@team-agent/installer 0.5.46 → 0.5.48

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.46"
+version = "0.5.48"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.46"
+version = "0.5.48"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/emit.rs

@@ -11,16 +11,22 @@ use std::io::Write as _;
 pub fn emit(output: &CmdOutput, as_json: bool) -> Option<String> {
     match output {
         CmdOutput::None => None,
-        CmdOutput::Human(text) => Some(text.clone()),
-        CmdOutput::Json(value) if as_json => serde_json::to_string_pretty(&sort_json(value)).ok(),
-        CmdOutput::Json(Value::Object(obj)) => {
-            let lines: Vec<String> = obj
-                .iter()
-                .map(|(key, value)| format!("{key}: {}", human_value(value)))
-                .collect();
-            Some(lines.join("\n"))
+        CmdOutput::Human(text) => Some(crate::redaction::redact_external_text(text)),
+        CmdOutput::Json(value) => {
+            let value = crate::redaction::redact_external_value(value);
+            if as_json {
+                return serde_json::to_string_pretty(&sort_json(&value)).ok();
+            }
+            if let Value::Object(obj) = value {
+                let lines: Vec<String> = obj
+                    .iter()
+                    .map(|(key, value)| format!("{key}: {}", human_value(value)))
+                    .collect();
+                Some(lines.join("\n"))
+            } else {
+                Some(human_value(&value))
+            }
         }
-        CmdOutput::Json(value) => Some(human_value(value)),
     }
 }
 
@@ -620,8 +626,24 @@ fn emit_cli_error(command: &str, args: &[String], cwd: &Path, error: &CliError)
     }
     let normalized = normalize_cli_error(error);
     let payload_error = normalized.as_ref().unwrap_or(error);
-    let _ = std::fs::write(&log_path, format!("{payload_error}\n"));
-    let payload = payload_error.to_payload(&log_path, command);
+    let safe_error = crate::redaction::redact_external_text(&payload_error.to_string());
+    let _ = std::fs::write(&log_path, format!("{safe_error}\n"));
+    let mut payload = payload_error.to_payload(&log_path, command);
+    payload.error = safe_error;
+    payload.action = crate::redaction::redact_external_text(&payload.action);
+    payload.log = crate::redaction::redact_external_text(&payload.log);
+    payload.reason = payload
+        .reason
+        .map(|value| crate::redaction::redact_external_text(&value));
+    payload.session_name = payload
+        .session_name
+        .map(|value| crate::redaction::redact_external_text(&value));
+    payload.next_actions = payload.next_actions.map(|values| {
+        values
+            .into_iter()
+            .map(|value| crate::redaction::redact_external_text(&value))
+            .collect()
+    });
     if has_arg(args, "--json") {
         if let Ok(value) = serde_json::to_value(payload) {
             println!("{}", python_compact_json(&value));

package/crates/team-agent/src/cli/status_port.rs

@@ -89,7 +89,7 @@ pub fn status_scoped(
         );
     }
     let readiness = crate::cli::diagnose::wait_readiness(&readiness_state);
-    let full = json!({
+    let full = crate::redaction::redact_external_value(&json!({
         "ok": true,
         "team": state.pointer("/leader/id").cloned().unwrap_or_else(|| json!("leader")),
         "session_name": state.get("session_name").cloned().unwrap_or(Value::Null),
@@ -124,7 +124,7 @@ pub fn status_scoped(
                 .tail(10)
                 .map_err(|e| CliError::Runtime(e.to_string()))?,
         ),
-    });
+    }));
     if compact {
         Ok(compact_status(full))
     } else {

package/crates/team-agent/src/event_log.rs

@@ -147,7 +147,7 @@ impl EventLog {
                 obj.insert(k, v);
             }
         }
-        let event = Value::Object(obj);
+        let event = crate::redaction::redact_external_value(&Value::Object(obj));
         self.maybe_rotate()?;
         // 单次 write_all(line+"\n"):POSIX O_APPEND 对 <PIPE_BUF 写原子,避免并发写者交错(对抗 P1)。
         let mut bytes = to_python_json(&sort_value(&event)).into_bytes();
@@ -176,11 +176,11 @@ impl EventLog {
         let mut out = Vec::new();
         for line in &lines[start..] {
             match serde_json::from_str::<Value>(line) {
-                Ok(v) => out.push(v),
+                Ok(v) => out.push(crate::redaction::redact_external_value(&v)),
                 Err(_) => {
                     let mut m = serde_json::Map::new();
                     m.insert("raw".to_string(), Value::String((*line).to_string()));
-                    out.push(Value::Object(m));
+                    out.push(crate::redaction::redact_external_value(&Value::Object(m)));
                 }
             }
         }

package/crates/team-agent/src/lib.rs

@@ -56,6 +56,7 @@ pub use crate::db::message_store;
 // step 8 (provider) — ProviderAdapter trait + typed provider/turn-state/liveness 等(ROUND-0 骨架;
 // fn body unimplemented!(),P2 porter 落实现)。MUST-NOT-13:provider 调用全走 trait。
 pub mod provider;
+mod redaction;
 /// unit-6 (Stage 2) compat shim. Physical home is now
 /// `crate::provider::session::capture`; this re-export keeps every
 /// `crate::session_capture::*` caller working without modification.

package/crates/team-agent/src/lifecycle/launch.rs

@@ -4366,6 +4366,7 @@ pub fn fork_agent_with_transport(
     // E5 §3:team_dir(角色定义+profiles)恒用户目录。spec 读用 selector 解析的 spec_path
     // (读序 B:runtime 优先、legacy 回落),写恒走 runtime_spec_path(canonical 落点)。
     let fork_team_dir = selected.team_dir.clone();
+    let fork_team = selected.team_key.clone();
     let read_spec_path = selected
         .spec_path
         .clone()
@@ -4373,7 +4374,7 @@ pub fn fork_agent_with_transport(
     let workspace = selected.run_workspace;
     let state = selected.state;
     ensure_owner_allowed_for_state(&state, Some(source_agent_id))?;
-    let spec_path = crate::model::paths::runtime_spec_path(&workspace, &selected.team_key);
+    let spec_path = crate::model::paths::runtime_spec_path(&workspace, &fork_team);
     let text = std::fs::read_to_string(&read_spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", read_spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
@@ -4487,7 +4488,6 @@ pub fn fork_agent_with_transport(
         &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
-    let fork_team = crate::messaging::leader_receiver::active_team_key(&workspace, &state);
     let mcp_config = adapter.mcp_config(auth_mode).map_err(|e| {
         let _ = std::fs::write(&spec_path, text.as_bytes());
         LifecycleError::Provider(e.to_string())
@@ -4625,13 +4625,16 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(e);
     }
-    if let Err(e) = crate::state::persist::save_runtime_state_with_lifecycle_topology_authority(
-        &workspace,
+    if let Err(e) = crate::state::repository::StateRepository::new(&workspace).save(
+        crate::state::repository::StateWriteIntent::ForkAgent {
+            team_key: &fork_team,
+            agent_id: as_agent_id.as_str(),
+        },
         &next_state,
-        &[as_agent_id.as_str()],
     ) {
         rollback_fork_after_spawn(
             &workspace,
@@ -4644,9 +4647,56 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(LifecycleError::StatePersist(e.to_string()));
     }
+    let registration =
+        crate::state::projection::select_runtime_state(&workspace, Some(fork_team.as_str()))
+            .map_err(|e| e.to_string())
+            .and_then(|saved| {
+                let agent = saved
+                    .get("agents")
+                    .and_then(|agents| agents.get(as_agent_id.as_str()))
+                    .ok_or_else(|| "canonical team row is missing".to_string())?;
+                if agent.get("pane_id").and_then(serde_json::Value::as_str)
+                    != Some(spawn.pane_id.as_str())
+                {
+                    return Err("canonical team pane_id does not match spawned pane".to_string());
+                }
+                if agent.get("window").and_then(serde_json::Value::as_str) != Some(window.as_str())
+                {
+                    return Err("canonical team window does not match spawned window".to_string());
+                }
+                if let Some(pid) = spawn.child_pid {
+                    if agent.get("pane_pid").and_then(serde_json::Value::as_u64)
+                        != Some(u64::from(pid))
+                    {
+                        return Err(
+                            "canonical team pane_pid does not match spawned process".to_string()
+                        );
+                    }
+                }
+                Ok(())
+            });
+    if let Err(reason) = registration {
+        rollback_fork_after_spawn(
+            &workspace,
+            &spec_path,
+            &text,
+            &old_state,
+            transport,
+            &session_name,
+            &window,
+            &mcp_config_path,
+            as_agent_id,
+            &profile_launch,
+            &fork_team,
+        );
+        return Err(LifecycleError::StatePersist(format!(
+            "fork spawned but team registration readback failed: {reason}"
+        )));
+    }
     if let Err(e) = maybe_fail_fork_after_spawn("start_coordinator") {
         rollback_fork_after_spawn(
             &workspace,
@@ -4659,6 +4709,7 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(e);
     }
@@ -4678,6 +4729,7 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         LifecycleError::StatePersist(e.to_string())
     })?;
@@ -4704,16 +4756,19 @@ fn rollback_fork_after_spawn(
     mcp_config_path: &Path,
     agent_id: &AgentId,
     profile_launch: &crate::provider::ProviderProfileLaunch,
+    team_key: &str,
 ) {
     let _ = transport.kill_window(&Target::SessionWindow {
         session: session_name.clone(),
         window: window.clone(),
     });
     let _ = std::fs::write(spec_path, spec_text.as_bytes());
-    let _ = crate::state::persist::save_runtime_state_with_deleted_agents(
-        workspace,
+    let _ = crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::AgentRollback {
+            team_key: Some(team_key),
+            agent_id: agent_id.as_str(),
+        },
         old_state,
-        &[agent_id.as_str()],
     );
     cleanup_fork_mcp_artifacts(workspace, agent_id, mcp_config_path, profile_launch);
 }

package/crates/team-agent/src/lifecycle/profile_smoke.rs

@@ -485,27 +485,17 @@ fn proxy_scheme(url: &str) -> Option<String> {
 
 fn redact_endpoint(raw: &str) -> String {
     let no_query = raw.split_once('?').map(|(head, _)| head).unwrap_or(raw);
-    let Some((scheme, rest)) = no_query.split_once("://") else {
-        return no_query.to_string();
-    };
-    let slash = rest.find('/').unwrap_or(rest.len());
-    let authority = &rest[..slash];
-    let path = &rest[slash..];
-    if let Some((_, host)) = authority.rsplit_once('@') {
-        format!("{scheme}://[redacted]@{host}{path}")
-    } else {
-        no_query.to_string()
-    }
+    crate::redaction::redact_external_text(no_query)
 }
 
 fn redact_text(raw: &str, secrets: &[&str]) -> String {
     let mut out = raw.chars().take(512).collect::<String>();
     for secret in secrets {
         if !secret.is_empty() {
-            out = out.replace(secret, "[redacted]");
+            out = out.replace(secret, "[REDACTED]");
         }
     }
-    out
+    crate::redaction::redact_external_text(&out)
 }
 
 fn auth_mode_wire(auth_mode: AuthMode) -> &'static str {

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -113,11 +113,7 @@ pub(crate) fn start_agent_at_paths(
     let window = agent_window(&agent, agent_id);
     let adaptive_layout =
         open_display && crate::lifecycle::launch::state_uses_adaptive_layout(&state);
-    let fake_provider = raw_agent
-        .get("provider")
-        .and_then(serde_json::Value::as_str)
-        .is_some_and(|provider| provider.eq_ignore_ascii_case("fake"));
-    if force && !fake_provider && is_per_agent_window(&window, agent_id) {
+    if force && is_per_agent_window(&window, agent_id) {
         let expected_pane_id = raw_agent
             .get("pane_id")
             .and_then(serde_json::Value::as_str)
@@ -276,12 +272,20 @@ pub(crate) fn start_agent_at_paths(
         None,
         Some(resolved_team_key.as_str()),
     )?;
-    verify_spawned_pane_matches_target(
+    if let Err(error) = verify_spawned_pane_matches_target(
         transport,
         &spawn.spawn.pane_id,
         &session_name,
         &spawn.spawn.window,
-    )?;
+    ) {
+        if let Err(rollback_error) = transport.kill_pane(&spawn.spawn.pane_id) {
+            return Err(LifecycleError::RequirementUnmet(format!(
+                "{error}; failed to roll back spawned pane {}: {rollback_error}",
+                spawn.spawn.pane_id.as_str()
+            )));
+        }
+        return Err(error);
+    }
     let actual_spawn_window = spawn.spawn.window.as_str().to_string();
     mark_agent_started(
         &mut state,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -89,11 +89,19 @@ fn same_role_cohort_error(
     expected_live: usize,
     expected_old_only: bool,
 ) -> Option<String> {
-    let panes = transport.list_targets().ok()?;
+    let panes = match transport.list_targets() {
+        Ok(panes) => panes,
+        Err(error) => {
+            return Some(format!(
+                "{operation} refused: same-role cohort observation failed: {error}"
+            ));
+        }
+    };
     let mut cardinality_proofs = Vec::new();
     let mut binding_proofs = Vec::new();
+    let mut observation_proofs = Vec::new();
     for target in targets {
-        let live_panes = panes
+        let candidate_panes = panes
             .iter()
             .filter(|pane| pane.session.as_str() == session_name.as_str())
             .filter(|pane| {
@@ -101,20 +109,30 @@ fn same_role_cohort_error(
                     .as_ref()
                     .is_some_and(|window| window.as_str() == target.window)
             })
-            .filter(|pane| {
-                !expected_old_only
-                    || target
-                        .expected_pane_id
-                        .as_deref()
-                        .is_some_and(|expected| pane.pane_id.as_str() == expected)
-            })
-            .filter(|pane| {
-                transport
-                    .liveness(&pane.pane_id)
-                    .is_ok_and(|live| live == crate::transport::PaneLiveness::Live)
-            })
-            .map(|pane| pane.pane_id.as_str().to_string())
             .collect::<Vec<_>>();
+        let mut live_panes = Vec::new();
+        for pane in candidate_panes {
+            match transport.liveness(&pane.pane_id) {
+                Ok(crate::transport::PaneLiveness::Live) => {
+                    live_panes.push(pane.pane_id.as_str().to_string());
+                }
+                Ok(crate::transport::PaneLiveness::Dead) => {}
+                Ok(crate::transport::PaneLiveness::Unknown) => {
+                    observation_proofs.push(format!(
+                        "{}:window={}:pane={}:liveness=unknown",
+                        target.agent_id,
+                        target.window,
+                        pane.pane_id.as_str()
+                    ));
+                }
+                Err(error) => observation_proofs.push(format!(
+                    "{}:window={}:pane={}:liveness_error={error}",
+                    target.agent_id,
+                    target.window,
+                    pane.pane_id.as_str()
+                )),
+            }
+        }
         if live_panes.len() != expected_live {
             cardinality_proofs.push(format!(
                 "{}:window={}:live_panes=[{}]",
@@ -135,6 +153,12 @@ fn same_role_cohort_error(
             }
         }
     }
+    if !observation_proofs.is_empty() {
+        return Some(format!(
+            "{operation} refused: same-role cohort observation failed; {}",
+            observation_proofs.join("; ")
+        ));
+    }
     if !binding_proofs.is_empty() {
         return Some(format!(
             "{operation} refused: spawn identity/binding mismatch; {}",
@@ -476,6 +500,16 @@ pub(super) fn spawn_agent_window(
     );
     if let Some(error) = startup_prompt.capture_error.as_deref() {
         if is_structural_startup_prompt_error(error) {
+            if let Err(rollback_error) = transport.kill_pane(&spawn.pane_id) {
+                return Err(LifecycleError::Transport(format!(
+                    "startup prompt structural failure for {}:{} pane {}: {}; failed to roll back spawned pane: {}",
+                    session_name.as_str(),
+                    window.as_str(),
+                    spawn.pane_id.as_str(),
+                    error,
+                    rollback_error
+                )));
+            }
             return Err(LifecycleError::Transport(format!(
                 "startup prompt structural failure for {}:{} pane {}: {}",
                 session_name.as_str(),

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -14,7 +14,7 @@ pub(super) type LaneSpawns = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<St
 /// end-to-end in-process.
 pub(super) struct LaneTransport {
     session: String,
-    windows: Vec<String>,
+    windows: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
     killed: LaneKills,
     spawns: LaneSpawns,
 }
@@ -22,7 +22,9 @@ impl LaneTransport {
     pub(super) fn new(session: &str, windows: &[&str]) -> Self {
         Self {
             session: session.to_string(),
-            windows: windows.iter().map(|w| (*w).to_string()).collect(),
+            windows: std::sync::Arc::new(std::sync::Mutex::new(
+                windows.iter().map(|w| (*w).to_string()).collect(),
+            )),
             killed: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
             spawns: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
         }
@@ -120,6 +122,8 @@ impl crate::transport::Transport for LaneTransport {
     ) -> Result<Vec<crate::transport::PaneInfo>, crate::transport::TransportError> {
         Ok(self
             .windows
+            .lock()
+            .unwrap()
             .iter()
             .map(|w| crate::transport::PaneInfo {
                 pane_id: crate::transport::PaneId::new(format!("%{w}")),
@@ -149,6 +153,8 @@ impl crate::transport::Transport for LaneTransport {
         if s.as_str() == self.session {
             Ok(self
                 .windows
+                .lock()
+                .unwrap()
                 .iter()
                 .map(|w| crate::transport::WindowName::new(w.as_str()))
                 .collect())
@@ -174,13 +180,22 @@ impl crate::transport::Transport for LaneTransport {
         &self,
         t: &crate::transport::Target,
     ) -> Result<(), crate::transport::TransportError> {
-        let name = match t {
-            crate::transport::Target::Pane(p) => p.as_str().to_string(),
+        let (name, window) = match t {
+            crate::transport::Target::Pane(p) => (p.as_str().to_string(), None),
             crate::transport::Target::SessionWindow { session, window } => {
-                format!("{}:{}", session.as_str(), window.as_str())
+                (
+                    format!("{}:{}", session.as_str(), window.as_str()),
+                    Some(window.as_str()),
+                )
             }
         };
         self.killed.lock().unwrap().push(name);
+        if let Some(window) = window {
+            self.windows
+                .lock()
+                .unwrap()
+                .retain(|candidate| candidate != window);
+        }
         Ok(())
     }
     fn attach_session(

package/crates/team-agent/src/mcp_server/wire.rs

@@ -204,6 +204,7 @@ fn run_stdio_loop_inner<R: BufRead, W: Write>(
         report.requests_read = report.requests_read.saturating_add(1);
         let frame = handle_stdin_line(tools, &line, report)?;
         if let Some(value) = frame {
+            let value = crate::redaction::redact_external_value(&value);
             serde_json::to_writer(&mut *writer, &value)?;
             writer.write_all(b"\n")?;
             writer.flush()?;
@@ -266,7 +267,8 @@ fn rpc_id_from_request(request: &Value) -> RpcId {
 }
 
 fn tool_call_result_value(is_error: bool, body: &Value) -> Value {
-    let text = json_dumps_default(body);
+    let body = crate::redaction::redact_external_value(body);
+    let text = json_dumps_default(&body);
     let mut content = serde_json::Map::new();
     content.insert("type".to_string(), Value::String("text".to_string()));
     content.insert("text".to_string(), Value::String(text));

package/crates/team-agent/src/redaction.rs

@@ -0,0 +1,185 @@
+use std::sync::LazyLock;
+
+use regex::{Captures, Regex};
+use serde_json::Value;
+
+const REDACTED: &str = "[REDACTED]";
+const SENSITIVE_FAMILIES: [&str; 7] = [
+    "PROXY",
+    "TOKEN",
+    "KEY",
+    "PASSWORD",
+    "AUTH",
+    "SECRET",
+    "CREDENTIAL",
+];
+const STRUCTURAL_KEYS: [&str; 13] = [
+    "active_team_key",
+    "cohort_key",
+    "dedupe_key",
+    "error_key",
+    "error_observation_key",
+    "last_check_key",
+    "last_error_observation_key",
+    "last_notified_key",
+    "last_suppressed_key",
+    "parent_team_key",
+    "runtime_team_key",
+    "team_key",
+    "team_state_key",
+];
+
+static SHELL_ASSIGNMENT: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r#"(?i)(?P<prefix>^|[\s\[,;('"])(?P<key>[a-z_][a-z0-9_]*)=(?P<value>'[^']*'|"[^"]*"|[^\s,\]\[};)]+)"#,
+    )
+    .expect("shell assignment redaction regex")
+});
+
+static URL_USERINFO: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?P<scheme>[A-Za-z][A-Za-z0-9+.-]*://)[^\s/?#]+@")
+        .expect("URL userinfo redaction regex")
+});
+
+pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Value {
+    match value {
+        Value::Object(object) => Value::Object(
+            object
+                .iter()
+                .map(|(key, value)| {
+                    let value = if is_sensitive_env_key(key) {
+                        Value::String(REDACTED.to_string())
+                    } else {
+                        redact_external_value(value)
+                    };
+                    (key.clone(), value)
+                })
+                .collect(),
+        ),
+        Value::Array(values) => Value::Array(values.iter().map(redact_external_value).collect()),
+        Value::String(text) => Value::String(redact_external_text(text)),
+        other => other.clone(),
+    }
+}
+
+pub(crate) fn redact_external_text(text: &str) -> String {
+    let assignments = SHELL_ASSIGNMENT.replace_all(text, |captures: &Captures<'_>| {
+        let key = captures.name("key").map_or("", |value| value.as_str());
+        if !is_sensitive_env_key(key) {
+            return captures[0].to_string();
+        }
+        let prefix = captures.name("prefix").map_or("", |value| value.as_str());
+        let value = captures.name("value").map_or("", |value| value.as_str());
+        let quote = match (value.as_bytes().first(), value.as_bytes().last()) {
+            (Some(b'\''), Some(b'\'')) => "'",
+            (Some(b'"'), Some(b'"')) => "\"",
+            _ => "",
+        };
+        let unquoted = value
+            .strip_prefix(quote)
+            .and_then(|value| value.strip_suffix(quote))
+            .unwrap_or(value);
+        let has_url_userinfo = URL_USERINFO.is_match(unquoted);
+        let redacted_url = URL_USERINFO
+            .replace_all(unquoted, "${scheme}[REDACTED]@")
+            .into_owned();
+        let safe_value = if has_url_userinfo {
+            &redacted_url
+        } else {
+            REDACTED
+        };
+        format!("{prefix}{key}={quote}{safe_value}{quote}")
+    });
+    URL_USERINFO
+        .replace_all(&assignments, "${scheme}[REDACTED]@")
+        .into_owned()
+}
+
+fn is_sensitive_env_key(key: &str) -> bool {
+    if STRUCTURAL_KEYS
+        .iter()
+        .any(|structural| key.eq_ignore_ascii_case(structural))
+    {
+        return false;
+    }
+    let key = key.to_ascii_uppercase();
+    SENSITIVE_FAMILIES
+        .iter()
+        .any(|family| key == *family || key.ends_with(&format!("_{family}")))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn recursive_values_mask_env_families_without_erasing_wire_truth() {
+        let input = json!({
+            "HTTPS_PROXY": "proxy-secret",
+            "Copilot_Github_Token": "token-secret",
+            "nested": [{"db_password": "password-secret"}],
+            "team_key": "current",
+            "active_team_key": "current",
+            "dedupe_key": "restart:worker",
+            "auth_mode": "subscription",
+            "model_source": "role",
+            "model_stale": true,
+        });
+
+        let redacted = redact_external_value(&input);
+
+        assert_eq!(redacted["HTTPS_PROXY"], REDACTED);
+        assert_eq!(redacted["Copilot_Github_Token"], REDACTED);
+        assert_eq!(redacted["nested"][0]["db_password"], REDACTED);
+        assert_eq!(redacted["team_key"], "current");
+        assert_eq!(redacted["active_team_key"], "current");
+        assert_eq!(redacted["dedupe_key"], "restart:worker");
+        assert_eq!(redacted["auth_mode"], "subscription");
+        assert_eq!(redacted["model_source"], "role");
+        assert_eq!(redacted["model_stale"], true);
+        assert_eq!(redact_external_value(&redacted), redacted);
+    }
+
+    #[test]
+    fn text_masks_quoted_assignments_and_url_userinfo_idempotently() {
+        let input = "HTTPS_PROXY='https://user:pass@proxy.invalid:8443/path' http_proxy=other endpoint=https://user:pass@proxy.invalid:8443/path";
+        let expected = "HTTPS_PROXY='https://[REDACTED]@proxy.invalid:8443/path' http_proxy=[REDACTED] endpoint=https://[REDACTED]@proxy.invalid:8443/path";
+
+        let redacted = redact_external_text(input);
+
+        assert_eq!(redacted, expected);
+        assert_eq!(redact_external_text(&redacted), redacted);
+    }
+
+    #[test]
+    fn text_leaves_non_env_assignments_and_plain_urls_unchanged() {
+        let input = "team_key=current author=operator endpoint=https://proxy.invalid/health";
+        assert_eq!(redact_external_text(input), input);
+    }
+
+    #[test]
+    fn mixed_external_value_is_idempotent() {
+        let marker = "synthetic-redaction-unit-marker";
+        let credential_url = format!("https://demo-user:{marker}@proxy.invalid:8443/path");
+        let diagnostic = format!(
+            "subprocess exited 37: argv=[tmux, HTTPS_PROXY='{credential_url}']; endpoint={credential_url}"
+        );
+        let input = json!({
+            "HTTPS_PROXY": marker,
+            "ordinary_diagnostic": format!(
+                "HTTPS_PROXY='{credential_url}' http_proxy=\"{credential_url}\" OPENAI_API_KEY={marker} endpoint={credential_url}"
+            ),
+            "nested": [[diagnostic, credential_url]],
+            "team_key": "current",
+        });
+
+        let once = redact_external_value(&input);
+        let twice = redact_external_value(&once);
+        let text = once.to_string();
+
+        assert!(!text.contains(marker));
+        assert!(text.contains("https://[REDACTED]@proxy.invalid:8443/path"));
+        assert_eq!(twice, once);
+    }
+}

package/crates/team-agent/src/state/repository.rs

@@ -315,16 +315,22 @@ fn route_direct(
         StateWriteIntent::RemoveAgent { agent_id, .. } => {
             helper_write_team_scoped_with_deleted_agents(workspace, state, &[agent_id])
         }
-        // ForkAgent -> the launch fork writer uses the root helper at
-        // lifecycle/launch.rs:4542.
-        StateWriteIntent::ForkAgent { .. } => helper_write_root(workspace, state),
-        // AgentRollback -> pre-state rollback uses either the root helper or
-        // the deleted-agents variant depending on the caller; S1a keeps the
-        // root form as the shared entry, and rollback specializations retain
-        // their allowlisted callsites in launch.rs / restart/remove.rs.
-        StateWriteIntent::AgentRollback { agent_id, .. } => {
-            helper_write_root_with_deleted_agents(workspace, state, &[agent_id])
+        // ForkAgent mutates a selected team projection, so persist it back to
+        // that projection with the forked row as lifecycle topology authority.
+        StateWriteIntent::ForkAgent { agent_id, .. } => {
+            helper_write_team_scoped_with_lifecycle_topology_authority(
+                workspace,
+                state,
+                &[agent_id],
+            )
         }
+        // Team-scoped rollback must restore only the selected projection and
+        // preserve sibling teams. Legacy callers without a team keep the root
+        // deleted-agents writer.
+        StateWriteIntent::AgentRollback { team_key, agent_id } => match team_key {
+            Some(_) => helper_write_team_scoped_with_deleted_agents(workspace, state, &[agent_id]),
+            None => helper_write_root_with_deleted_agents(workspace, state, &[agent_id]),
+        },
         // ClaimLeader -> leader/lease.rs:1625 uses the root helper, and the
         // scoped preserve-claim-fields variant at :1702 uses the team-tombstoned
         // agents helper.

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -514,9 +514,9 @@ fn spawn_into_same_named_replacement_returns_identity_created_by_spawn_command()
 }
 
 #[test]
-fn spawn_with_command_refuses_spawn_pane_owned_by_other_window() {
+fn spawn_with_command_refuses_and_rolls_back_spawn_pane_owned_by_other_window() {
     let pane_inventory = "%5\tteamsess\t1\tw2\t0\t/dev/ttys005\tnode\t1\t/work/dir\t1\t0\t125\n";
-    let (be, _rec) = backend_with(
+    let (be, rec) = backend_with(
         MockResp::Out(ok("")),
         vec![
             MockResp::Out(ok("%5\n")),
@@ -539,6 +539,48 @@ fn spawn_with_command_refuses_spawn_pane_owned_by_other_window() {
             && msg.contains("observed=teamsess:w2"),
         "error must include requested/observed ownership evidence, got {msg}"
     );
+    let calls = rec.lock().unwrap().clone();
+    assert!(
+        calls
+            .iter()
+            .any(|call| call == &svec(&["tmux", "kill-pane", "-t", "%5"])),
+        "identity mismatch must roll back the exact pane created by this spawn; calls={calls:?}"
+    );
+}
+
+#[test]
+fn spawn_with_command_retries_until_spawn_pane_is_visible() {
+    let pane_inventory = "%6\tteamsess\t1\tw1\t0\t/dev/ttys006\tnode\t1\t/work/dir\t1\t0\t126\n";
+    let (be, rec) = backend_with(
+        MockResp::Out(ok(pane_inventory)),
+        vec![MockResp::Out(ok("%6\n")), MockResp::Out(ok(""))],
+    );
+    let result = be
+        .spawn_into(
+            &SessionName::new("teamsess"),
+            &WindowName::new("w1"),
+            &svec(&["provider-bin"]),
+            Path::new("/work/dir"),
+            &BTreeMap::new(),
+        )
+        .expect("spawn pane must tolerate bounded tmux inventory lag");
+    let calls = rec.lock().unwrap().clone();
+
+    assert_eq!(result.pane_id.as_str(), "%6");
+    assert_eq!(
+        calls
+            .iter()
+            .filter(|call| call.get(1).is_some_and(|arg| arg == "list-panes"))
+            .count(),
+        2,
+        "spawn identity must retry the same pane id until it becomes visible; calls={calls:?}"
+    );
+    assert!(
+        calls
+            .iter()
+            .all(|call| call.get(1).is_none_or(|arg| arg != "kill-pane")),
+        "a delayed but valid identity must not be rolled back; calls={calls:?}"
+    );
 }
 
 #[test]
@@ -1742,16 +1784,16 @@ fn query_single_field_argv_and_nonzero_maps_to_none() {
 }
 
 // ── 11. list_targets (TRANSPORT TRIO) — `list-panes -a -F TMUX_PANE_FORMAT` + per-line parse ────
-// Golden _legacy_pane_discovery.py:29-33 _tmux_list_panes: `tmux list-panes -a -F <TMUX_PANE_FORMAT>`
-// (returncode != 0 -> []), parse each tab line via _parse_tmux_pane_info. TMUX_PANE_FORMAT
-// (runtime.py:456-460) is the byte-exact tab string locked below; P5 (C-P5-3) appends
+// Golden _legacy_pane_discovery.py:29-33 _tmux_list_panes: `tmux list-panes -a -F <TMUX_PANE_FORMAT>`.
+// The Rust backend uses the printable separator locked below so the 12-field frame stays explicit
+// in argv/log evidence, while retaining the golden nonzero -> empty inventory behavior. P5 (C-P5-3) appends
 // `#{pane_pid}` as field 12 so pane pids ride the single list-panes call (the per-pane
 // display-message N+1 fallback is gone). leader_env stays the reverse-env real-machine bit.
 #[test]
 fn list_targets_argv_and_parses_tmux_pane_format() {
-    const FMT: &str = "#{pane_id}\t#{session_name}\t#{window_index}\t#{window_name}\t#{pane_index}\t#{pane_tty}\t#{pane_current_command}\t#{pane_active}\t#{pane_current_path}\t#{session_attached}\t#{pane_in_mode}\t#{pane_pid}";
-    let stdout = "%7\tteam-x\t0\twin0\t0\t/dev/ttys003\tcodex\t1\t/Users/me/work\t1\t0\t41001\n\
-                      %8\tteam-x\t1\twin1\t0\t/dev/ttys004\tnode\t0\t/Users/me/other\t0\t0\t41002\n";
+    const FMT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
+    let stdout = "%7__TA_FIELD__team-x__TA_FIELD__0__TA_FIELD__win0__TA_FIELD__0__TA_FIELD__/dev/ttys003__TA_FIELD__codex__TA_FIELD__1__TA_FIELD__/Users/me/work__TA_FIELD__1__TA_FIELD__0__TA_FIELD__41001\n\
+                      %8__TA_FIELD__team-x__TA_FIELD__1__TA_FIELD__win1__TA_FIELD__0__TA_FIELD__/dev/ttys004__TA_FIELD__node__TA_FIELD__0__TA_FIELD__/Users/me/other__TA_FIELD__0__TA_FIELD__0__TA_FIELD__41002\n";
     let (be, rec) = backend_with(MockResp::Out(ok(stdout)), vec![]);
     let panes = be.list_targets().expect("list_targets ok");
     assert_eq!(

package/crates/team-agent/src/tmux_backend.rs

@@ -71,6 +71,8 @@ pub trait CommandRunner: Send + Sync {
 pub struct RealCommandRunner;
 
 const COMMAND_TIMEOUT: Duration = Duration::from_secs(5);
+const SPAWN_IDENTITY_TIMEOUT: Duration = Duration::from_millis(500);
+const SPAWN_IDENTITY_POLL_INTERVAL: Duration = Duration::from_millis(25);
 
 impl CommandRunner for RealCommandRunner {
     fn run(&self, argv: &[String]) -> Result<CommandOutput, std::io::Error> {
@@ -779,46 +781,68 @@ impl TmuxBackend {
             });
         }
         let pane_id = PaneId::new(pane);
-        let targets = self.list_targets()?;
-        if let Some(target) = targets.iter().find(|target| {
-            target.pane_id == pane_id
-                && target.session.as_str() == session.as_str()
-                && target
-                    .window_name
-                    .as_ref()
-                    .is_some_and(|name| name.as_str() == window.as_str())
-        }) {
-            return Ok(SpawnResult {
-                pane_id,
-                session: session.clone(),
-                window: window.clone(),
-                child_pid: target.pane_pid,
-            });
-        }
-        let observed = targets
-            .iter()
-            .find(|target| target.pane_id == pane_id)
-            .map(|target| {
-                format!(
-                    "{}:{}",
-                    target.session.as_str(),
-                    target
-                        .window_name
-                        .as_ref()
-                        .map(WindowName::as_str)
-                        .unwrap_or("<unknown>")
-                )
-            })
-            .unwrap_or_else(|| "<missing-from-list-targets>".to_string());
+        let deadline = Instant::now() + SPAWN_IDENTITY_TIMEOUT;
+        let observed = loop {
+            match self.list_targets() {
+                Ok(targets) => {
+                    if let Some(target) = targets.iter().find(|target| {
+                        target.pane_id == pane_id
+                            && target.session.as_str() == session.as_str()
+                            && target
+                                .window_name
+                                .as_ref()
+                                .is_some_and(|name| name.as_str() == window.as_str())
+                    }) {
+                        return Ok(SpawnResult {
+                            pane_id,
+                            session: session.clone(),
+                            window: window.clone(),
+                            child_pid: target.pane_pid,
+                        });
+                    }
+                    if let Some(target) = targets.iter().find(|target| target.pane_id == pane_id) {
+                        break format!(
+                            "{}:{}",
+                            target.session.as_str(),
+                            target
+                                .window_name
+                                .as_ref()
+                                .map(WindowName::as_str)
+                                .unwrap_or("<unknown>")
+                        );
+                    }
+                    if Instant::now() >= deadline {
+                        break "<missing-from-list-targets>".to_string();
+                    }
+                }
+                Err(error) => {
+                    if Instant::now() >= deadline {
+                        break format!("<list-targets-error:{error}>");
+                    }
+                }
+            }
+            std::thread::sleep(SPAWN_IDENTITY_POLL_INTERVAL);
+        };
+        let rollback_argv = vec![
+            "tmux".to_string(),
+            "kill-pane".to_string(),
+            "-t".to_string(),
+            pane_id.as_str().to_string(),
+        ];
+        let rollback_error = self.run_ok(&rollback_argv).err();
+        let rollback_suffix = rollback_error
+            .map(|error| format!("; failed to roll back spawned pane: {error}"))
+            .unwrap_or_default();
         Err(TransportError::Subprocess {
             argv: spawn_argv,
             code: output.code,
             stderr: format!(
-                "tmux spawn pane identity mismatch: requested={}:{} observed_pane={} observed={}",
+                "tmux spawn pane identity mismatch: requested={}:{} observed_pane={} observed={}{}",
                 session.as_str(),
                 window.as_str(),
                 pane_id.as_str(),
-                observed
+                observed,
+                rollback_suffix
             ),
         })
     }
@@ -1338,6 +1362,7 @@ fn strip_ansi_escapes_inplace(input: &str) -> String {
 }
 
 fn scrub_secrets(line: &str) -> String {
+    let line = crate::redaction::redact_external_text(line);
     // Five shapes: sk-XXXX, ghp_XXXX, AKIAXXXX (16-char uppercase id), Bearer XXXX,
     // 32+ hex (token).
     let mut out = String::with_capacity(line.len());
@@ -2313,7 +2338,9 @@ impl Transport for TmuxBackend {
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
         // P5 (C-P5-3): `#{pane_pid}` rides the single list-panes call (field index 11),
         // killing the per-pane display-message N+1 fallback.
-        const TMUX_PANE_FORMAT: &str = "#{pane_id}\t#{session_name}\t#{window_index}\t#{window_name}\t#{pane_index}\t#{pane_tty}\t#{pane_current_command}\t#{pane_active}\t#{pane_current_path}\t#{session_attached}\t#{pane_in_mode}\t#{pane_pid}";
+        // Use a printable sentinel so the 12-field frame stays explicit in argv/log evidence;
+        // `parse_pane_info_line` retains compatibility with legacy tab-delimited output.
+        const TMUX_PANE_FORMAT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
         let argv = self.tmux_argv(&[
             "tmux".to_string(),
             "list-panes".to_string(),
@@ -2509,7 +2536,11 @@ fn query_pane_pid(backend: &TmuxBackend, pane: &PaneId) -> Result<Option<u32>, T
 }
 
 fn parse_pane_info_line(line: &str) -> Option<PaneInfo> {
-    let fields = line.split('\t').collect::<Vec<_>>();
+    let fields = if line.contains("__TA_FIELD__") {
+        line.split("__TA_FIELD__").collect::<Vec<_>>()
+    } else {
+        line.split('\t').collect::<Vec<_>>()
+    };
     if fields.len() < 11 {
         return None;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.46",
+  "version": "0.5.48",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.46",
-    "@team-agent/cli-darwin-x64": "0.5.46",
-    "@team-agent/cli-linux-x64": "0.5.46"
+    "@team-agent/cli-darwin-arm64": "0.5.48",
+    "@team-agent/cli-darwin-x64": "0.5.48",
+    "@team-agent/cli-linux-x64": "0.5.48"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",