pids.iter().rev() {
-            send_process_signal(*pid, libc::SIGTERM);
+            let _ = crate::platform::process::terminate_pid(
+                *pid,
+                crate::platform::process::SignalKind::TerminateGraceful,
+            );
         }
         std::thread::sleep(std::time::Duration::from_millis(150));
         for pid in pids.iter().rev() {
-            send_process_signal(*pid, libc::SIGKILL);
+            let _ = crate::platform::process::terminate_pid(
+                *pid,
+                crate::platform::process::SignalKind::TerminateForce,
+            );
         }
         wait_for_processes_gone(&pids, std::time::Duration::from_secs(1));
     }
 
     fn reap_process_groups(pgids: &[u32], protected: &ShutdownProtection) {
+        // 0.5.x Windows portability Batch 3: routes group termination
+        // through `platform::process::terminate_group`. Unix keeps
+        // `kill(-pgid, SIGTERM|SIGKILL)` semantics byte-for-byte;
+        // Windows returns AlreadyGone (no pgid concept — Job Object
+        // teardown is the shim-side concern per design §Route B).
+        // The `pgid_t <= 1 || protected.contains_pgid(...)` filter
+        // stays in place so pgid 0/1 (kernel/init) and the caller's
+        // own group are never targeted.
         for pgid in pgids {
-            let Ok(pgid_t) = libc::pid_t::try_from(*pgid) else {
-                continue;
-            };
-            if pgid_t <= 1 || protected.contains_pgid(*pgid) {
+            if *pgid <= 1 || protected.contains_pgid(*pgid) {
                 continue;
             }
-            send_process_signal_group(pgid_t, libc::SIGTERM);
+            let _ = crate::platform::process::terminate_group(
+                *pgid,
+                crate::platform::process::SignalKind::TerminateGraceful,
+            );
         }
         std::thread::sleep(std::time::Duration::from_millis(150));
         for pgid in pgids {
-            let Ok(pgid_t) = libc::pid_t::try_from(*pgid) else {
-                continue;
-            };
-            if pgid_t <= 1 || protected.contains_pgid(*pgid) {
+            if *pgid <= 1 || protected.contains_pgid(*pgid) {
                 continue;
             }
-            send_process_signal_group(pgid_t, libc::SIGKILL);
+            let _ = crate::platform::process::terminate_group(
+                *pgid,
+                crate::platform::process::SignalKind::TerminateForce,
+            );
         }
     }
 
@@ -1705,7 +1780,10 @@ pub mod lifecycle_port {
         let mut protected = ShutdownProtection::default();
         let current = std::process::id();
         protected.pids.insert(current);
-        if let Ok(pgid) = u32::try_from(unsafe { libc::getpgrp() }) {
+        // 0.5.x Windows portability Batch 3: use platform primitive.
+        // Windows returns None (no pgid concept) and the branch is
+        // skipped honestly.
+        if let Some(pgid) = crate::platform::process::current_process_group() {
             protected.pgids.insert(pgid);
         }
         let mut cursor = current;
@@ -1840,56 +1918,33 @@ pub mod lifecycle_port {
         }
     }
 
-    fn send_process_signal(pid: u32, signal: libc::c_int) {
-        let Ok(pid_t) = libc::pid_t::try_from(pid) else {
-            return;
-        };
-        unsafe {
-            libc::kill(pid_t, signal);
-        }
-    }
-
-    fn send_process_signal_group(pgid: libc::pid_t, signal: libc::c_int) {
-        unsafe {
-            libc::kill(-pgid, signal);
-        }
-    }
+    // 0.5.x Windows portability Batch 3: the four inline helpers
+    // (send_process_signal, send_process_signal_group,
+    // reap_child_if_possible, process_is_live) have been replaced
+    // by direct calls through `crate::platform::process::*` at the
+    // shutdown callsites above. The private helpers are removed so
+    // there's a single source of truth for signal/waitpid/liveness
+    // semantics; Unix behavior is byte-preserving (SignalKind maps
+    // 1:1 to SIGTERM/SIGKILL, ProcessLiveness::Live == the previous
+    // `kill(pid, 0) == 0 || EPERM` branch).
 
     fn wait_for_processes_gone(pids: &[u32], timeout: std::time::Duration) {
         let start = std::time::Instant::now();
         loop {
             for pid in pids {
-                reap_child_if_possible(*pid);
+                crate::platform::process::reap_child_if_possible(*pid);
             }
-            if !pids.iter().any(|pid| process_is_live(*pid)) || start.elapsed() >= timeout {
+            if !pids
+                .iter()
+                .any(|pid| crate::platform::process::pid_is_alive(*pid))
+                || start.elapsed() >= timeout
+            {
                 return;
             }
             std::thread::sleep(std::time::Duration::from_millis(25));
         }
     }
 
-    fn reap_child_if_possible(pid: u32) {
-        let Ok(pid_t) = libc::pid_t::try_from(pid) else {
-            return;
-        };
-        let mut status = 0;
-        unsafe {
-            libc::waitpid(pid_t, &mut status, libc::WNOHANG);
-        }
-    }
-
-    fn process_is_live(pid: u32) -> bool {
-        let Ok(pid_t) = libc::pid_t::try_from(pid) else {
-            return false;
-        };
-        let rc = unsafe { libc::kill(pid_t, 0) };
-        if rc == 0 {
-            return true;
-        }
-        let err = std::io::Error::last_os_error();
-        err.raw_os_error() == Some(libc::EPERM)
-    }
-
     fn process_pgids(
         pids: &[u32],
         protected: &ShutdownProtection,
@@ -1900,8 +1955,15 @@ pub mod lifecycle_port {
             .filter_map(|pid| table.iter().find(|process| process.pid == *pid))
             .filter_map(|process| process.pgid)
             .filter(|pgid| {
-                libc::pid_t::try_from(*pgid)
-                    .map(|pgid_t| pgid_t > 1 && !protected.contains_pgid(*pgid))
+                // 0.5.x Windows portability Batch 4: `libc::pid_t` was
+                // used here as a signed-integer conversion gate to
+                // reject values > INT_MAX. Replace with the equivalent
+                // `i32::try_from` (pgid_t is `c_int` on every Unix we
+                // support). Windows has no pgid concept so `pgids`
+                // is empty in practice — the filter is dead code on
+                // Windows but must still compile.
+                i32::try_from(*pgid)
+                    .map(|pgid_int| pgid_int > 1 && !protected.contains_pgid(*pgid))
                     .unwrap_or(false)
             })
             .collect::<Vec<_>>();
@@ -1927,7 +1989,10 @@ pub mod lifecycle_port {
             .map(|process| process.pid)
             .collect::<std::collections::BTreeSet<_>>();
         for pid in root_pids {
-            if !protected.contains_pid(*pid) && process_is_live(*pid) && seen.insert(*pid) {
+            if !protected.contains_pid(*pid)
+                && crate::platform::process::pid_is_alive(*pid)
+                && seen.insert(*pid)
+            {
                 residuals.push(ProcessInfo {
                     pid: *pid,
                     ppid: 0,

package/crates/team-agent/src/cli/tests/named_address.rs

@@ -355,6 +355,9 @@ fn resolve_leader_name_after_rebind() {
     let _ = std::fs::remove_dir_all(&ws);
 }
 
+// 0.5.x Windows portability Batch 5: `FakeAppServer` uses Unix
+// domain sockets — Unix-only.
+#[cfg(unix)]
 #[test]
 fn resolve_app_server_leader_name_uses_typed_receiver_not_tmux_pane() {
     let ws = named_ws("appserver-leader-resolve");
@@ -419,6 +422,7 @@ fn resolve_app_server_leader_name_fails_closed_on_transport_conflict() {
     let _ = std::fs::remove_dir_all(&ws);
 }
 
+#[cfg(unix)]
 #[test]
 fn send_to_name_app_server_leader_submits_turn_without_tmux_pane() {
     let ws = named_ws("appserver-leader-send");

package/crates/team-agent/src/codex_app_server.rs

@@ -1,10 +1,31 @@
 //! Minimal Codex app-server Unix-socket WebSocket client for leader delivery.
+//!
+//! 0.5.x Windows portability Batch 1: this client is fundamentally
+//! Unix-only (`UnixStream` WebSocket handshake, uid/mode socket
+//! ownership check). On Windows we still expose the same public API
+//! surface so `messaging/delivery.rs`, `cli/send.rs`, `cli/named_address.rs`,
+//! `leader/lease.rs` compile identically. Windows implementations of
+//! `attach_probe` + `submit_to_bound_thread` return
+//! `AppServerError::SocketUnreachable("codex_app_server unix socket not supported on this platform (Windows)")`
+//! (N38 three-line typed unsupported: code+reason+action are baked into
+//! `AppServerError::code()` and the `Display` impl). Truth source:
+//! `.team/artifacts/0.5.x-windows-portability-survey-design.md` §Batch 1.
+//!
+//! Portable pieces below (types, JSON helpers) stay unconditional so
+//! `receiver_is_app_server` / `binding_from_receiver` work identically
+//! everywhere.
 
 use serde_json::{json, Value};
+#[cfg(unix)]
 use std::io::{Read, Write};
+#[cfg(unix)]
 use std::os::unix::fs::{FileTypeExt, MetadataExt, PermissionsExt};
+#[cfg(unix)]
 use std::os::unix::net::UnixStream;
-use std::path::{Path, PathBuf};
+#[cfg(unix)]
+use std::path::Path;
+use std::path::PathBuf;
+#[cfg(unix)]
 use std::time::Duration;
 
 pub const APP_SERVER_PROTOCOL_FIXTURE_CLI_MIN: &str = "0.139.0";
@@ -79,6 +100,7 @@ impl std::fmt::Display for AppServerError {
 
 impl std::error::Error for AppServerError {}
 
+#[cfg(unix)]
 pub fn attach_probe(endpoint: &str, thread_id: &str) -> Result<AppServerBinding, AppServerError> {
     check_socket_ownership(endpoint)?;
     let socket = socket_path(endpoint)?;
@@ -95,6 +117,21 @@ pub fn attach_probe(endpoint: &str, thread_id: &str) -> Result<AppServerBinding,
     })
 }
 
+/// Batch 1 Windows N38 typed-unsupported stub. Callers see the same
+/// `AppServerError` shape as Unix — no silent success, no panic.
+#[cfg(not(unix))]
+pub fn attach_probe(
+    _endpoint: &str,
+    _thread_id: &str,
+) -> Result<AppServerBinding, AppServerError> {
+    Err(AppServerError::SocketUnreachable(
+        "codex_app_server unix-socket client not supported on this platform \
+         (Windows); use codex CLI stdio or ConPTY worker delivery instead"
+            .to_string(),
+    ))
+}
+
+#[cfg(unix)]
 pub fn submit_to_bound_thread(
     binding: &AppServerBinding,
     message_id: &str,
@@ -108,6 +145,19 @@ pub fn submit_to_bound_thread(
     client.turn_start(&binding.thread_id, message_id, rendered)
 }
 
+#[cfg(not(unix))]
+pub fn submit_to_bound_thread(
+    _binding: &AppServerBinding,
+    _message_id: &str,
+    _rendered: &str,
+) -> Result<AppServerSubmit, AppServerError> {
+    Err(AppServerError::SocketUnreachable(
+        "codex_app_server unix-socket submit not supported on this platform \
+         (Windows); use codex CLI stdio or ConPTY worker delivery instead"
+            .to_string(),
+    ))
+}
+
 pub fn binding_from_receiver(receiver: &Value) -> Result<AppServerBinding, AppServerError> {
     let app = receiver
         .get("app_server")
@@ -135,6 +185,7 @@ fn required_str<'a>(value: &'a Value, field: &str) -> Result<&'a str, AppServerE
         .ok_or_else(|| AppServerError::ProtocolMismatch(format!("missing {field}")))
 }
 
+#[cfg(unix)]
 fn validate_tuple(
     binding: &AppServerBinding,
     user_agent: &str,
@@ -163,6 +214,7 @@ fn validate_tuple(
     Ok(())
 }
 
+#[cfg(unix)]
 fn check_socket_ownership(endpoint: &str) -> Result<(), AppServerError> {
     let path = socket_path(endpoint)?;
     let meta = std::fs::metadata(&path)
@@ -189,6 +241,7 @@ fn check_socket_ownership(endpoint: &str) -> Result<(), AppServerError> {
     Ok(())
 }
 
+#[cfg(unix)]
 fn socket_path(endpoint: &str) -> Result<PathBuf, AppServerError> {
     let raw = endpoint.strip_prefix("unix://").unwrap_or(endpoint);
     if raw.is_empty() {
@@ -199,17 +252,20 @@ fn socket_path(endpoint: &str) -> Result<PathBuf, AppServerError> {
     Ok(PathBuf::from(raw))
 }
 
+#[cfg(unix)]
 struct ThreadResume {
     thread_id: String,
     session_id: String,
     cwd: String,
 }
 
+#[cfg(unix)]
 struct AppServerClient {
     stream: UnixStream,
     next_id: u64,
 }
 
+#[cfg(unix)]
 impl AppServerClient {
     fn connect(path: &Path) -> Result<Self, AppServerError> {
         let mut stream = UnixStream::connect(path)
@@ -386,17 +442,20 @@ impl AppServerClient {
     }
 }
 
+#[cfg(unix)]
 fn is_approval_method(method: &str) -> bool {
     method.contains("requestApproval")
         || method.contains("requestUserInput")
         || method.contains("elicitation/request")
 }
 
+#[cfg(unix)]
 fn looks_busy(message: &str) -> bool {
     let lower = message.to_ascii_lowercase();
     lower.contains("active turn") || lower.contains("already has") || lower.contains("busy")
 }
 
+#[cfg(unix)]
 fn read_http_response(stream: &mut UnixStream) -> Result<String, AppServerError> {
     let mut data = Vec::new();
     let mut buf = [0u8; 1];
@@ -414,6 +473,7 @@ fn read_http_response(stream: &mut UnixStream) -> Result<String, AppServerError>
     Ok(String::from_utf8_lossy(&data).to_string())
 }
 
+#[cfg(unix)]
 fn write_ws_text(stream: &mut UnixStream, text: &str) -> Result<(), AppServerError> {
     let payload = text.as_bytes();
     let mut frame = vec![0x81];
@@ -436,6 +496,7 @@ fn write_ws_text(stream: &mut UnixStream, text: &str) -> Result<(), AppServerErr
         .map_err(|e| AppServerError::Io(e.to_string()))
 }
 
+#[cfg(unix)]
 fn read_ws_text(stream: &mut UnixStream) -> Result<String, AppServerError> {
     loop {
         let mut header = [0u8; 2];