@team-agent/installer 0.5.48 → 0.5.50

package/crates/team-agent/src/cli/send.rs

@@ -7,133 +7,63 @@ use crate::messaging::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, Delivery
 /// `cmd_send`(`commands.py:164`)。解析 target(`--to` fanout / 单 target / `*`)→ [`MessageTarget`],
 /// 拼 [`SendOptions`](no_ack→requires_ack 取反、no_wait→wait_visible 取反等)→ `messaging::send_message`。
 pub fn cmd_send(args: &SendArgs) -> Result<CmdResult, CliError> {
-    if let Some(ref to_leader) = args.to_leader {
-        // E7 (0.5.9 host-leader-registry-design §4.2): `--to-leader NAME`
-        // resolves NAME through `~/.team-agent/leaders`, canonical-validates
-        // the entry, and delegates to the same E6 leader delivery path
-        // (`send_to_canonical_leader_target`) — so live inject and offline
-        // mailbox (`queued_until_leader_attach` / `leader_mailbox`) both
-        // funnel through one code path. Mutually exclusive with
-        // `--to-name`, TARGET/--to, `--pane`.
-        if args.to_name.is_some()
-            || args.pane.is_some()
-            || args.target.is_some()
+    // F1 (0.3.26, cross-team send): --pane <pane_id> direct targeting.
+    // Mutually exclusive with target / --to (agent-name routing).
+    if let Some(ref pane_id) = args.pane {
+        warn_send_alias("--pane");
+        if args.target.is_some()
             || args.targets.is_some()
+            || args.to_name.is_some()
+            || args.to_leader.is_some()
         {
+            let message = if args.to_name.is_some() {
+                "--to-name and --pane/TARGET/--to are mutually exclusive"
+            } else {
+                "--pane and TARGET/--to are mutually exclusive; --pane also conflicts with --to-leader"
+            };
             return Err(CliError::Usage(
-                "--to-leader and --to-name/--pane/TARGET/--to are mutually exclusive: \
-                 --to-leader resolves a host leader delivery name via the leader registry"
-                    .to_string(),
+                message.to_string(),
             ));
         }
         let content = args.message.join(" ");
         if content.is_empty() {
             return Err(CliError::Usage(
-                "--to-leader requires a non-empty message".to_string(),
+                "--pane requires a non-empty message".to_string(),
             ));
         }
-        let value = send_to_canonical_leader_target(
-            &args.workspace,
-            to_leader,
-            &content,
-            &args.sender,
-            args.task.as_deref(),
-        )?;
-        return Ok(cmd_send_result(value, args.json));
+        return Err(CliError::Usage(format!(
+            "--pane {pane_id} is deprecated and sunset; use a logical TARGET so the message is persisted before delivery"
+        )));
     }
-    if let Some(ref to_name) = args.to_name {
-        if args.pane.is_some() || args.target.is_some() || args.targets.is_some() {
-            return Err(CliError::Usage(
-                "--to-name and --pane/TARGET/--to are mutually exclusive: \
-                 --to-name resolves a stable workspace/team/name to a live pane"
-                    .to_string(),
-            ));
-        }
-        let content = args.message.join(" ");
-        if content.is_empty() {
-            return Err(CliError::Usage(
-                "--to-name requires a non-empty message".to_string(),
-            ));
-        }
-        // 0.5.45 naming-addressing (design §3.1, RED-1): thread
-        // `--team` down to resolver so bare `--to-name agent --team T`
-        // scopes to `T` BEFORE workspace scanning. Qualified addresses
-        // (`team/agent`, `workspace::team/agent`) ignore the scope
-        // per §1 priority ladder.
-        let (resolved, transport) =
-            match crate::cli::named_address::resolve_name_for_cli(
-                &args.workspace,
-                to_name,
-                args.team.as_deref(),
-            ) {
-                Ok(resolved) => resolved,
-                Err(error) => {
-                    // E6 (0.5.9 offline-mailbox-toname-design §3.1/§6.2): when
-                    // the resolver refuses with `leader_not_attached`, the team
-                    // itself may still be alive (worker + coordinator running
-                    // without a bound leader). Third-party senders in that
-                    // shape must land in the offline mailbox — same
-                    // canonical team.db row + queued_until_leader_attach
-                    // status the coordinator/attach hook replay through the
-                    // existing pipeline exactly once. Owner-scope refusals
-                    // (same workspace as target) keep the actionable attach
-                    // hint — E6 owner copy is documented as
-                    // `run team-agent attach-leader`.
-                    if let Some(mut value) = maybe_enqueue_offline_leader_mailbox(
-                        &args.workspace,
-                        to_name,
-                        &content,
-                        &args.sender,
-                        args.task.as_deref(),
-                        &error,
-                    )? {
-                        add_send_reminder_if_ok(&mut value);
-                        return Ok(cmd_send_result(value, args.json));
-                    }
-                    if args.json {
-                        return Ok(CmdResult::from_json(error.to_json(), args.json));
-                    }
-                    return Err(CliError::Usage(error.n38_message()));
-                }
-            };
-        let mut value = send_to_named_pane_direct(
-            &args.workspace,
-            transport.as_ref(),
-            &resolved,
-            &content,
-            &args.sender,
-            args.task.as_deref(),
-            args.json,
-        )?;
-        add_send_reminder_if_ok(&mut value);
-        return Ok(cmd_send_result(value, args.json));
+    if args.targets.is_some() {
+        warn_send_alias("--targets");
     }
-    // F1 (0.3.26, cross-team send): --pane <pane_id> direct targeting.
-    // Mutually exclusive with target / --to (agent-name routing).
-    if let Some(ref pane_id) = args.pane {
-        if args.target.is_some() || args.targets.is_some() {
-            return Err(CliError::Usage(
-                "--pane and TARGET/--to are mutually exclusive: \
-                 --pane bypasses agent-name routing and injects directly into the \
-                 specified tmux pane (cross-team capable)"
-                    .to_string(),
-            ));
+    if args.to_name.is_some() {
+        warn_send_alias("--to-name");
+    }
+    if args.to_leader.is_some() {
+        warn_send_alias("--to-leader");
+    }
+    let host_leader_alias = if let Some(name) = args.to_leader.as_deref() {
+        match resolve_host_leader_alias(name) {
+            Ok(resolved) => Some(resolved),
+            Err(value) => return Ok(cmd_send_result(value, args.json)),
         }
-        let content = args.message.join(" ");
-        if content.is_empty() {
-            return Err(CliError::Usage(
-                "--pane requires a non-empty message".to_string(),
-            ));
+    } else {
+        None
+    };
+    let logical_to = logical_to_from_args(
+        args,
+        host_leader_alias
+            .as_ref()
+            .map(|(logical_to, _)| logical_to.as_str()),
+    )?;
+    let content = args.message.join(" ");
+    if !logical_to.is_empty() && logical_to != "*" && !content.is_empty() {
+        let mut value = send_to_logical_to(args, &logical_to, &content)?;
+        if let Some((_, entry)) = host_leader_alias.as_ref() {
+            decorate_host_leader_alias(&mut value, entry);
         }
-        let mut value = send_to_pane_direct(
-            &args.workspace,
-            pane_id,
-            &content,
-            &args.sender,
-            args.task.as_deref(),
-            args.team.as_deref(),
-            args.json,
-        )?;
         add_send_reminder_if_ok(&mut value);
         return Ok(cmd_send_result(value, args.json));
     }
@@ -142,12 +72,12 @@ pub fn cmd_send(args: &SendArgs) -> Result<CmdResult, CliError> {
         args.team.as_deref(),
         crate::state::selector::SelectorMode::RuntimeOnly,
     )?;
-    let target = send_target(args.targets.as_deref(), args.target.as_deref());
+    let target = send_target(None, Some(logical_to.as_str()));
     let mut opts = send_options_from_args(args);
-    if opts.team.is_none() {
-        opts.team = Some(TeamKey::new(selected.team_key.clone()));
-    }
-    let content = args.message.join(" ");
+    // `args.team` is a selector and may be a legacy session/team-dir alias.
+    // All downstream membership and DB scope must use the canonical key that
+    // resolve_active_team returned, never the original selector spelling.
+    opts.team = Some(TeamKey::new(selected.team_key.clone()));
     // CR-061/N27 routing-ambiguous: a single positional with no `--to`/`--targets` and an
     // empty message body is a prompt-only invocation (`team-agent send "fix the build"`).
     // The lone positional is CONTENT, not a target — reject with `routing_ambiguous`
@@ -160,11 +90,12 @@ pub fn cmd_send(args: &SendArgs) -> Result<CmdResult, CliError> {
     if let Some(value) = dirty_topology_refusal_value(&selected, args.team.as_deref()) {
         return Ok(cmd_send_result(value, args.json));
     }
-    let coordinator_ensure = if target_has_known_worker(&selected.state, &target, &opts.sender) {
-        loud_ensure_coordinator(&selected)?
-    } else {
-        None
-    };
+    let coordinator_ensure =
+        if target_has_known_worker(&selected.state, &target, opts.sender.as_str()) {
+            loud_ensure_coordinator(&selected)?
+        } else {
+            None
+        };
     if let Some(value) =
         coordinator_ensure_unavailable_value(coordinator_ensure.as_ref(), &target, &content, &opts)
     {
@@ -390,253 +321,393 @@ fn coordinator_health_status_wire(
     }
 }
 
-/// F1 (0.3.26): direct pane-id send — bypasses agent-name routing + team
-/// membership check. Constructs `Target::Pane`, renders the message with
-/// the standard protocol block (Team Agent message from sender + token),
-/// injects via the selected team's endpoint-local tmux transport, and
-/// surfaces the inject report as a JSON result.
-///
-/// 0.5.43 debt-sweep (§6.2): the pre-0.5.43 comment overstated the
-/// scope. pane_id is inherently endpoint-local —
-/// `lifecycle_worker_tmux_backend_for_selected_state` below builds the
-/// transport from the SELECTED team's persisted endpoint. For cross-
-/// workspace delivery, use `--to-name` / `--to-leader` instead; there
-/// is intentionally no `--socket` flag.
-fn send_to_pane_direct(
-    workspace: &Path,
-    pane_id: &str,
-    content: &str,
-    sender: &str,
-    task_id: Option<&str>,
-    team: Option<&str>,
-    json: bool,
-) -> Result<serde_json::Value, CliError> {
-    use crate::messaging::delivery::render_message;
-    use crate::transport::{InjectPayload, Key, PaneId, Target};
+fn warn_send_alias(flag: &str) {
+    let spec = crate::cli::spec::command_spec("send");
+    let sunset = spec.and_then(|spec| spec.sunset).unwrap_or("next compatibility release");
+    let action = spec
+        .and_then(|spec| spec.action)
+        .unwrap_or("use positional logical TARGET addressing");
+    eprintln!("warning: {flag} is deprecated; sunset: {sunset}; action: {action}");
+}
 
-    let message_id = format!("pane_send_{}", chrono::Utc::now().timestamp_millis());
-    let rendered = render_message(sender, task_id, content, &message_id);
-    let target = Target::Pane(PaneId::new(pane_id));
-    let run_workspace = crate::model::paths::canonical_run_workspace(workspace)
-        .unwrap_or_else(|_| workspace.to_path_buf());
-    let transport = crate::lifecycle::restart::lifecycle_worker_tmux_backend_for_selected_state(
-        &run_workspace,
-        team,
-    )
-    .unwrap_or_else(|_| crate::tmux_backend::TmuxBackend::for_workspace(&run_workspace));
-    let event_log = crate::event_log::EventLog::new(&run_workspace);
-    // Warn if the pane is not in the team's known agents (cross-team usage).
-    let state = crate::state::persist::load_runtime_state(&run_workspace).ok();
-    let in_team = state
-        .as_ref()
-        .and_then(|s| s.get("agents"))
-        .and_then(serde_json::Value::as_object)
-        .is_some_and(|agents| {
-            agents.values().any(|agent| {
-                agent
-                    .get("pane_id")
-                    .and_then(serde_json::Value::as_str)
-                    .is_some_and(|p| p == pane_id)
+fn logical_to_from_args(args: &SendArgs, host_leader_to: Option<&str>) -> Result<String, CliError> {
+    if args.to_name.is_some()
+        && (args.target.is_some() || args.targets.is_some() || args.to_leader.is_some())
+    {
+        return Err(CliError::Usage(
+            "--to-name and --pane/TARGET/--to are mutually exclusive".to_string(),
+        ));
+    }
+    let supplied = [
+        args.target.is_some(),
+        args.targets.is_some(),
+        args.to_name.is_some(),
+        args.to_leader.is_some(),
+    ]
+    .into_iter()
+    .filter(|present| *present)
+    .count();
+    if supplied > 1 {
+        return Err(CliError::Usage(
+            "TARGET, --targets, --to-name, and --to-leader are mutually exclusive".to_string(),
+        ));
+    }
+    let logical_to = if args.to_leader.is_some() {
+        host_leader_to.unwrap_or_default().to_string()
+    } else if let Some(name) = args.to_name.as_deref() {
+        name.to_string()
+    } else if let Some(targets) = args.targets.as_deref() {
+        targets.to_string()
+    } else {
+        args.target.clone().unwrap_or_default()
+    };
+    if args.target.is_none() && supplied > 0 && args.message.is_empty() {
+        if args.to_name.is_some() {
+            return Err(CliError::Usage(
+                "--to-name requires a non-empty message".to_string(),
+            ));
+        }
+        return Err(CliError::Usage(
+            "send requires a non-empty message after logical TO".to_string(),
+        ));
+    }
+    Ok(logical_to)
+}
+
+fn resolve_host_leader_alias(
+    name: &str,
+) -> Result<(String, crate::leader::registry::LeaderRegistryEntry), Value> {
+    let classified = crate::leader::registry::list_validated_no_gc();
+    let candidates = classified
+        .iter()
+        .filter(|(entry, _, _)| {
+            entry.delivery_name == name
+                || entry.qualified_name == name
+                || entry.stable_qualified_name == name
+                || entry.aliases.iter().any(|alias| alias == name)
+        })
+        .map(|(entry, _, _)| entry.clone())
+        .collect::<Vec<_>>();
+    if candidates.is_empty() {
+        return Err(json!({
+            "ok": false,
+            "status": "refused",
+            "reason": "leader_name_not_found",
+            "requested_name": name,
+            "resolved_via": "host_leader_registry",
+            "candidates": Vec::<Value>::new(),
+            "workspace_hash": null,
+            "stable_qualified_name": null,
+            "channel": "leader_mailbox",
+            "delivered": false,
+            "message_status": "queued_until_leader_attach",
+            "action": "run `team-agent leaders` to see registered leaders; inspect queued leader messages with `team-agent inbox`; retry with a qualified name",
+            "registry_stale": false,
+        }));
+    }
+    if candidates.len() > 1 {
+        let candidates = candidates
+            .iter()
+            .map(|entry| {
+                json!({
+                    "name": entry.qualified_name,
+                    "workspace": entry.workspace.display().to_string(),
+                    "team_key": entry.team_key,
+                    "workspace_hash": entry.workspace_hash,
+                    "stable_qualified_name": entry.stable_qualified_name,
+                })
             })
-        });
-    if !in_team {
-        eprintln!(
-            "warning: pane {pane_id} is not in the team's known agents — \
-             cross-team delivery (F1)"
-        );
+            .collect::<Vec<_>>();
+        return Err(json!({
+            "ok": false,
+            "status": "refused",
+            "reason": "name_ambiguous",
+            "requested_name": name,
+            "resolved_via": "host_leader_registry",
+            "candidates": candidates,
+            "channel": "leader_mailbox",
+            "delivered": false,
+            "action": "run `team-agent leaders` and retry with the qualified name",
+        }));
     }
-    let transport: &dyn crate::transport::Transport = &transport;
-    let report = transport
-        .inject(&target, &InjectPayload::Text(rendered), Key::Enter, true)
-        .map_err(|e| CliError::Runtime(format!("inject to pane {pane_id} failed: {e}")))?;
-    let _ = event_log.write(
-        "send.pane_direct",
-        serde_json::json!({
-            "pane_id": pane_id,
-            "sender": sender,
-            "message_id": message_id,
-            "submit_verification": crate::transport::submit_verification_wire(report.submit_verification),
-            "inject_verification": format!("{:?}", report.inject_verification),
-            "in_team": in_team,
-        }),
-    );
-    let ok = matches!(
-        report.submit_verification,
-        crate::transport::SubmitVerification::EnterSentWithoutPlaceholderCheck
-            | crate::transport::SubmitVerification::PastedContentPromptAbsentAfterSubmit
-            | crate::transport::SubmitVerification::KeySentAfterVisibleToken { .. }
+    let entry = candidates[0].clone();
+    let (status, reason) = crate::leader::registry::classify(&entry);
+    if status == "STALE" {
+        let team_alive = crate::state::persist::load_runtime_state(&entry.workspace)
+            .ok()
+            .and_then(|state| {
+                state
+                    .get("teams")
+                    .and_then(Value::as_object)
+                    .and_then(|teams| teams.get(&entry.team_key))
+                    .and_then(|team| team.get("status"))
+                    .and_then(Value::as_str)
+                    .map(|status| status == "alive" || status.is_empty())
+            })
+            .unwrap_or(false);
+        if !team_alive {
+            return Err(json!({
+                "ok": false,
+                "status": "refused",
+                "reason": "registry_stale",
+                "requested_name": name,
+                "resolved_via": "host_leader_registry",
+                "stale_reason": reason,
+                "workspace_hash": entry.workspace_hash,
+                "stable_qualified_name": entry.stable_qualified_name,
+                "channel": "leader_mailbox",
+                "delivered": false,
+                "action": "target team is not alive; run `team-agent leaders` for current state",
+            }));
+        }
+    }
+    let logical_to = format!("{}::{}/leader", entry.workspace.display(), entry.team_key);
+    Ok((logical_to, entry))
+}
+
+fn decorate_host_leader_alias(
+    value: &mut Value,
+    entry: &crate::leader::registry::LeaderRegistryEntry,
+) {
+    let Some(object) = value.as_object_mut() else {
+        return;
+    };
+    object.insert("resolved_via".to_string(), json!("host_leader_registry"));
+    object.insert("to_leader".to_string(), json!(entry.qualified_name));
+    object.insert("requested_name".to_string(), json!(entry.delivery_name));
+    object.insert("workspace_hash".to_string(), json!(entry.workspace_hash));
+    object.insert(
+        "stable_qualified_name".to_string(),
+        json!(entry.stable_qualified_name),
     );
-    Ok(serde_json::json!({
+}
+
+fn send_to_logical_to(args: &SendArgs, logical_to: &str, content: &str) -> Result<Value, CliError> {
+    let names = logical_to
+        .split(',')
+        .map(str::trim)
+        .filter(|name| !name.is_empty())
+        .collect::<Vec<_>>();
+    if names.is_empty() || names.len() != logical_to.split(',').count() {
+        return Err(CliError::Usage(
+            "logical TO comma-list contains an empty recipient".to_string(),
+        ));
+    }
+
+    let mut resolved = Vec::with_capacity(names.len());
+    for name in names {
+        match crate::cli::named_address::resolve_name_for_cli(
+            &args.workspace,
+            name,
+            args.team.as_deref(),
+        ) {
+            Ok((recipient, _transport)) => resolved.push(recipient),
+            Err(mut error) => {
+                adapt_positional_bare_error(args, name, &mut error);
+                if matches!(
+                    error.kind,
+                    crate::cli::named_address::NamedAddressErrorKind::StateNotFound
+                ) {
+                    return Ok(resolution_refusal_json(
+                        &error,
+                        logical_to,
+                        content,
+                        args,
+                    ));
+                }
+                if resolved.is_empty() && !logical_to.contains(',') {
+                    if let Some(value) = maybe_enqueue_offline_leader_mailbox(
+                        &args.workspace,
+                        name,
+                        content,
+                        args.sender.as_str(),
+                        args.task.as_deref(),
+                        &error,
+                    )? {
+                        return Ok(value);
+                    }
+                }
+                if args.json {
+                    return Ok(error.to_json());
+                }
+                return Err(CliError::Usage(error.n38_message()));
+            }
+        }
+    }
+
+    if resolved.len() == 1 {
+        return send_to_resolved_name(args, &resolved[0], content);
+    }
+
+    let first = &resolved[0];
+    let one_scope = resolved.iter().all(|recipient| {
+        recipient.target_workspace == first.target_workspace && recipient.team_key == first.team_key
+    });
+    if one_scope {
+        let recipients = resolved
+            .iter()
+            .map(logical_recipient_id)
+            .collect::<Result<Vec<_>, _>>()?;
+        let target = MessageTarget::Fanout(recipients);
+        return persist_resolved_target(args, first, &target, content);
+    }
+
+    let mut results = Vec::with_capacity(resolved.len());
+    for recipient in &resolved {
+        results.push(send_to_resolved_name(args, recipient, content)?);
+    }
+    let ok = results
+        .iter()
+        .all(|value| value.get("ok").and_then(Value::as_bool) == Some(true));
+    let message_id = results
+        .iter()
+        .rev()
+        .find_map(|value| value.get("message_id").and_then(Value::as_str))
+        .map(str::to_string);
+    Ok(json!({
         "ok": ok,
-        "pane_id": pane_id,
+        "status": if ok { "fanout_delivered" } else { "fanout_partial" },
+        "delivery_status": if ok { "pending" } else { "fanout_partial" },
+        "delivered": false,
+        "target": logical_to.split(',').map(str::trim).collect::<Vec<_>>(),
+        "content_length_bytes": content.len(),
+        "sender": args.sender,
         "message_id": message_id,
-        "submit_verification": crate::transport::submit_verification_wire(report.submit_verification),
-        "inject_verification": format!("{:?}", report.inject_verification),
-        "in_team": in_team,
+        "results": results,
     }))
 }
 
-fn send_to_named_pane_direct(
-    sender_workspace: &Path,
-    transport: &dyn crate::transport::Transport,
-    resolved: &crate::cli::named_address::ResolvedNamedAddress,
+fn resolution_refusal_json(
+    error: &crate::cli::named_address::NamedAddressError,
+    logical_to: &str,
     content: &str,
-    sender: &str,
-    task_id: Option<&str>,
-    _json: bool,
-) -> Result<serde_json::Value, CliError> {
-    use crate::messaging::delivery::render_message;
-    use crate::transport::{InjectPayload, Key, PaneId, Target};
+    args: &SendArgs,
+) -> Value {
+    let mut value = error.to_json();
+    if let Some(object) = value.as_object_mut() {
+        object.insert("delivery_status".to_string(), json!("refused"));
+        object.insert("delivered".to_string(), json!(false));
+        object.insert("target".to_string(), json!(logical_to));
+        object.insert("agent_id".to_string(), json!(logical_to));
+        object.insert("content_length_bytes".to_string(), json!(content.len()));
+        object.insert("sender".to_string(), json!(args.sender));
+        object.insert("message_id".to_string(), Value::Null);
+        object.insert("message_status".to_string(), json!("refused"));
+        object.insert("verification".to_string(), Value::Null);
+        object.insert("stage".to_string(), Value::Null);
+        object.insert("channel".to_string(), Value::Null);
+    }
+    value
+}
 
-    let message_id = format!("named_send_{}", chrono::Utc::now().timestamp_millis());
-    let rendered = render_message(sender, task_id, content, &message_id);
-    let sender_run_workspace = crate::model::paths::canonical_run_workspace(sender_workspace)
-        .unwrap_or_else(|_| sender_workspace.to_path_buf());
-    let event_log = crate::event_log::EventLog::new(&sender_run_workspace);
-    if let Some(warning) = &resolved.warning {
-        eprintln!("warning: {warning}");
+fn adapt_positional_bare_error(
+    args: &SendArgs,
+    name: &str,
+    error: &mut crate::cli::named_address::NamedAddressError,
+) {
+    if args.target.as_deref() != Some(name)
+        || args.team.is_none()
+        || name.contains('/')
+        || name.contains(':')
+        || name.contains(',')
+    {
+        return;
     }
-    if resolved.transport_kind.as_deref() == Some("codex_app_server") {
-        return send_to_named_app_server_leader(
-            &event_log,
-            resolved,
-            &message_id,
-            &rendered,
-            sender,
-        );
+    error.requested_name = Some(name.to_string());
+    for candidate in &mut error.candidates {
+        let agent_id = candidate
+            .get("agent_id")
+            .and_then(Value::as_str)
+            .map(str::to_string);
+        if let (Some(object), Some(agent_id)) = (candidate.as_object_mut(), agent_id) {
+            object.insert("name".to_string(), json!(agent_id));
+        }
     }
-    let target = Target::Pane(PaneId::new(&resolved.pane_id));
-    let report = transport
-        .inject(&target, &InjectPayload::Text(rendered), Key::Enter, true)
-        .map_err(|e| {
-            CliError::Runtime(format!(
-                "inject to named target {} pane {} failed: {e}",
-                resolved.raw_name, resolved.pane_id
-            ))
-        })?;
-    let target_kind = named_target_kind_wire(resolved.target_kind);
-    let event = serde_json::json!({
-        "to_name": resolved.raw_name,
-        "target_kind": target_kind,
-        "sender": sender,
-        "sender_workspace": sender_run_workspace.display().to_string(),
-        "target_workspace": resolved.target_workspace.display().to_string(),
-        "team_key": resolved.team_key,
-        "agent_id": resolved.agent_id,
-        "pane_id": resolved.pane_id,
-        "session_name": resolved.session_name,
-        "window_name": resolved.window_name,
-        "tmux_endpoint": resolved.tmux_endpoint,
-        "state_pane_id": resolved.state_pane_id,
-        "state_pane_stale": resolved.state_pane_stale,
-        "agent_status": resolved.agent_status,
-        "warning": resolved.warning,
-        "message_id": message_id,
-        "submit_verification": crate::transport::submit_verification_wire(report.submit_verification),
-        "inject_verification": format!("{:?}", report.inject_verification),
-    });
-    let _ = event_log.write("send.name_direct", event.clone());
-    let ok = matches!(
-        report.submit_verification,
-        crate::transport::SubmitVerification::EnterSentWithoutPlaceholderCheck
-            | crate::transport::SubmitVerification::PastedContentPromptAbsentAfterSubmit
-            | crate::transport::SubmitVerification::KeySentAfterVisibleToken { .. }
-    );
-    let mut value = event;
-    if let Some(obj) = value.as_object_mut() {
-        obj.insert("ok".to_string(), serde_json::json!(ok));
+    error.suggested_name = error
+        .suggested_name
+        .as_deref()
+        .and_then(|suggested| suggested.rsplit('/').next())
+        .map(str::to_string);
+    if let Some(suggested) = error.suggested_name.as_deref() {
+        error.action = format!("Did you mean `{suggested}`? Retry with `{suggested}` as TO.");
     }
-    Ok(value)
 }
 
-fn send_to_named_app_server_leader(
-    event_log: &crate::event_log::EventLog,
+fn logical_recipient_id(
     resolved: &crate::cli::named_address::ResolvedNamedAddress,
-    message_id: &str,
-    rendered: &str,
-    sender: &str,
-) -> Result<serde_json::Value, CliError> {
-    let receiver = serde_json::json!({
-        "mode": "codex_app_server",
-        "transport_kind": "codex_app_server",
-        "app_server": resolved.app_server.clone().unwrap_or(serde_json::Value::Null),
-    });
-    let binding = crate::codex_app_server::binding_from_receiver(&receiver)
-        .map_err(|error| CliError::Runtime(format!("invalid app-server named leader: {error}")))?;
-    let target_kind = named_target_kind_wire(resolved.target_kind);
-    let base_event = serde_json::json!({
-        "to_name": resolved.raw_name,
-        "target_kind": target_kind,
-        "sender": sender,
-        "sender_workspace": resolved.sender_workspace.display().to_string(),
-        "target_workspace": resolved.target_workspace.display().to_string(),
-        "team_key": resolved.team_key,
-        "agent_id": resolved.agent_id,
-        "transport_kind": "codex_app_server",
-        "socket": binding.socket,
-        "thread_id": binding.thread_id,
-        "message_id": message_id,
-    });
-    match crate::codex_app_server::submit_to_bound_thread(&binding, message_id, rendered) {
-        Ok(submit) => {
-            let event = merge_json(
-                base_event.clone(),
-                serde_json::json!({
-                    "ok": true,
-                    "turn_id": submit.turn_id,
-                    "turn_status": submit.turn_status,
-                }),
-            );
-            let _ = event_log.write("send.name_app_server", event.clone());
-            Ok(event)
-        }
-        Err(crate::codex_app_server::AppServerError::LeaderBusy(message)) => {
-            let event = merge_json(
-                base_event.clone(),
-                serde_json::json!({
-                    "ok": false,
-                    "status": "retry_scheduled",
-                    "reason": "leader_busy",
-                    "channel": "leader_busy",
-                    "error": message,
-                }),
-            );
-            let _ = event_log.write("send.name_app_server", event.clone());
-            Ok(event)
-        }
-        Err(error) => {
-            let event = merge_json(
-                base_event.clone(),
-                serde_json::json!({
-                    "ok": false,
-                    "status": "refused",
-                    "reason": error.code(),
-                    "channel": "rebind_required",
-                    "error": error.to_string(),
-                    "action": "run team-agent attach-app-server-leader for the target team",
-                }),
-            );
-            let _ = event_log.write("send.name_app_server", event.clone());
-            Ok(event)
-        }
+) -> Result<String, CliError> {
+    match resolved.target_kind {
+        crate::cli::named_address::NamedTargetKind::Worker => resolved
+            .agent_id
+            .clone()
+            .ok_or_else(|| CliError::Runtime("resolved worker is missing agent id".to_string())),
+        crate::cli::named_address::NamedTargetKind::Leader => Ok("leader".to_string()),
+        crate::cli::named_address::NamedTargetKind::SessionWindow => Err(CliError::Usage(
+            "named session/window delivery is sunset; use a logical agent or leader name"
+                .to_string(),
+        )),
     }
 }
 
-fn merge_json(mut left: serde_json::Value, right: serde_json::Value) -> serde_json::Value {
-    if let (Some(left), Some(right)) = (left.as_object_mut(), right.as_object()) {
-        for (key, value) in right {
-            left.insert(key.clone(), value.clone());
+fn send_to_resolved_name(
+    args: &SendArgs,
+    resolved: &crate::cli::named_address::ResolvedNamedAddress,
+    content: &str,
+) -> Result<Value, CliError> {
+    let recipient = logical_recipient_id(resolved)?;
+    if let Some(warning) = &resolved.warning {
+        eprintln!("warning: {warning}");
+    }
+    let target = MessageTarget::Single(recipient);
+    let mut value = persist_resolved_target(args, resolved, &target, content)?;
+    if args.to_name.is_some() || args.to_leader.is_some() {
+        if let Some(obj) = value.as_object_mut() {
+            obj.insert("to_name".to_string(), json!(resolved.raw_name));
+            obj.insert(
+                "target_workspace".to_string(),
+                json!(resolved.target_workspace.display().to_string()),
+            );
+            obj.insert("team_key".to_string(), json!(resolved.team_key));
         }
     }
-    left
+    Ok(value)
 }
 
-fn named_target_kind_wire(kind: crate::cli::named_address::NamedTargetKind) -> &'static str {
-    match kind {
-        crate::cli::named_address::NamedTargetKind::Worker => "worker",
-        crate::cli::named_address::NamedTargetKind::Leader => "leader",
-        crate::cli::named_address::NamedTargetKind::SessionWindow => "session_window",
+fn persist_resolved_target(
+    args: &SendArgs,
+    resolved: &crate::cli::named_address::ResolvedNamedAddress,
+    target: &MessageTarget,
+    content: &str,
+) -> Result<Value, CliError> {
+    let selected = crate::state::selector::resolve_active_team(
+        &resolved.target_workspace,
+        resolved.team_key.as_deref(),
+        crate::state::selector::SelectorMode::RuntimeOnly,
+    )?;
+    if let Some(value) = dirty_topology_refusal_value(&selected, resolved.team_key.as_deref()) {
+        return Ok(value);
     }
+    let mut opts = send_options_from_args(args);
+    opts.route_task_id = args.to_name.is_none() && args.to_leader.is_none();
+    opts.team = Some(TeamKey::new(selected.team_key.clone()));
+    let coordinator_ensure = if target_has_known_worker(&selected.state, target, opts.sender.as_str())
+    {
+        loud_ensure_coordinator(&selected)?
+    } else {
+        None
+    };
+    if let Some(value) = coordinator_ensure_unavailable_value(
+        coordinator_ensure.as_ref(),
+        target,
+        content,
+        &opts,
+    ) {
+        return Ok(value);
+    }
+    let outcome = messaging::send_message(&selected.run_workspace, target, content, &opts)?;
+    let mut value = delivery_outcome_json(&outcome, target, content, &opts);
+    append_loud_ensure_fields(&mut value, coordinator_ensure.as_ref());
+    Ok(value)
 }
 
 fn routing_ambiguous_value(
@@ -1219,183 +1290,33 @@ pub fn send_to_canonical_leader_target(
     sender_workspace: &std::path::Path,
     name: &str,
     content: &str,
-    sender: &str,
+    sender: &TrustedSender,
     task_id: Option<&str>,
 ) -> Result<serde_json::Value, CliError> {
-    // Resolve NAME through the registry. Ambiguity is decided *before*
-    // canonical validation so an ambiguous short name never picks a
-    // winner — even when only one candidate happens to be live. Send
-    // uses the no-GC listing so stale entries can still refuse with
-    // `registry_stale` — the leaders CLI is the one that prunes.
-    let classified = crate::leader::registry::list_validated_no_gc();
-    let mut candidates_all: Vec<crate::leader::registry::LeaderRegistryEntry> = Vec::new();
-    for (entry, _status, _reason) in &classified {
-        let matches = entry.delivery_name == name
-            || entry.qualified_name == name
-            || entry.stable_qualified_name == name
-            || entry.aliases.iter().any(|a| a == name);
-        if matches {
-            candidates_all.push(entry.clone());
-        }
-    }
-    if candidates_all.is_empty() {
-        return Ok(serde_json::json!({
-            "ok": false,
-            "status": "refused",
-            "reason": "leader_name_not_found",
-            "requested_name": name,
-            "resolved_via": "host_leader_registry",
-            "candidates": Vec::<serde_json::Value>::new(),
-            "workspace_hash": null,
-            "stable_qualified_name": null,
-            "channel": "leader_mailbox",
-            "delivered": false,
-            "message_status": "queued_until_leader_attach",
-            "action": "run `team-agent leaders` to see registered leaders; inspect queued leader messages with `team-agent inbox`; retry with a qualified name",
-            "registry_stale": false,
-        }));
-    }
-    if candidates_all.len() > 1 {
-        let cand_json: Vec<serde_json::Value> = candidates_all
-            .iter()
-            .map(|e| {
-                serde_json::json!({
-                    "name": e.qualified_name,
-                    "workspace": e.workspace.display().to_string(),
-                    "team_key": e.team_key,
-                    "workspace_hash": e.workspace_hash,
-                    "stable_qualified_name": e.stable_qualified_name,
-                })
-            })
-            .collect();
-        return Ok(serde_json::json!({
-            "ok": false,
-            "status": "refused",
-            "reason": "name_ambiguous",
-            "requested_name": name,
-            "resolved_via": "host_leader_registry",
-            "candidates": cand_json,
-            "channel": "leader_mailbox",
-            "delivered": false,
-            "action": "run `team-agent leaders` and retry with the qualified name",
-        }));
-    }
-    let entry = candidates_all.into_iter().next().ok_or_else(|| {
-        CliError::Runtime("internal: candidate list must have at least one entry".to_string())
-    })?;
-    // Canonical-validate the entry against target workspace state. Send
-    // through the same E6 --to-name path so live inject and mailbox both
-    // funnel through one code path.
-    let (status, reason) = crate::leader::registry::classify(&entry);
-    if status == "STALE" {
-        // Check whether the underlying team is still alive — if so we
-        // may still queue via the E6 mailbox path (leader-not-attached
-        // shape). If the workspace/team is gone we refuse `registry_stale`.
-        let state = crate::state::persist::load_runtime_state(&entry.workspace).ok();
-        let team_alive = state
-            .as_ref()
-            .and_then(|s| s.get("teams"))
-            .and_then(|v| v.as_object())
-            .and_then(|teams| teams.get(&entry.team_key))
-            .and_then(|t| t.get("status"))
-            .and_then(serde_json::Value::as_str)
-            .map(|s| s == "alive" || s.is_empty())
-            .unwrap_or(false);
-        if !team_alive {
-            return Ok(serde_json::json!({
-                "ok": false,
-                "status": "refused",
-                "reason": "registry_stale",
-                "requested_name": name,
-                "resolved_via": "host_leader_registry",
-                "stale_reason": reason,
-                "workspace_hash": entry.workspace_hash,
-                "stable_qualified_name": entry.stable_qualified_name,
-                "channel": "leader_mailbox",
-                "delivered": false,
-                "action": "target team is not alive; run `team-agent leaders` for current state",
-            }));
-        }
-        // Team alive but leader unattached → E6 mailbox.
-        let event_log = crate::event_log::EventLog::new(&entry.workspace);
-        let task = task_id.map(|s| crate::model::ids::TaskId::new(s.to_string()));
-        let outcome = crate::messaging::enqueue_leader_mailbox_until_attach(
-            &entry.workspace,
-            &entry.team_key,
-            content,
-            task.as_ref(),
-            sender,
-            &event_log,
-        )
-        .map_err(|e| CliError::Runtime(e.to_string()))?;
-        return Ok(serde_json::json!({
-            "ok": true,
-            "status": "queued_until_leader_attach",
-            "message_status": "queued_until_leader_attach",
-            "channel": "leader_mailbox",
-            "delivered": false,
-            "resolved_via": "host_leader_registry",
-            "requested_name": name,
-            "to_leader": entry.qualified_name,
-            "target_workspace": entry.workspace.display().to_string(),
-            "workspace_hash": entry.workspace_hash,
-            "stable_qualified_name": entry.stable_qualified_name,
-            "team_key": entry.team_key,
-            "message_id": outcome.message_id,
-        }));
-    }
-    // LIVE: canonical-validated. Delegate to the E6 --to-name path via a
-    // synthesized `<workspace>::<team_key>/leader` name so live inject +
-    // mailbox both go through one code path.
-    let to_name = format!("{}::{}/leader", entry.workspace.display(), entry.team_key);
-    // 0.5.45 naming-addressing (design §3.1 / §4.1): internal
-    // registry-to-E6 delegation MUST pass None for bare_team_scope.
-    // The synthesized name above is a full `workspace::team/leader`
-    // form, and the caller's `--team` flag (if any) must not
-    // override the registry's authoritative team_key.
-    let (resolved, transport) =
-        match crate::cli::named_address::resolve_name_for_cli(sender_workspace, &to_name, None) {
-            Ok(r) => r,
-            Err(err) => {
-                // Named-address refusal — surface it verbatim but tag as
-                // registry-resolved so callers can trace the origin.
-                let mut body = err.to_json();
-                if let Some(obj) = body.as_object_mut() {
-                    obj.insert(
-                        "resolved_via".to_string(),
-                        serde_json::Value::String("host_leader_registry".to_string()),
-                    );
-                    obj.insert("delivered".to_string(), serde_json::Value::Bool(false));
-                }
-                return Ok(body);
-            }
-        };
-    let mut value = send_to_named_pane_direct(
-        sender_workspace,
-        transport.as_ref(),
-        &resolved,
-        content,
-        sender,
-        task_id,
-        true,
-    )?;
-    if let Some(obj) = value.as_object_mut() {
-        obj.insert(
-            "resolved_via".to_string(),
-            serde_json::Value::String("host_leader_registry".to_string()),
-        );
-        obj.insert(
-            "to_leader".to_string(),
-            serde_json::Value::String(entry.qualified_name.clone()),
-        );
-        // Honest delivered marker. `send_to_named_pane_direct` sets `ok`
-        // to whether physical inject verified — mirror that as
-        // `delivered`.
-        let ok = obj
-            .get("ok")
-            .and_then(serde_json::Value::as_bool)
-            .unwrap_or(false);
-        obj.insert("delivered".to_string(), serde_json::Value::Bool(ok));
-    }
+    let (logical_to, entry) = match resolve_host_leader_alias(name) {
+        Ok(resolved) => resolved,
+        Err(value) => return Ok(value),
+    };
+    let args = SendArgs {
+        target: Some(logical_to.clone()),
+        message: vec![content.to_string()],
+        targets: None,
+        workspace: sender_workspace.to_path_buf(),
+        team: None,
+        task: task_id.map(str::to_string),
+        sender: sender.clone(),
+        no_ack: false,
+        no_wait: true,
+        watch_result: false,
+        timeout: 0.0,
+        confirm_human: false,
+        json: true,
+        message_id: None,
+        pane: None,
+        to_name: None,
+        to_leader: None,
+    };
+    let mut value = send_to_logical_to(&args, &logical_to, content)?;
+    decorate_host_leader_alias(&mut value, &entry);
     Ok(value)
 }