@team-agent/installer 0.5.50 → 0.5.51

package/crates/team-agent/src/messaging/send.rs

@@ -10,7 +10,11 @@ use crate::transport::{PaneId, Transport};
 
 use super::helpers::{status_wire, MessageStatusShadow};
 use super::leader_receiver::{send_to_leader_receiver, send_to_leader_receiver_with_message_id};
-use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStatus, MessagingError};
+use super::{
+    persist_resolved_send, DeliveryBlocker, DeliveryOutcome, DeliveryRefusal, DeliveryStatus,
+    InitialDisposition, LogicalRecipient, MessagingError, PersistResolution, ResolvedSendIntent,
+    SendOrigin,
+};
 
 /// 发件目标:单 target / 广播 `*` / 扇出 list (`send.py:36` `target: str|list[str]|None`)。
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -49,6 +53,7 @@ impl TrustedSender {
 /// `send_message` 选项 (`send.py:36`:Python 大量默认参数 → typed 选项 struct)。
 #[derive(Debug, Clone)]
 pub struct SendOptions {
+    pub origin: SendOrigin,
     pub task_id: Option<TaskId>,
     /// `route_task_id`(golden `send.py:190`,默认 `True`):仅 **routing**(CLI `send --task`)时把
     /// `task_id` 当真任务校验/路由。**投递/fanout/internal/coordinator** 路径传 `false`
@@ -73,6 +78,7 @@ impl Default for SendOptions {
     fn default() -> Self {
         // 默认值对齐 Python 签名 (`send.py:38-40`)。
         Self {
+            origin: SendOrigin::Internal(super::InternalSendKind::Delivery),
             task_id: None,
             route_task_id: true,
             sender: TrustedSender::leader(),
@@ -207,46 +213,47 @@ pub fn send_message(
     }
     let stale_worker_target_missing =
         stale_worker_target_missing_preflight(workspace, &state, recipient)?;
-    if !stale_worker_target_missing {
-        if let Some(outcome) =
-            coordinator_unavailable_outcome(workspace, recipient, opts, &event_log)?
-        {
-            return Ok(outcome);
-        }
+    let coordinator_unavailable = if stale_worker_target_missing {
+        None
+    } else {
+        coordinator_unavailable_outcome(workspace, recipient, opts, &event_log)?
+    };
+    if let Some(gate) = coordinator_unavailable
+        .as_ref()
+        .filter(|gate| !gate.persist)
+    {
+        return Ok(gate.outcome.clone());
     }
-    let store = crate::message_store::MessageStore::open(workspace)?;
-    let task_id = opts.task_id.as_ref().map(|t| t.as_str());
-    let owner_team_id = opts.team.as_ref().map(|t| t.as_str());
-    // CR-015/054 caller-key dedup: if the caller supplied a stable id, an identical
-    // re-send must NOT create a second row — return a Duplicate refusal instead.
-    let message_id = if let Some(requested) = opts.message_id.as_deref() {
-        if store.message_exists(requested)? {
+    let mut intent = ResolvedSendIntent::accepted(
+        opts.origin,
+        workspace,
+        opts.team.clone(),
+        LogicalRecipient::from_resolved(recipient),
+        opts.sender.clone(),
+        opts.task_id.clone(),
+        content,
+        None,
+        opts.requires_ack,
+        opts.message_id.clone(),
+    );
+    if coordinator_unavailable
+        .as_ref()
+        .is_some_and(|gate| gate.persist)
+    {
+        intent.initial_disposition =
+            InitialDisposition::Blocked(DeliveryBlocker::CoordinatorUnavailable);
+    }
+    let persisted = match persist_resolved_send(&intent)? {
+        PersistResolution::Persisted(persisted) => persisted,
+        PersistResolution::Duplicate(message_id) => {
             return Ok(refused_outcome_with_id(
                 DeliveryRefusal::Duplicate,
-                Some(requested.to_string()),
+                Some(message_id),
             ));
         }
-        store.create_message_with_id(
-            requested,
-            task_id,
-            opts.sender.as_str(),
-            recipient,
-            content,
-            None,
-            opts.requires_ack,
-            owner_team_id,
-        )?
-    } else {
-        store.create_message(
-            task_id,
-            opts.sender.as_str(),
-            recipient,
-            content,
-            None,
-            opts.requires_ack,
-            owner_team_id,
-        )?
     };
+    let message_id = persisted.message_id.clone();
+    let store = crate::message_store::MessageStore::open(workspace)?;
     if stale_worker_target_missing {
         return super::delivery::mark_worker_target_missing(
             &store,
@@ -256,10 +263,37 @@ pub fn send_message(
             None,
         );
     }
+    if let Some(CoordinatorUnavailableGate {
+        mut outcome,
+        persist: true,
+    }) = coordinator_unavailable
+    {
+        let Some(blocker) = persisted.blocker else {
+            return Err(MessagingError::Validation(
+                "coordinator-blocked persistence returned no blocker".to_string(),
+            ));
+        };
+        let message_status = persisted.row_status.as_str();
+        event_log.write(
+            "send.message_queued",
+            serde_json::json!({
+                "message_id": message_id,
+                "recipient": recipient,
+                "sender": opts.sender,
+                "message_status": message_status,
+                "blocker": blocker.as_str(),
+            }),
+        )?;
+        outcome.ok = true;
+        outcome.status = DeliveryStatus::Blocked;
+        outcome.message_status = MessageStatusShadow(message_status.to_string());
+        outcome.message_id = Some(message_id);
+        return Ok(outcome);
+    }
     Ok(DeliveryOutcome {
         ok: true,
         status: DeliveryStatus::Queued,
-        message_status: MessageStatusShadow("accepted".to_string()),
+        message_status: MessageStatusShadow(persisted.row_status.as_str().to_string()),
         message_id: Some(message_id),
         verification: None,
         stage: None,
@@ -331,12 +365,17 @@ fn refused_outcome_with_verification(
     }
 }
 
+struct CoordinatorUnavailableGate {
+    outcome: DeliveryOutcome,
+    persist: bool,
+}
+
 fn coordinator_unavailable_outcome(
     workspace: &Path,
     recipient: &str,
     opts: &SendOptions,
     event_log: &EventLog,
-) -> Result<Option<DeliveryOutcome>, MessagingError> {
+) -> Result<Option<CoordinatorUnavailableGate>, MessagingError> {
     let coordinator_workspace = WorkspacePath::new(workspace.to_path_buf());
     let health = crate::coordinator::coordinator_health(&coordinator_workspace);
     if health.ok || matches!(health.status, CoordinatorHealthStatus::Missing) {
@@ -366,9 +405,19 @@ fn coordinator_unavailable_outcome(
         )?;
         return Ok(None);
     }
-    let warning = format!(
-        "coordinator is not running; message was not queued for {recipient}. Run `team-agent diagnose` or restart the team before sending again."
+    let persist = !matches!(
+        health.metadata_mismatch_reason.as_deref(),
+        Some("protocol_version_mismatch" | "message_store_schema_version_mismatch")
     );
+    let warning = if persist {
+        format!(
+            "coordinator is not running; message was queued for {recipient} and will retry. Run `team-agent diagnose` or restart the team."
+        )
+    } else {
+        format!(
+            "coordinator protocol or schema is incompatible; message was not queued for {recipient}. Run `team-agent diagnose` or upgrade the runtime."
+        )
+    };
     event_log.write(
         "send.coordinator_unavailable",
         serde_json::json!({
@@ -377,22 +426,25 @@ fn coordinator_unavailable_outcome(
             "coordinator_status": health.status,
             "coordinator_pid": health.pid.map(|pid| pid.get()),
             "metadata_mismatch_reason": health.metadata_mismatch_reason,
-            "message_queued": false,
+            "message_queued": persist,
             "warning": warning,
             "coordinator_log": crate::coordinator::coordinator_log_path(&coordinator_workspace)
                 .display()
                 .to_string(),
         }),
     )?;
-    Ok(Some(DeliveryOutcome {
-        ok: false,
-        status: DeliveryStatus::Degraded,
-        message_status: MessageStatusShadow("degraded".to_string()),
-        message_id: None,
-        verification: Some(warning),
-        stage: None,
-        reason: Some(DeliveryRefusal::CoordinatorUnavailable),
-        channel: Some("coordinator_unavailable".to_string()),
+    Ok(Some(CoordinatorUnavailableGate {
+        persist,
+        outcome: DeliveryOutcome {
+            ok: false,
+            status: DeliveryStatus::Degraded,
+            message_status: MessageStatusShadow("degraded".to_string()),
+            message_id: None,
+            verification: Some(warning),
+            stage: None,
+            reason: Some(DeliveryRefusal::CoordinatorUnavailable),
+            channel: Some("coordinator_unavailable".to_string()),
+        },
     }))
 }
 

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -0,0 +1,305 @@
+//! Unit regressions for leader injection receipt acceptance.
+//!
+//! These fixtures intentionally seed DB/state/transcript internals. Per MUST-15,
+//! that synthetic setup belongs only in src/**/tests and is not acceptance proof.
+
+use super::*;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use crate::event_log::EventLog;
+use crate::message_store::MessageStore;
+use crate::transport::{
+    AttachOutcome, BackendKind, CaptureRange, CapturedText, InjectPayload, InjectReport,
+    InjectStage, InjectVerification, Key, PaneField, PaneId, PaneInfo, PaneLiveness, SessionName,
+    SetEnvOutcome, SpawnResult, SubmitVerification, Target, Transport, TransportError,
+    TurnVerification, WindowName,
+};
+use rusqlite::params;
+
+#[test]
+fn tmux_leader_submit_without_provider_receipt_stays_pending_then_accepts_same_row() {
+    let case = Case::new("receipt");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("receipt canary");
+
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("first delivery attempt");
+
+    assert!(
+        first.ok,
+        "verified transport submission is accepted even while provider receipt is pending: {first:?}"
+    );
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+    assert!(
+        case.events().contains("leader_receiver.acceptance_pending"),
+        "missing receipt must be observable"
+    );
+
+    std::fs::write(
+        &case.rollout,
+        format!(r#"{{"type":"user","message":"[team-agent-token:{message_id}]"}}"#),
+    )
+    .unwrap();
+    let second = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("receipt observation");
+
+    assert!(
+        second.ok,
+        "provider receipt advances the same row: {second:?}"
+    );
+    assert_eq!(case.message_status(&message_id), "delivered");
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "receipt observation must not inject the message a second time"
+    );
+    assert!(case.delivery_consumed_at(&message_id).is_some());
+}
+
+#[test]
+fn attached_leader_mailbox_is_rechecked_by_the_normal_delivery_tick() {
+    let case = Case::new("mailbox");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("mailbox canary");
+    case.store
+        .mark(&message_id, "queued_until_leader_attach", None)
+        .unwrap();
+
+    let delivered =
+        deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log)
+            .expect("normal coordinator delivery pass");
+
+    assert!(delivered.is_empty(), "provider receipt is still pending");
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+    assert!(case.events().contains("leader_receiver.mailbox_requeued"));
+}
+
+struct Case {
+    workspace: PathBuf,
+    rollout: PathBuf,
+    store: MessageStore,
+    event_log: EventLog,
+    state: serde_json::Value,
+}
+
+impl Case {
+    fn new(tag: &str) -> Self {
+        let workspace = tmp_ws(&format!("leader-inject-acceptance-{tag}"));
+        let rollout = workspace.join("leader.jsonl");
+        std::fs::write(&rollout, "").unwrap();
+        let state = serde_json::json!({
+            "active_team_key": "acceptance-team",
+            "session_name": "team-acceptance",
+            "leader_receiver": {
+                "pane_id": "%leader",
+                "status": "attached",
+                "provider": "claude",
+                "rollout_path": rollout,
+            }
+        });
+        crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+        let store = MessageStore::open(&workspace).unwrap();
+        let event_log = EventLog::new(&workspace);
+        Self {
+            workspace,
+            rollout,
+            store,
+            event_log,
+            state,
+        }
+    }
+
+    fn seed_message(&self, content: &str) -> String {
+        self.store
+            .create_message(None, "worker", "leader", content, None, false, None)
+            .unwrap()
+    }
+
+    fn message_status(&self, message_id: &str) -> String {
+        let conn = crate::db::schema::open_db(self.store.db_path()).unwrap();
+        conn.query_row(
+            "select status from messages where message_id = ?1",
+            [message_id],
+            |row| row.get(0),
+        )
+        .unwrap()
+    }
+
+    fn delivery_consumed_at(&self, message_id: &str) -> Option<String> {
+        let conn = crate::db::schema::open_db(self.store.db_path()).unwrap();
+        conn.query_row(
+            "select consumed_at from delivery_tokens where message_id = ?1",
+            params![message_id],
+            |row| row.get(0),
+        )
+        .unwrap()
+    }
+
+    fn events(&self) -> String {
+        self.event_log
+            .tail(0)
+            .unwrap()
+            .into_iter()
+            .map(|event| event.to_string())
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+}
+
+#[derive(Clone)]
+struct RecordingTransport {
+    injects: Arc<AtomicUsize>,
+    capture: Arc<Mutex<String>>,
+}
+
+impl RecordingTransport {
+    fn new(capture: &str) -> Self {
+        Self {
+            injects: Arc::new(AtomicUsize::new(0)),
+            capture: Arc::new(Mutex::new(capture.to_string())),
+        }
+    }
+
+    fn inject_count(&self) -> usize {
+        self.injects.load(Ordering::Relaxed)
+    }
+}
+
+impl Transport for RecordingTransport {
+    fn kind(&self) -> BackendKind {
+        BackendKind::Tmux
+    }
+
+    fn spawn_first(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("delivery contract does not spawn")
+    }
+
+    fn spawn_into(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("delivery contract does not spawn")
+    }
+
+    fn inject(
+        &self,
+        _target: &Target,
+        _payload: &InjectPayload,
+        _submit: Key,
+        _bracketed_paste: bool,
+    ) -> Result<InjectReport, TransportError> {
+        self.injects.fetch_add(1, Ordering::Relaxed);
+        Ok(InjectReport {
+            stage_reached: InjectStage::Submit,
+            inject_verification: InjectVerification::CaptureContainsToken,
+            submit_verification: SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            turn_verification: TurnVerification::NotYetObserved,
+            attempts: 1,
+            submit_diagnostics: None,
+        })
+    }
+
+    fn send_keys(&self, _target: &Target, _keys: &[Key]) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn capture(
+        &self,
+        _target: &Target,
+        range: CaptureRange,
+    ) -> Result<CapturedText, TransportError> {
+        Ok(CapturedText {
+            text: self.capture.lock().unwrap().clone(),
+            range,
+        })
+    }
+
+    fn query(&self, _target: &Target, _field: PaneField) -> Result<Option<String>, TransportError> {
+        Ok(None)
+    }
+
+    fn liveness(&self, _pane: &PaneId) -> Result<PaneLiveness, TransportError> {
+        Ok(PaneLiveness::Live)
+    }
+
+    fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
+        Ok(vec![PaneInfo {
+            pane_id: PaneId::new("%leader"),
+            session: SessionName::new("team-acceptance"),
+            window_index: None,
+            window_name: Some(WindowName::new("leader")),
+            pane_index: None,
+            tty: None,
+            current_command: Some("claude".to_string()),
+            current_path: None,
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+    }
+
+    fn has_session(&self, _session: &SessionName) -> Result<bool, TransportError> {
+        Ok(true)
+    }
+
+    fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
+        Ok(vec![WindowName::new("leader")])
+    }
+
+    fn set_session_env(
+        &self,
+        _session: &SessionName,
+        _key: &str,
+        _value: &str,
+    ) -> Result<SetEnvOutcome, TransportError> {
+        Ok(SetEnvOutcome::Applied)
+    }
+
+    fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn kill_window(&self, _target: &Target) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn attach_session(&self, _session: &SessionName) -> Result<AttachOutcome, TransportError> {
+        Ok(AttachOutcome::Attached)
+    }
+}

package/crates/team-agent/src/messaging/tests/mod.rs

@@ -292,6 +292,7 @@ impl Drop for EnvGuardMsg {
 
 mod basic;
 mod e23;
+mod leader_inject_acceptance;
 mod main_preserved;
 mod runtime;
 mod spine;

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -18,12 +18,11 @@ fn pane_info(pane_id: &str, session: &str, window: &str) -> PaneInfo {
 }
 
 // ════════════════════════════════════════════════════════════════════════
-// GROUP E — _fail_leader_delivery: bug-52 fallback-log semantics. ok=True but
-// status=FallbackLog (NOT a real submit). leader.py:394-436.
+// GROUP E — legacy diagnostics may only advance an existing durable row.
 // ════════════════════════════════════════════════════════════════════════
 
 #[test]
-fn fail_leader_delivery_returns_fallback_log_ok_true_not_submitted() {
+fn fail_leader_delivery_without_message_id_does_not_invent_a_row() {
     let ws = tmp_ws("faillead");
     let payload = json(serde_json::json!({
         "to": "leader", "content": "hi", "sender": "coordinator"
@@ -35,12 +34,17 @@ fn fail_leader_delivery_returns_fallback_log_ok_true_not_submitted() {
         Some("No direct leader tmux pane is attached. Run team-agent attach-leader."),
     )
     .unwrap();
-    // leader.py:423-431 — ok True, status fallback_log, channel fallback_inbox.
-    assert!(out.ok);
+    assert!(!out.ok);
     assert_eq!(out.status, DeliveryStatus::FallbackLog);
     assert_eq!(out.reason, Some(DeliveryRefusal::LeaderNotAttached));
-    // The audit must be distinguishable from a real submit (Delivered).
+    assert_eq!(out.message_id, None);
     assert_ne!(out.status, DeliveryStatus::Delivered);
+    let store = MessageStore::open(&ws).unwrap();
+    let connection = crate::db::schema::open_db(store.db_path()).unwrap();
+    let rows: i64 = connection
+        .query_row("select count(*) from messages", [], |row| row.get(0))
+        .unwrap();
+    assert_eq!(rows, 0, "diagnostics cannot create a fallback message row");
 }
 
 // ════════════════════════════════════════════════════════════════════════
@@ -439,28 +443,30 @@ fn message_not_silently_stuck_accepted_when_coordinator_dead() {
     )
     .unwrap();
 
-    assert!(!out.ok);
-    assert_eq!(out.status, DeliveryStatus::Degraded);
-    assert_eq!(out.message_status.0, "degraded");
+    assert!(out.ok, "durable persistence is the send success boundary");
+    assert_eq!(out.status, DeliveryStatus::Blocked);
+    assert_eq!(out.message_status.0, "queued_coordinator_unavailable");
+    assert!(out.message_id.as_deref().is_some_and(|id| id.starts_with("msg_")));
     assert_eq!(out.reason, Some(DeliveryRefusal::CoordinatorUnavailable));
     assert!(
         out.verification
             .as_deref()
             .is_some_and(|warning| warning.contains("coordinator is not running")),
-        "N38 warning must explain why the message was not queued; out={out:?}"
+        "N38 warning must explain the durable retry blocker; out={out:?}"
     );
     let store = MessageStore::open(&ws).unwrap();
     let conn = crate::db::schema::open_db(store.db_path()).unwrap();
-    let accepted: i64 = conn
+    let blocked: i64 = conn
         .query_row(
-            "select count(*) from messages where status = 'accepted'",
+            "select count(*) from messages where status = 'queued_coordinator_unavailable' \
+             and error = 'coordinator_unavailable' and delivered_at is null",
             [],
             |row| row.get(0),
         )
         .unwrap();
     assert_eq!(
-        accepted, 0,
-        "dead coordinator send must not strand an accepted row"
+        blocked, 1,
+        "dead coordinator send must park exactly one durable, non-delivered row"
     );
     let events = EventLog::new(&ws).tail(20).unwrap();
     assert!(
@@ -470,7 +476,7 @@ fn message_not_silently_stuck_accepted_when_coordinator_dead() {
                 && event
                     .get("message_queued")
                     .and_then(serde_json::Value::as_bool)
-                    == Some(false)
+                    == Some(true)
         }),
         "send.coordinator_unavailable event must be durable; events={events:?}"
     );
@@ -2914,9 +2920,15 @@ fn gate054_rebind_required_status_refuses_leader_delivery_without_cross_server_p
 }
 
 #[test]
-fn gate054_attached_status_still_delivers_when_pane_is_live() {
+fn gate054_attached_status_still_accepts_when_pane_is_live() {
     // Companion negative: prove the new status gate does NOT over-refuse when
     // `status="attached"` and the workspace-canonical socket has the pane.
+    // Injection-case revision: transport submit success is NOT a provider
+    // receipt, so the old `delivered` pin was a false-positive lock
+    // (MUST-10: physical submit is the framework's fact; acceptance is the
+    // provider's). The un-refused path now parks the SAME row in
+    // submitted_pending_acceptance until a provider receipt or retry
+    // schedule advances it.
     let ws = tmp_ws("gate054ok");
     let store = store_for(&ws);
     let log = EventLog::new(&ws);
@@ -2945,7 +2957,16 @@ fn gate054_attached_status_still_delivers_when_pane_is_live() {
         out.ok,
         "0.5.4 gate054: status='attached' with a live pane must not be over-refused: {out:?}"
     );
-    assert_eq!(out.message_status.0, "delivered");
+    assert_eq!(
+        transport.inject_targets().len(),
+        1,
+        "gate054: exactly one physical inject must have happened (MUST-10 anchor)"
+    );
+    assert_eq!(
+        out.message_status.0, "submitted_pending_acceptance",
+        "gate054 (injection-case revision): a successful physical submit without a provider \
+         receipt must park as submitted_pending_acceptance, never claim delivered: {out:?}"
+    );
 }
 
 // ════════════════════════════════════════════════════════════════════════