@team-agent/installer 0.5.50 → 0.5.52

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -0,0 +1,305 @@
+//! Unit regressions for leader injection receipt acceptance.
+//!
+//! These fixtures intentionally seed DB/state/transcript internals. Per MUST-15,
+//! that synthetic setup belongs only in src/**/tests and is not acceptance proof.
+
+use super::*;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use crate::event_log::EventLog;
+use crate::message_store::MessageStore;
+use crate::transport::{
+    AttachOutcome, BackendKind, CaptureRange, CapturedText, InjectPayload, InjectReport,
+    InjectStage, InjectVerification, Key, PaneField, PaneId, PaneInfo, PaneLiveness, SessionName,
+    SetEnvOutcome, SpawnResult, SubmitVerification, Target, Transport, TransportError,
+    TurnVerification, WindowName,
+};
+use rusqlite::params;
+
+#[test]
+fn tmux_leader_submit_without_provider_receipt_stays_pending_then_accepts_same_row() {
+    let case = Case::new("receipt");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("receipt canary");
+
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("first delivery attempt");
+
+    assert!(
+        first.ok,
+        "verified transport submission is accepted even while provider receipt is pending: {first:?}"
+    );
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+    assert!(
+        case.events().contains("leader_receiver.acceptance_pending"),
+        "missing receipt must be observable"
+    );
+
+    std::fs::write(
+        &case.rollout,
+        format!(r#"{{"type":"user","message":"[team-agent-token:{message_id}]"}}"#),
+    )
+    .unwrap();
+    let second = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("receipt observation");
+
+    assert!(
+        second.ok,
+        "provider receipt advances the same row: {second:?}"
+    );
+    assert_eq!(case.message_status(&message_id), "delivered");
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "receipt observation must not inject the message a second time"
+    );
+    assert!(case.delivery_consumed_at(&message_id).is_some());
+}
+
+#[test]
+fn attached_leader_mailbox_is_rechecked_by_the_normal_delivery_tick() {
+    let case = Case::new("mailbox");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("mailbox canary");
+    case.store
+        .mark(&message_id, "queued_until_leader_attach", None)
+        .unwrap();
+
+    let delivered =
+        deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log)
+            .expect("normal coordinator delivery pass");
+
+    assert!(delivered.is_empty(), "provider receipt is still pending");
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+    assert!(case.events().contains("leader_receiver.mailbox_requeued"));
+}
+
+struct Case {
+    workspace: PathBuf,
+    rollout: PathBuf,
+    store: MessageStore,
+    event_log: EventLog,
+    state: serde_json::Value,
+}
+
+impl Case {
+    fn new(tag: &str) -> Self {
+        let workspace = tmp_ws(&format!("leader-inject-acceptance-{tag}"));
+        let rollout = workspace.join("leader.jsonl");
+        std::fs::write(&rollout, "").unwrap();
+        let state = serde_json::json!({
+            "active_team_key": "acceptance-team",
+            "session_name": "team-acceptance",
+            "leader_receiver": {
+                "pane_id": "%leader",
+                "status": "attached",
+                "provider": "claude",
+                "rollout_path": rollout,
+            }
+        });
+        crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+        let store = MessageStore::open(&workspace).unwrap();
+        let event_log = EventLog::new(&workspace);
+        Self {
+            workspace,
+            rollout,
+            store,
+            event_log,
+            state,
+        }
+    }
+
+    fn seed_message(&self, content: &str) -> String {
+        self.store
+            .create_message(None, "worker", "leader", content, None, false, None)
+            .unwrap()
+    }
+
+    fn message_status(&self, message_id: &str) -> String {
+        let conn = crate::db::schema::open_db(self.store.db_path()).unwrap();
+        conn.query_row(
+            "select status from messages where message_id = ?1",
+            [message_id],
+            |row| row.get(0),
+        )
+        .unwrap()
+    }
+
+    fn delivery_consumed_at(&self, message_id: &str) -> Option<String> {
+        let conn = crate::db::schema::open_db(self.store.db_path()).unwrap();
+        conn.query_row(
+            "select consumed_at from delivery_tokens where message_id = ?1",
+            params![message_id],
+            |row| row.get(0),
+        )
+        .unwrap()
+    }
+
+    fn events(&self) -> String {
+        self.event_log
+            .tail(0)
+            .unwrap()
+            .into_iter()
+            .map(|event| event.to_string())
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+}
+
+#[derive(Clone)]
+struct RecordingTransport {
+    injects: Arc<AtomicUsize>,
+    capture: Arc<Mutex<String>>,
+}
+
+impl RecordingTransport {
+    fn new(capture: &str) -> Self {
+        Self {
+            injects: Arc::new(AtomicUsize::new(0)),
+            capture: Arc::new(Mutex::new(capture.to_string())),
+        }
+    }
+
+    fn inject_count(&self) -> usize {
+        self.injects.load(Ordering::Relaxed)
+    }
+}
+
+impl Transport for RecordingTransport {
+    fn kind(&self) -> BackendKind {
+        BackendKind::Tmux
+    }
+
+    fn spawn_first(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("delivery contract does not spawn")
+    }
+
+    fn spawn_into(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("delivery contract does not spawn")
+    }
+
+    fn inject(
+        &self,
+        _target: &Target,
+        _payload: &InjectPayload,
+        _submit: Key,
+        _bracketed_paste: bool,
+    ) -> Result<InjectReport, TransportError> {
+        self.injects.fetch_add(1, Ordering::Relaxed);
+        Ok(InjectReport {
+            stage_reached: InjectStage::Submit,
+            inject_verification: InjectVerification::CaptureContainsToken,
+            submit_verification: SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            turn_verification: TurnVerification::NotYetObserved,
+            attempts: 1,
+            submit_diagnostics: None,
+        })
+    }
+
+    fn send_keys(&self, _target: &Target, _keys: &[Key]) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn capture(
+        &self,
+        _target: &Target,
+        range: CaptureRange,
+    ) -> Result<CapturedText, TransportError> {
+        Ok(CapturedText {
+            text: self.capture.lock().unwrap().clone(),
+            range,
+        })
+    }
+
+    fn query(&self, _target: &Target, _field: PaneField) -> Result<Option<String>, TransportError> {
+        Ok(None)
+    }
+
+    fn liveness(&self, _pane: &PaneId) -> Result<PaneLiveness, TransportError> {
+        Ok(PaneLiveness::Live)
+    }
+
+    fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
+        Ok(vec![PaneInfo {
+            pane_id: PaneId::new("%leader"),
+            session: SessionName::new("team-acceptance"),
+            window_index: None,
+            window_name: Some(WindowName::new("leader")),
+            pane_index: None,
+            tty: None,
+            current_command: Some("claude".to_string()),
+            current_path: None,
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+    }
+
+    fn has_session(&self, _session: &SessionName) -> Result<bool, TransportError> {
+        Ok(true)
+    }
+
+    fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
+        Ok(vec![WindowName::new("leader")])
+    }
+
+    fn set_session_env(
+        &self,
+        _session: &SessionName,
+        _key: &str,
+        _value: &str,
+    ) -> Result<SetEnvOutcome, TransportError> {
+        Ok(SetEnvOutcome::Applied)
+    }
+
+    fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn kill_window(&self, _target: &Target) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn attach_session(&self, _session: &SessionName) -> Result<AttachOutcome, TransportError> {
+        Ok(AttachOutcome::Attached)
+    }
+}

package/crates/team-agent/src/messaging/tests/mod.rs

@@ -292,6 +292,8 @@ impl Drop for EnvGuardMsg {
 
 mod basic;
 mod e23;
+mod leader_channel;
+mod leader_inject_acceptance;
 mod main_preserved;
 mod runtime;
 mod spine;

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -18,12 +18,11 @@ fn pane_info(pane_id: &str, session: &str, window: &str) -> PaneInfo {
 }
 
 // ════════════════════════════════════════════════════════════════════════
-// GROUP E — _fail_leader_delivery: bug-52 fallback-log semantics. ok=True but
-// status=FallbackLog (NOT a real submit). leader.py:394-436.
+// GROUP E — legacy diagnostics may only advance an existing durable row.
 // ════════════════════════════════════════════════════════════════════════
 
 #[test]
-fn fail_leader_delivery_returns_fallback_log_ok_true_not_submitted() {
+fn fail_leader_delivery_without_message_id_does_not_invent_a_row() {
     let ws = tmp_ws("faillead");
     let payload = json(serde_json::json!({
         "to": "leader", "content": "hi", "sender": "coordinator"
@@ -35,12 +34,17 @@ fn fail_leader_delivery_returns_fallback_log_ok_true_not_submitted() {
         Some("No direct leader tmux pane is attached. Run team-agent attach-leader."),
     )
     .unwrap();
-    // leader.py:423-431 — ok True, status fallback_log, channel fallback_inbox.
-    assert!(out.ok);
+    assert!(!out.ok);
     assert_eq!(out.status, DeliveryStatus::FallbackLog);
     assert_eq!(out.reason, Some(DeliveryRefusal::LeaderNotAttached));
-    // The audit must be distinguishable from a real submit (Delivered).
+    assert_eq!(out.message_id, None);
     assert_ne!(out.status, DeliveryStatus::Delivered);
+    let store = MessageStore::open(&ws).unwrap();
+    let connection = crate::db::schema::open_db(store.db_path()).unwrap();
+    let rows: i64 = connection
+        .query_row("select count(*) from messages", [], |row| row.get(0))
+        .unwrap();
+    assert_eq!(rows, 0, "diagnostics cannot create a fallback message row");
 }
 
 // ════════════════════════════════════════════════════════════════════════
@@ -439,28 +443,30 @@ fn message_not_silently_stuck_accepted_when_coordinator_dead() {
     )
     .unwrap();
 
-    assert!(!out.ok);
-    assert_eq!(out.status, DeliveryStatus::Degraded);
-    assert_eq!(out.message_status.0, "degraded");
+    assert!(out.ok, "durable persistence is the send success boundary");
+    assert_eq!(out.status, DeliveryStatus::Blocked);
+    assert_eq!(out.message_status.0, "queued_coordinator_unavailable");
+    assert!(out.message_id.as_deref().is_some_and(|id| id.starts_with("msg_")));
     assert_eq!(out.reason, Some(DeliveryRefusal::CoordinatorUnavailable));
     assert!(
         out.verification
             .as_deref()
             .is_some_and(|warning| warning.contains("coordinator is not running")),
-        "N38 warning must explain why the message was not queued; out={out:?}"
+        "N38 warning must explain the durable retry blocker; out={out:?}"
     );
     let store = MessageStore::open(&ws).unwrap();
     let conn = crate::db::schema::open_db(store.db_path()).unwrap();
-    let accepted: i64 = conn
+    let blocked: i64 = conn
         .query_row(
-            "select count(*) from messages where status = 'accepted'",
+            "select count(*) from messages where status = 'queued_coordinator_unavailable' \
+             and error = 'coordinator_unavailable' and delivered_at is null",
             [],
             |row| row.get(0),
         )
         .unwrap();
     assert_eq!(
-        accepted, 0,
-        "dead coordinator send must not strand an accepted row"
+        blocked, 1,
+        "dead coordinator send must park exactly one durable, non-delivered row"
     );
     let events = EventLog::new(&ws).tail(20).unwrap();
     assert!(
@@ -470,7 +476,7 @@ fn message_not_silently_stuck_accepted_when_coordinator_dead() {
                 && event
                     .get("message_queued")
                     .and_then(serde_json::Value::as_bool)
-                    == Some(false)
+                    == Some(true)
         }),
         "send.coordinator_unavailable event must be durable; events={events:?}"
     );
@@ -2914,9 +2920,15 @@ fn gate054_rebind_required_status_refuses_leader_delivery_without_cross_server_p
 }
 
 #[test]
-fn gate054_attached_status_still_delivers_when_pane_is_live() {
+fn gate054_attached_status_still_accepts_when_pane_is_live() {
     // Companion negative: prove the new status gate does NOT over-refuse when
     // `status="attached"` and the workspace-canonical socket has the pane.
+    // Injection-case revision: transport submit success is NOT a provider
+    // receipt, so the old `delivered` pin was a false-positive lock
+    // (MUST-10: physical submit is the framework's fact; acceptance is the
+    // provider's). The un-refused path now parks the SAME row in
+    // submitted_pending_acceptance until a provider receipt or retry
+    // schedule advances it.
     let ws = tmp_ws("gate054ok");
     let store = store_for(&ws);
     let log = EventLog::new(&ws);
@@ -2945,7 +2957,16 @@ fn gate054_attached_status_still_delivers_when_pane_is_live() {
         out.ok,
         "0.5.4 gate054: status='attached' with a live pane must not be over-refused: {out:?}"
     );
-    assert_eq!(out.message_status.0, "delivered");
+    assert_eq!(
+        transport.inject_targets().len(),
+        1,
+        "gate054: exactly one physical inject must have happened (MUST-10 anchor)"
+    );
+    assert_eq!(
+        out.message_status.0, "submitted_pending_acceptance",
+        "gate054 (injection-case revision): a successful physical submit without a provider \
+         receipt must park as submitted_pending_acceptance, never claim delivered: {out:?}"
+    );
 }
 
 // ════════════════════════════════════════════════════════════════════════

package/crates/team-agent/src/messaging/watchers.rs

@@ -49,6 +49,7 @@ pub fn notify_result_watchers(
             if idx == 0 {
                 primary_watcher_id = Some(watcher_id.to_string());
                 notices.push(deliver_primary_watcher(
+                    workspace,
                     &conn,
                     &store,
                     event_log,
@@ -112,6 +113,7 @@ fn watcher_matches(
 }
 
 fn deliver_primary_watcher(
+    workspace: &Path,
     conn: &rusqlite::Connection,
     store: &MessageStore,
     event_log: &EventLog,
@@ -178,7 +180,10 @@ fn deliver_primary_watcher(
         );
     }
     let content = format_result_watcher_notification(result);
-    let message_id = store.create_message(
+    let super::PersistResolution::Persisted(persisted) = super::persist::persist_internal_send(
+        workspace,
+        super::InternalSendKind::Watcher,
+        watcher.get("owner_team_id").and_then(|v| v.as_str()),
         result_task,
         watcher
             .get("leader_id")
@@ -188,8 +193,13 @@ fn deliver_primary_watcher(
         &content,
         None,
         false,
-        watcher.get("owner_team_id").and_then(|v| v.as_str()),
-    )?;
+        None,
+        super::InitialDisposition::Accepted,
+    )?
+    else {
+        unreachable!("watcher notifications do not accept caller-supplied ids")
+    };
+    let message_id = persisted.message_id;
     let claim = store.claim_leader_notification_delivery(NotificationClaimParams {
         result_id,
         owner_team_id: watcher.get("owner_team_id").and_then(|v| v.as_str()),

package/crates/team-agent/src/redaction.rs

@@ -13,6 +13,7 @@ const SENSITIVE_FAMILIES: [&str; 7] = [
     "SECRET",
     "CREDENTIAL",
 ];
+const SENSITIVE_KEYS: [&str; 2] = ["authorization_header", "credential_blob"];
 const STRUCTURAL_KEYS: [&str; 13] = [
     "active_team_key",
     "cohort_key",
@@ -31,7 +32,7 @@ const STRUCTURAL_KEYS: [&str; 13] = [
 
 static SHELL_ASSIGNMENT: LazyLock<Regex> = LazyLock::new(|| {
     Regex::new(
-        r#"(?i)(?P<prefix>^|[\s\[,;('"])(?P<key>[a-z_][a-z0-9_]*)=(?P<value>'[^']*'|"[^"]*"|[^\s,\]\[};)]+)"#,
+        r#"(?i)(?P<prefix>^|[\s\[,;('"])(?P<key>[a-z_][a-z0-9_.]*)=(?P<value>'[^']*'|"[^"]*"|[^\s,\]\[};)]+)"#,
     )
     .expect("shell assignment redaction regex")
 });
@@ -41,6 +42,13 @@ static URL_USERINFO: LazyLock<Regex> = LazyLock::new(|| {
         .expect("URL userinfo redaction regex")
 });
 
+static BEARER_TOKEN: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r"(?i)(?P<prefix>\bBearer[ \t]+)(?P<token>[A-Za-z0-9][-A-Za-z0-9._~+/=]{14,}[-A-Za-z0-9._~+/=])",
+    )
+    .expect("Bearer token redaction regex")
+});
+
 pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Value {
     match value {
         Value::Object(object) => Value::Object(
@@ -49,6 +57,8 @@ pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Va
                 .map(|(key, value)| {
                     let value = if is_sensitive_env_key(key) {
                         Value::String(REDACTED.to_string())
+                    } else if is_argument_array_key(key) {
+                        redact_argument_array(value)
                     } else {
                         redact_external_value(value)
                     };
@@ -62,6 +72,33 @@ pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Va
     }
 }
 
+fn is_argument_array_key(key: &str) -> bool {
+    key.eq_ignore_ascii_case("argv") || key.eq_ignore_ascii_case("command")
+}
+
+fn redact_argument_array(value: &Value) -> Value {
+    let Value::Array(values) = value else {
+        return redact_external_value(value);
+    };
+    let mut redact_next = false;
+    Value::Array(
+        values
+            .iter()
+            .map(|value| {
+                if redact_next {
+                    redact_next = false;
+                    return Value::String(REDACTED.to_string());
+                }
+                if let Some(flag) = value.as_str().filter(|flag| flag.starts_with('-')) {
+                    let normalized = flag.trim_start_matches('-').replace('-', "_");
+                    redact_next = is_sensitive_env_key(&normalized);
+                }
+                redact_external_value(value)
+            })
+            .collect(),
+    )
+}
+
 pub(crate) fn redact_external_text(text: &str) -> String {
     let assignments = SHELL_ASSIGNMENT.replace_all(text, |captures: &Captures<'_>| {
         let key = captures.name("key").map_or("", |value| value.as_str());
@@ -90,18 +127,28 @@ pub(crate) fn redact_external_text(text: &str) -> String {
         };
         format!("{prefix}{key}={quote}{safe_value}{quote}")
     });
-    URL_USERINFO
+    let urls = URL_USERINFO
         .replace_all(&assignments, "${scheme}[REDACTED]@")
+        .into_owned();
+    BEARER_TOKEN
+        .replace_all(&urls, "${prefix}[REDACTED]")
         .into_owned()
 }
 
 fn is_sensitive_env_key(key: &str) -> bool {
+    let key = key.rsplit('.').next().unwrap_or(key);
     if STRUCTURAL_KEYS
         .iter()
         .any(|structural| key.eq_ignore_ascii_case(structural))
     {
         return false;
     }
+    if SENSITIVE_KEYS
+        .iter()
+        .any(|sensitive| key.eq_ignore_ascii_case(sensitive))
+    {
+        return true;
+    }
     let key = key.to_ascii_uppercase();
     SENSITIVE_FAMILIES
         .iter()
@@ -182,4 +229,27 @@ mod tests {
         assert!(text.contains("https://[REDACTED]@proxy.invalid:8443/path"));
         assert_eq!(twice, once);
     }
+
+    #[test]
+    fn event_log_shapes_are_masked_without_hiding_structural_arguments() {
+        let marker = "synthetic-event-log-marker";
+        let input = json!({
+            "authorization_header": format!("Bearer {marker}"),
+            "credential_blob": marker,
+            "config": format!("mcp_servers.demo.env.OPENAI_API_KEY=\"{marker}\""),
+            "argv": ["provider", "--api-key", marker, "--team-key", "current"],
+            "command": ["provider", "--authorization-header", marker, "--auth-mode", "subscription"],
+        });
+
+        let redacted = redact_external_value(&input);
+
+        assert!(!redacted.to_string().contains(marker));
+        assert_eq!(redacted["authorization_header"], REDACTED);
+        assert_eq!(redacted["credential_blob"], REDACTED);
+        assert_eq!(redacted["argv"][2], REDACTED);
+        assert_eq!(redacted["argv"][4], "current");
+        assert_eq!(redacted["command"][2], REDACTED);
+        assert_eq!(redacted["command"][4], "subscription");
+        assert_eq!(redact_external_value(&redacted), redacted);
+    }
 }