@team-agent/installer 0.5.37 → 0.5.39

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.37"
+version = "0.5.39"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.37"
+version = "0.5.39"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/diagnose.rs

@@ -3,6 +3,22 @@ use super::*;
 use crate::provider::wire::{command_name, parse_provider, provider_wire};
 use crate::transport::Transport;
 
+/// 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B): classify a tmux
+/// transport error string into a diagnose issue id. When the underlying
+/// tmux subprocess stderr contains `server exited unexpectedly`, the
+/// tmux server itself crashed (upstream tmux 3.6a control-mode +
+/// broadcast attach/detach jitter is one known trigger) — the physical
+/// layer that disappeared is the whole server, not just this team's
+/// session. Otherwise, callers keep the legacy `tmux_session_missing`
+/// classification.
+pub(crate) fn classify_tmux_server_error(error_text: &str) -> &'static str {
+    if error_text.contains("server exited unexpectedly") {
+        "tmux_server_crashed"
+    } else {
+        "tmux_session_missing"
+    }
+}
+
 pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value, Value) {
     let mut issues = Vec::new();
     let mut repairs = Vec::new();
@@ -31,11 +47,20 @@ pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value
                 ));
             }
             Err(error) => {
-                issues.push(json!("tmux_session_missing"));
+                // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B):
+                // when the transport error stderr matches "server exited
+                // unexpectedly", the physical layer that disappeared is
+                // the tmux server itself — not just this team's session.
+                // Surface `tmux_server_crashed` so the user's next
+                // action is a coordinator/host-level recovery, not a
+                // per-agent `restart <agent>`.
+                let error_str = error.to_string();
+                let issue_id = classify_tmux_server_error(&error_str);
+                issues.push(json!(issue_id));
                 let mut hint =
-                    recovery_hint(session_name, "tmux_session_missing", "team-agent restart");
+                    recovery_hint(session_name, issue_id, "team-agent diagnose");
                 if let Some(obj) = hint.as_object_mut() {
-                    obj.insert("reason".to_string(), Value::String(error.to_string()));
+                    obj.insert("reason".to_string(), Value::String(error_str));
                 }
                 repairs.push(hint);
             }

package/crates/team-agent/src/lifecycle/display.rs

@@ -1,10 +1,19 @@
 //! lifecycle::display —— 能力门 / 后端解析 / 开关 / rebind 后重建。
+//!
+//! 0.5.39 Slice 1 (tmux-server-death-locate §7 Slice 1): all tmux
+//! session/window/pane operations here MUST go through the workspace's
+//! scoped `TmuxBackend` — raw `Command::new("tmux")` / ambient
+//! `run_tmux(...)` helpers in this file inherit ambient `$TMUX` and can
+//! kill sessions on the wrong socket. Ambient leader-pane env probes
+//! (`display-message` reading $TMUX to discover which session invoked
+//! us) live in `tmux_backend::probe_ambient_leader_pane_info` — that
+//! probe is definitionally ambient (its whole job is "which session am I
+//! in") and stays outside this module.
 
 use std::collections::BTreeMap;
 use std::path::Path;
-use std::process::Command;
 
-use crate::transport::{PaneId, SessionName, WindowName};
+use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
 
 use super::*;
 
@@ -239,6 +248,12 @@ fn close_adaptive_displays(
             orphans_cleaned: Vec::new(),
         });
     };
+    // 0.5.39 Slice 1: build workspace-scoped tmux transport once and
+    // route every destructive tmux op below through it (no ambient
+    // $TMUX). The kill_* Transport methods carry the workspace socket
+    // (`tmux -L <socket>`) so display cleanup cannot cross-kill a session
+    // on the user's default tmux server.
+    let transport = crate::transport_factory::tmux_workspace_transport(workspace);
     let mut closed = Vec::new();
     let mut orphans_cleaned = Vec::new();
     let mut seen = std::collections::BTreeSet::new();
@@ -258,13 +273,13 @@ fn close_adaptive_displays(
         }
         for target in display_identifiers(display, agent, agent_id, session_name, &state) {
             if seen.insert(target.clone()) {
-                kill_display_target(&target);
+                kill_display_target(&transport, &target);
                 closed.push(target);
             }
         }
     }
     if let Some(leader_session) = adaptive_leader_session(&state) {
-        for target in close_adaptive_windows(leader_session.as_str(), session_name.as_str()) {
+        for target in close_adaptive_windows(&transport, leader_session.as_str(), session_name.as_str()) {
             orphans_cleaned.push(target.clone());
             if seen.insert(target.clone()) {
                 closed.push(target);
@@ -351,13 +366,6 @@ struct LeaderTmuxInfo {
     pane: Option<String>,
 }
 
-#[derive(Debug)]
-struct TmuxOutput {
-    ok: bool,
-    stdout: String,
-    stderr: String,
-}
-
 fn in_wsl() -> bool {
     std::env::var("WSL_DISTRO_NAME").is_ok_and(|value| !value.is_empty())
         || std::env::var("WSL_INTEROP").is_ok_and(|value| !value.is_empty())
@@ -369,52 +377,11 @@ fn running_inside_tmux() -> bool {
 }
 
 fn current_leader_tmux_info() -> Option<LeaderTmuxInfo> {
-    let pane = std::env::var("TMUX_PANE")
-        .ok()
-        .filter(|value| !value.is_empty());
-    let mut commands = Vec::new();
-    if let Some(pane) = pane.as_deref() {
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-t".to_string(),
-            pane.to_string(),
-            "-F".to_string(),
-            "#{session_name}\t#{pane_id}".to_string(),
-        ]);
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-t".to_string(),
-            pane.to_string(),
-            "-F".to_string(),
-            "#{session_name}".to_string(),
-        ]);
-    }
-    if std::env::var("TMUX").is_ok_and(|value| !value.is_empty()) {
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-F".to_string(),
-            "#{session_name}\t#{pane_id}".to_string(),
-        ]);
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-F".to_string(),
-            "#{session_name}".to_string(),
-        ]);
-    }
-    for command in commands {
-        let args = command.iter().map(String::as_str).collect::<Vec<_>>();
-        if let Some(parsed) = run_tmux(&args)
-            .ok()
-            .and_then(|out| parse_tmux_info(&out.stdout))
-        {
-            return Some(parsed);
-        }
-    }
-    None
+    // 0.5.39 Slice 1: ambient probe lives in `tmux_backend` — the single
+    // controlled exception to the "all tmux ops through socket-scoped
+    // transport" rule (its whole job is "which session am I in?").
+    crate::tmux_backend::probe_ambient_leader_pane_info()
+        .map(|(session, pane)| LeaderTmuxInfo { session, pane })
 }
 
 fn env_leader_tmux_info() -> Option<LeaderTmuxInfo> {
@@ -428,44 +395,29 @@ fn env_leader_tmux_info() -> Option<LeaderTmuxInfo> {
     Some(LeaderTmuxInfo { session, pane })
 }
 
-fn parse_tmux_info(stdout: &str) -> Option<LeaderTmuxInfo> {
-    let line = stdout.lines().find(|line| !line.trim().is_empty())?.trim();
-    let parts = line.split('\t').collect::<Vec<_>>();
-    match parts.as_slice() {
-        [session, pane, ..] if !session.is_empty() && !session.starts_with('%') => {
-            Some(LeaderTmuxInfo {
-                session: (*session).to_string(),
-                pane: (!pane.is_empty()).then(|| (*pane).to_string()),
-            })
-        }
-        [pane, session, ..] if pane.starts_with('%') && !session.is_empty() => {
-            Some(LeaderTmuxInfo {
-                session: (*session).to_string(),
-                pane: Some((*pane).to_string()),
-            })
-        }
-        [session] if !session.is_empty() && !session.starts_with('%') => Some(LeaderTmuxInfo {
-            session: (*session).to_string(),
-            pane: None,
-        }),
-        _ => None,
-    }
-}
-
-fn close_adaptive_windows(leader_session: &str, session_name: &str) -> Vec<String> {
+fn close_adaptive_windows(
+    transport: &dyn Transport,
+    leader_session: &str,
+    session_name: &str,
+) -> Vec<String> {
     let prefix = format!("team-agent:{session_name}:overview");
-    let Ok(output) = run_tmux(&["list-windows", "-t", leader_session, "-F", "#{window_name}"])
-    else {
+    // 0.5.39 Slice 1: `Transport::list_windows` uses the workspace socket
+    // — if `leader_session` doesn't exist on that socket, list_windows
+    // returns Err/empty and we bail without touching another server.
+    let Ok(windows) = transport.list_windows(&SessionName::new(leader_session.to_string())) else {
         return Vec::new();
     };
-    output
-        .stdout
-        .lines()
-        .filter_map(|line| {
-            let window = line.trim();
+    windows
+        .into_iter()
+        .filter_map(|window| {
+            let window = window.as_str().to_string();
             if window == prefix || window.starts_with(&format!("{prefix}-")) {
-                let target = format!("{leader_session}:{window}");
-                kill_adaptive_window(&target).then_some(target)
+                let target_string = format!("{leader_session}:{window}");
+                let target = Target::SessionWindow {
+                    session: SessionName::new(leader_session.to_string()),
+                    window: WindowName::new(window),
+                };
+                transport.kill_window(&target).ok().map(|_| target_string)
             } else {
                 None
             }
@@ -473,18 +425,23 @@ fn close_adaptive_windows(leader_session: &str, session_name: &str) -> Vec<Strin
         .collect()
 }
 
-fn kill_adaptive_window(target: &str) -> bool {
-    run_tmux(&["kill-window", "-t", target]).is_ok()
-}
-
-fn kill_display_target(target: &str) {
-    if target.contains(':') {
-        let _ = run_tmux(&["kill-window", "-t", target]);
+fn kill_display_target(transport: &dyn Transport, target: &str) {
+    // 0.5.39 Slice 1: only kill window/pane — never fall back to
+    // kill-session on an ambiguous string shape. Locate §7 Slice 1:
+    // "Remove the string-shape `kill-session` fallback unless target is a
+    // proven display-only session." The old code parsed any bare
+    // non-`%`/non-`:` target as a session and issued `kill-session`,
+    // which is exactly the unbounded blast radius we're closing.
+    if let Some((session, window)) = target.split_once(':') {
+        let _ = transport.kill_window(&Target::SessionWindow {
+            session: SessionName::new(session.to_string()),
+            window: WindowName::new(window.to_string()),
+        });
     } else if target.starts_with('%') {
-        let _ = run_tmux(&["kill-pane", "-t", target]);
-    } else {
-        let _ = run_tmux(&["kill-session", "-t", target]);
+        let _ = transport.kill_pane(&PaneId::new(target.to_string()));
     }
+    // Bare session-name form is intentionally a no-op: display cleanup
+    // must not kill a whole session on shape guesswork.
 }
 
 fn adaptive_leader_session(state: &serde_json::Value) -> Option<String> {
@@ -525,23 +482,3 @@ fn string_field(display: &serde_json::Map<String, serde_json::Value>, key: &str)
         .map(str::to_string)
 }
 
-fn run_tmux(args: &[&str]) -> Result<TmuxOutput, LifecycleError> {
-    let output = Command::new("tmux")
-        .args(args)
-        .output()
-        .map_err(|e| LifecycleError::StatePersist(format!("tmux {}: {e}", args.join(" "))))?;
-    let result = TmuxOutput {
-        ok: output.status.success(),
-        stdout: String::from_utf8_lossy(&output.stdout).to_string(),
-        stderr: String::from_utf8_lossy(&output.stderr).to_string(),
-    };
-    if result.ok {
-        Ok(result)
-    } else {
-        Err(LifecycleError::StatePersist(format!(
-            "tmux {}: {}",
-            args.join(" "),
-            result.stderr.trim()
-        )))
-    }
-}

package/crates/team-agent/src/lifecycle/launch.rs

@@ -68,6 +68,9 @@ pub fn launch_with_transport_in_workspace(
     transport: &dyn Transport,
 ) -> Result<LaunchReport, LifecycleError> {
     let _ = skip_profile_smoke;
+    // 0.5.38 (`.team/artifacts/startup-latency-locate.md` §5): launch.phase
+    // timer with monotonic `elapsed_ms` for latency triage.
+    let phase_timer = crate::lifecycle::restart::RestartPhaseTimer::start();
     if !spec_path.exists() {
         return Err(LifecycleError::Compile(format!(
             "spec path not found: {}",
@@ -77,6 +80,7 @@ pub fn launch_with_transport_in_workspace(
     let text = std::fs::read_to_string(spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
+    phase_timer.emit(workspace, "launch.phase", "compile_spec");
     let session_name = spec_session_name(&spec);
     let safety = effective_runtime_config(&spec)?;
     if safety.enabled && !safety.inherited && !auto_approve && !dry_run {
@@ -102,6 +106,7 @@ pub fn launch_with_transport_in_workspace(
     let started = if dry_run {
         Vec::new()
     } else {
+        phase_timer.emit(workspace, "launch.phase", "spawn_all");
         let started = spawn_agents(
             workspace,
             spec_path,
@@ -119,6 +124,37 @@ pub fn launch_with_transport_in_workspace(
             &started,
             &safety,
         )?;
+        // 0.5.38: per-worker timing tags (source="launch") so operators can
+        // trace which worker's spawn dominates wall time. Zeros for now on
+        // the sub-timings — Step 1 first enables shape assertion; a later
+        // slice may thread real command_plan / transport_spawn / handler
+        // timings from spawn_agents.
+        for agent in &started {
+            let provider = spec_agent_values(&spec)
+                .into_iter()
+                .find(|entry| {
+                    entry
+                        .get("id")
+                        .and_then(Value::as_str)
+                        .map(|id| id == agent.agent_id.as_str())
+                        .unwrap_or(false)
+                })
+                .and_then(|entry| entry.get("provider").and_then(Value::as_str).map(str::to_string))
+                .unwrap_or_else(|| "fake".to_string());
+            crate::lifecycle::restart::write_worker_spawn_timing_event(
+                workspace,
+                phase_timer.elapsed_ms(),
+                agent.agent_id.as_str(),
+                &provider,
+                agent.start_mode,
+                "new-window",
+                0,
+                0,
+                0,
+                0,
+                "launch",
+            );
+        }
         started
     };
     // 0.3.28 Step 1: topology invariant guard (warn-only during migration).
@@ -3241,6 +3277,11 @@ pub fn quick_start_with_transport_in_workspace_with_display(
     // FIX (rt-host-a real-machine finding): dry_run=false so launch_with_transport calls spawn_agents
     // and really creates the tmux session + worker windows (was hardcoded true → never spawned, which
     // also starved the coordinator: no session → first tick TmuxSessionMissing → run_daemon loop exits).
+    // 0.5.38 (`.team/artifacts/startup-latency-locate.md` §5): quick-start
+    // owns the outer `launch.phase` timer so `coordinator_start` /
+    // `readiness_wait` / `completed` fire monotonically after the inner
+    // launch_with_transport's own `compile_spec` / `spawn_all` events.
+    let quick_start_phase_timer = crate::lifecycle::restart::RestartPhaseTimer::start();
     let mut launch =
         launch_with_transport_in_workspace(&workspace, &spec_path, false, yes, true, transport)?;
     annotate_persisted_team_depth(
@@ -3257,6 +3298,7 @@ pub fn quick_start_with_transport_in_workspace_with_display(
     let coordinator_started = crate::coordinator::start_coordinator(&coordinator_workspace)
         .map(|report| report.ok)
         .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+    quick_start_phase_timer.emit(&workspace, "launch.phase", "coordinator_start");
     let coordinator_action = if coordinator_started {
         "coordinator started"
     } else {
@@ -3269,6 +3311,7 @@ pub fn quick_start_with_transport_in_workspace_with_display(
     //   loaded successfully (provider-side codex/claude schema rejections happen
     //   asynchronously after spawn), so the verdict is PendingToolLoad — never
     //   bare Ready.
+    quick_start_phase_timer.emit(&workspace, "launch.phase", "readiness_wait");
     let worker_readiness = quick_start_worker_readiness(&workspace, &state_team_key);
     let attach_windows = load_runtime_state(&workspace)
         .ok()
@@ -3310,6 +3353,7 @@ pub fn quick_start_with_transport_in_workspace_with_display(
         .and_then(serde_json::Value::as_str)
         .unwrap_or("none")
         .to_string();
+    quick_start_phase_timer.emit(&workspace, "launch.phase", "completed");
     Ok(QuickStartReport::Ready {
         session_name,
         launch: Box::new(launch),

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -228,25 +228,35 @@ pub(super) fn spawn_agent_window(
         );
     }
 
+    // 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): route the
+    // primary worker spawn through the worker shell wrapper so provider
+    // exit leaves the pane at an interactive shell with an explicit exit
+    // marker instead of collapsing the pane into `[exited]`. This mirrors
+    // the leader wrapper's manual-tmux equivalence. The split path stays
+    // on plain spawn_split — split panes are display overlays, not the
+    // primary worker process.
+    let provider_label = crate::provider::wire::command_name(provider);
     let result = if let Some(placement) = layout_placement {
         if placement.starts_window {
             if into_existing_session {
-                transport.spawn_into_with_env_unset(
+                transport.spawn_into_with_worker_shell_wrapper(
                     session_name,
                     &window,
                     &plan.argv,
                     spawn_cwd,
                     &env,
                     &env_unset,
+                    provider_label,
                 )
             } else {
-                transport.spawn_first_with_env_unset(
+                transport.spawn_first_with_worker_shell_wrapper(
                     session_name,
                     &window,
                     &plan.argv,
                     spawn_cwd,
                     &env,
                     &env_unset,
+                    provider_label,
                 )
             }
         } else if !window_present_in_live(transport, session_name, &window)
@@ -264,13 +274,14 @@ pub(super) fn spawn_agent_window(
             // hijack the developer worker's pane. Downgrade to spawn_into
             // (new window named after agent_id) — canonical per-agent
             // fallback the existing 7 workers use.
-            transport.spawn_into_with_env_unset(
+            transport.spawn_into_with_worker_shell_wrapper(
                 session_name,
                 &WindowName::new(agent_id.as_str()),
                 &plan.argv,
                 spawn_cwd,
                 &env,
                 &env_unset,
+                provider_label,
             )
         } else {
             // 0.3.28 Step 8: spawn_split must only fire from the display
@@ -286,22 +297,24 @@ pub(super) fn spawn_agent_window(
             )
         }
     } else if into_existing_session {
-        transport.spawn_into_with_env_unset(
+        transport.spawn_into_with_worker_shell_wrapper(
             session_name,
             &window,
             &plan.argv,
             spawn_cwd,
             &env,
             &env_unset,
+            provider_label,
         )
     } else {
-        transport.spawn_first_with_env_unset(
+        transport.spawn_first_with_worker_shell_wrapper(
             session_name,
             &window,
             &plan.argv,
             spawn_cwd,
             &env,
             &env_unset,
+            provider_label,
         )
     };
     let spawn = result.map_err(|e| LifecycleError::Transport(e.to_string()))?;