@team-agent/installer 0.5.38 → 0.5.39

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.38"
+version = "0.5.39"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.38"
+version = "0.5.39"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/diagnose.rs

@@ -3,6 +3,22 @@ use super::*;
 use crate::provider::wire::{command_name, parse_provider, provider_wire};
 use crate::transport::Transport;
 
+/// 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B): classify a tmux
+/// transport error string into a diagnose issue id. When the underlying
+/// tmux subprocess stderr contains `server exited unexpectedly`, the
+/// tmux server itself crashed (upstream tmux 3.6a control-mode +
+/// broadcast attach/detach jitter is one known trigger) — the physical
+/// layer that disappeared is the whole server, not just this team's
+/// session. Otherwise, callers keep the legacy `tmux_session_missing`
+/// classification.
+pub(crate) fn classify_tmux_server_error(error_text: &str) -> &'static str {
+    if error_text.contains("server exited unexpectedly") {
+        "tmux_server_crashed"
+    } else {
+        "tmux_session_missing"
+    }
+}
+
 pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value, Value) {
     let mut issues = Vec::new();
     let mut repairs = Vec::new();
@@ -31,11 +47,20 @@ pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value
                 ));
             }
             Err(error) => {
-                issues.push(json!("tmux_session_missing"));
+                // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B):
+                // when the transport error stderr matches "server exited
+                // unexpectedly", the physical layer that disappeared is
+                // the tmux server itself — not just this team's session.
+                // Surface `tmux_server_crashed` so the user's next
+                // action is a coordinator/host-level recovery, not a
+                // per-agent `restart <agent>`.
+                let error_str = error.to_string();
+                let issue_id = classify_tmux_server_error(&error_str);
+                issues.push(json!(issue_id));
                 let mut hint =
-                    recovery_hint(session_name, "tmux_session_missing", "team-agent restart");
+                    recovery_hint(session_name, issue_id, "team-agent diagnose");
                 if let Some(obj) = hint.as_object_mut() {
-                    obj.insert("reason".to_string(), Value::String(error.to_string()));
+                    obj.insert("reason".to_string(), Value::String(error_str));
                 }
                 repairs.push(hint);
             }

package/crates/team-agent/src/lifecycle/display.rs

@@ -1,10 +1,19 @@
 //! lifecycle::display —— 能力门 / 后端解析 / 开关 / rebind 后重建。
+//!
+//! 0.5.39 Slice 1 (tmux-server-death-locate §7 Slice 1): all tmux
+//! session/window/pane operations here MUST go through the workspace's
+//! scoped `TmuxBackend` — raw `Command::new("tmux")` / ambient
+//! `run_tmux(...)` helpers in this file inherit ambient `$TMUX` and can
+//! kill sessions on the wrong socket. Ambient leader-pane env probes
+//! (`display-message` reading $TMUX to discover which session invoked
+//! us) live in `tmux_backend::probe_ambient_leader_pane_info` — that
+//! probe is definitionally ambient (its whole job is "which session am I
+//! in") and stays outside this module.
 
 use std::collections::BTreeMap;
 use std::path::Path;
-use std::process::Command;
 
-use crate::transport::{PaneId, SessionName, WindowName};
+use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
 
 use super::*;
 
@@ -239,6 +248,12 @@ fn close_adaptive_displays(
             orphans_cleaned: Vec::new(),
         });
     };
+    // 0.5.39 Slice 1: build workspace-scoped tmux transport once and
+    // route every destructive tmux op below through it (no ambient
+    // $TMUX). The kill_* Transport methods carry the workspace socket
+    // (`tmux -L <socket>`) so display cleanup cannot cross-kill a session
+    // on the user's default tmux server.
+    let transport = crate::transport_factory::tmux_workspace_transport(workspace);
     let mut closed = Vec::new();
     let mut orphans_cleaned = Vec::new();
     let mut seen = std::collections::BTreeSet::new();
@@ -258,13 +273,13 @@ fn close_adaptive_displays(
         }
         for target in display_identifiers(display, agent, agent_id, session_name, &state) {
             if seen.insert(target.clone()) {
-                kill_display_target(&target);
+                kill_display_target(&transport, &target);
                 closed.push(target);
             }
         }
     }
     if let Some(leader_session) = adaptive_leader_session(&state) {
-        for target in close_adaptive_windows(leader_session.as_str(), session_name.as_str()) {
+        for target in close_adaptive_windows(&transport, leader_session.as_str(), session_name.as_str()) {
             orphans_cleaned.push(target.clone());
             if seen.insert(target.clone()) {
                 closed.push(target);
@@ -351,13 +366,6 @@ struct LeaderTmuxInfo {
     pane: Option<String>,
 }
 
-#[derive(Debug)]
-struct TmuxOutput {
-    ok: bool,
-    stdout: String,
-    stderr: String,
-}
-
 fn in_wsl() -> bool {
     std::env::var("WSL_DISTRO_NAME").is_ok_and(|value| !value.is_empty())
         || std::env::var("WSL_INTEROP").is_ok_and(|value| !value.is_empty())
@@ -369,52 +377,11 @@ fn running_inside_tmux() -> bool {
 }
 
 fn current_leader_tmux_info() -> Option<LeaderTmuxInfo> {
-    let pane = std::env::var("TMUX_PANE")
-        .ok()
-        .filter(|value| !value.is_empty());
-    let mut commands = Vec::new();
-    if let Some(pane) = pane.as_deref() {
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-t".to_string(),
-            pane.to_string(),
-            "-F".to_string(),
-            "#{session_name}\t#{pane_id}".to_string(),
-        ]);
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-t".to_string(),
-            pane.to_string(),
-            "-F".to_string(),
-            "#{session_name}".to_string(),
-        ]);
-    }
-    if std::env::var("TMUX").is_ok_and(|value| !value.is_empty()) {
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-F".to_string(),
-            "#{session_name}\t#{pane_id}".to_string(),
-        ]);
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-F".to_string(),
-            "#{session_name}".to_string(),
-        ]);
-    }
-    for command in commands {
-        let args = command.iter().map(String::as_str).collect::<Vec<_>>();
-        if let Some(parsed) = run_tmux(&args)
-            .ok()
-            .and_then(|out| parse_tmux_info(&out.stdout))
-        {
-            return Some(parsed);
-        }
-    }
-    None
+    // 0.5.39 Slice 1: ambient probe lives in `tmux_backend` — the single
+    // controlled exception to the "all tmux ops through socket-scoped
+    // transport" rule (its whole job is "which session am I in?").
+    crate::tmux_backend::probe_ambient_leader_pane_info()
+        .map(|(session, pane)| LeaderTmuxInfo { session, pane })
 }
 
 fn env_leader_tmux_info() -> Option<LeaderTmuxInfo> {
@@ -428,44 +395,29 @@ fn env_leader_tmux_info() -> Option<LeaderTmuxInfo> {
     Some(LeaderTmuxInfo { session, pane })
 }
 
-fn parse_tmux_info(stdout: &str) -> Option<LeaderTmuxInfo> {
-    let line = stdout.lines().find(|line| !line.trim().is_empty())?.trim();
-    let parts = line.split('\t').collect::<Vec<_>>();
-    match parts.as_slice() {
-        [session, pane, ..] if !session.is_empty() && !session.starts_with('%') => {
-            Some(LeaderTmuxInfo {
-                session: (*session).to_string(),
-                pane: (!pane.is_empty()).then(|| (*pane).to_string()),
-            })
-        }
-        [pane, session, ..] if pane.starts_with('%') && !session.is_empty() => {
-            Some(LeaderTmuxInfo {
-                session: (*session).to_string(),
-                pane: Some((*pane).to_string()),
-            })
-        }
-        [session] if !session.is_empty() && !session.starts_with('%') => Some(LeaderTmuxInfo {
-            session: (*session).to_string(),
-            pane: None,
-        }),
-        _ => None,
-    }
-}
-
-fn close_adaptive_windows(leader_session: &str, session_name: &str) -> Vec<String> {
+fn close_adaptive_windows(
+    transport: &dyn Transport,
+    leader_session: &str,
+    session_name: &str,
+) -> Vec<String> {
     let prefix = format!("team-agent:{session_name}:overview");
-    let Ok(output) = run_tmux(&["list-windows", "-t", leader_session, "-F", "#{window_name}"])
-    else {
+    // 0.5.39 Slice 1: `Transport::list_windows` uses the workspace socket
+    // — if `leader_session` doesn't exist on that socket, list_windows
+    // returns Err/empty and we bail without touching another server.
+    let Ok(windows) = transport.list_windows(&SessionName::new(leader_session.to_string())) else {
         return Vec::new();
     };
-    output
-        .stdout
-        .lines()
-        .filter_map(|line| {
-            let window = line.trim();
+    windows
+        .into_iter()
+        .filter_map(|window| {
+            let window = window.as_str().to_string();
             if window == prefix || window.starts_with(&format!("{prefix}-")) {
-                let target = format!("{leader_session}:{window}");
-                kill_adaptive_window(&target).then_some(target)
+                let target_string = format!("{leader_session}:{window}");
+                let target = Target::SessionWindow {
+                    session: SessionName::new(leader_session.to_string()),
+                    window: WindowName::new(window),
+                };
+                transport.kill_window(&target).ok().map(|_| target_string)
             } else {
                 None
             }
@@ -473,18 +425,23 @@ fn close_adaptive_windows(leader_session: &str, session_name: &str) -> Vec<Strin
         .collect()
 }
 
-fn kill_adaptive_window(target: &str) -> bool {
-    run_tmux(&["kill-window", "-t", target]).is_ok()
-}
-
-fn kill_display_target(target: &str) {
-    if target.contains(':') {
-        let _ = run_tmux(&["kill-window", "-t", target]);
+fn kill_display_target(transport: &dyn Transport, target: &str) {
+    // 0.5.39 Slice 1: only kill window/pane — never fall back to
+    // kill-session on an ambiguous string shape. Locate §7 Slice 1:
+    // "Remove the string-shape `kill-session` fallback unless target is a
+    // proven display-only session." The old code parsed any bare
+    // non-`%`/non-`:` target as a session and issued `kill-session`,
+    // which is exactly the unbounded blast radius we're closing.
+    if let Some((session, window)) = target.split_once(':') {
+        let _ = transport.kill_window(&Target::SessionWindow {
+            session: SessionName::new(session.to_string()),
+            window: WindowName::new(window.to_string()),
+        });
     } else if target.starts_with('%') {
-        let _ = run_tmux(&["kill-pane", "-t", target]);
-    } else {
-        let _ = run_tmux(&["kill-session", "-t", target]);
+        let _ = transport.kill_pane(&PaneId::new(target.to_string()));
     }
+    // Bare session-name form is intentionally a no-op: display cleanup
+    // must not kill a whole session on shape guesswork.
 }
 
 fn adaptive_leader_session(state: &serde_json::Value) -> Option<String> {
@@ -525,23 +482,3 @@ fn string_field(display: &serde_json::Map<String, serde_json::Value>, key: &str)
         .map(str::to_string)
 }
 
-fn run_tmux(args: &[&str]) -> Result<TmuxOutput, LifecycleError> {
-    let output = Command::new("tmux")
-        .args(args)
-        .output()
-        .map_err(|e| LifecycleError::StatePersist(format!("tmux {}: {e}", args.join(" "))))?;
-    let result = TmuxOutput {
-        ok: output.status.success(),
-        stdout: String::from_utf8_lossy(&output.stdout).to_string(),
-        stderr: String::from_utf8_lossy(&output.stderr).to_string(),
-    };
-    if result.ok {
-        Ok(result)
-    } else {
-        Err(LifecycleError::StatePersist(format!(
-            "tmux {}: {}",
-            args.join(" "),
-            result.stderr.trim()
-        )))
-    }
-}

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -228,25 +228,35 @@ pub(super) fn spawn_agent_window(
         );
     }
 
+    // 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): route the
+    // primary worker spawn through the worker shell wrapper so provider
+    // exit leaves the pane at an interactive shell with an explicit exit
+    // marker instead of collapsing the pane into `[exited]`. This mirrors
+    // the leader wrapper's manual-tmux equivalence. The split path stays
+    // on plain spawn_split — split panes are display overlays, not the
+    // primary worker process.
+    let provider_label = crate::provider::wire::command_name(provider);
     let result = if let Some(placement) = layout_placement {
         if placement.starts_window {
             if into_existing_session {
-                transport.spawn_into_with_env_unset(
+                transport.spawn_into_with_worker_shell_wrapper(
                     session_name,
                     &window,
                     &plan.argv,
                     spawn_cwd,
                     &env,
                     &env_unset,
+                    provider_label,
                 )
             } else {
-                transport.spawn_first_with_env_unset(
+                transport.spawn_first_with_worker_shell_wrapper(
                     session_name,
                     &window,
                     &plan.argv,
                     spawn_cwd,
                     &env,
                     &env_unset,
+                    provider_label,
                 )
             }
         } else if !window_present_in_live(transport, session_name, &window)
@@ -264,13 +274,14 @@ pub(super) fn spawn_agent_window(
             // hijack the developer worker's pane. Downgrade to spawn_into
             // (new window named after agent_id) — canonical per-agent
             // fallback the existing 7 workers use.
-            transport.spawn_into_with_env_unset(
+            transport.spawn_into_with_worker_shell_wrapper(
                 session_name,
                 &WindowName::new(agent_id.as_str()),
                 &plan.argv,
                 spawn_cwd,
                 &env,
                 &env_unset,
+                provider_label,
             )
         } else {
             // 0.3.28 Step 8: spawn_split must only fire from the display
@@ -286,22 +297,24 @@ pub(super) fn spawn_agent_window(
             )
         }
     } else if into_existing_session {
-        transport.spawn_into_with_env_unset(
+        transport.spawn_into_with_worker_shell_wrapper(
             session_name,
             &window,
             &plan.argv,
             spawn_cwd,
             &env,
             &env_unset,
+            provider_label,
         )
     } else {
-        transport.spawn_first_with_env_unset(
+        transport.spawn_first_with_worker_shell_wrapper(
             session_name,
             &window,
             &plan.argv,
             spawn_cwd,
             &env,
             &env_unset,
+            provider_label,
         )
     };
     let spawn = result.map_err(|e| LifecycleError::Transport(e.to_string()))?;

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -2049,6 +2049,16 @@ fn restart_failure_phase(
     phase: &'static str,
     error: &str,
 ) -> &'static str {
+    // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B): promote
+    // spawn/readiness errors whose stderr contains "server exited
+    // unexpectedly" to `tmux_server_crashed`, so downstream event
+    // classification and diagnose next_actions ("team-agent diagnose")
+    // don't misattribute a whole-server death to a per-agent provider
+    // failure. Restart itself does not recover from server crashes in
+    // 0.5.39 (§11.1 C is Slice 3, later car); it just classifies clearly.
+    if is_tmux_server_crashed(error) {
+        return "tmux_server_crashed";
+    }
     if is_resume_integrity_failure(decision, phase, error) {
         "resume"
     } else {
@@ -2056,6 +2066,10 @@ fn restart_failure_phase(
     }
 }
 
+fn is_tmux_server_crashed(error: &str) -> bool {
+    error.contains("server exited unexpectedly")
+}
+
 fn is_resume_integrity_failure(decision: &RestartedAgent, phase: &str, error: &str) -> bool {
     if !matches!(decision.restart_mode, StartMode::Resumed) {
         return false;
@@ -2349,7 +2363,7 @@ fn run_bounded_parallel_worker_spawns(
                     }
                     // Advance the gate so the next plan-order thread can
                     // start its own `spawn_agent_window` in parallel; a
-                    // deterministic 2ms stagger between plan slots keeps
+                    // deterministic 10ms stagger between plan slots keeps
                     // pane_id assignment (which happens inside the
                     // transport at the tail of its call) ordered by plan
                     // even when each individual call sleeps for tens of
@@ -2362,11 +2376,14 @@ fn run_bounded_parallel_worker_spawns(
                 // per-slot stagger so pane_id assignment inside the
                 // transport happens in plan order even though the
                 // subsequent per-call sleeps overlap across threads.
-                // 10ms per slot is enough headroom over OS scheduler
-                // jitter (previous 3/5ms values flaked on shared macOS
-                // gate machines) while remaining well under real tmux
+                // 10ms per slot is enough headroom over OS scheduler jitter
+                // (previous 3/5ms values flaked on shared macOS gate
+                // machines) while remaining well under real tmux
                 // new-window latency (~50-120ms) so the overlap
-                // property required by R1 still holds.
+                // property required by R1 still holds. Reverse guard for
+                // this stagger lives in
+                // `tests/parallel_spawn_stagger_reverse_guard.rs`
+                // (0.5.38 cr observation D-k).
                 std::thread::sleep(std::time::Duration::from_millis(slot as u64 * 10));
                 let spawn_start = std::time::Instant::now();
                 let outcome = match spawn_agent_window(

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -336,7 +336,17 @@ if [ "$track" != 1 ]; then
   fi
   exit 127
 fi
-printf '%s\n' "$*" >> "$log"
+# 0.5.39 Slice 2: worker spawn now goes through the worker shell
+# wrapper (tmux-server-death-locate §7 Slice 2), which embeds a
+# printf format literal containing "\n" bytes so the pane returns to
+# an interactive shell with an explicit exit marker instead of
+# collapsing to `[exited]`. Those embedded newlines land inside the
+# tmux argv payload, so a naive `printf '%s\n' "$*"` writes multiple
+# lines per tmux invocation and downstream `raw.lines()` scans see
+# fake "argv" lines that carry only the marker text. Escape newlines
+# to a literal `\n` marker so one shim call = one log line = one
+# assertion target.
+printf '%s\n' "$*" | awk 'BEGIN{ORS=""} {print sep $0; sep="\\n"} END{print "\n"}' >> "$log"
 case "$*" in
   *"-S $expected"*) ;;
   *)

package/crates/team-agent/src/tmux_backend.rs

@@ -1509,6 +1509,149 @@ pub fn leader_provider_exit_marker(provider_label: &str) -> String {
     )
 }
 
+/// 0.5.39 Slice 1 (tmux-server-death-locate §7 Slice 1): ambient-tmux
+/// leader-pane probe. Kept inside `tmux_backend` because it is
+/// definitionally ambient — its job is to discover *which* session/pane
+/// the leader process is currently inside via $TMUX/$TMUX_PANE +
+/// `tmux display-message`. Everywhere else in the codebase, tmux ops
+/// must go through a socket-scoped `TmuxBackend` (that constraint is
+/// enforced by `n16_tmux_socket_invariant_red.rs` +
+/// `tmux_server_death_0539_contract.rs::display_cleanup_...`); this
+/// helper is the single controlled exception.
+///
+/// Returns `(session_name, Some(pane_id))` when the ambient tmux
+/// responds, or `None` if `$TMUX` is unset / `display-message` fails.
+pub fn probe_ambient_leader_pane_info() -> Option<(String, Option<String>)> {
+    let pane = std::env::var("TMUX_PANE")
+        .ok()
+        .filter(|value| !value.is_empty());
+    let mut commands: Vec<Vec<String>> = Vec::new();
+    if let Some(pane) = pane.as_deref() {
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-t".to_string(),
+            pane.to_string(),
+            "-F".to_string(),
+            "#{session_name}\t#{pane_id}".to_string(),
+        ]);
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-t".to_string(),
+            pane.to_string(),
+            "-F".to_string(),
+            "#{session_name}".to_string(),
+        ]);
+    }
+    if std::env::var("TMUX").is_ok_and(|value| !value.is_empty()) {
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-F".to_string(),
+            "#{session_name}\t#{pane_id}".to_string(),
+        ]);
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-F".to_string(),
+            "#{session_name}".to_string(),
+        ]);
+    }
+    for command in commands {
+        let output = match std::process::Command::new("tmux").args(&command).output() {
+            Ok(output) if output.status.success() => output,
+            _ => continue,
+        };
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        let Some(line) = stdout.lines().find(|line| !line.trim().is_empty()) else {
+            continue;
+        };
+        let line = line.trim();
+        let parts: Vec<&str> = line.split('\t').collect();
+        let parsed = match parts.as_slice() {
+            [session, pane_str, ..] if !session.is_empty() && !session.starts_with('%') => Some((
+                (*session).to_string(),
+                (!pane_str.is_empty()).then(|| (*pane_str).to_string()),
+            )),
+            [pane_str, session, ..] if pane_str.starts_with('%') && !session.is_empty() => {
+                Some(((*session).to_string(), Some((*pane_str).to_string())))
+            }
+            [session] if !session.is_empty() && !session.starts_with('%') => {
+                Some(((*session).to_string(), None))
+            }
+            _ => None,
+        };
+        if parsed.is_some() {
+            return parsed;
+        }
+    }
+    None
+}
+
+/// 0.5.39 Slice 2 (tmux-server-death-locate §11.2): single-source worker
+/// exit marker prefix. Same envelope shape as `LEADER_PROVIDER_EXIT_MARKER_*`
+/// but distinct so status/classifier code can tell "leader pane fell back
+/// to shell" from "worker pane fell back to shell". Format:
+/// `"[team-agent worker] {provider_label} exited with {rc}"`.
+pub const WORKER_PROVIDER_EXIT_MARKER_PREFIX: &str = "[team-agent worker]";
+pub const WORKER_PROVIDER_EXIT_MARKER_SUFFIX: &str = "exited with";
+
+/// 0.5.39 Slice 2: build the worker exit marker text for `provider_label`.
+/// Used by both the worker shell wrapper (printf source) and future
+/// status/classifier code (capture substring) so they cannot drift.
+pub fn worker_provider_exit_marker(provider_label: &str) -> String {
+    format!(
+        "{WORKER_PROVIDER_EXIT_MARKER_PREFIX} {provider_label} {WORKER_PROVIDER_EXIT_MARKER_SUFFIX}"
+    )
+}
+
+/// 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): worker shell
+/// wrapper. Same shape as `leader_shell_wrapper_command` — provider runs
+/// as a CHILD of a long-lived shell so provider exit does NOT collapse the
+/// worker pane (which under upstream tmux 3.6a private-server bugs can
+/// cascade into whole-server death). When the provider exits, the worker
+/// pane returns to an interactive shell with an explicit worker exit
+/// marker, matching manual `tmux new-window` then `<provider>` behaviour.
+pub fn worker_shell_wrapper_command(
+    argv: &[String],
+    cwd: &Path,
+    env: &BTreeMap<String, String>,
+    env_unset: &[String],
+    provider_label: &str,
+) -> String {
+    let unset_set: std::collections::BTreeSet<&str> =
+        env_unset.iter().map(String::as_str).collect();
+    let mut parts = Vec::new();
+    parts.push("cd".to_string());
+    parts.push(shell_quote(&cwd.to_string_lossy()));
+    parts.push("&&".to_string());
+    for key in env_unset {
+        parts.push("unset".to_string());
+        parts.push(key.clone());
+        parts.push("&&".to_string());
+    }
+    for (key, value) in env {
+        if unset_set.contains(key.as_str()) {
+            continue;
+        }
+        parts.push(format!("{key}={}", shell_quote(value)));
+    }
+    parts.extend(argv.iter().map(|arg| shell_quote(arg)));
+    parts.push(";".to_string());
+    parts.push("rc=$?;".to_string());
+    parts.push("printf".to_string());
+    parts.push(shell_quote(&format!(
+        "\n{} %s\n",
+        worker_provider_exit_marker(provider_label)
+    )));
+    parts.push("\"$rc\";".to_string());
+    parts.push("exec".to_string());
+    parts.push("\"${SHELL:-/bin/zsh}\"".to_string());
+    parts.push("-l".to_string());
+    parts.join(" ")
+}
+
 /// 0.4.x (CR C-2): leader shell wrapper — provider runs as a CHILD of a
 /// long-lived shell, not as the pane's primary process. When the provider
 /// exits, the pane returns to an interactive shell with an explicit exit
@@ -1670,6 +1813,38 @@ impl Transport for TmuxBackend {
         self.spawn_split(session, window, argv, cwd, env, env_unset)
     }
 
+    /// 0.5.39 Slice 2: TmuxBackend override of the worker-shell-wrapper
+    /// variant. Same mechanism as the leader wrapper (child provider under
+    /// long-lived shell), but the marker text is distinct so downstream
+    /// classifiers can tell leader vs worker provider exit apart.
+    fn spawn_first_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let command = worker_shell_wrapper_command(argv, cwd, env, env_unset, provider_label);
+        self.spawn_with_command(session, window, &command, true)
+    }
+
+    fn spawn_into_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let command = worker_shell_wrapper_command(argv, cwd, env, env_unset, provider_label);
+        self.spawn_with_command(session, window, &command, false)
+    }
+
     /// 0.4.x (CR C-2): TmuxBackend override of the leader-shell-wrapper
     /// variant. Builds the wrapper shell line via
     /// `leader_shell_wrapper_command` and runs it through

package/crates/team-agent/src/transport.rs

@@ -589,6 +589,44 @@ pub trait Transport: Send + Sync {
         self.spawn_into(session, window, argv, cwd, env)
     }
 
+    /// 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): worker spawn
+    /// variant that reuses the leader-wrapper mechanism so worker provider
+    /// exit does not collapse the pane into `[exited]` (which under
+    /// upstream tmux 3.6a private-server bugs can cascade into server
+    /// death). When the provider exits, the worker pane returns to an
+    /// interactive shell with an explicit worker exit marker — matching
+    /// manual `tmux new-window` then `<provider>` behaviour. Default falls
+    /// back to plain `spawn_first_with_env_unset` for backends that have
+    /// no shell layer (test-only `OfflineTransport`).
+    fn spawn_first_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let _ = provider_label;
+        self.spawn_first_with_env_unset(session, window, argv, cwd, env, env_unset)
+    }
+
+    /// 同 [`Transport::spawn_first_with_worker_shell_wrapper`],对应 `spawn_into`。
+    fn spawn_into_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let _ = provider_label;
+        self.spawn_into_with_env_unset(session, window, argv, cwd, env, env_unset)
+    }
+
     /// 0.4.x (CR C-2): leader-specific spawn variant. Instead of `exec <cmd>`
     /// (which makes the provider the pane's primary process and turns the
     /// pane into `[exited]` when the provider exits), build a shell line

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.38",
+  "version": "0.5.39",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.38",
-    "@team-agent/cli-darwin-x64": "0.5.38",
-    "@team-agent/cli-linux-x64": "0.5.38"
+    "@team-agent/cli-darwin-arm64": "0.5.39",
+    "@team-agent/cli-darwin-x64": "0.5.39",
+    "@team-agent/cli-linux-x64": "0.5.39"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",