@team-agent/installer 0.5.49 → 0.5.51

package/crates/team-agent/src/messaging/send.rs

@@ -5,12 +5,16 @@ use std::path::Path;
 use crate::coordinator::{CoordinatorHealthStatus, WorkspacePath};
 use crate::event_log::EventLog;
 use crate::model::enums::PaneLiveness;
-use crate::model::ids::{TaskId, TeamKey};
+use crate::model::ids::{AgentId, TaskId, TeamKey};
 use crate::transport::{PaneId, Transport};
 
 use super::helpers::{status_wire, MessageStatusShadow};
 use super::leader_receiver::{send_to_leader_receiver, send_to_leader_receiver_with_message_id};
-use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStatus, MessagingError};
+use super::{
+    persist_resolved_send, DeliveryBlocker, DeliveryOutcome, DeliveryRefusal, DeliveryStatus,
+    InitialDisposition, LogicalRecipient, MessagingError, PersistResolution, ResolvedSendIntent,
+    SendOrigin,
+};
 
 /// 发件目标:单 target / 广播 `*` / 扇出 list (`send.py:36` `target: str|list[str]|None`)。
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -23,15 +27,39 @@ pub enum MessageTarget {
     Fanout(Vec<String>),
 }
 
+/// Sender identity captured from a framework-owned runtime context.
+///
+/// Public CLI/MCP inputs never construct this value from a caller-supplied
+/// string. The wrapper keeps that trust boundary visible throughout delivery
+/// instead of degrading the identity back to an untyped option field.
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+#[serde(transparent)]
+pub struct TrustedSender(AgentId);
+
+impl TrustedSender {
+    pub fn from_runtime_identity(agent_id: AgentId) -> Self {
+        Self(agent_id)
+    }
+
+    pub fn leader() -> Self {
+        Self(AgentId::new("leader"))
+    }
+
+    pub fn as_str(&self) -> &str {
+        self.0.as_str()
+    }
+}
+
 /// `send_message` 选项 (`send.py:36`:Python 大量默认参数 → typed 选项 struct)。
 #[derive(Debug, Clone)]
 pub struct SendOptions {
+    pub origin: SendOrigin,
     pub task_id: Option<TaskId>,
     /// `route_task_id`(golden `send.py:190`,默认 `True`):仅 **routing**(CLI `send --task`)时把
     /// `task_id` 当真任务校验/路由。**投递/fanout/internal/coordinator** 路径传 `false`
     /// (`internal_delivery.py:44`、`send.py:412/481`),此时 `task_id` 只是标签,**不校验 state.tasks**。
     pub route_task_id: bool,
-    pub sender: String,
+    pub sender: TrustedSender,
     pub requires_ack: bool,
     pub confirm_human: bool,
     pub wait_visible: bool,
@@ -50,9 +78,10 @@ impl Default for SendOptions {
     fn default() -> Self {
         // 默认值对齐 Python 签名 (`send.py:38-40`)。
         Self {
+            origin: SendOrigin::Internal(super::InternalSendKind::Delivery),
             task_id: None,
             route_task_id: true,
-            sender: "leader".to_string(),
+            sender: TrustedSender::leader(),
             requires_ack: true,
             confirm_human: false,
             wait_visible: true,
@@ -95,7 +124,7 @@ pub fn send_message(
                 "leader",
                 content,
                 opts.task_id.as_ref(),
-                &opts.sender,
+                opts.sender.as_str(),
                 opts.requires_ack,
                 None,
                 opts.message_id.as_deref(),
@@ -119,7 +148,7 @@ pub fn send_message(
         }
         MessageTarget::Single(target) => target,
         MessageTarget::Broadcast => {
-            let recipients = broadcast_recipients(&state, &opts.sender, opts.team.as_ref());
+            let recipients = broadcast_recipients(&state, opts.sender.as_str(), opts.team.as_ref());
             return fanout_send(
                 workspace,
                 &state,
@@ -163,13 +192,13 @@ pub fn send_message(
         &state,
         recipient,
         "leader",
-        &opts.sender,
+        opts.sender.as_str(),
         opts.task_id.as_ref(),
         &event_log,
     )? {
         return Ok(outcome);
     }
-    if let Some(outcome) = send_owner_gate_refusal(workspace, &state, &opts.sender)? {
+    if let Some(outcome) = send_owner_gate_refusal(workspace, &state, opts.sender.as_str())? {
         return Ok(outcome);
     }
     if opts.route_task_id {
@@ -184,46 +213,47 @@ pub fn send_message(
     }
     let stale_worker_target_missing =
         stale_worker_target_missing_preflight(workspace, &state, recipient)?;
-    if !stale_worker_target_missing {
-        if let Some(outcome) =
-            coordinator_unavailable_outcome(workspace, recipient, opts, &event_log)?
-        {
-            return Ok(outcome);
-        }
+    let coordinator_unavailable = if stale_worker_target_missing {
+        None
+    } else {
+        coordinator_unavailable_outcome(workspace, recipient, opts, &event_log)?
+    };
+    if let Some(gate) = coordinator_unavailable
+        .as_ref()
+        .filter(|gate| !gate.persist)
+    {
+        return Ok(gate.outcome.clone());
     }
-    let store = crate::message_store::MessageStore::open(workspace)?;
-    let task_id = opts.task_id.as_ref().map(|t| t.as_str());
-    let owner_team_id = opts.team.as_ref().map(|t| t.as_str());
-    // CR-015/054 caller-key dedup: if the caller supplied a stable id, an identical
-    // re-send must NOT create a second row — return a Duplicate refusal instead.
-    let message_id = if let Some(requested) = opts.message_id.as_deref() {
-        if store.message_exists(requested)? {
+    let mut intent = ResolvedSendIntent::accepted(
+        opts.origin,
+        workspace,
+        opts.team.clone(),
+        LogicalRecipient::from_resolved(recipient),
+        opts.sender.clone(),
+        opts.task_id.clone(),
+        content,
+        None,
+        opts.requires_ack,
+        opts.message_id.clone(),
+    );
+    if coordinator_unavailable
+        .as_ref()
+        .is_some_and(|gate| gate.persist)
+    {
+        intent.initial_disposition =
+            InitialDisposition::Blocked(DeliveryBlocker::CoordinatorUnavailable);
+    }
+    let persisted = match persist_resolved_send(&intent)? {
+        PersistResolution::Persisted(persisted) => persisted,
+        PersistResolution::Duplicate(message_id) => {
             return Ok(refused_outcome_with_id(
                 DeliveryRefusal::Duplicate,
-                Some(requested.to_string()),
+                Some(message_id),
             ));
         }
-        store.create_message_with_id(
-            requested,
-            task_id,
-            &opts.sender,
-            recipient,
-            content,
-            None,
-            opts.requires_ack,
-            owner_team_id,
-        )?
-    } else {
-        store.create_message(
-            task_id,
-            &opts.sender,
-            recipient,
-            content,
-            None,
-            opts.requires_ack,
-            owner_team_id,
-        )?
     };
+    let message_id = persisted.message_id.clone();
+    let store = crate::message_store::MessageStore::open(workspace)?;
     if stale_worker_target_missing {
         return super::delivery::mark_worker_target_missing(
             &store,
@@ -233,10 +263,37 @@ pub fn send_message(
             None,
         );
     }
+    if let Some(CoordinatorUnavailableGate {
+        mut outcome,
+        persist: true,
+    }) = coordinator_unavailable
+    {
+        let Some(blocker) = persisted.blocker else {
+            return Err(MessagingError::Validation(
+                "coordinator-blocked persistence returned no blocker".to_string(),
+            ));
+        };
+        let message_status = persisted.row_status.as_str();
+        event_log.write(
+            "send.message_queued",
+            serde_json::json!({
+                "message_id": message_id,
+                "recipient": recipient,
+                "sender": opts.sender,
+                "message_status": message_status,
+                "blocker": blocker.as_str(),
+            }),
+        )?;
+        outcome.ok = true;
+        outcome.status = DeliveryStatus::Blocked;
+        outcome.message_status = MessageStatusShadow(message_status.to_string());
+        outcome.message_id = Some(message_id);
+        return Ok(outcome);
+    }
     Ok(DeliveryOutcome {
         ok: true,
         status: DeliveryStatus::Queued,
-        message_status: MessageStatusShadow("accepted".to_string()),
+        message_status: MessageStatusShadow(persisted.row_status.as_str().to_string()),
         message_id: Some(message_id),
         verification: None,
         stage: None,
@@ -308,12 +365,17 @@ fn refused_outcome_with_verification(
     }
 }
 
+struct CoordinatorUnavailableGate {
+    outcome: DeliveryOutcome,
+    persist: bool,
+}
+
 fn coordinator_unavailable_outcome(
     workspace: &Path,
     recipient: &str,
     opts: &SendOptions,
     event_log: &EventLog,
-) -> Result<Option<DeliveryOutcome>, MessagingError> {
+) -> Result<Option<CoordinatorUnavailableGate>, MessagingError> {
     let coordinator_workspace = WorkspacePath::new(workspace.to_path_buf());
     let health = crate::coordinator::coordinator_health(&coordinator_workspace);
     if health.ok || matches!(health.status, CoordinatorHealthStatus::Missing) {
@@ -343,9 +405,19 @@ fn coordinator_unavailable_outcome(
         )?;
         return Ok(None);
     }
-    let warning = format!(
-        "coordinator is not running; message was not queued for {recipient}. Run `team-agent diagnose` or restart the team before sending again."
+    let persist = !matches!(
+        health.metadata_mismatch_reason.as_deref(),
+        Some("protocol_version_mismatch" | "message_store_schema_version_mismatch")
     );
+    let warning = if persist {
+        format!(
+            "coordinator is not running; message was queued for {recipient} and will retry. Run `team-agent diagnose` or restart the team."
+        )
+    } else {
+        format!(
+            "coordinator protocol or schema is incompatible; message was not queued for {recipient}. Run `team-agent diagnose` or upgrade the runtime."
+        )
+    };
     event_log.write(
         "send.coordinator_unavailable",
         serde_json::json!({
@@ -354,22 +426,25 @@ fn coordinator_unavailable_outcome(
             "coordinator_status": health.status,
             "coordinator_pid": health.pid.map(|pid| pid.get()),
             "metadata_mismatch_reason": health.metadata_mismatch_reason,
-            "message_queued": false,
+            "message_queued": persist,
             "warning": warning,
             "coordinator_log": crate::coordinator::coordinator_log_path(&coordinator_workspace)
                 .display()
                 .to_string(),
         }),
     )?;
-    Ok(Some(DeliveryOutcome {
-        ok: false,
-        status: DeliveryStatus::Degraded,
-        message_status: MessageStatusShadow("degraded".to_string()),
-        message_id: None,
-        verification: Some(warning),
-        stage: None,
-        reason: Some(DeliveryRefusal::CoordinatorUnavailable),
-        channel: Some("coordinator_unavailable".to_string()),
+    Ok(Some(CoordinatorUnavailableGate {
+        persist,
+        outcome: DeliveryOutcome {
+            ok: false,
+            status: DeliveryStatus::Degraded,
+            message_status: MessageStatusShadow("degraded".to_string()),
+            message_id: None,
+            verification: Some(warning),
+            stage: None,
+            reason: Some(DeliveryRefusal::CoordinatorUnavailable),
+            channel: Some("coordinator_unavailable".to_string()),
+        },
     }))
 }
 
@@ -690,7 +765,7 @@ fn fanout_send(
     let mut delivered_count = 0usize;
     let mut attempted_count = 0usize;
     for recipient in recipients {
-        if recipient.is_empty() || recipient == &opts.sender {
+        if recipient.is_empty() || recipient == opts.sender.as_str() {
             continue;
         }
         attempted_count = attempted_count.saturating_add(1);
@@ -701,7 +776,7 @@ fn fanout_send(
                 recipient,
                 content,
                 opts.task_id.as_ref(),
-                &opts.sender,
+                opts.sender.as_str(),
                 opts.requires_ack,
                 None,
                 event_log,

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -0,0 +1,305 @@
+//! Unit regressions for leader injection receipt acceptance.
+//!
+//! These fixtures intentionally seed DB/state/transcript internals. Per MUST-15,
+//! that synthetic setup belongs only in src/**/tests and is not acceptance proof.
+
+use super::*;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use crate::event_log::EventLog;
+use crate::message_store::MessageStore;
+use crate::transport::{
+    AttachOutcome, BackendKind, CaptureRange, CapturedText, InjectPayload, InjectReport,
+    InjectStage, InjectVerification, Key, PaneField, PaneId, PaneInfo, PaneLiveness, SessionName,
+    SetEnvOutcome, SpawnResult, SubmitVerification, Target, Transport, TransportError,
+    TurnVerification, WindowName,
+};
+use rusqlite::params;
+
+#[test]
+fn tmux_leader_submit_without_provider_receipt_stays_pending_then_accepts_same_row() {
+    let case = Case::new("receipt");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("receipt canary");
+
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("first delivery attempt");
+
+    assert!(
+        first.ok,
+        "verified transport submission is accepted even while provider receipt is pending: {first:?}"
+    );
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+    assert!(
+        case.events().contains("leader_receiver.acceptance_pending"),
+        "missing receipt must be observable"
+    );
+
+    std::fs::write(
+        &case.rollout,
+        format!(r#"{{"type":"user","message":"[team-agent-token:{message_id}]"}}"#),
+    )
+    .unwrap();
+    let second = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("receipt observation");
+
+    assert!(
+        second.ok,
+        "provider receipt advances the same row: {second:?}"
+    );
+    assert_eq!(case.message_status(&message_id), "delivered");
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "receipt observation must not inject the message a second time"
+    );
+    assert!(case.delivery_consumed_at(&message_id).is_some());
+}
+
+#[test]
+fn attached_leader_mailbox_is_rechecked_by_the_normal_delivery_tick() {
+    let case = Case::new("mailbox");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("mailbox canary");
+    case.store
+        .mark(&message_id, "queued_until_leader_attach", None)
+        .unwrap();
+
+    let delivered =
+        deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log)
+            .expect("normal coordinator delivery pass");
+
+    assert!(delivered.is_empty(), "provider receipt is still pending");
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+    assert!(case.events().contains("leader_receiver.mailbox_requeued"));
+}
+
+struct Case {
+    workspace: PathBuf,
+    rollout: PathBuf,
+    store: MessageStore,
+    event_log: EventLog,
+    state: serde_json::Value,
+}
+
+impl Case {
+    fn new(tag: &str) -> Self {
+        let workspace = tmp_ws(&format!("leader-inject-acceptance-{tag}"));
+        let rollout = workspace.join("leader.jsonl");
+        std::fs::write(&rollout, "").unwrap();
+        let state = serde_json::json!({
+            "active_team_key": "acceptance-team",
+            "session_name": "team-acceptance",
+            "leader_receiver": {
+                "pane_id": "%leader",
+                "status": "attached",
+                "provider": "claude",
+                "rollout_path": rollout,
+            }
+        });
+        crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+        let store = MessageStore::open(&workspace).unwrap();
+        let event_log = EventLog::new(&workspace);
+        Self {
+            workspace,
+            rollout,
+            store,
+            event_log,
+            state,
+        }
+    }
+
+    fn seed_message(&self, content: &str) -> String {
+        self.store
+            .create_message(None, "worker", "leader", content, None, false, None)
+            .unwrap()
+    }
+
+    fn message_status(&self, message_id: &str) -> String {
+        let conn = crate::db::schema::open_db(self.store.db_path()).unwrap();
+        conn.query_row(
+            "select status from messages where message_id = ?1",
+            [message_id],
+            |row| row.get(0),
+        )
+        .unwrap()
+    }
+
+    fn delivery_consumed_at(&self, message_id: &str) -> Option<String> {
+        let conn = crate::db::schema::open_db(self.store.db_path()).unwrap();
+        conn.query_row(
+            "select consumed_at from delivery_tokens where message_id = ?1",
+            params![message_id],
+            |row| row.get(0),
+        )
+        .unwrap()
+    }
+
+    fn events(&self) -> String {
+        self.event_log
+            .tail(0)
+            .unwrap()
+            .into_iter()
+            .map(|event| event.to_string())
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+}
+
+#[derive(Clone)]
+struct RecordingTransport {
+    injects: Arc<AtomicUsize>,
+    capture: Arc<Mutex<String>>,
+}
+
+impl RecordingTransport {
+    fn new(capture: &str) -> Self {
+        Self {
+            injects: Arc::new(AtomicUsize::new(0)),
+            capture: Arc::new(Mutex::new(capture.to_string())),
+        }
+    }
+
+    fn inject_count(&self) -> usize {
+        self.injects.load(Ordering::Relaxed)
+    }
+}
+
+impl Transport for RecordingTransport {
+    fn kind(&self) -> BackendKind {
+        BackendKind::Tmux
+    }
+
+    fn spawn_first(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("delivery contract does not spawn")
+    }
+
+    fn spawn_into(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("delivery contract does not spawn")
+    }
+
+    fn inject(
+        &self,
+        _target: &Target,
+        _payload: &InjectPayload,
+        _submit: Key,
+        _bracketed_paste: bool,
+    ) -> Result<InjectReport, TransportError> {
+        self.injects.fetch_add(1, Ordering::Relaxed);
+        Ok(InjectReport {
+            stage_reached: InjectStage::Submit,
+            inject_verification: InjectVerification::CaptureContainsToken,
+            submit_verification: SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            turn_verification: TurnVerification::NotYetObserved,
+            attempts: 1,
+            submit_diagnostics: None,
+        })
+    }
+
+    fn send_keys(&self, _target: &Target, _keys: &[Key]) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn capture(
+        &self,
+        _target: &Target,
+        range: CaptureRange,
+    ) -> Result<CapturedText, TransportError> {
+        Ok(CapturedText {
+            text: self.capture.lock().unwrap().clone(),
+            range,
+        })
+    }
+
+    fn query(&self, _target: &Target, _field: PaneField) -> Result<Option<String>, TransportError> {
+        Ok(None)
+    }
+
+    fn liveness(&self, _pane: &PaneId) -> Result<PaneLiveness, TransportError> {
+        Ok(PaneLiveness::Live)
+    }
+
+    fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
+        Ok(vec![PaneInfo {
+            pane_id: PaneId::new("%leader"),
+            session: SessionName::new("team-acceptance"),
+            window_index: None,
+            window_name: Some(WindowName::new("leader")),
+            pane_index: None,
+            tty: None,
+            current_command: Some("claude".to_string()),
+            current_path: None,
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+    }
+
+    fn has_session(&self, _session: &SessionName) -> Result<bool, TransportError> {
+        Ok(true)
+    }
+
+    fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
+        Ok(vec![WindowName::new("leader")])
+    }
+
+    fn set_session_env(
+        &self,
+        _session: &SessionName,
+        _key: &str,
+        _value: &str,
+    ) -> Result<SetEnvOutcome, TransportError> {
+        Ok(SetEnvOutcome::Applied)
+    }
+
+    fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn kill_window(&self, _target: &Target) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn attach_session(&self, _session: &SessionName) -> Result<AttachOutcome, TransportError> {
+        Ok(AttachOutcome::Attached)
+    }
+}

package/crates/team-agent/src/messaging/tests/mod.rs

@@ -292,6 +292,7 @@ impl Drop for EnvGuardMsg {
 
 mod basic;
 mod e23;
+mod leader_inject_acceptance;
 mod main_preserved;
 mod runtime;
 mod spine;