@team-agent/installer 0.5.4 → 0.5.6

package/crates/team-agent/src/mcp_server/tools.rs

@@ -21,9 +21,8 @@ use crate::messaging::{self, MessageTarget, SendOptions};
 
 use super::helpers::{
     delivery_outcome_value, ensure_object, enum_value, insert_array, is_worker_recipient,
-    json_dumps_default, latest_task_for_assignee, latest_uncorrelated_delivered_message_for,
-    non_empty_string, normalized_envelope_value, object_fields, requires_ack_for_target,
-    tool_runtime_error,
+    json_dumps_default, latest_reportable_message_for, latest_task_for_assignee, non_empty_string,
+    normalized_envelope_value, object_fields, requires_ack_for_target, tool_runtime_error,
 };
 use super::normalize::{
     compact_tool_result, normalize_report_envelope, normalize_result_status_observed,
@@ -326,9 +325,9 @@ impl TeamOrchestratorTools {
                 //   1. explicit arg
                 //   2. latest nonterminal task assigned to this agent in
                 //      teams.<owner>.tasks (scoped) → top-level tasks
-                //   3. latest delivered direct message to this agent with no
-                //      task id and no result yet (message-scope correlation —
-                //      collect path: is_message_scoped_result)
+                //   3. current/in-flight reportable direct message to this agent
+                //      with no task id and no result yet (message-scope
+                //      correlation — collect path: is_message_scoped_result)
                 //   4. "manual" — truly uncorrelated; collect still rejects
                 let owner_team_id_str = self.owner_team_id.as_ref().map(|t| t.as_str().to_string());
                 let resolved = task_id
@@ -344,7 +343,7 @@ impl TeamOrchestratorTools {
                     })
                     .or_else(|| {
                         self.agent_id.as_ref().and_then(|agent| {
-                            latest_uncorrelated_delivered_message_for(
+                            latest_reportable_message_for(
                                 &self.workspace,
                                 agent.as_str(),
                                 owner_team_id_str.as_deref(),

package/crates/team-agent/src/messaging/delivery.rs

@@ -165,7 +165,7 @@ pub fn deliver_pending_message(
     };
     let attempt = if store.claim_for_delivery(message_id)? {
         message.delivery_attempts.saturating_add(1)
-    } else if message.status == "target_resolved" {
+    } else if message.status == "target_resolved" && message.error.is_some() {
         bump_delivery_attempts(store, message_id)?
     } else {
         return Ok(DeliveryOutcome {
@@ -190,6 +190,42 @@ pub fn deliver_pending_message(
             )? {
                 return Ok(outcome);
             }
+            // 0.5.4 gate054 cross-team leak fix: a `leader_receiver.status`
+            // other than `"attached"` (restart demotes killed-session receivers
+            // to `"rebind_required"` — lifecycle/restart/rebuild.rs:1311) MUST
+            // refuse delivery before any pane injection or cross-server pane-id
+            // probing. Without this gate, a stale receiver on team A's socket
+            // could otherwise fall back to the same pane id on the main tmux
+            // server (delivery.rs:1150-1201) and inject A's leader traffic into
+            // team B's leader pane. See .team/artifacts/0.5.4-gate-crossteam-notify-triage.md.
+            if let Some(status) = leader_receiver_status(state) {
+                if status != "attached" {
+                    store.mark(message_id, "failed", Some("leader_not_attached"))?;
+                    event_log.write(
+                        "leader_receiver.delivery_blocked",
+                        serde_json::json!({
+                            "message_id": message_id,
+                            "sender": message.sender,
+                            "reason": "leader_receiver_not_attached",
+                            "channel": "rebind_required",
+                            "action": "run team-agent attach-leader or team-agent takeover",
+                            "status": status,
+                        }),
+                    )?;
+                    return Ok(DeliveryOutcome {
+                        ok: false,
+                        status: DeliveryStatus::Refused,
+                        message_status: MessageStatusShadow("failed".to_string()),
+                        message_id: Some(message_id.to_string()),
+                        verification: Some(
+                            "run team-agent attach-leader or team-agent takeover".to_string(),
+                        ),
+                        stage: None,
+                        reason: Some(DeliveryRefusal::LeaderNotAttached),
+                        channel: Some("rebind_required".to_string()),
+                    });
+                }
+            }
             if crate::codex_app_server::receiver_is_app_server(receiver) {
                 return deliver_leader_via_app_server(
                     store,
@@ -288,6 +324,16 @@ pub fn deliver_pending_message(
         });
     }
     let target = resolve_inject_target(state, &message.recipient, transport, &live_targets);
+    if let Some(outcome) = block_missing_worker_target(
+        store,
+        event_log,
+        message_id,
+        &message.recipient,
+        &target,
+        &live_targets,
+    )? {
+        return Ok(outcome);
+    }
     // Contract B / MUST-10 / N31/N32: physical paste+Enter into a startup trust/update
     // menu is NOT provider delivery — the menu consumes the Enter and the task text
     // is lost (PROBE-2 root-cause). Before injection, peek at the recipient's pane for
@@ -358,6 +404,15 @@ pub fn deliver_pending_message(
                     channel: Some("rebind_required".to_string()),
                 });
             }
+            if transport_error_is_target_missing(&error) {
+                return mark_worker_target_missing(
+                    store,
+                    event_log,
+                    message_id,
+                    &message.recipient,
+                    Some(reason),
+                );
+            }
             event_log.write(
                 "send.inject_failed",
                 serde_json::json!({
@@ -405,6 +460,14 @@ pub fn deliver_pending_message(
             });
         }
     };
+    record_current_turn_after_inject_if_leader_to_worker_scoped(
+        workspace,
+        &message.sender,
+        &message.recipient,
+        message_id,
+        event_log,
+        canonical_owner_team_id.as_deref(),
+    )?;
     let submit_verified = inject_submit_verified(&inject_report);
     let readback_verified = pane_readback_verified(&inject_report);
     // Leader pane: inject success is delivery proof. Worker pane: post-submit
@@ -574,6 +637,136 @@ pub fn deliver_pending_message(
     Ok(outcome)
 }
 
+fn block_missing_worker_target(
+    store: &MessageStore,
+    event_log: &EventLog,
+    message_id: &str,
+    recipient: &str,
+    target: &Target,
+    live_targets: &[PaneInfo],
+) -> Result<Option<DeliveryOutcome>, MessagingError> {
+    let Target::SessionWindow { session, window } = target else {
+        return Ok(None);
+    };
+    if live_targets.is_empty() {
+        return Ok(None);
+    }
+    if window.as_str().ends_with("_pane_conflicts_with_leader") {
+        return Ok(None);
+    }
+    if live_targets.iter().any(|pane| {
+        pane.session.as_str() == session.as_str()
+            && pane
+                .window_name
+                .as_ref()
+                .is_some_and(|name| name.as_str() == window.as_str())
+    }) {
+        return Ok(None);
+    }
+    mark_worker_target_missing(store, event_log, message_id, recipient, None).map(Some)
+}
+
+fn mark_worker_target_missing(
+    store: &MessageStore,
+    event_log: &EventLog,
+    message_id: &str,
+    recipient: &str,
+    verification: Option<String>,
+) -> Result<DeliveryOutcome, MessagingError> {
+    let action = format!("run team-agent start-agent {recipient} --allow-fresh");
+    store.mark(
+        message_id,
+        "queued_pane_missing",
+        Some("tmux_target_missing"),
+    )?;
+    event_log.write(
+        "send.inject_blocked",
+        serde_json::json!({
+            "message_id": message_id,
+            "recipient": recipient,
+            "reason": "tmux_target_missing",
+            "channel": "delivery_blocked",
+            "action": action,
+            "verification": verification,
+        }),
+    )?;
+    Ok(DeliveryOutcome {
+        ok: false,
+        status: DeliveryStatus::Blocked,
+        message_status: MessageStatusShadow("queued_pane_missing".to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: verification.or(Some(action)),
+        stage: Some(DeliveryStage::Inject),
+        reason: Some(DeliveryRefusal::TmuxTargetMissing),
+        channel: Some("delivery_blocked".to_string()),
+    })
+}
+
+fn transport_error_is_target_missing(error: &crate::transport::TransportError) -> bool {
+    match error {
+        crate::transport::TransportError::TargetNotFound { .. } => true,
+        crate::transport::TransportError::Subprocess { stderr, .. } => {
+            let stderr = stderr.to_ascii_lowercase();
+            (stderr.contains("can't find") || stderr.contains("no such"))
+                && (stderr.contains("pane")
+                    || stderr.contains("window")
+                    || stderr.contains("session"))
+        }
+        _ => false,
+    }
+}
+
+pub fn requeue_worker_target_missing_messages(
+    workspace: &Path,
+    store: &MessageStore,
+    event_log: &EventLog,
+    recipient: &str,
+    owner_team_id: Option<&str>,
+) -> Result<Vec<String>, MessagingError> {
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    let now = chrono::Utc::now().to_rfc3339();
+    let mut stmt = conn.prepare(
+        "select message_id from messages
+         where recipient = ?1
+           and status = 'queued_pane_missing'
+           and error = 'tmux_target_missing'
+           and (
+               (?2 is null and owner_team_id is null)
+               or owner_team_id = ?2
+           )
+         order by created_at, message_id",
+    )?;
+    let ids = stmt
+        .query_map(params![recipient, owner_team_id], |row| {
+            row.get::<_, String>(0)
+        })?
+        .collect::<Result<Vec<_>, _>>()?;
+    drop(stmt);
+    for message_id in &ids {
+        conn.execute(
+            "update messages
+             set status = 'accepted',
+                 error = null,
+                 updated_at = ?2
+             where message_id = ?1",
+            params![message_id, now.as_str()],
+        )?;
+    }
+    if !ids.is_empty() {
+        event_log.write(
+            "worker_receiver.blocked_messages_requeued",
+            serde_json::json!({
+                "recipient": recipient,
+                "owner_team_id": owner_team_id,
+                "count": ids.len(),
+                "message_ids": ids,
+            }),
+        )?;
+    }
+    let _ = workspace;
+    Ok(ids)
+}
+
 /// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
 pub(crate) fn inject_submit_verified(report: &InjectReport) -> bool {
     match report.submit_verification {
@@ -1170,34 +1363,17 @@ fn delivery_transport_for_recipient<'a>(
     if socket == crate::tmux_backend::socket_name_for_workspace(workspace) {
         DeliveryTransport::Borrowed(product_transport)
     } else {
+        // 0.5.4 gate054 cross-team leak fix: when `leader_receiver.tmux_socket`
+        // is present and non-canonical, it is a hard channel boundary — the
+        // caller (team A on socket X) explicitly recorded which tmux server
+        // hosts its leader pane. Pane ids (`%N`) are only unique per tmux
+        // server, so probing product/default servers for the same pane id and
+        // switching transports on a match can cross the team/tmux boundary and
+        // inject A's leader traffic into team B's leader pane. If the pane is
+        // absent on the recorded endpoint, let the downstream
+        // `leader_receiver_pane_is_usable` guard produce `rebind_required`
+        // instead of falling back to another server.
         let endpoint_backend = crate::transport_factory::tmux_endpoint_transport(socket);
-        if let Some(pane_id) = pane_id {
-            if endpoint_backend
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Owned(Box::new(endpoint_backend));
-            }
-            if product_transport
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Borrowed(product_transport);
-            }
-            let default_backend = crate::transport_factory::tmux_default_transport();
-            if default_backend
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Owned(Box::new(default_backend));
-            }
-        }
         DeliveryTransport::Owned(Box::new(endpoint_backend))
     }
 }
@@ -1237,6 +1413,15 @@ fn leader_receiver_tmux_socket(state: &serde_json::Value) -> Option<&str> {
     leader_receiver_field(state, "tmux_socket")
 }
 
+/// 0.5.4 gate054 cross-team leak fix: read the bound `leader_receiver.status`
+/// through the same team-scope resolution as [`leader_receiver_tmux_socket`].
+/// Restart marks demoted receivers as `"rebind_required"`
+/// (lifecycle/restart/rebuild.rs:1311); delivery must refuse before injecting
+/// or cross-server pane-id probing (delivery.rs:1150-1201).
+fn leader_receiver_status(state: &serde_json::Value) -> Option<&str> {
+    leader_receiver_field(state, "status")
+}
+
 fn leader_receiver_has_noncanonical_tmux_socket(state: &serde_json::Value) -> bool {
     leader_receiver_tmux_socket(state)
         .is_some_and(|socket| socket != "default" && !std::path::Path::new(socket).is_absolute())
@@ -1494,6 +1679,7 @@ struct PendingMessage {
     task_id: Option<String>,
     owner_team_id: Option<String>,
     status: String,
+    error: Option<String>,
     delivery_attempts: u32,
 }
 
@@ -1504,7 +1690,7 @@ fn message_for_delivery(
     let conn = crate::db::schema::open_db(store.db_path())?;
     let message = conn
         .query_row(
-            "select sender, recipient, content, task_id, owner_team_id, status, delivery_attempts from messages where message_id = ?1",
+            "select sender, recipient, content, task_id, owner_team_id, status, error, delivery_attempts from messages where message_id = ?1",
             params![message_id],
             |row| {
                 Ok(PendingMessage {
@@ -1514,7 +1700,8 @@ fn message_for_delivery(
                     task_id: row.get::<_, Option<String>>(3)?,
                     owner_team_id: row.get::<_, Option<String>>(4)?,
                     status: row.get::<_, String>(5)?,
-                    delivery_attempts: row.get::<_, i64>(6)?.max(0) as u32,
+                    error: row.get::<_, Option<String>>(6)?,
+                    delivery_attempts: row.get::<_, i64>(7)?.max(0) as u32,
                 })
             },
         )
@@ -1713,7 +1900,7 @@ pub fn execute_trust_retry(
 }
 
 /// `_record_turn_open_if_leader_to_worker` (`delivery.py:430`):**take-over arm 来自真实投递**
-/// (card §121) —— 仅 leader→worker 注入**成功后**才调 `record_turn_open_after_delivery`,绝不凭空 arm。
+/// (card §121) —— 仅 leader→worker 注入/投递成功后才 arm,绝不凭空 arm。
 pub fn record_turn_open_if_leader_to_worker(
     workspace: &Path,
     state: &serde_json::Value,
@@ -1728,6 +1915,30 @@ pub fn record_turn_open_if_leader_to_worker(
     )
 }
 
+fn record_current_turn_after_inject_if_leader_to_worker_scoped(
+    workspace: &Path,
+    sender: &str,
+    recipient: &str,
+    message_id: &str,
+    event_log: &EventLog,
+    owner_team_id: Option<&str>,
+) -> Result<(), MessagingError> {
+    if !matches!(sender, "leader" | "Leader") || recipient == "leader" {
+        return Ok(());
+    }
+    let message_id = Some(message_id.to_string());
+    let mut state = scoped_state_for_write(workspace, owner_team_id)?;
+    arm_turn_open(&mut state, recipient, &message_id);
+    save_scoped_state_reapplying_after_conflict(workspace, &state, owner_team_id, |latest| {
+        arm_turn_open(latest, recipient, &message_id);
+    })?;
+    event_log.write(
+        "turn_open.armed_after_inject",
+        serde_json::json!({"agent_id": recipient, "message_id": message_id}),
+    )?;
+    Ok(())
+}
+
 fn record_turn_open_if_leader_to_worker_scoped(
     workspace: &Path,
     sender: &str,
@@ -1764,6 +1975,19 @@ fn arm_turn_open(state: &mut serde_json::Value, recipient: &str, message_id: &Op
             serde_json::json!({"armed": true, "node_id": recipient, "turn_id": message_id}),
         );
     }
+    if let Some(agent) = root
+        .get_mut("agents")
+        .and_then(serde_json::Value::as_object_mut)
+        .and_then(|agents| agents.get_mut(recipient))
+        .and_then(serde_json::Value::as_object_mut)
+    {
+        agent.insert(
+            "current_task_id".to_string(),
+            message_id.as_ref().map_or(serde_json::Value::Null, |id| {
+                serde_json::Value::String(id.clone())
+            }),
+        );
+    }
 }
 
 /// `_stamp_first_send_at_if_leader_to_worker` (`delivery.py:380`):首次 leader→worker 投递戳

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -8,7 +8,7 @@ use serde_json::Value;
 use crate::event_log::EventLog;
 use crate::message_store::{MessageStore, NotificationClaimParams};
 use crate::model::ids::TaskId;
-use crate::transport::{InjectPayload, Key, PaneId, Target, Transport};
+use crate::transport::{InjectPayload, InjectReport, Key, PaneId, Target, Transport, TransportError};
 
 use super::helpers::MessageStatusShadow;
 use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
@@ -286,27 +286,41 @@ pub fn deliver_to_leader_fallback_pane(
     let rendered = render_fallback_pane_message(content, message_id, primary_error);
     let target = Target::Pane(PaneId::new(&pane_id));
     let payload = InjectPayload::Text(rendered);
-    // 0.5.x Phase 1d Batch 4: leader-fallback pane inject uses the
-    // factory tmux channel helpers so `grep transport_factory::tmux_`
-    // enumerates every tmux-only leader-channel site. Semantics are
-    // identical to the previous direct `TmuxBackend::*` calls
-    // (helpers are thin wrappers). `transport_kind`-based dispatch
-    // is the parallel `feat/appserver-leader-host` work; this batch
-    // stays helper-swap only.
-    let inject_result = leader_tmux_socket(state)
-        .and_then(|socket| {
+    // 0.5.5 gate054 cross-team notify boundary: when the leader receiver
+    // has a recorded `tmux_socket` (canonical), that socket is a HARD
+    // channel boundary. Pane ids (`%N`) are only unique per tmux server,
+    // so falling back from a missing/dead pane on the recorded endpoint
+    // to the workspace-canonical or default tmux server can inject team
+    // A's leader traffic into team B's leader pane on a different socket
+    // (real-machine gate054 acceptance B-arm: private socket %1 absent
+    // after leader kill, default server's %1 was the main leader — the
+    // prior chain silently landed A's `report_result` there).
+    //
+    // Loud-not-silent (user tie-break E23 / N32): if the recorded endpoint
+    // rejects the inject we return `Blocked` with `channel=rebind_required`
+    // and audit `leader_receiver.fallback_pane_failed` — the message row
+    // stays pending in the store, coordinator surfaces the pending
+    // notification via status/monitor, and no cross-server injection is
+    // attempted.
+    let inject_result: Result<InjectReport, TransportError> = match leader_tmux_socket(state) {
+        Some(socket) => {
             let backend = crate::transport_factory::tmux_endpoint_transport(socket);
-            backend.inject(&target, &payload, Key::Enter, true).ok()
-        })
-        .map(Ok)
-        .unwrap_or_else(|| {
-            let backend = crate::transport_factory::tmux_workspace_transport(workspace);
-            backend.inject(&target, &payload, Key::Enter, true)
-        })
-        .or_else(|_| {
-            let backend = crate::transport_factory::tmux_default_transport();
             backend.inject(&target, &payload, Key::Enter, true)
-        });
+        }
+        None => {
+            // No socket recorded → legacy (pre-0.5) shape where the receiver
+            // was implicitly bound to the workspace-canonical tmux server.
+            // Keep the workspace→default chain here (single team assumption)
+            // but never mix it with a recorded-socket team.
+            let backend = crate::transport_factory::tmux_workspace_transport(workspace);
+            backend
+                .inject(&target, &payload, Key::Enter, true)
+                .or_else(|_| {
+                    let backend = crate::transport_factory::tmux_default_transport();
+                    backend.inject(&target, &payload, Key::Enter, true)
+                })
+        }
+    };
 
     match inject_result {
         Ok(report) => {
@@ -367,6 +381,14 @@ pub fn deliver_to_leader_fallback_pane(
             }
         }
         Err(error) => {
+            // 0.5.5 gate054: when a leader_receiver.tmux_socket is recorded,
+            // a fallback inject error is a HARD team-boundary event — we do
+            // not cross to workspace/default tmux (see the inject_result
+            // branch above). Surface `rebind_required` so callers wire the
+            // notification status accordingly; the row stays pending in the
+            // store and the audit event carries the same forensic fields as
+            // the pre-fix path.
+            let socket_bound = leader_tmux_socket(state).is_some();
             event_log.write(
                 "leader_receiver.fallback_pane_failed",
                 serde_json::json!({
@@ -377,17 +399,28 @@ pub fn deliver_to_leader_fallback_pane(
                     "primary_error": primary_error,
                     "delivered_via": "fallback_pane",
                     "reason": error.to_string(),
+                    "socket_bound": socket_bound,
                 }),
             )?;
+            // Row status is left untouched so status/monitor surfaces the
+            // pending notification until the operator rebinds the leader.
+            let (status, channel) = if socket_bound {
+                (
+                    DeliveryStatus::Blocked,
+                    "rebind_required".to_string(),
+                )
+            } else {
+                (DeliveryStatus::Failed, "fallback_pane".to_string())
+            };
             Ok(DeliveryOutcome {
                 ok: false,
-                status: DeliveryStatus::Failed,
+                status,
                 message_status: MessageStatusShadow("failed".to_string()),
                 message_id: Some(message_id.to_string()),
                 verification: Some(error.to_string()),
                 stage: None,
                 reason: Some(DeliveryRefusal::TmuxTargetMissing),
-                channel: Some("fallback_pane".to_string()),
+                channel: Some(channel),
             })
         }
     }
@@ -445,9 +478,11 @@ pub(crate) fn leader_pane_bound_but_not_live(workspace: &Path, state: &Value) ->
 }
 
 fn leader_pane_is_live(workspace: &Path, state: &Value, pane_id: &str) -> bool {
-    // 0.5.x Phase 1d Batch 4: leader liveness uses factory tmux
-    // channel helpers. Semantics unchanged; `transport_kind`-based
-    // dispatch is the parallel feat/appserver-leader-host work.
+    // 0.5.5 gate054 boundary: when a socket is recorded, liveness is
+    // scoped to that endpoint. Never union with workspace/default targets
+    // (pane ids are only unique per tmux server; a stray same-numbered
+    // pane on another server would falsely report "live" and steer the
+    // fallback path into a cross-team inject).
     if let Some(socket) = leader_tmux_socket(state) {
         return crate::transport_factory::tmux_endpoint_transport(socket)
             .list_targets()