@team-agent/installer 0.5.49 → 0.5.51

package/crates/team-agent/src/lifecycle/launch/add_agent_state.rs

@@ -0,0 +1,297 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use crate::lifecycle::*;
+use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
+use crate::model::ids::AgentId;
+use crate::model::permissions::{self, AgentPermissionInput};
+use crate::model::yaml::{self, Value};
+use crate::state::persist::load_runtime_state;
+use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
+
+use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
+
+use super::*;
+
+/// E42 (0.3.24 P0, double-spec deadlock): best-effort atomic rollback for a
+/// failed add-agent. Restores the canonical spec to its pre-write bytes (or
+/// removes the file if it didn't exist), and restores runtime state to its
+/// pre-write JSON (so the half-written `status:starting` row is gone). The
+/// caller propagates the ORIGINAL operation error after rollback; rollback
+/// errors are swallowed (best-effort, no panic).
+pub(super) fn rollback_add_agent_atomic(
+    run_workspace: &Path,
+    spec_path: &Path,
+    pre_spec_text: Option<&str>,
+    pre_runtime_state: Option<&serde_json::Value>,
+    agent_id: &AgentId,
+    reason: &str,
+) {
+    let spec_restored = if let Some(text) = pre_spec_text {
+        std::fs::write(spec_path, text).is_ok()
+    } else {
+        std::fs::remove_file(spec_path)
+            .or_else(|error| {
+                if error.kind() == std::io::ErrorKind::NotFound {
+                    Ok(())
+                } else {
+                    Err(error)
+                }
+            })
+            .is_ok()
+    };
+    // 0.5.26 (`.team/artifacts/stale-team-saveconflict-locate.md` §7.4):
+    // rollback must tombstone the newly-added agent so the persist merge
+    // does not re-attach a `roster_stub` from the latest on disk. Without
+    // the tombstone the half-added `agents.standards` / `teams.<key>.agents.standards`
+    // survives the restore-from-pre_state pass and the retry sees
+    // "agent id already exists".
+    let state_restored = if let Some(state) = pre_runtime_state {
+        crate::state::repository::StateRepository::new(run_workspace)
+            .save(
+                crate::state::repository::StateWriteIntent::AgentRollback {
+                    team_key: None,
+                    agent_id: agent_id.as_str(),
+                },
+                state,
+            )
+            .is_ok()
+    } else {
+        // No prior runtime state — drop just the agent we added (load → strip → save).
+        if let Ok(mut state) = crate::state::persist::load_runtime_state(run_workspace) {
+            if let Some(agents) = state
+                .get_mut("agents")
+                .and_then(serde_json::Value::as_object_mut)
+            {
+                agents.remove(agent_id.as_str());
+            }
+            if let Some(teams) = state
+                .get_mut("teams")
+                .and_then(serde_json::Value::as_object_mut)
+            {
+                for team in teams.values_mut() {
+                    if let Some(agents) = team
+                        .get_mut("agents")
+                        .and_then(serde_json::Value::as_object_mut)
+                    {
+                        agents.remove(agent_id.as_str());
+                    }
+                }
+            }
+            crate::state::repository::StateRepository::new(run_workspace)
+                .save(
+                    crate::state::repository::StateWriteIntent::AgentRollback {
+                        team_key: None,
+                        agent_id: agent_id.as_str(),
+                    },
+                    &state,
+                )
+                .is_ok()
+        } else {
+            false
+        }
+    };
+    let rollback_ok = spec_restored && state_restored;
+    let _ = crate::event_log::EventLog::new(run_workspace).write(
+        "add_agent.rollback",
+        serde_json::json!({
+            "agent_id": agent_id.as_str(),
+            "reason": reason,
+            "rollback_ok": rollback_ok,
+            "spec_restored": spec_restored,
+            "state_restored": state_restored,
+        }),
+    );
+}
+
+pub(super) fn upsert_agent_state_from_role(
+    workspace: &Path,
+    canonical_team_key: &str,
+    agent_id: &AgentId,
+    meta: &Value,
+    dynamic_role_file: &Path,
+    safety: &DangerousApproval,
+) -> Result<(), LifecycleError> {
+    let mut state =
+        crate::state::projection::select_runtime_state(workspace, Some(canonical_team_key))
+            .map_err(|e| LifecycleError::TeamSelect(e.to_string()))?;
+    if !state.is_object() {
+        state = serde_json::json!({});
+    }
+    let Some(root) = state.as_object_mut() else {
+        return Err(LifecycleError::StatePersist(
+            "runtime state root is not an object".to_string(),
+        ));
+    };
+    let agents = root
+        .entry("agents".to_string())
+        .or_insert_with(|| serde_json::json!({}));
+    if !agents.is_object() {
+        *agents = serde_json::json!({});
+    }
+    let Some(agent_map) = agents.as_object_mut() else {
+        return Err(LifecycleError::StatePersist(
+            "runtime state agents is not an object".to_string(),
+        ));
+    };
+    let provider = meta
+        .get("provider")
+        .and_then(Value::as_str)
+        .unwrap_or("codex");
+    let auth_mode = meta
+        .get("auth_mode")
+        .and_then(Value::as_str)
+        .unwrap_or("subscription");
+    let role = meta
+        .get("role")
+        .and_then(Value::as_str)
+        .unwrap_or_else(|| agent_id.as_str());
+    // E42 (0.3.24 P0, double-spec deadlock): persist the initial state row as
+    // "starting" (not "running"). The caller (add_agent_with_transport_at_paths)
+    // promotes to "running" only after start_agent_at_paths returns Running.
+    // If the spawn fails, the rollback below removes the entry entirely.
+    let mut entry = serde_json::json!({
+        "provider": provider,
+        "auth_mode": auth_mode,
+        "role": role,
+        "status": "starting",
+        "dynamic_role_file": dynamic_role_file.to_string_lossy().to_string(),
+        "role_source_ownership": role_source_ownership(workspace, dynamic_role_file),
+    });
+    if let Some(model) = meta.get("model").and_then(Value::as_str) {
+        if let Some(obj) = entry.as_object_mut() {
+            obj.insert("model".to_string(), serde_json::json!(model));
+            obj.insert("model_source".to_string(), serde_json::json!("role"));
+        }
+    }
+    if let Some(profile) = meta.get("profile").and_then(Value::as_str) {
+        if let Some(obj) = entry.as_object_mut() {
+            obj.insert("profile".to_string(), serde_json::json!(profile));
+            if let Some(team_dir) = dynamic_role_file.parent().and_then(Path::parent) {
+                obj.insert(
+                    "_profile_dir".to_string(),
+                    serde_json::json!(team_dir.join("profiles").to_string_lossy().to_string()),
+                );
+            }
+            if !obj.contains_key("model_source") {
+                obj.insert("model_source".to_string(), serde_json::json!("default"));
+            }
+        }
+    }
+    // 0.4.x provider effort MVP step 8 (dynamic add-agent): persist effort
+    // from the role doc front matter (compiler.rs validates syntax/semantics
+    // at compile; add-agent path validates here too in case of direct YAML).
+    if let Some(effort_str) = meta.get("effort").and_then(Value::as_str) {
+        if !effort_str.is_empty() {
+            if let Some(obj) = entry.as_object_mut() {
+                obj.insert("effort".to_string(), serde_json::json!(effort_str));
+            }
+        }
+    }
+    if let Some(obj) = entry.as_object_mut() {
+        persist_effective_approval_policy(obj, safety);
+    }
+    agent_map.insert(agent_id.as_str().to_string(), entry);
+    save_launched_team_state_for_key(workspace, &state, Some(canonical_team_key))
+}
+
+pub(super) fn role_source_ownership(workspace: &Path, role_file: &Path) -> &'static str {
+    let managed_root = workspace.join(".team").join("dynamic-role-files");
+    match (
+        std::fs::canonicalize(&managed_root),
+        std::fs::canonicalize(role_file),
+    ) {
+        (Ok(root), Ok(path)) if path.starts_with(&root) => "managed",
+        _ => "external",
+    }
+}
+
+/// E5 Bug1:把 add-agent 就地编译出的 agent 条目注入 base team spec(`agents` 列表 +
+/// `routing.rules` 加 `route-<id>`),复刻 [`compile_team`] 的路由规则形态。不落任何文件。
+///
+/// 0.5.30 (`.team/artifacts/add-agent-restart-saveconflict-locate.md` §5.2):
+/// `pub(crate)` 让 restart/rebuild.rs::rebuild_runtime_spec_from_roles 复用
+/// 同一去重注入逻辑,把 add-agent 记录的 dynamic_role_file 合并回 restart
+/// 重建 spec,防止 live helper 被 prune 后触发 SaveConflict。行为不变。
+pub(crate) fn inject_agent_into_spec(
+    spec: &mut Value,
+    agent: Value,
+    agent_id: &str,
+) -> Result<(), LifecycleError> {
+    let Value::Map(pairs) = spec else {
+        return Err(LifecycleError::Compile("spec is not a map".to_string()));
+    };
+    // agents 列表追加。
+    match pairs.iter_mut().find(|(k, _)| k == "agents") {
+        Some((_, Value::List(agents))) => {
+            if !agents
+                .iter()
+                .any(|existing| yaml_agent_id(existing) == Some(agent_id))
+            {
+                agents.push(agent);
+            }
+        }
+        _ => {
+            return Err(LifecycleError::Compile(
+                "spec.agents missing or not a list".to_string(),
+            ))
+        }
+    }
+    // routing.rules 追加 route-<id>(与 compile_team 同形)。
+    if let Some((_, Value::Map(routing))) = pairs.iter_mut().find(|(k, _)| k == "routing") {
+        if let Some((_, Value::List(rules))) = routing.iter_mut().find(|(k, _)| k == "rules") {
+            if !rules
+                .iter()
+                .any(|rule| yaml_route_assigns_to(rule) == Some(agent_id))
+            {
+                rules.push(Value::Map(vec![
+                    ("id".to_string(), Value::Str(format!("route-{agent_id}"))),
+                    (
+                        "match".to_string(),
+                        Value::Map(vec![(
+                            "assignee".to_string(),
+                            Value::List(vec![Value::Str(agent_id.to_string())]),
+                        )]),
+                    ),
+                    ("assign_to".to_string(), Value::Str(agent_id.to_string())),
+                    ("priority".to_string(), Value::Int(10)),
+                ]));
+            }
+        }
+    }
+    Ok(())
+}
+
+pub(super) fn runtime_agent_exists(state: &serde_json::Value, agent_id: &AgentId) -> bool {
+    state
+        .get("agents")
+        .and_then(serde_json::Value::as_object)
+        .is_some_and(|agents| agents.contains_key(agent_id.as_str()))
+}
+
+pub(super) fn yaml_agent_id(agent: &Value) -> Option<&str> {
+    let Value::Map(pairs) = agent else {
+        return None;
+    };
+    pairs
+        .iter()
+        .find(|(key, _)| key == "id")
+        .and_then(|(_, value)| match value {
+            Value::Str(id) => Some(id.as_str()),
+            _ => None,
+        })
+}
+
+pub(super) fn yaml_route_assigns_to(rule: &Value) -> Option<&str> {
+    let Value::Map(pairs) = rule else {
+        return None;
+    };
+    pairs
+        .iter()
+        .find(|(key, _)| key == "assign_to")
+        .and_then(|(_, value)| match value {
+            Value::Str(id) => Some(id.as_str()),
+            _ => None,
+        })
+}

package/crates/team-agent/src/lifecycle/launch/agent_state.rs

@@ -0,0 +1,160 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use crate::lifecycle::*;
+use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
+use crate::model::ids::AgentId;
+use crate::model::permissions::{self, AgentPermissionInput};
+use crate::model::yaml::{self, Value};
+use crate::state::persist::load_runtime_state;
+use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
+
+use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
+
+use super::*;
+
+pub(super) fn running_agent_state(
+    agent: &Value,
+    id: &str,
+    provider: Provider,
+    workspace: &Path,
+    spawn_cwd: &Path,
+    spawned_at: &str,
+    team_id: &str,
+    pane_id: Option<&str>,
+    pane_pid: Option<u32>,
+    safety: &DangerousApproval,
+    started_agent: Option<&StartedAgent>,
+    profile_dir: Option<&Path>,
+) -> Result<serde_json::Value, LifecycleError> {
+    let model = agent.get("model").and_then(Value::as_str);
+    let auth_mode = agent
+        .get("auth_mode")
+        .and_then(Value::as_str)
+        .and_then(parse_auth_mode)
+        .unwrap_or(AuthMode::Subscription);
+    let profile = agent
+        .get("profile")
+        .map(yaml_value_to_json)
+        .unwrap_or(serde_json::Value::Null);
+    let window = started_agent
+        .and_then(|started| started.layout_window.as_ref())
+        .map(WindowName::as_str)
+        .or_else(|| agent.get("window").and_then(Value::as_str))
+        .unwrap_or(id);
+    let mcp_config = crate::provider::get_adapter(provider)
+        .mcp_config(auth_mode)
+        .map_err(|e| LifecycleError::Provider(e.to_string()))?;
+    let mcp_config = resolve_mcp_config(mcp_config, workspace, id, team_id);
+    let mcp_config_path =
+        write_worker_mcp_config_for_provider(workspace, id, &mcp_config, Some(provider))?;
+    let mut state = serde_json::Map::new();
+    state.insert("status".to_string(), serde_json::json!("running"));
+    state.insert("provider".to_string(), serde_json::json!(provider));
+    state.insert("agent_id".to_string(), serde_json::json!(id));
+    state.insert(
+        "model".to_string(),
+        model.map_or(serde_json::Value::Null, |m| serde_json::json!(m)),
+    );
+    state.insert("auth_mode".to_string(), serde_json::json!(auth_mode));
+    // 0.4.x provider effort MVP step 8: persist resolved effort so restart
+    // / resume reads the same value (no re-resolution from role/team).
+    if let Some(effort_str) = agent.get("effort").and_then(Value::as_str) {
+        if !effort_str.is_empty() {
+            state.insert("effort".to_string(), serde_json::json!(effort_str));
+        }
+    }
+    state.insert("profile".to_string(), profile);
+    if agent.get("profile").is_some() {
+        if let Some(profile_dir) = profile_dir {
+            state.insert(
+                "_profile_dir".to_string(),
+                serde_json::json!(profile_dir.to_string_lossy().to_string()),
+            );
+        }
+    }
+    state.insert("window".to_string(), serde_json::json!(window));
+    state.insert(
+        "mcp_config".to_string(),
+        serde_json::json!(mcp_config_path.to_string_lossy().to_string()),
+    );
+    state.insert(
+        "permissions".to_string(),
+        permissions_json(agent, id, provider)
+            .map_err(|e| LifecycleError::Compile(e.to_string()))?,
+    );
+    persist_effective_approval_policy(&mut state, safety);
+    state.insert("session_id".to_string(), serde_json::Value::Null);
+    state.insert("rollout_path".to_string(), serde_json::Value::Null);
+    state.insert("captured_at".to_string(), serde_json::Value::Null);
+    state.insert("captured_via".to_string(), serde_json::Value::Null);
+    state.insert(
+        "attribution_confidence".to_string(),
+        serde_json::Value::Null,
+    );
+    if let Some(started_agent) = started_agent {
+        persist_started_agent_plan_state(&mut state, started_agent);
+        if let Some(layout_window) = started_agent.layout_window.as_ref() {
+            state.insert(
+                "layout_window".to_string(),
+                serde_json::json!(layout_window.as_str()),
+            );
+        }
+        if let Some(layout_index) = started_agent.layout_index {
+            state.insert("layout_index".to_string(), serde_json::json!(layout_index));
+        }
+        if let Some(pane_index) = started_agent.pane_index {
+            state.insert("pane_index".to_string(), serde_json::json!(pane_index));
+        }
+        if !matches!(started_agent.display, WorkerDisplay::Blocked { .. }) {
+            state.insert(
+                "display".to_string(),
+                serde_json::to_value(&started_agent.display)
+                    .map_err(|e| LifecycleError::StatePersist(e.to_string()))?,
+            );
+        }
+    }
+    state.insert(
+        "spawn_cwd".to_string(),
+        serde_json::json!(spawn_cwd.to_string_lossy().to_string()),
+    );
+    state.insert("spawned_at".to_string(), serde_json::json!(spawned_at));
+    if let Some(pane_id) = pane_id.filter(|pane| !pane.is_empty()) {
+        state.insert("pane_id".to_string(), serde_json::json!(pane_id));
+    }
+    if let Some(pane_pid) = pane_pid {
+        state.insert("pane_pid".to_string(), serde_json::json!(pane_pid));
+    }
+    Ok(serde_json::Value::Object(state))
+}
+
+pub(crate) fn effective_approval_policy(safety: &DangerousApproval) -> serde_json::Value {
+    serde_json::json!({
+        "enabled": safety.enabled,
+        "source": dangerous_approval_source_str(safety.source),
+        "inherited": safety.inherited,
+        "explicit_yes_confirmed": safety.enabled && matches!(safety.source, DangerousApprovalSource::RuntimeConfig),
+        "provider": safety.provider,
+        "flag": safety.flag,
+        "worker_capability_above_leader": safety.worker_capability_above_leader,
+    })
+}
+
+pub(crate) fn persist_effective_approval_policy(
+    agent_state: &mut serde_json::Map<String, serde_json::Value>,
+    safety: &DangerousApproval,
+) {
+    agent_state.insert(
+        "effective_approval_policy".to_string(),
+        effective_approval_policy(safety),
+    );
+}
+
+pub(super) fn dangerous_approval_source_str(source: DangerousApprovalSource) -> &'static str {
+    match source {
+        DangerousApprovalSource::RuntimeConfig => "runtime_config",
+        DangerousApprovalSource::LeaderProcess => "leader_process",
+        DangerousApprovalSource::Disabled => "disabled",
+    }
+}

package/crates/team-agent/src/lifecycle/launch/approval.rs

@@ -0,0 +1,134 @@
+use std::path::Path;
+
+use crate::lifecycle::{DangerousApproval, DangerousApprovalSource, LifecycleError};
+
+/// `detect_inherited_dangerous_permissions`(`launch/config.py`):扫进程祖先链找
+/// `--dangerously-*` flag,产出危险审批继承态。launch 在 inherited=false 且无 --yes 时拒。
+pub fn detect_dangerous_approval() -> Result<DangerousApproval, LifecycleError> {
+    if let Ok(raw) = std::env::var("TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON") {
+        let argv_tokens = serde_json::from_str::<Vec<String>>(&raw).map_err(|e| {
+            LifecycleError::StatePersist(format!("invalid test ancestry argv: {e}"))
+        })?;
+        return Ok(detect_dangerous_approval_in_argv(&argv_tokens)
+            .unwrap_or_else(disabled_dangerous_approval));
+    }
+    for argv_tokens in process_ancestry_argv(std::process::id()) {
+        if let Some(detected) = detect_dangerous_approval_in_argv(&argv_tokens) {
+            return Ok(detected);
+        }
+    }
+    Ok(disabled_dangerous_approval())
+}
+
+pub(super) fn disabled_dangerous_approval() -> DangerousApproval {
+    DangerousApproval {
+        enabled: false,
+        source: DangerousApprovalSource::Disabled,
+        inherited: false,
+        provider: None,
+        flag: None,
+        worker_capability_above_leader: false,
+        ancestry_binary_name: None,
+        unexpected_binary: false,
+    }
+}
+
+pub(super) fn detect_dangerous_approval_in_argv(
+    argv_tokens: &[String],
+) -> Option<DangerousApproval> {
+    let argv0 = argv_tokens.first().map(String::as_str).unwrap_or("");
+    let ancestry_binary_name = binary_name(argv0);
+    for token in argv_tokens {
+        for (provider, flag) in dangerous_leader_flags() {
+            if token == flag {
+                let unexpected_binary =
+                    !binary_matches_provider(provider, ancestry_binary_name.as_deref());
+                return Some(DangerousApproval {
+                    enabled: true,
+                    source: DangerousApprovalSource::LeaderProcess,
+                    inherited: true,
+                    provider: Some((*provider).to_string()),
+                    flag: Some((*flag).to_string()),
+                    worker_capability_above_leader: false,
+                    ancestry_binary_name,
+                    unexpected_binary,
+                });
+            }
+        }
+    }
+    None
+}
+
+pub(super) fn dangerous_leader_flags() -> &'static [(&'static str, &'static str)] {
+    // Process argv command grammar, not persisted provider identity parsing.
+    &[
+        ("claude", "--dangerously-skip-permissions"),
+        ("claude", "--dangerously-skip-permission"),
+        ("codex", "--dangerously-bypass-approvals-and-sandbox"),
+        // 0.3.27 P1 (E54 symptom 2): copilot's full-permission flags. Without
+        // these entries, a copilot leader running with --allow-all / --yolo would
+        // NOT propagate bypass to claude/codex workers because
+        // detect_dangerous_approval scans the coordinator's ancestor argv and
+        // only matches entries in THIS table.
+        ("copilot", "--allow-all"),
+        ("copilot", "--yolo"),
+    ]
+}
+
+pub(super) fn binary_matches_provider(provider: &str, binary: Option<&str>) -> bool {
+    // Binary-name command grammar, not provider identity parsing.
+    match (provider, binary) {
+        ("codex", Some("codex")) => true,
+        ("claude", Some("claude" | "claude-code" | "claude_code")) => true,
+        // 0.3.27 P1 (E54): copilot binary detection for dangerous-approval scan.
+        ("copilot", Some("copilot" | "github-copilot" | "gh-copilot")) => true,
+        _ => false,
+    }
+}
+
+pub(super) fn binary_name(argv0: &str) -> Option<String> {
+    Path::new(argv0)
+        .file_name()
+        .and_then(|v| v.to_str())
+        .filter(|s| !s.is_empty())
+        .map(str::to_string)
+}
+
+pub(super) fn process_ancestry_argv(pid: u32) -> Vec<Vec<String>> {
+    let mut out = Vec::new();
+    let mut current = pid;
+    let mut seen = std::collections::BTreeSet::new();
+    for _ in 0..12 {
+        if current == 0 || !seen.insert(current) {
+            break;
+        }
+        if let Some(argv_tokens) = process_argv_tokens(current) {
+            out.push(argv_tokens);
+        }
+        let Some(parent) = process_parent_pid(current) else {
+            break;
+        };
+        if parent <= 1 || parent == current {
+            break;
+        }
+        current = parent;
+    }
+    out
+}
+
+// 0.5.x Windows portability Batch 4: `process_argv_tokens` and
+// `process_parent_pid` route through `crate::platform::argv`. Unix
+// impls are byte-preserving (Linux `/proc/<pid>/cmdline`, macOS
+// `sysctl(KERN_PROCARGS2)`, other Unix `ps -p ... -o command=`).
+// Windows returns `None` per design §Batch 4 conservative anchor:
+// unknown argv must never infer elevated approval; callers already
+// treat `None` as "no elevation inherited" via
+// `disabled_dangerous_approval()`.
+
+pub(super) fn process_argv_tokens(pid: u32) -> Option<Vec<String>> {
+    crate::platform::argv::argv_tokens(pid)
+}
+
+pub(super) fn process_parent_pid(pid: u32) -> Option<u32> {
+    crate::platform::argv::parent_pid(pid)
+}