@team-agent/installer 0.5.42 → 0.5.44

package/crates/team-agent/src/layout/worker_env.rs

@@ -28,6 +28,7 @@ use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 
 use crate::model::yaml::Value as YamlValue;
+use crate::provider::Provider;
 
 /// Env-key PREFIXES that are stripped from the inherited parent env
 /// before worker spawn. These carry leader-process identity and must
@@ -52,6 +53,10 @@ const STRIP_EXACT: &[&str] = &[
     "TMUX_PANE",
 ];
 
+const WORKER_IDENTITY_EXACT: &[&str] = &["CLAUDECODE", "CLAUDE_EFFORT", "CODEX_THREAD_ID"];
+
+const WORKER_IDENTITY_PREFIXES: &[&str] = &["CLAUDE_CODE_"];
+
 /// Build the worker spawn env per Python inherit-then-strip semantics.
 ///
 /// Inputs:
@@ -102,6 +107,30 @@ where
     env
 }
 
+pub(crate) fn isolate_worker_spawn_env(
+    _target_provider: Provider,
+    env: &mut BTreeMap<String, String>,
+    base_env_unset: impl IntoIterator<Item = String>,
+) -> Vec<String> {
+    let mut env_unset = base_env_unset
+        .into_iter()
+        .collect::<std::collections::BTreeSet<_>>();
+    for key in WORKER_IDENTITY_EXACT {
+        env.remove(*key);
+        env_unset.insert((*key).to_string());
+    }
+    let dynamic_keys = env
+        .keys()
+        .filter(|key| is_worker_identity_key(key))
+        .cloned()
+        .collect::<Vec<_>>();
+    for key in dynamic_keys {
+        env.remove(&key);
+        env_unset.insert(key);
+    }
+    env_unset.into_iter().collect()
+}
+
 fn is_stripped(key: &str) -> bool {
     if STRIP_EXACT.iter().any(|exact| *exact == key) {
         return true;
@@ -112,9 +141,17 @@ fn is_stripped(key: &str) -> bool {
     false
 }
 
+fn is_worker_identity_key(key: &str) -> bool {
+    WORKER_IDENTITY_PREFIXES
+        .iter()
+        .any(|prefix| key.starts_with(prefix))
+}
+
 fn is_posix_shell_identifier(s: &str) -> bool {
     let mut bytes = s.bytes();
-    let Some(first) = bytes.next() else { return false };
+    let Some(first) = bytes.next() else {
+        return false;
+    };
     if !(first.is_ascii_alphabetic() || first == b'_') {
         return false;
     }
@@ -147,12 +184,24 @@ mod tests {
             ("OPENAI_API_KEY".to_string(), "sk-test".to_string()),
             ("COPILOT_TOKEN".to_string(), "tok".to_string()),
             // Leader identity — must be stripped.
-            ("TEAM_AGENT_LEADER_PROVIDER".to_string(), "claude".to_string()),
-            ("TEAM_AGENT_LEADER_SESSION_UUID".to_string(), "leader-uuid".to_string()),
-            ("TEAM_AGENT_MACHINE_FINGERPRINT".to_string(), "fp".to_string()),
+            (
+                "TEAM_AGENT_LEADER_PROVIDER".to_string(),
+                "claude".to_string(),
+            ),
+            (
+                "TEAM_AGENT_LEADER_SESSION_UUID".to_string(),
+                "leader-uuid".to_string(),
+            ),
+            (
+                "TEAM_AGENT_MACHINE_FINGERPRINT".to_string(),
+                "fp".to_string(),
+            ),
             ("TEAM_AGENT_TEAM_ID".to_string(), "alpha".to_string()),
             ("TEAM_AGENT_LEADER_BYPASS".to_string(), "1".to_string()),
-            ("COPILOT_DISABLE_TERMINAL_TITLE".to_string(), "1".to_string()),
+            (
+                "COPILOT_DISABLE_TERMINAL_TITLE".to_string(),
+                "1".to_string(),
+            ),
             // Random noise — non-whitelisted prefix.
             ("RANDOM_NOISE".to_string(), "x".to_string()),
             ("TMUX".to_string(), "leader-pane".to_string()),
@@ -197,20 +246,27 @@ mod tests {
             "developer",
             Some("alpha"),
         );
-        assert_eq!(env.get("TEAM_AGENT_ID").map(String::as_str), Some("developer"));
-        assert_eq!(env.get("TEAM_AGENT_AGENT_ID").map(String::as_str), Some("developer"));
-        assert_eq!(env.get("TEAM_AGENT_WORKSPACE").map(String::as_str), Some("/ws"));
-        assert_eq!(env.get("TEAM_AGENT_OWNER_TEAM_ID").map(String::as_str), Some("alpha"));
+        assert_eq!(
+            env.get("TEAM_AGENT_ID").map(String::as_str),
+            Some("developer")
+        );
+        assert_eq!(
+            env.get("TEAM_AGENT_AGENT_ID").map(String::as_str),
+            Some("developer")
+        );
+        assert_eq!(
+            env.get("TEAM_AGENT_WORKSPACE").map(String::as_str),
+            Some("/ws")
+        );
+        assert_eq!(
+            env.get("TEAM_AGENT_OWNER_TEAM_ID").map(String::as_str),
+            Some("alpha")
+        );
     }
 
     #[test]
     fn worker_spawn_env_inherits_parent_env_minus_strip_list() {
-        let env = worker_spawn_env(
-            make_parent_env(&[]),
-            Path::new("/ws"),
-            "developer",
-            None,
-        );
+        let env = worker_spawn_env(make_parent_env(&[]), Path::new("/ws"), "developer", None);
         // Inherit-then-strip: every parent key passes through EXCEPT the
         // strip list. PATH-like + provider creds + random user vars all
         // present.
@@ -240,15 +296,24 @@ mod tests {
     #[test]
     fn worker_spawn_cwd_returns_workspace_when_no_spec_override() {
         // YAML agent with no spawn_cwd field.
-        let agent = YamlValue::Map(vec![("id".to_string(), YamlValue::Str("developer".to_string()))]);
-        assert_eq!(worker_spawn_cwd(&agent, Path::new("/ws")), PathBuf::from("/ws"));
+        let agent = YamlValue::Map(vec![(
+            "id".to_string(),
+            YamlValue::Str("developer".to_string()),
+        )]);
+        assert_eq!(
+            worker_spawn_cwd(&agent, Path::new("/ws")),
+            PathBuf::from("/ws")
+        );
     }
 
     #[test]
     fn worker_spawn_cwd_returns_yaml_override_when_present() {
         let agent = YamlValue::Map(vec![
             ("id".to_string(), YamlValue::Str("developer".to_string())),
-            ("spawn_cwd".to_string(), YamlValue::Str("/explicit/cwd".to_string())),
+            (
+                "spawn_cwd".to_string(),
+                YamlValue::Str("/explicit/cwd".to_string()),
+            ),
         ]);
         assert_eq!(
             worker_spawn_cwd(&agent, Path::new("/ws")),
@@ -262,6 +327,9 @@ mod tests {
             ("id".to_string(), YamlValue::Str("developer".to_string())),
             ("spawn_cwd".to_string(), YamlValue::Str("".to_string())),
         ]);
-        assert_eq!(worker_spawn_cwd(&agent, Path::new("/ws")), PathBuf::from("/ws"));
+        assert_eq!(
+            worker_spawn_cwd(&agent, Path::new("/ws")),
+            PathBuf::from("/ws")
+        );
     }
 }

package/crates/team-agent/src/leader/helpers.rs

@@ -63,7 +63,13 @@ pub(crate) fn resolve_workspace_for_hash(workspace: &Path) -> PathBuf {
 pub(crate) fn sanitize_session_folder(raw: &str) -> String {
     let replaced: String = raw
         .chars()
-        .map(|c| if c.is_ascii_alphanumeric() || matches!(c, '_' | '-' | '.') { c } else { '_' })
+        .map(|c| {
+            if c.is_ascii_alphanumeric() || matches!(c, '_' | '-' | '.') {
+                c
+            } else {
+                '_'
+            }
+        })
         .take(48)
         .collect();
     let trimmed = replaced.trim_matches(|c| matches!(c, '_' | '-' | '.'));