@team-agent/installer 0.5.3 → 0.5.4

package/crates/team-agent/src/lifecycle/tests/restart.rs

@@ -101,11 +101,8 @@ fn layer2_backing_missing_refusal_carries_checked_paths_and_recovery_hint() {
     use std::sync::atomic::{AtomicU32, Ordering};
     static N: AtomicU32 = AtomicU32::new(0);
     let n = N.fetch_add(1, Ordering::Relaxed);
-    let ws = std::env::temp_dir().join(format!(
-        "ta_rs_l2_backingmiss_{}_{}",
-        std::process::id(),
-        n
-    ));
+    let ws =
+        std::env::temp_dir().join(format!("ta_rs_l2_backingmiss_{}_{}", std::process::id(), n));
     std::fs::create_dir_all(&ws).unwrap();
 
     let missing_rollout = ws.join(".missing-rollout.jsonl");
@@ -168,6 +165,148 @@ fn layer2_backing_missing_refusal_carries_checked_paths_and_recovery_hint() {
     }
 }
 
+fn write_codex_identity_rollout(
+    workspace: &std::path::Path,
+    file_name: &str,
+    session_id: &str,
+    embedded_agent_id: &str,
+) -> std::path::PathBuf {
+    let path = workspace.join(file_name);
+    let text = format!(
+        "{{\"session_meta\":{{\"payload\":{{\"id\":\"{session_id}\",\"cwd\":\"{}\"}}}}}}\n\
+         {{\"type\":\"turn_context\",\"payload\":{{}}}}\n\
+         {{\"type\":\"response_item\",\"payload\":{{\"content\":[{{\"type\":\"input_text\",\"text\":\"You are Team Agent worker `{embedded_agent_id}` with role `fixture`.\"}}]}}}}\n",
+        workspace.to_string_lossy()
+    );
+    std::fs::write(&path, text).unwrap();
+    path
+}
+
+#[test]
+fn restart_refuses_codex_session_identity_mismatch_without_allow_fresh() {
+    let ws = temp_ws();
+    let rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-frontend-poison.jsonl",
+        "019f3327-c35a-7023-b3cd-1bea93a7a157",
+        "ios-dev",
+    );
+    let state = json!({
+        "agents": {
+            "frontend": {
+                "provider": "codex",
+                "status": "running",
+                "session_id": "019f3327-c35a-7023-b3cd-1bea93a7a157",
+                "rollout_path": rollout.to_string_lossy(),
+                "captured_at": "2026-07-05T17:04:04Z",
+                "captured_via": "fs_watch",
+                "spawn_cwd": ws.to_string_lossy(),
+                "first_send_at": "2026-07-05T17:10:00Z"
+            }
+        }
+    });
+
+    let plan = crate::lifecycle::restart::classify_restart_plan_with_resume_validation(
+        Some(&ws),
+        &state,
+        false,
+    )
+    .unwrap();
+
+    assert_eq!(plan.decisions.len(), 1);
+    assert_eq!(plan.decisions[0].decision, ResumeDecision::Refuse);
+    assert_eq!(plan.unresumable.len(), 1);
+    let entry = &plan.unresumable[0];
+    assert_eq!(entry.agent_id.as_str(), "frontend");
+    assert_eq!(entry.reason, "session_identity_mismatch");
+    assert_eq!(
+        entry
+            .refusal_reason
+            .as_ref()
+            .map(crate::provider::session::ResumeRefusalReason::wire),
+        Some("session_identity_mismatch")
+    );
+}
+
+#[test]
+fn restart_identity_probe_reports_real_frontend_ios_dev_mismatch_shape() {
+    let ws = temp_ws();
+    let rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-frontend-poison.jsonl",
+        "019f3327-c35a-7023-b3cd-1bea93a7a157",
+        "ios-dev",
+    );
+    let rollout_path = crate::provider::RolloutPath::new(rollout.clone());
+    let probe = crate::lifecycle::restart::session_identity_probe_for_agent(
+        &aid("frontend"),
+        crate::provider::Provider::Codex,
+        Some(&rollout_path),
+    );
+    assert_eq!(probe.identity_ok, Some(false));
+    assert_eq!(probe.embedded_agent_id.as_deref(), Some("ios-dev"));
+    assert_eq!(probe.rollout_path.as_deref(), Some(rollout.as_path()));
+}
+
+#[test]
+fn restart_allow_fresh_only_fresh_starts_mismatched_codex_worker() {
+    let ws = temp_ws();
+    let frontend_rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-frontend-poison.jsonl",
+        "019f3327-c35a-7023-b3cd-1bea93a7a157",
+        "ios-dev",
+    );
+    let backend_rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-backend-valid.jsonl",
+        "019f3327-backend-valid",
+        "backend",
+    );
+    let state = json!({
+        "agents": {
+            "frontend": {
+                "provider": "codex",
+                "status": "running",
+                "session_id": "019f3327-c35a-7023-b3cd-1bea93a7a157",
+                "rollout_path": frontend_rollout.to_string_lossy(),
+                "captured_at": "2026-07-05T17:04:04Z",
+                "captured_via": "fs_watch",
+                "spawn_cwd": ws.to_string_lossy()
+            },
+            "backend": {
+                "provider": "codex",
+                "status": "running",
+                "session_id": "019f3327-backend-valid",
+                "rollout_path": backend_rollout.to_string_lossy(),
+                "captured_at": "2026-07-05T17:04:05Z",
+                "captured_via": "fs_watch",
+                "spawn_cwd": ws.to_string_lossy()
+            }
+        }
+    });
+
+    let plan = crate::lifecycle::restart::classify_restart_plan_with_resume_validation(
+        Some(&ws),
+        &state,
+        true,
+    )
+    .unwrap();
+
+    assert!(
+        plan.unresumable.is_empty(),
+        "allow_fresh should convert the poisoned worker to fresh without refusing; got {:?}",
+        plan.unresumable
+    );
+    let decisions = plan
+        .decisions
+        .iter()
+        .map(|decision| (decision.agent_id.as_str(), decision.decision))
+        .collect::<std::collections::BTreeMap<_, _>>();
+    assert_eq!(decisions.get("frontend"), Some(&ResumeDecision::FreshStart));
+    assert_eq!(decisions.get("backend"), Some(&ResumeDecision::Resume));
+}
+
 #[test]
 fn unit0_restart_corrupt_first_send_at_blocks_before_resume_classification() {
     // The corrupt-first_send_at branch is the hard-refuse gate that fires

package/crates/team-agent/src/lifecycle/types.rs

@@ -440,6 +440,7 @@ pub struct StartedAgent {
     pub agent_id: AgentId,
     pub start_mode: StartMode,
     pub target: String,
+    pub spawned_at: String,
     pub session_id: Option<SessionId>,
     pub rollout_path: Option<RolloutPath>,
     pub pending_session_id: Option<SessionId>,

package/crates/team-agent/src/provider/adapter.rs

@@ -5,12 +5,12 @@ use std::process::Command;
 
 use super::helpers::patterns;
 use super::types::{
-    AuthHintStatus, CapturedSession, CommandPlan, McpConfig, ProviderCaps,
-    ProviderCommandContext, ProviderError, SessionId, StatusPatterns,
+    AuthHintStatus, CapturedSession, CommandPlan, McpConfig, ProviderCaps, ProviderCommandContext,
+    ProviderError, SessionId, StatusPatterns,
 };
 use super::{AuthMode, Provider};
 
-pub use crate::provider::session_scan::{CapturedSessionCandidate, CaptureSessionContext};
+pub use crate::provider::session_scan::{CaptureSessionContext, CapturedSessionCandidate};
 
 // ===========================================================================
 // TRAIT: ProviderAdapter (method SIGNATURES only — 无 body)
@@ -70,7 +70,7 @@ pub trait ProviderAdapter {
             ctx.model,
             ctx.tools,
         )
-            .map(CommandPlan::argv_only)
+        .map(CommandPlan::argv_only)
     }
 
     /// 启动后从 provider session 日志捕获 session_id + rollout_path
@@ -95,6 +95,7 @@ pub trait ProviderAdapter {
             .into_iter()
             .map(|captured| CapturedSessionCandidate {
                 captured,
+                embedded_agent_id: None,
                 positive_agent_id_match: false,
                 agent_path_match: false,
             })
@@ -183,7 +184,7 @@ pub trait ProviderAdapter {
             ctx.model,
             ctx.tools,
         )
-            .map(CommandPlan::argv_only)
+        .map(CommandPlan::argv_only)
     }
 
     /// 计算本 provider 该用的 MCP server 配置(`adapter.py` mcp_config;claude
@@ -226,19 +227,17 @@ pub trait ProviderAdapter {
         sleep_s: f64,
     ) -> super::startup_prompt::StartupPromptOutcome {
         std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| match self.provider() {
-            Provider::Codex => {
-                super::startup_prompt::codex_handle_startup_prompts(transport, target, checks, sleep_s)
-            }
+            Provider::Codex => super::startup_prompt::codex_handle_startup_prompts(
+                transport, target, checks, sleep_s,
+            ),
             Provider::Claude | Provider::ClaudeCode => {
                 super::startup_prompt::claude_handle_startup_prompts(
                     transport, target, checks, sleep_s,
                 )
             }
-            Provider::Copilot => {
-                super::startup_prompt::copilot_handle_startup_prompts(
-                    transport, target, checks, sleep_s,
-                )
-            }
+            Provider::Copilot => super::startup_prompt::copilot_handle_startup_prompts(
+                transport, target, checks, sleep_s,
+            ),
             _ => super::startup_prompt::StartupPromptOutcome::default(),
         }))
         .unwrap_or_default()
@@ -342,7 +341,9 @@ impl ProviderAdapter for BasicProviderAdapter {
         let output = Command::new(command_name(self.provider))
             .arg("--version")
             .output()
-            .map_err(|e| ProviderError::Io(format!("{} --version: {e}", command_name(self.provider))))?;
+            .map_err(|e| {
+                ProviderError::Io(format!("{} --version: {e}", command_name(self.provider)))
+            })?;
         if !output.status.success() {
             return Ok("unknown".to_string());
         }
@@ -390,10 +391,24 @@ impl ProviderAdapter for BasicProviderAdapter {
         tools: &[&str],
     ) -> Result<Vec<String>, ProviderError> {
         match self.provider {
-            Provider::Claude | Provider::ClaudeCode => {
-                Ok(claude_launch_command(self, auth_mode, mcp_config, system_prompt, model, tools)?)
-            }
-            Provider::Codex => Ok(codex_base_command(None, auth_mode, mcp_config, system_prompt, model, tools, None, None)),
+            Provider::Claude | Provider::ClaudeCode => Ok(claude_launch_command(
+                self,
+                auth_mode,
+                mcp_config,
+                system_prompt,
+                model,
+                tools,
+            )?),
+            Provider::Codex => Ok(codex_base_command(
+                None,
+                auth_mode,
+                mcp_config,
+                system_prompt,
+                model,
+                tools,
+                None,
+                None,
+            )),
             // §C1 worker argv 形态 + C-1/C-5/C-6 cr verdict:
             //   copilot --no-color --no-auto-update [<dangerous|granular>] [--model]
             //          --additional-mcp-config <inline json> --session-id <expected_uuid> -C <cwd>
@@ -401,7 +416,11 @@ impl ProviderAdapter for BasicProviderAdapter {
             // AGENTS.md(launch 路径写文件,见 lifecycle/launch.rs)注入,**不入 argv**
             // (B2 灵魂件降级,C-1-2 禁 silent 写全局)。
             Provider::Copilot => Ok(copilot_base_command(
-                auth_mode, mcp_config, system_prompt, model, tools,
+                auth_mode,
+                mcp_config,
+                system_prompt,
+                model,
+                tools,
             )),
             Provider::GeminiCli => {
                 let mut argv = vec!["gemini".to_string()];
@@ -439,7 +458,9 @@ impl ProviderAdapter for BasicProviderAdapter {
                 // `--resume <existing_id>` on a session id that already has
                 // a real transcript.
                 let expected = next_session_token();
-                let managed = ctx.profile_launch.is_some_and(|profile| profile.managed_mcp_config);
+                let managed = ctx
+                    .profile_launch
+                    .is_some_and(|profile| profile.managed_mcp_config);
                 let projects_root = ctx
                     .profile_launch
                     .and_then(|profile| profile.claude_projects_root.clone());
@@ -614,7 +635,9 @@ impl ProviderAdapter for BasicProviderAdapter {
             )));
         }
         let Some(session_id) = session_id else {
-            return Err(ProviderError::ResumeUnavailable("resume requires session_id".to_string()));
+            return Err(ProviderError::ResumeUnavailable(
+                "resume requires session_id".to_string(),
+            ));
         };
         match self.provider {
             Provider::Codex => {
@@ -632,8 +655,16 @@ impl ProviderAdapter for BasicProviderAdapter {
                 Ok(argv)
             }
             Provider::Claude | Provider::ClaudeCode => {
-                let mut argv =
-                    claude_base_command(self, auth_mode, mcp_config, system_prompt, model, tools, false, None)?;
+                let mut argv = claude_base_command(
+                    self,
+                    auth_mode,
+                    mcp_config,
+                    system_prompt,
+                    model,
+                    tools,
+                    false,
+                    None,
+                )?;
                 argv.push("--resume".to_string());
                 argv.push(session_id.as_str().to_string());
                 Ok(argv)
@@ -641,9 +672,8 @@ impl ProviderAdapter for BasicProviderAdapter {
             // §C1 cr verdict:resume 同 base + `--resume <sid>`(去 --session-id,
             // copilot --resume 接受 id|name)。
             Provider::Copilot => {
-                let mut argv = copilot_base_command_resume(
-                    auth_mode, mcp_config, system_prompt, model, tools,
-                );
+                let mut argv =
+                    copilot_base_command_resume(auth_mode, mcp_config, system_prompt, model, tools);
                 argv.push("--resume".to_string());
                 argv.push(session_id.as_str().to_string());
                 Ok(argv)
@@ -663,9 +693,13 @@ impl ProviderAdapter for BasicProviderAdapter {
         match self.provider {
             Provider::Claude | Provider::ClaudeCode => {
                 let Some(session_id) = session_id else {
-                    return Err(ProviderError::ResumeUnavailable("resume requires session_id".to_string()));
+                    return Err(ProviderError::ResumeUnavailable(
+                        "resume requires session_id".to_string(),
+                    ));
                 };
-                let managed = ctx.profile_launch.is_some_and(|profile| profile.managed_mcp_config);
+                let managed = ctx
+                    .profile_launch
+                    .is_some_and(|profile| profile.managed_mcp_config);
                 let model = claude_context_model(ctx);
                 let mut argv = claude_base_command(
                     self,
@@ -758,7 +792,9 @@ impl ProviderAdapter for BasicProviderAdapter {
             )));
         }
         let Some(session_id) = session_id else {
-            return Err(ProviderError::ResumeUnavailable("fork requires session_id".to_string()));
+            return Err(ProviderError::ResumeUnavailable(
+                "fork requires session_id".to_string(),
+            ));
         };
         match self.provider {
             Provider::Codex => {
@@ -776,8 +812,16 @@ impl ProviderAdapter for BasicProviderAdapter {
                 Ok(argv)
             }
             Provider::Claude | Provider::ClaudeCode => {
-                let mut argv =
-                    claude_base_command(self, auth_mode, mcp_config, system_prompt, model, tools, false, None)?;
+                let mut argv = claude_base_command(
+                    self,
+                    auth_mode,
+                    mcp_config,
+                    system_prompt,
+                    model,
+                    tools,
+                    false,
+                    None,
+                )?;
                 argv.push("--session-id".to_string());
                 argv.push(next_session_token());
                 argv.push("--resume".to_string());
@@ -792,10 +836,12 @@ impl ProviderAdapter for BasicProviderAdapter {
             Provider::Copilot => Err(ProviderError::CapabilityUnsupported(
                 "copilot CLI 无 fork 旗标,session-store 不支持 branched continuation".to_string(),
             )),
-            Provider::GeminiCli | Provider::Fake => Err(ProviderError::CapabilityUnsupported(format!(
-                "{} does not support native session fork",
-                provider_wire(self.provider)
-            ))),
+            Provider::GeminiCli | Provider::Fake => {
+                Err(ProviderError::CapabilityUnsupported(format!(
+                    "{} does not support native session fork",
+                    provider_wire(self.provider)
+                )))
+            }
         }
     }
 
@@ -813,10 +859,14 @@ impl ProviderAdapter for BasicProviderAdapter {
                     )));
                 }
                 let Some(session_id) = session_id else {
-                    return Err(ProviderError::ResumeUnavailable("fork requires session_id".to_string()));
+                    return Err(ProviderError::ResumeUnavailable(
+                        "fork requires session_id".to_string(),
+                    ));
                 };
                 let expected = next_session_token();
-                let managed = ctx.profile_launch.is_some_and(|profile| profile.managed_mcp_config);
+                let managed = ctx
+                    .profile_launch
+                    .is_some_and(|profile| profile.managed_mcp_config);
                 let projects_root = ctx
                     .profile_launch
                     .and_then(|profile| profile.claude_projects_root.clone());
@@ -910,10 +960,22 @@ impl ProviderAdapter for BasicProviderAdapter {
 
     fn status_patterns(&self) -> Result<StatusPatterns, ProviderError> {
         match self.provider {
-            Provider::Claude | Provider::ClaudeCode => patterns(r"[>❯]\s", r"[✶✢✽✻✳·].*…", r"Error|Traceback"),
-            Provider::Codex => patterns(r"(›|❯|codex>)", r"•.*esc to interrupt", r"Error|Traceback|panic"),
-            Provider::Copilot => patterns(r"(?m)^\s*❯\s*$| / commands · \? help", r"working|processing", r"Error|panic"),
-            Provider::GeminiCli | Provider::Fake => patterns(r">", r"working|processing", r"Error|Traceback"),
+            Provider::Claude | Provider::ClaudeCode => {
+                patterns(r"[>❯]\s", r"[✶✢✽✻✳·].*…", r"Error|Traceback")
+            }
+            Provider::Codex => patterns(
+                r"(›|❯|codex>)",
+                r"•.*esc to interrupt",
+                r"Error|Traceback|panic",
+            ),
+            Provider::Copilot => patterns(
+                r"(?m)^\s*❯\s*$| / commands · \? help",
+                r"working|processing",
+                r"Error|panic",
+            ),
+            Provider::GeminiCli | Provider::Fake => {
+                patterns(r">", r"working|processing", r"Error|Traceback")
+            }
         }
     }