@team-agent/installer 0.5.50 → 0.5.52

package/crates/team-agent/src/state/persist.rs

@@ -33,7 +33,7 @@ use crate::event_log::EventLog;
 use crate::model::paths::runtime_dir;
 use crate::state::identity::{migrate_state_identity, SystemEnv};
 use crate::state::json_truthy;
-use crate::state::projection::team_state_key;
+use crate::state::projection::{team_state_key, CURRENT_TEAM_ALIAS};
 use crate::state::StateError;
 
 /// `state.py:26-29`:agent session-state 归一字段(setdefault None)。
@@ -47,7 +47,7 @@ const SESSION_STATE_FIELDS: [&str; 6] = [
 ];
 const LIVE_TOPOLOGY_FIELDS: [&str; 5] =
     ["pane_id", "pane_pid", "window", "spawned_at", "spawn_epoch"];
-const ROSTER_STUB_ALLOWLIST: [&str; 15] = [
+const ROSTER_STUB_ALLOWLIST: [&str; 16] = [
     "agent_id",
     "provider",
     "auth_mode",
@@ -57,6 +57,7 @@ const ROSTER_STUB_ALLOWLIST: [&str; 15] = [
     "profile",
     "_profile_dir",
     "dynamic_role_file",
+    "role_source_ownership",
     "effort",
     "forked_from",
     "managed_mcp_config",
@@ -204,7 +205,24 @@ impl Drop for RuntimeLock {
 /// `save_runtime_state`(bug-084)。`state` 是 state.json 的内存 Value(插入序保留)。
 /// 注:Python 在此还调 `_migrate_state_identity`(identity slice 落地后接入;本 slice 不改 state 内容)。
 pub fn save_runtime_state(workspace: &Path, state: &Value) -> Result<(), StateError> {
-    save_runtime_state_with_merge_options(workspace, state, &[], None, &[], &[])
+    save_runtime_state_with_merge_options(workspace, state, &[], None, &[], None, &[], None)
+}
+
+pub(crate) fn save_runtime_state_with_receiver_authority(
+    workspace: &Path,
+    state: &Value,
+    receiver_team_key: &str,
+) -> Result<(), StateError> {
+    save_runtime_state_with_merge_options(
+        workspace,
+        state,
+        &[],
+        None,
+        &[],
+        None,
+        &[],
+        Some(receiver_team_key),
+    )
 }
 
 pub(crate) fn save_runtime_state_reapplying_after_conflict<F>(
@@ -229,9 +247,19 @@ where
 pub(crate) fn save_runtime_state_with_lifecycle_topology_authority(
     workspace: &Path,
     state: &Value,
+    topology_team_key: &str,
     agent_ids: &[&str],
 ) -> Result<(), StateError> {
-    save_runtime_state_with_merge_options(workspace, state, &[], None, &[], agent_ids)
+    save_runtime_state_with_merge_options(
+        workspace,
+        state,
+        &[],
+        None,
+        &[],
+        Some(topology_team_key),
+        agent_ids,
+        None,
+    )
 }
 
 pub(crate) fn save_runtime_state_with_lifecycle_topology_authority_and_capture_backfill_skip(
@@ -247,7 +275,9 @@ pub(crate) fn save_runtime_state_with_lifecycle_topology_authority_and_capture_b
         &[],
         Some(skip_capture_backfill_team_key),
         skip_capture_backfill_agent_ids,
+        Some(skip_capture_backfill_team_key),
         topology_agent_ids,
+        None,
     )
 }
 
@@ -256,7 +286,16 @@ pub(crate) fn save_runtime_state_with_deleted_agents(
     state: &Value,
     deleted_agent_ids: &[&str],
 ) -> Result<(), StateError> {
-    save_runtime_state_with_merge_options(workspace, state, deleted_agent_ids, None, &[], &[])
+    save_runtime_state_with_merge_options(
+        workspace,
+        state,
+        deleted_agent_ids,
+        None,
+        &[],
+        None,
+        &[],
+        None,
+    )
 }
 
 pub(crate) fn save_runtime_state_with_team_tombstoned_agents(
@@ -271,7 +310,9 @@ pub(crate) fn save_runtime_state_with_team_tombstoned_agents(
         &[],
         Some(tombstoned_team_key),
         tombstoned_agent_ids,
+        None,
         &[],
+        None,
     )
 }
 
@@ -287,7 +328,9 @@ pub(crate) fn save_runtime_state_with_team_tombstone_lifecycle_topology_authorit
         &[],
         Some(tombstoned_team_key),
         agent_ids,
+        Some(tombstoned_team_key),
         agent_ids,
+        None,
     )
 }
 
@@ -297,7 +340,9 @@ fn save_runtime_state_with_merge_options(
     deleted_agent_ids: &[&str],
     skip_capture_backfill_team_key: Option<&str>,
     skip_capture_backfill_agent_ids: &[&str],
+    topology_update_team_key: Option<&str>,
     topology_update_agent_ids: &[&str],
+    receiver_update_team_key: Option<&str>,
 ) -> Result<(), StateError> {
     let path = runtime_state_path(workspace);
     // Python `state.py:497`:先对入参 state 跑 `_migrate_state_identity`(就地填缺失 leader uuid)。
@@ -361,10 +406,19 @@ fn save_runtime_state_with_merge_options(
             .filter(|id| !id.is_empty())
             .map(str::to_string)
             .collect::<BTreeSet<_>>();
-        let topology_updates = topology_update_agent_ids
-            .iter()
-            .copied()
-            .filter(|id| !id.is_empty())
+        let topology_updates = topology_update_team_key
+            .into_iter()
+            .flat_map(|team_key| {
+                topology_update_agent_ids
+                    .iter()
+                    .copied()
+                    .filter(|id| !id.is_empty())
+                    .map(move |agent_id| (team_key.to_string(), agent_id.to_string()))
+            })
+            .collect::<BTreeSet<_>>();
+        let receiver_updates = receiver_update_team_key
+            .into_iter()
+            .filter(|team_key| !team_key.is_empty())
             .map(str::to_string)
             .collect::<BTreeSet<_>>();
         apply_persist_merge_contract(
@@ -374,6 +428,7 @@ fn save_runtime_state_with_merge_options(
             skip_capture_backfill_team_key,
             &skip_capture_backfill,
             &topology_updates,
+            &receiver_updates,
         )?;
     }
     // Stage 3 save-output strip second pass (defence-in-depth): after the
@@ -439,7 +494,8 @@ fn apply_persist_merge_contract(
     deleted_agent_ids: &BTreeSet<String>,
     skip_capture_backfill_team_key: Option<&str>,
     skip_capture_backfill_agent_ids: &BTreeSet<String>,
-    topology_update_agent_ids: &BTreeSet<String>,
+    topology_updates: &BTreeSet<(String, String)>,
+    receiver_updates: &BTreeSet<String>,
 ) -> Result<(), StateError> {
     // A0/R1: the projection gate only guards the TOP-LEVEL passes (top-level agents and
     // the top-level<->active-team cross projections depend on which team is active); the
@@ -447,10 +503,19 @@ fn apply_persist_merge_contract(
     // even when another process flipped session_name/active_team_key between this
     // writer's load and save.
     let projection_matches = same_runtime_projection(incoming, latest);
-    let top_level_team = Some(team_state_key(incoming)).or_else(|| Some(team_state_key(latest)));
+    let top_level_team = incoming
+        .get("active_team_key")
+        .and_then(Value::as_str)
+        .filter(|key| !key.is_empty())
+        .map(str::to_string)
+        .or_else(|| Some(team_state_key(incoming)))
+        .or_else(|| Some(team_state_key(latest)));
     let skip_top_level_capture_backfill =
         should_skip_capture_backfill(top_level_team.as_deref(), skip_capture_backfill_team_key);
     if projection_matches {
+        let topology_update_agent_ids =
+            topology_updates_for_team(topology_updates, top_level_team.as_deref());
+        preserve_latest_retired_agents(incoming, latest, &topology_update_agent_ids)?;
         // 0.5.26 (§7.3): top-level projection uses the incoming root state's
         // implicit "alive" shape (top-level agents are always the active team).
         // Passing `None` for team lifecycle keeps historical behavior when the
@@ -462,7 +527,7 @@ fn apply_persist_merge_contract(
             deleted_agent_ids,
             skip_top_level_capture_backfill,
             skip_capture_backfill_agent_ids,
-            topology_update_agent_ids,
+            &topology_update_agent_ids,
             None,
         )?;
         // Stage 3c (identity-boundary unified plan, architect direction
@@ -499,6 +564,21 @@ fn apply_persist_merge_contract(
             let Some(incoming_entry) = incoming_teams.get_mut(team) else {
                 continue;
             };
+            // Intentional semantic split with
+            // `projection::resolve_runtime_team_scope`: that selector checks
+            // alive/terminal state, but this lock-held merge cannot depend on
+            // the mutable alive view. A change to either CURRENT_TEAM_ALIAS
+            // mapping must evaluate the other. The legacy physical alias gets
+            // active-team authority; every real sibling remains self-scoped.
+            let authority_team = if team == CURRENT_TEAM_ALIAS {
+                top_level_team.as_deref()
+            } else {
+                Some(team.as_str())
+            };
+            let topology_update_agent_ids =
+                topology_updates_for_team(topology_updates, authority_team);
+            let receiver_update_authoritative =
+                authority_team.is_some_and(|team_key| receiver_updates.contains(team_key));
             let projection = format!("teams.{team}.agents");
             // 0.5.26 (`.team/artifacts/stale-team-saveconflict-locate.md` §7.3):
             // decide the containing team's aliveness from BOTH sides — a shutdown
@@ -513,6 +593,11 @@ fn apply_persist_merge_contract(
                         .map(|_| crate::state::projection::team_is_alive_candidate(incoming_entry))
                         .unwrap_or(true),
             );
+            preserve_latest_retired_agents(
+                incoming_entry,
+                latest_entry,
+                &topology_update_agent_ids,
+            )?;
             merge_agent_projection(
                 &projection,
                 incoming_entry.get_mut("agents"),
@@ -520,16 +605,79 @@ fn apply_persist_merge_contract(
                 deleted_agent_ids,
                 should_skip_capture_backfill(Some(team), skip_capture_backfill_team_key),
                 skip_capture_backfill_agent_ids,
-                topology_update_agent_ids,
+                &topology_update_agent_ids,
                 team_alive,
             )?;
-            preserve_latest_ownership_fields(incoming_entry, latest_entry);
+            preserve_latest_ownership_fields(
+                incoming_entry,
+                latest_entry,
+                receiver_update_authoritative,
+            );
             preserve_latest_endpoint_convergence_fields(incoming_entry, latest_entry);
         }
     }
     Ok(())
 }
 
+fn topology_updates_for_team(
+    topology_updates: &BTreeSet<(String, String)>,
+    team_key: Option<&str>,
+) -> BTreeSet<String> {
+    topology_updates
+        .iter()
+        .filter(|(authority_team, _)| Some(authority_team.as_str()) == team_key)
+        .map(|(_, agent_id)| agent_id.clone())
+        .collect()
+}
+
+fn preserve_latest_retired_agents(
+    incoming: &mut Value,
+    latest: &Value,
+    topology_update_agent_ids: &BTreeSet<String>,
+) -> Result<(), StateError> {
+    // A persisted retirement is lifecycle authority, so an ordinary stale
+    // writer (notably a coordinator tick captured before remove-agent) cannot
+    // resurrect its old roster row. Explicit lifecycle topology writers are
+    // the only override: AddAgent uses that existing authority to consume the
+    // tombstone, while remove itself supplies the newer tombstone as incoming.
+    let retired = latest
+        .get("agent_lifecycle")
+        .and_then(Value::as_object)
+        .into_iter()
+        .flat_map(|entries| entries.iter())
+        .filter(|(agent_id, entry)| {
+            !topology_update_agent_ids.contains(*agent_id)
+                && entry.get("state").and_then(Value::as_str) == Some("retired")
+        })
+        .map(|(agent_id, entry)| (agent_id.clone(), entry.clone()))
+        .collect::<Vec<_>>();
+    if retired.is_empty() {
+        return Ok(());
+    }
+    let Some(incoming) = incoming.as_object_mut() else {
+        return Err(StateError::SaveFailed(
+            "incoming runtime projection is not an object".to_string(),
+        ));
+    };
+    if let Some(agents) = incoming.get_mut("agents").and_then(Value::as_object_mut) {
+        for (agent_id, _) in &retired {
+            agents.remove(agent_id);
+        }
+    }
+    let lifecycle = incoming
+        .entry("agent_lifecycle".to_string())
+        .or_insert_with(|| serde_json::json!({}));
+    let Some(lifecycle) = lifecycle.as_object_mut() else {
+        return Err(StateError::SaveFailed(
+            "incoming agent_lifecycle is not an object".to_string(),
+        ));
+    };
+    for (agent_id, entry) in retired {
+        lifecycle.insert(agent_id, entry);
+    }
+    Ok(())
+}
+
 /// 0.5.x Windows portability Batch 7 F6: copy `latest.transport.shim`
 /// into `incoming` if the incoming save omitted it. The coordinator's
 /// `conpty_shim::finalize` writes `state.transport.shim = {pid,
@@ -577,8 +725,12 @@ fn should_skip_capture_backfill(
     }
 }
 
-fn preserve_latest_ownership_fields(incoming: &mut Value, latest: &Value) {
-    if !latest_has_preferable_ownership(incoming, latest) {
+fn preserve_latest_ownership_fields(
+    incoming: &mut Value,
+    latest: &Value,
+    receiver_update_authoritative: bool,
+) {
+    if !latest_has_preferable_ownership(incoming, latest, receiver_update_authoritative) {
         return;
     }
     let Some(incoming_obj) = incoming.as_object_mut() else {
@@ -642,13 +794,19 @@ fn endpoint_convergence_epoch(state: &Value) -> Option<u64> {
         .and_then(Value::as_u64)
 }
 
-fn latest_has_preferable_ownership(incoming: &Value, latest: &Value) -> bool {
+fn latest_has_preferable_ownership(
+    incoming: &Value,
+    latest: &Value,
+    receiver_update_authoritative: bool,
+) -> bool {
     let latest_epoch = ownership_epoch(latest);
     let incoming_epoch = ownership_epoch(incoming);
     if latest_epoch > incoming_epoch {
         return true;
     }
-    latest_epoch == incoming_epoch && !ownership_attached(incoming) && ownership_attached(latest)
+    latest_epoch == incoming_epoch
+        && !receiver_update_authoritative
+        && (ownership_attached(latest) || !ownership_attached(incoming))
 }
 
 fn ownership_epoch(state: &Value) -> u64 {
@@ -1808,8 +1966,13 @@ mod tests {
                 "other": {"agent_id": "other", "provider": "codex", "window": "old-other", "pane_id": "%old", "spawn_epoch": 1}
             },
         });
-        let err = save_runtime_state_with_lifecycle_topology_authority(&ws, &incoming, &["target"])
-            .expect_err("authorized target must not hide other agent conflict");
+        let err = save_runtime_state_with_lifecycle_topology_authority(
+            &ws,
+            &incoming,
+            "team-a",
+            &["target"],
+        )
+        .expect_err("authorized target must not hide other agent conflict");
         assert!(matches!(err, StateError::SaveConflict(_)));
         assert!(err.to_string().contains("agent_id=other"));
     }
@@ -1834,7 +1997,13 @@ mod tests {
                 "target": {"agent_id": "target", "provider": "codex", "status": "stopped"}
             },
         });
-        save_runtime_state_with_lifecycle_topology_authority(&ws, &incoming, &["target"]).unwrap();
+        save_runtime_state_with_lifecycle_topology_authority(
+            &ws,
+            &incoming,
+            "team-a",
+            &["target"],
+        )
+        .unwrap();
         let target = read_state(&ws).pointer("/agents/target").cloned().unwrap();
         assert!(
             target.get("pane_id").is_none(),
@@ -2417,4 +2586,98 @@ mod tests {
             "0.4.6: partial poisoned latest must not resurrect cleared session_id; got {alpha}"
         );
     }
+
+    fn ownership_projection(session: &str, tty: &str) -> Value {
+        let entry = json!({
+            "session_name": "team-authority-merge",
+            "owner_epoch": 10,
+            "team_owner": {"status": "attached", "owner_epoch": 10, "pane_id": "%7"},
+            "leader_receiver": {
+                "status": "attached",
+                "owner_epoch": 10,
+                "pane_id": "%7",
+                "session_name": session,
+                "pane_tty": tty
+            }
+        });
+        let mut state = json!({
+            "session_name": "team-authority-merge",
+            "active_team_key": "team-authority-merge",
+            "teams": {
+                "team-authority-merge": entry.clone(),
+                "sibling": entry.clone()
+            }
+        });
+        state["teams"][CURRENT_TEAM_ALIAS] = entry;
+        state
+    }
+
+    #[test]
+    fn equal_epoch_ordinary_writer_preserves_latest_receiver_observation() {
+        let mut incoming = ownership_projection("stale-session", "/dev/stale");
+        let latest = ownership_projection("refreshed-session", "/dev/refreshed");
+        apply_persist_merge_contract(
+            &mut incoming,
+            &latest,
+            &BTreeSet::new(),
+            None,
+            &BTreeSet::new(),
+            &BTreeSet::new(),
+            &BTreeSet::new(),
+        )
+        .unwrap();
+
+        assert_eq!(
+            incoming.pointer("/teams/team-authority-merge/leader_receiver/session_name"),
+            Some(&json!("refreshed-session"))
+        );
+        assert_eq!(
+            incoming.pointer("/teams/team-authority-merge/leader_receiver/pane_tty"),
+            Some(&json!("/dev/refreshed"))
+        );
+        assert_eq!(
+            incoming["teams"][CURRENT_TEAM_ALIAS]["leader_receiver"]["session_name"],
+            json!("refreshed-session")
+        );
+        assert_eq!(
+            incoming["teams"]["sibling"]["leader_receiver"]["session_name"],
+            json!("refreshed-session")
+        );
+    }
+
+    #[test]
+    fn equal_epoch_receiver_authority_keeps_incoming_refresh() {
+        let mut incoming = ownership_projection("refreshed-session", "/dev/refreshed");
+        let latest = ownership_projection("stale-session", "/dev/stale");
+        let receiver_updates = BTreeSet::from(["team-authority-merge".to_string()]);
+        apply_persist_merge_contract(
+            &mut incoming,
+            &latest,
+            &BTreeSet::new(),
+            None,
+            &BTreeSet::new(),
+            &BTreeSet::new(),
+            &receiver_updates,
+        )
+        .unwrap();
+
+        assert_eq!(
+            incoming.pointer("/teams/team-authority-merge/leader_receiver/session_name"),
+            Some(&json!("refreshed-session"))
+        );
+        assert_eq!(
+            incoming.pointer("/teams/team-authority-merge/leader_receiver/pane_tty"),
+            Some(&json!("/dev/refreshed"))
+        );
+        assert_eq!(
+            incoming["teams"][CURRENT_TEAM_ALIAS]["leader_receiver"]["session_name"],
+            json!("refreshed-session"),
+            "current alias must inherit the active team's receiver authority"
+        );
+        assert_eq!(
+            incoming["teams"]["sibling"]["leader_receiver"]["session_name"],
+            json!("stale-session"),
+            "team-scoped receiver authority must not overwrite a sibling's latest tuple"
+        );
+    }
 }