@team-agent/installer 0.5.2 → 0.5.4

package/crates/team-agent/src/coordinator/health.rs

@@ -53,6 +53,21 @@ pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
 /// `start_coordinator`(`lifecycle.py:49-121`):幂等 — 已健康 no-op(AlreadyRunning);metadata 不兼容
 /// 先 stop 再起;schema 不兼容拒启 + hint;否则 spawn `team-agent coordinator --workspace <ws>`。
 pub fn start_coordinator(workspace: &WorkspacePath) -> Result<StartReport, StartError> {
+    start_coordinator_with_team(workspace, None)
+}
+
+/// 0.5.x Windows portability Batch 9 F8 (leader msg_2a4cc1fa54c0):
+/// forward `--team` to the spawned coord daemon so it doesn't have
+/// to derive team_key from `state.active_team_key` at boot. The
+/// derivation stays as fallback (see `coordinator::backoff::run_daemon`),
+/// so Unix daemons and pre-existing test harnesses are byte-preserving.
+///
+/// Callers that CAN pass team_key (Batch 9 quick-start Windows path)
+/// SHOULD — that avoids Batch 8's F8 seed-state trap.
+pub fn start_coordinator_with_team(
+    workspace: &WorkspacePath,
+    team_key: Option<&str>,
+) -> Result<StartReport, StartError> {
     let health = coordinator_health(workspace);
     if health.ok {
         return Ok(StartReport {
@@ -101,7 +116,13 @@ pub fn start_coordinator(workspace: &WorkspacePath) -> Result<StartReport, Start
     let mut command = Command::new(std::env::current_exe()?);
     command
         .args(["coordinator", "--workspace"])
-        .arg(workspace.as_path())
+        .arg(workspace.as_path());
+    if let Some(tk) = team_key {
+        if !tk.is_empty() {
+            command.args(["--team", tk]);
+        }
+    }
+    command
         .stdin(Stdio::null())
         .stdout(Stdio::from(log))
         .stderr(Stdio::from(log_err));
@@ -135,7 +156,23 @@ fn detach_daemon_child(command: &mut Command) {
     }
 }
 
-#[cfg(not(unix))]
+#[cfg(windows)]
+fn detach_daemon_child(command: &mut Command) {
+    // 0.5.x Windows portability Batch 8 F7 (leader msg_590b4dce0f68):
+    // detach the coordinator daemon on Windows via
+    // `DETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB` creation flags,
+    // matching what `coordinator::conpty_shim::spawn_shim_and_handshake`
+    // does for the shim. Without these flags, an SSH-launched
+    // quick-start blocks waiting for the coord daemon's process
+    // tree to exit (never happens — daemon runs forever), and the
+    // quick-start caller sees a hung command.
+    use std::os::windows::process::CommandExt;
+    const DETACHED_PROCESS: u32 = 0x00000008;
+    const CREATE_BREAKAWAY_FROM_JOB: u32 = 0x01000000;
+    command.creation_flags(DETACHED_PROCESS | CREATE_BREAKAWAY_FROM_JOB);
+}
+
+#[cfg(not(any(unix, windows)))]
 fn detach_daemon_child(_command: &mut Command) {}
 
 /// `stop_coordinator`(`lifecycle.py:228-247`):SIGTERM pid + 清 pid/meta → typed report。
@@ -272,16 +309,32 @@ fn coordinator_command_matches_workspace(command: &str, workspaces: &[String]) -
 }
 
 fn terminate_pid(pid: Pid) -> bool {
+    // 0.5.x Windows portability Batch 3: routes signal delivery through
+    // `platform::process::terminate_pid`. Unix keeps
+    // SIGTERM → 5s grace → SIGKILL semantics byte-for-byte
+    // (`SignalKind::TerminateGraceful` → SIGTERM,
+    // `SignalKind::TerminateForce` → SIGKILL). Windows performs
+    // `TerminateProcess` for both kinds; the `TerminationOutcome::ForceOnly`
+    // return on the graceful call is what a future audit-event
+    // emitter (CR C-6) will trigger `platform.terminate_force_only`
+    // on. For this batch the return value is discarded, matching the
+    // current inline `let _ = send_signal(...)` pattern.
     if pid_is_running(pid).ok() == Some(false) {
         return true;
     }
     let pids = process_tree_pids(pid);
     for child in pids.iter().rev() {
-        let _ = send_signal(*child, libc::SIGTERM);
+        let _ = crate::platform::process::terminate_pid(
+            child.get(),
+            crate::platform::process::SignalKind::TerminateGraceful,
+        );
     }
     if !wait_until_all_not_running(&pids, Duration::from_secs(5)) {
         for child in pids.iter().rev() {
-            let _ = send_signal(*child, libc::SIGKILL);
+            let _ = crate::platform::process::terminate_pid(
+                child.get(),
+                crate::platform::process::SignalKind::TerminateForce,
+            );
         }
     }
     wait_until_all_not_running(&pids, Duration::from_secs(5))
@@ -348,16 +401,17 @@ fn wait_until_all_not_running(pids: &[Pid], timeout: Duration) -> bool {
 }
 
 fn reap_child_if_possible(pid: Pid) {
-    let Ok(pid_t) = libc::pid_t::try_from(pid.get()) else {
-        return;
-    };
-    let mut status = 0;
-    unsafe {
-        libc::waitpid(pid_t, &mut status, libc::WNOHANG);
-    }
+    // Batch 3: routed through `platform::process`. Unix `waitpid
+    // (WNOHANG)`; Windows no-op (no zombie model).
+    crate::platform::process::reap_child_if_possible(pid.get());
 }
 
+#[cfg(unix)]
+#[allow(dead_code)]
 fn send_signal(pid: Pid, signal: libc::c_int) -> bool {
+    // Retained (dead code post-Batch-3) as a Unix-only helper for any
+    // future non-standard signal delivery. All product paths now use
+    // `crate::platform::process::terminate_pid` with `SignalKind`.
     let Ok(pid_t) = libc::pid_t::try_from(pid.get()) else {
         return false;
     };
@@ -383,6 +437,21 @@ fn wait_until_not_running(pid: Pid, timeout: Duration) -> bool {
 
 /// `pid_is_running`(`metadata.py:16-25`):`os.kill(pid, 0)` + `ps -o stat=` 查 zombie(Z* → 不算活)。
 /// §10 fallible:进程探测 I/O 可失败 → Result。
+///
+/// 0.5.x Windows portability Batch 4: this function has UNIQUE
+/// coordinator-metadata semantics — it treats `EPERM` as "not
+/// running" (different from `platform::process::pid_liveness` which
+/// treats `EPERM` as Live) because the coordinator only owns
+/// processes it can signal, and uses `ps -o stat=` for zombie
+/// detection. The `ps` shellout is Unix-only.
+///
+/// On Windows the coordinator-metadata identity check runs through
+/// `platform::process::pid_liveness` instead (Windows has no zombie
+/// state — a process is either Live or Dead — so the additional
+/// `ps stat=` step has no analogue). This preserves the coordinator's
+/// "am I the owner" check without silently reporting stale pids as
+/// alive.
+#[cfg(unix)]
 pub fn pid_is_running(pid: Pid) -> Result<bool, std::io::Error> {
     let Ok(pid_t) = libc::pid_t::try_from(pid.get()) else {
         return Ok(false);
@@ -407,6 +476,23 @@ pub fn pid_is_running(pid: Pid) -> Result<bool, std::io::Error> {
     Ok(!stat.is_empty() && !stat.starts_with('Z'))
 }
 
+/// Windows shim: no `ps stat=` zombie detection needed (Windows has
+/// no zombie state — a process is either Live or Dead). Route through
+/// `platform::process::pid_liveness` and map to bool. The EPERM
+/// semantic ("we can't signal → treat as not running") maps to
+/// Windows `ERROR_ACCESS_DENIED` which the platform layer already
+/// treats as `Live`; so on Windows the coordinator sees a process
+/// it can't query as still-running (safer than pretending it's gone
+/// and losing the ownership handle).
+#[cfg(not(unix))]
+pub fn pid_is_running(pid: Pid) -> Result<bool, std::io::Error> {
+    match crate::platform::process::pid_liveness(pid.get())? {
+        crate::platform::process::ProcessLiveness::Live => Ok(true),
+        crate::platform::process::ProcessLiveness::Dead => Ok(false),
+        crate::platform::process::ProcessLiveness::Unknown { .. } => Ok(false),
+    }
+}
+
 /// `read_coordinator_metadata`(`metadata.py:28-34`)。读 `coordinator.json`;损坏/缺失/非 dict → `None`。
 pub fn read_coordinator_metadata(workspace: &WorkspacePath) -> Option<CoordinatorMetadata> {
     let text = std::fs::read_to_string(coordinator_meta_path(workspace)).ok()?;

package/crates/team-agent/src/coordinator/mod.rs

@@ -62,6 +62,14 @@ use crate::provider::{ProviderAdapter, TurnId, TurnState};
 use serde_json::Value;
 
 pub mod backoff;
+// 0.5.x Windows portability Batch 6 Option A: shim lifecycle
+// manager. Windows-only per design §Shim Lifecycle (the shim binary
+// exists only on Windows; Unix uses tmux). Cfg-gated at the module
+// level so callers can `crate::coordinator::conpty_shim::...`
+// uniformly on Windows and get a compile error (rather than a
+// silent no-op) on Unix — Unix code paths never reach for the shim.
+#[cfg(windows)]
+pub mod conpty_shim;
 pub mod health;
 pub mod orphan;
 pub mod runtime_detectors;

package/crates/team-agent/src/coordinator/tests/daemon.rs

@@ -87,7 +87,7 @@ fn start_coordinator_fresh_workspace_decides_started() {
 fn run_daemon_once_writes_boot_metadata_and_returns_ok() {
     let (wp, dir) = daemon_ws();
     crate::state::persist::save_runtime_state(&dir, &serde_json::json!({"session_name": "team-x", "agents": {}})).unwrap();
-    let r = run_daemon(DaemonArgs { workspace: wp.clone(), once: true, tick_interval_sec: None });
+    let r = run_daemon(DaemonArgs { workspace: wp.clone(), once: true, tick_interval_sec: None, team_key: None });
     assert!(r.is_ok(), "run_daemon --once must return Ok; got {r:?}");
     assert!(coordinator_meta_path(&wp).exists(), "run_daemon must write the coordinator boot metadata");
 }
@@ -438,6 +438,7 @@ fn run_daemon_backs_off_on_transient_tick_err_then_recovers_without_exiting() {
         workspace: WorkspacePath::new(dir.clone()),
         once: false,
         tick_interval_sec: Some(0.01), // tiny backoff so the test is fast
+        team_key: None,
     };
     let result = run_daemon_with_coordinator(&args, &coord);
     assert!(

package/crates/team-agent/src/coordinator/tests/tick_core.rs

@@ -192,6 +192,12 @@ fn p2_tick_skips_tmux_gate_when_session_name_absent() {
 
 // P1 — pid_is_running must use os.kill(pid,0) first: a pid owned by another user (pid 1 /
 // launchd, root) is EPERM → not signalable → False. Current only `ps -p` (rc=0) → True.
+//
+// 0.5.x Windows portability Batch 5: this test's PREMISE is Unix
+// specific (pid 1 = init/launchd, EPERM semantics). On Windows,
+// pid_is_running routes through `platform::process::pid_liveness` which
+// has different accessible-pid semantics. Unix-only test.
+#[cfg(unix)]
 #[test]
 fn p2_pid_is_running_false_for_cross_user_pid() {
     // The cross-user semantics only hold for a non-root caller (root CAN signal pid 1).

package/crates/team-agent/src/coordinator/tick.rs

@@ -553,6 +553,19 @@ impl Coordinator {
                 }),
             )?;
         }
+        for mismatch in &report.identity_mismatches {
+            event_log.write(
+                "provider.session.identity_mismatch",
+                serde_json::json!({
+                    "agent_id": mismatch.agent_id,
+                    "expected_agent_id": mismatch.expected_agent_id,
+                    "embedded_agent_id": mismatch.embedded_agent_id,
+                    "session_id": mismatch.session_id,
+                    "rollout_path": mismatch.rollout_path,
+                    "spawn_cwd": mismatch.spawn_cwd,
+                }),
+            )?;
+        }
         for ambiguous in report.ambiguous {
             let candidate_count = report
                 .candidate_count_by_agent

package/crates/team-agent/src/diagnose/orphans.rs

@@ -342,14 +342,25 @@ fn tmux_socket_names() -> Vec<String> {
 }
 
 fn tmux_socket_roots() -> Vec<PathBuf> {
-    let uid = unsafe { libc::geteuid() };
-    let mut roots = vec![PathBuf::from(format!("/tmp/tmux-{uid}"))];
-    if let Some(tmpdir) = std::env::var_os("TMPDIR") {
-        roots.push(PathBuf::from(tmpdir).join(format!("tmux-{uid}")));
+    // 0.5.x Windows portability Batch 1: tmux orphan scan is Unix-only
+    // (design §Layering Strategy — "ConPTY orphan diagnostics should be
+    // a separate shim registry command later"). On Windows return
+    // empty so the caller loops zero times honestly.
+    #[cfg(unix)]
+    {
+        let uid = unsafe { libc::geteuid() };
+        let mut roots = vec![PathBuf::from(format!("/tmp/tmux-{uid}"))];
+        if let Some(tmpdir) = std::env::var_os("TMPDIR") {
+            roots.push(PathBuf::from(tmpdir).join(format!("tmux-{uid}")));
+        }
+        roots.sort();
+        roots.dedup();
+        roots
+    }
+    #[cfg(not(unix))]
+    {
+        Vec::new()
     }
-    roots.sort();
-    roots.dedup();
-    roots
 }
 
 fn tmux_list_panes(socket: &str) -> Vec<TmuxPaneRow> {

package/crates/team-agent/src/leader/provider_attribution.rs

@@ -98,44 +98,29 @@ fn provider_wire_for_command_attribution(provider: Provider) -> &'static str {
     }
 }
 
-#[cfg(target_os = "linux")]
+// 0.5.x Windows portability Batch 4: process command-line + environ
+// probes route through `crate::platform::argv`. Unix keeps
+// byte-preserving semantics (Linux `/proc/<pid>/cmdline` + `environ`;
+// other Unix `ps -p ... -o command=`; macOS environ is `None` because
+// the pre-batch code also returned `None` on non-Linux). Windows
+// returns `None` per design §Batch 4 conservative anchor (unknown
+// argv must never infer elevated approval).
+//
+// The command-line format expected by the caller is a
+// whitespace-joined single string, so we join the argv tokens after
+// the platform probe. On the non-Linux Unix `ps` fallback path the
+// tokens come already whitespace-split from `ps -o command=`; joining
+// them back with spaces reproduces the exact pre-batch shape.
 fn process_command_line(pid: u32) -> Option<String> {
-    let bytes = std::fs::read(format!("/proc/{pid}/cmdline")).ok()?;
-    let parts = bytes
-        .split(|byte| *byte == 0)
-        .filter(|part| !part.is_empty())
-        .map(|part| String::from_utf8_lossy(part).to_string())
-        .collect::<Vec<_>>();
-    (!parts.is_empty()).then(|| parts.join(" "))
-}
-
-#[cfg(target_os = "linux")]
-fn process_environment(pid: u32) -> Option<String> {
-    String::from_utf8(std::fs::read(format!("/proc/{pid}/environ")).ok()?).ok()
-}
-
-#[cfg(not(target_os = "linux"))]
-fn process_command_line(pid: u32) -> Option<String> {
-    let output = crate::os_probe::bounded_command_output_with_probe(
-        Command::new("ps")
-            .arg("-p")
-            .arg(pid.to_string())
-            .args(["-o", "command="]),
-        "provider_argv",
-        Some(pid),
-    )
-    .ok()?;
-    output
-        .status
-        .success()
-        .then(|| String::from_utf8_lossy(&output.stdout).trim().to_string())
-        .filter(|text| !text.is_empty())
+    let argv = crate::platform::argv::argv_tokens(pid)?;
+    if argv.is_empty() {
+        return None;
+    }
+    Some(argv.join(" "))
 }
 
-#[cfg(not(target_os = "linux"))]
 fn process_environment(pid: u32) -> Option<String> {
-    let _ = pid;
-    None
+    crate::platform::argv::environ_text(pid)
 }
 
 #[cfg(test)]

package/crates/team-agent/src/leader/tests/lease_api.rs

@@ -303,6 +303,11 @@ fn r8_requeued_exhausted_watchers_event_payload_golden_shape() {
     assert_eq!(payload.get("trigger").and_then(|v| v.as_str()), Some("attach_leader"));
 }
 
+// 0.5.x Windows portability Batch 5: `FakeAppServer` uses UNIX domain
+// sockets to fake the Codex app-server. Codex app-server client is
+// Unix-only (Windows returns typed `SocketUnreachable`), so these
+// tests are Unix-only too.
+#[cfg(unix)]
 #[test]
 fn app_server_attach_writes_transport_kind_tuple_and_advances_epoch() {
     let ws = std::env::temp_dir().join(format!(
@@ -357,6 +362,7 @@ fn app_server_attach_writes_transport_kind_tuple_and_advances_epoch() {
     assert_eq!(saved["owner_epoch"], serde_json::json!(1));
 }
 
+#[cfg(unix)]
 #[test]
 fn app_server_attach_rejects_world_writable_socket_without_state_write() {
     let ws = std::env::temp_dir().join(format!(
@@ -396,6 +402,7 @@ fn app_server_attach_rejects_world_writable_socket_without_state_write() {
     );
 }
 
+#[cfg(unix)]
 #[test]
 fn app_server_attach_rejects_missing_user_agent_without_state_write() {
     let ws = std::env::temp_dir().join(format!(

package/crates/team-agent/src/lib.rs

@@ -78,6 +78,13 @@ pub mod diagnose;
 // 富返回类型,fn body unimplemented!(),P2 porter 落实现)。lifecycle=quick-start/restart/display;
 // mcp_server=stdio MCP tool handlers;cli=clap 子命令;packaging=install/migrate/repair。
 pub mod lifecycle;
+
+// 0.5.x Windows portability Batch 0: platform abstraction layer.
+// Truth sources:
+// - Design:    `.team/artifacts/0.5.x-windows-portability-survey-design.md`
+// - CR verdict: `.team/artifacts/0.5.x-windows-portability-cr-verdict.md`
+//              (6 constraints anchored inside the module doc)
+pub mod platform;
 // 0.3.28 — unified adaptive layout manager (single source of truth for tmux
 // topology decisions). See `.team/artifacts/adaptive-layout-full-architecture-locate.md`.
 pub mod layout;
@@ -114,5 +121,11 @@ pub mod conpty;
 //              (6 constraints anchored inside the module doc)
 pub mod transport_factory;
 
-#[cfg(test)]
+// 0.5.x Windows portability Batch 5: `app_server_test_support` is a
+// Unix-domain-socket fake for the Codex app-server client. It is
+// Unix-only because the code-under-test (`codex_app_server`) is
+// Unix-only via cfg (Windows gets typed `SocketUnreachable`
+// unsupported returns). Cfg-gating the module keeps `cargo check
+// --tests --target x86_64-pc-windows-msvc` compilable.
+#[cfg(all(test, unix))]
 pub(crate) mod app_server_test_support;

package/crates/team-agent/src/lifecycle/launch.rs

@@ -374,6 +374,8 @@ fn spawn_agents(
                 );
             }
         }
+        let spawn_epoch = u64::try_from(started.len()).unwrap_or(u64::MAX);
+        let spawned_at = spawn_timestamp_for_agent(u32::try_from(spawn_epoch).unwrap_or(u32::MAX));
         // E6 层1 实证3 + 诊断留痕:落最终 worker argv(spawn 前的真实形态)。
         // 任何"--session-id 预定 UUID 没生效"必须能从 events.jsonl 回答:argv 里到底有没有它。
         // 抽出 --session-id 值单列,方便和盘上 ~/.claude/projects/<cwd> 实际落的 UUID 对账。
@@ -393,6 +395,10 @@ fn spawn_agents(
                     "argv": plan.argv,
                     "session_id_in_argv": session_id_in_argv,
                     "expected_session_id": plan.expected_session_id.as_ref().map(|s| s.as_str()),
+                    "spawn_cwd": workspace.to_string_lossy(),
+                    "spawned_at": spawned_at.as_str(),
+                    "source": "launch",
+                    "spawn_epoch": spawn_epoch,
                 }),
             );
         }
@@ -473,6 +479,7 @@ fn spawn_agents(
             agent_id,
             start_mode: StartMode::Fresh,
             target: spawn.pane_id.as_str().to_string(),
+            spawned_at,
             session_id: None,
             rollout_path: None,
             pending_session_id: plan.expected_session_id.clone(),
@@ -872,7 +879,9 @@ fn persist_spawn_agent_state(
             continue;
         }
         let pane_pid = pane_pids_by_agent.get(id).copied();
-        let spawned_at = spawn_timestamp_for_agent(spawn_index);
+        let spawned_at = started_agent
+            .map(|started| started.spawned_at.clone())
+            .unwrap_or_else(|| spawn_timestamp_for_agent(spawn_index));
         spawn_index = spawn_index.saturating_add(1);
         agents.insert(
             id.to_string(),
@@ -2904,12 +2913,81 @@ pub fn quick_start_in_workspace_with_display_and_backend(
         ))
     })?;
     let team_key_for_factory = team_id;
+    // 0.5.x Windows portability Batch 8 F7 (leader msg_590b4dce0f68):
+    // shim ownership moves to the coordinator. quick-start no longer
+    // calls `spawn_shim_and_handshake` directly. Instead we ensure
+    // the coordinator daemon is running; the coordinator's boot
+    // path calls `conpty_shim::ensure_shim_running` (idempotent —
+    // spawns if no live shim, reconnects if one is recorded).
+    //
+    // Rationale (from Batch 7 gate report F7): quick-start is a
+    // one-shot process; if it owns the shim, the shim dies when
+    // quick-start exits. Moving ownership to the coord daemon
+    // gives us the "coord can die, shim survives" invariant the
+    // design's §Shim Lifecycle chapter requires.
+    //
+    // The `ensure_coordinator_running` call is idempotent per
+    // `coordinator/health.rs::start_coordinator`. On non-Windows
+    // this whole block is cfg'd out.
+    #[cfg(windows)]
+    if matches!(
+        requested,
+        crate::transport_factory::RequestedTransportBackend::ConPty
+    ) {
+        let team_key_str = team_key_for_factory.ok_or_else(|| {
+            LifecycleError::TeamSelect(
+                "team_key required for --backend conpty on Windows (Batch 9 F8)".to_string(),
+            )
+        })?;
+        // 0.5.x Windows portability Batch 9 F8 (leader msg_2a4cc1fa54c0):
+        // Batch 8's seed-state pattern (writing active_team_key +
+        // transport.kind to state.json before start_coordinator)
+        // caused downstream launch code to see "existing runtime, use
+        // restart" and skip spec compile. F8 fix: pass `--team`
+        // directly to the coord daemon via `start_coordinator_with_team`
+        // so state doesn't need pre-seeding.
+        //
+        // The coord daemon's `run_daemon_with_coordinator_and_boot_tmux`
+        // then calls `ensure_shim_running` with the CLI-supplied
+        // team_key. When quick-start's downstream code runs, state.json
+        // still has whatever it had before (empty on fresh launch), so
+        // the spec-compile + worker-spawn path runs normally.
+        let run_ws = crate::coordinator::WorkspacePath::new(workspace.clone());
+        let start_report =
+            crate::coordinator::health::start_coordinator_with_team(&run_ws, Some(team_key_str))
+                .map_err(|e| LifecycleError::TeamSelect(format!("coordinator start: {e}")))?;
+        if !start_report.ok {
+            return Err(LifecycleError::TeamSelect(format!(
+                "coordinator start failed: schema_error={:?}, action={:?}",
+                start_report.schema_error, start_report.action
+            )));
+        }
+        // Give the coordinator a beat to write its transport.shim
+        // block so the factory's `pipe_ready` gate opens on the
+        // next resolve. The coordinator's `run_daemon` calls
+        // `ensure_shim_running` inside its boot code path (see
+        // `coordinator::backoff::run_daemon`).
+        std::thread::sleep(std::time::Duration::from_millis(2500));
+    }
     let input = crate::transport_factory::TransportFactoryInput::new(
         &workspace,
         crate::transport_factory::TransportPurpose::Launch,
     )
     .with_team_key(team_key_for_factory)
     .with_explicit_backend(Some(requested));
+    // On Windows the factory needs to SEE the freshly-persisted
+    // `state.transport.shim.pipe_ready = true` marker so its
+    // `conpty_pipe_ready` gate opens.
+    #[cfg(windows)]
+    let state_value =
+        std::fs::read_to_string(crate::state::persist::runtime_state_path(&workspace))
+            .ok()
+            .and_then(|t| serde_json::from_str::<serde_json::Value>(&t).ok());
+    #[cfg(windows)]
+    let input = match state_value.as_ref() {
+        Some(v) => input.with_state(Some(v)),
+        None => input,
+    };
     let resolved = crate::transport_factory::resolve_transport(input)
         .map_err(|e| LifecycleError::TeamSelect(e.to_string()))?;
     // Hand the boxed backend down as `&dyn Transport`.
@@ -3644,102 +3722,21 @@ fn process_ancestry_argv(pid: u32) -> Vec<Vec<String>> {
     out
 }
 
-#[cfg(target_os = "linux")]
-fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
-    let bytes = std::fs::read(format!("/proc/{pid}/cmdline")).ok()?;
-    let argv_tokens = String::from_utf8_lossy(&bytes)
-        .split('\0')
-        .filter(|token| !token.is_empty())
-        .map(str::to_string)
-        .collect::<Vec<_>>();
-    (!argv_tokens.is_empty()).then_some(argv_tokens)
-}
-
-#[cfg(target_os = "macos")]
-fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
-    use std::mem::size_of;
-
-    let mut mib = [
-        libc::CTL_KERN,
-        libc::KERN_PROCARGS2,
-        i32::try_from(pid).ok()?,
-    ];
-    let mut size = 0usize;
-    let rc = unsafe {
-        libc::sysctl(
-            mib.as_mut_ptr(),
-            mib.len() as u32,
-            std::ptr::null_mut(),
-            &mut size,
-            std::ptr::null_mut(),
-            0,
-        )
-    };
-    if rc != 0 || size <= size_of::<libc::c_int>() {
-        return None;
-    }
-    let mut buf = vec![0u8; size];
-    let rc = unsafe {
-        libc::sysctl(
-            mib.as_mut_ptr(),
-            mib.len() as u32,
-            buf.as_mut_ptr().cast(),
-            &mut size,
-            std::ptr::null_mut(),
-            0,
-        )
-    };
-    if rc != 0 || size <= size_of::<libc::c_int>() {
-        return None;
-    }
-    let argc = i32::from_ne_bytes(buf.get(..size_of::<libc::c_int>())?.try_into().ok()?) as usize;
-    let mut offset = size_of::<libc::c_int>();
-    while offset < size && buf[offset] != 0 {
-        offset += 1;
-    }
-    while offset < size && buf[offset] == 0 {
-        offset += 1;
-    }
-    let raw = String::from_utf8_lossy(&buf[offset..size]);
-    let argv_tokens = raw
-        .split('\0')
-        .filter(|token| !token.is_empty())
-        .take(argc)
-        .map(str::to_string)
-        .collect::<Vec<_>>();
-    (!argv_tokens.is_empty()).then_some(argv_tokens)
-}
+// 0.5.x Windows portability Batch 4: `process_argv_tokens` and
+// `process_parent_pid` route through `crate::platform::argv`. Unix
+// impls are byte-preserving (Linux `/proc/<pid>/cmdline`, macOS
+// `sysctl(KERN_PROCARGS2)`, other Unix `ps -p ... -o command=`).
+// Windows returns `None` per design §Batch 4 conservative anchor:
+// unknown argv must never infer elevated approval; callers already
+// treat `None` as "no elevation inherited" via
+// `disabled_dangerous_approval()`.
 
-#[cfg(not(any(target_os = "linux", target_os = "macos")))]
 fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
-    let output = Command::new("ps")
-        .args(["-p", &pid.to_string(), "-o", "command="])
-        .output()
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    let text = String::from_utf8_lossy(&output.stdout);
-    let argv_tokens = text
-        .split_whitespace()
-        .filter(|token| !token.is_empty())
-        .map(str::to_string)
-        .collect::<Vec<_>>();
-    (!argv_tokens.is_empty()).then_some(argv_tokens)
+    crate::platform::argv::argv_tokens(pid)
 }
 
 fn process_parent_pid(pid: u32) -> Option<u32> {
-    let output = Command::new("ps")
-        .args(["-p", &pid.to_string(), "-o", "ppid="])
-        .output()
-        .ok()?;
-    if !output.status.success() {
-        return None;
-    }
-    String::from_utf8_lossy(&output.stdout)
-        .trim()
-        .parse::<u32>()
-        .ok()
+    crate::platform::argv::parent_pid(pid)
 }
 
 /// `add_agent(workspace, agent_id, role_file_path, open_display, team)`