@team-agent/installer 0.5.51 → 0.5.53

package/crates/team-agent/src/mcp_server/wire.rs

@@ -33,6 +33,7 @@ pub fn tools_contract() -> Vec<Value> {
         McpTool::StopAgent,
         McpTool::ResetAgent,
         McpTool::AddAgent,
+        McpTool::CloneAgent,
         McpTool::ForkAgent,
         McpTool::RequestHuman,
         McpTool::StuckList,
@@ -378,6 +379,7 @@ fn tool_contract(tool: McpTool) -> Value {
         McpTool::StopAgent => ("Stop a running worker.", vec!["agent_id"]),
         McpTool::ResetAgent => ("Reset one worker to a fresh session.", vec!["agent_id", "discard_session"]),
         McpTool::AddAgent => ("Add a first-class worker from a role file.", vec!["new_agent_id", "role_file_path"]),
+        McpTool::CloneAgent => ("Clone a worker role into a fresh provider session.", vec!["source_agent_id", "as_agent_id"]),
         McpTool::ForkAgent => ("Fork a running worker.", vec!["source_agent_id", "as_agent_id"]),
         McpTool::RequestHuman => ("Ask the leader or user for human input.", vec!["question"]),
         McpTool::StuckList => ("List manually suppressed idle alerts.", Vec::new()),
@@ -522,6 +524,23 @@ fn tool_properties(tool: McpTool) -> serde_json::Map<String, Value> {
                 string_property("Optional display label."),
             );
         }
+        McpTool::CloneAgent => {
+            insert_property(
+                &mut properties,
+                "source_agent_id",
+                string_property("Agent id to clone from."),
+            );
+            insert_property(
+                &mut properties,
+                "as_agent_id",
+                string_property("Agent id for the cloned worker."),
+            );
+            insert_property(
+                &mut properties,
+                "label",
+                string_property("Optional display label."),
+            );
+        }
         McpTool::RequestHuman => {
             insert_property(
                 &mut properties,
@@ -591,13 +610,7 @@ pub(crate) fn dispatch_tool(
         McpTool::SendMessage => {
             let target = message_target_from_value(args.get("to"));
             let content = args.get("content").and_then(Value::as_str).unwrap_or("");
-            let outcome = tools.send_message(
-                &target,
-                content,
-                None,
-                None,
-                None,
-            )?;
+            let outcome = tools.send_message(&target, content, None, None, None)?;
             match outcome {
                 SendOutcome::WorkerAccepted { .. } => Ok(ToolOk {
                     fields: object_fields(outcome.to_value()),
@@ -668,6 +681,15 @@ pub(crate) fn dispatch_tool(
                 .unwrap_or(""),
             args.get("label").and_then(Value::as_str),
         ),
+        McpTool::CloneAgent => tools.clone_agent(
+            args.get("source_agent_id")
+                .and_then(Value::as_str)
+                .unwrap_or(""),
+            args.get("as_agent_id")
+                .and_then(Value::as_str)
+                .unwrap_or(""),
+            args.get("label").and_then(Value::as_str),
+        ),
         McpTool::RequestHuman => tools.request_human(
             args.get("question").and_then(Value::as_str).unwrap_or(""),
             args.get("task_id").and_then(Value::as_str),
@@ -695,6 +717,7 @@ fn scope_ceiling_tool(tool: McpTool) -> bool {
             | McpTool::GetTeamStatus
             | McpTool::StopAgent
             | McpTool::ResetAgent
+            | McpTool::CloneAgent
             | McpTool::ForkAgent
     )
 }

package/crates/team-agent/src/messaging/delivery.rs

@@ -223,16 +223,41 @@ pub fn deliver_pending_message(
         return observe_pending_leader_acceptance(store, event_log, state, message_id);
     }
     if message.recipient == "leader" && message.status == "queued_until_leader_attach" {
-        if leader_receiver_status(state) != Some("attached") {
+        let Some(receiver) = leader_receiver_value(state) else {
             return Ok(leader_acceptance_pending_outcome(
                 message_id,
                 "queued_until_leader_attach",
             ));
-        }
+        };
+        let channel_transport =
+            delivery_transport_for_recipient(workspace, transport, state, "leader");
+        let resolution = crate::messaging::resolve_live_leader_channel(
+            workspace,
+            receiver,
+            channel_transport.as_transport(),
+        );
+        let crate::messaging::LeaderChannelResolution::Live(channel) = resolution else {
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "queued_until_leader_attach",
+            ));
+        };
+        let metadata_drift = match &channel {
+            crate::messaging::LiveLeaderChannel::DirectTmux(channel) => {
+                channel.metadata_drift.clone()
+            }
+            crate::messaging::LiveLeaderChannel::CodexAppServer(_) => Vec::new(),
+        };
         store.mark(message_id, "accepted", None)?;
         event_log.write(
             "leader_receiver.mailbox_requeued",
-            serde_json::json!({"message_id": message_id}),
+            serde_json::json!({
+                "message_id": message_id,
+                "channel_live": true,
+                "metadata_drift": metadata_drift,
+                "requeue_trigger": "delivery_revalidation",
+                "revalidated_at": chrono::Utc::now().to_rfc3339(),
+            }),
         )?;
     }
     let attempt = if store.claim_for_delivery(message_id)? {
@@ -252,88 +277,108 @@ pub fn deliver_pending_message(
         });
     };
     if message.recipient == "leader" {
-        if let Some(receiver) = leader_receiver_value(state) {
-            if let Some(outcome) = leader_receiver_transport_conflict_outcome(
+        let Some(receiver) = leader_receiver_value(state) else {
+            store.mark(message_id, "failed", Some("leader_not_attached"))?;
+            event_log.write(
+                "leader_receiver.delivery_blocked",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "sender": message.sender,
+                    "reason": "leader_receiver_not_attached",
+                    "error": "leader_not_attached",
+                    "channel_reason": "receiver_missing",
+                    "channel": "rebind_required",
+                    "action": "run team-agent attach-leader or team-agent takeover",
+                    "status": "unbound",
+                }),
+            )?;
+            return Ok(DeliveryOutcome {
+                ok: false,
+                status: DeliveryStatus::Refused,
+                message_status: MessageStatusShadow("failed".to_string()),
+                message_id: Some(message_id.to_string()),
+                verification: Some(
+                    "run team-agent attach-leader or team-agent takeover".to_string(),
+                ),
+                stage: None,
+                reason: Some(DeliveryRefusal::LeaderNotAttached),
+                channel: Some("rebind_required".to_string()),
+            });
+        };
+        if let Some(outcome) = leader_receiver_transport_conflict_outcome(
+            store,
+            event_log,
+            message_id,
+            receiver,
+            &message.sender,
+        )? {
+            return Ok(outcome);
+        }
+        let channel_transport =
+            delivery_transport_for_recipient(workspace, transport, state, "leader");
+        match crate::messaging::resolve_live_leader_channel(
+            workspace,
+            receiver,
+            channel_transport.as_transport(),
+        ) {
+            crate::messaging::LeaderChannelResolution::Live(_) => {}
+            crate::messaging::LeaderChannelResolution::ProbeFailed(error) => {
+                store.mark(message_id, "target_resolved", Some(&error))?;
+                return Ok(DeliveryOutcome {
+                    ok: false,
+                    status: DeliveryStatus::Degraded,
+                    message_status: MessageStatusShadow("target_resolved".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some(error),
+                    stage: None,
+                    reason: None,
+                    channel: Some("rebind_required".to_string()),
+                });
+            }
+            crate::messaging::LeaderChannelResolution::Unbound(reason) => {
+                let receiver_status = receiver
+                    .get("status")
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or("unbound");
+                store.mark(message_id, "failed", Some("leader_not_attached"))?;
+                event_log.write(
+                    "leader_receiver.delivery_blocked",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "sender": message.sender,
+                        "reason": "leader_receiver_not_attached",
+                        "error": "leader_not_attached",
+                        "channel_reason": format!("{reason:?}"),
+                        "channel": "rebind_required",
+                        "action": "run team-agent attach-leader or team-agent takeover",
+                        "status": receiver_status,
+                    }),
+                )?;
+                return Ok(DeliveryOutcome {
+                    ok: false,
+                    status: DeliveryStatus::Refused,
+                    message_status: MessageStatusShadow("failed".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some(
+                        "run team-agent attach-leader or team-agent takeover".to_string(),
+                    ),
+                    stage: None,
+                    reason: Some(DeliveryRefusal::LeaderNotAttached),
+                    channel: Some("rebind_required".to_string()),
+                });
+            }
+        }
+        if crate::codex_app_server::receiver_is_app_server(receiver) {
+            return deliver_leader_via_app_server(
                 store,
                 event_log,
+                state,
                 message_id,
-                receiver,
-                &message.sender,
-            )? {
-                return Ok(outcome);
-            }
-            // 0.5.4 gate054 cross-team leak fix: a `leader_receiver.status`
-            // other than `"attached"` (restart demotes killed-session receivers
-            // to `"rebind_required"` — lifecycle/restart/rebuild.rs:1311) MUST
-            // refuse delivery before any pane injection or cross-server pane-id
-            // probing. Without this gate, a stale receiver on team A's socket
-            // could otherwise fall back to the same pane id on the main tmux
-            // server (delivery.rs:1150-1201) and inject A's leader traffic into
-            // team B's leader pane. See .team/artifacts/0.5.4-gate-crossteam-notify-triage.md.
-            if let Some(status) = leader_receiver_status(state) {
-                if status != "attached" {
-                    store.mark(message_id, "failed", Some("leader_not_attached"))?;
-                    event_log.write(
-                        "leader_receiver.delivery_blocked",
-                        serde_json::json!({
-                            "message_id": message_id,
-                            "sender": message.sender,
-                            "reason": "leader_receiver_not_attached",
-                            "channel": "rebind_required",
-                            "action": "run team-agent attach-leader or team-agent takeover",
-                            "status": status,
-                        }),
-                    )?;
-                    return Ok(DeliveryOutcome {
-                        ok: false,
-                        status: DeliveryStatus::Refused,
-                        message_status: MessageStatusShadow("failed".to_string()),
-                        message_id: Some(message_id.to_string()),
-                        verification: Some(
-                            "run team-agent attach-leader or team-agent takeover".to_string(),
-                        ),
-                        stage: None,
-                        reason: Some(DeliveryRefusal::LeaderNotAttached),
-                        channel: Some("rebind_required".to_string()),
-                    });
-                }
-            }
-            if crate::codex_app_server::receiver_is_app_server(receiver) {
-                return deliver_leader_via_app_server(
-                    store,
-                    event_log,
-                    state,
-                    message_id,
-                    &message,
-                    canonical_owner_team_id.as_deref(),
-                );
-            }
+                &message,
+                canonical_owner_team_id.as_deref(),
+            );
         }
     }
-    if message.recipient == "leader" && leader_receiver_has_noncanonical_tmux_socket(state) {
-        store.mark(message_id, "failed", Some("leader_not_attached"))?;
-        event_log.write(
-            "leader_receiver.delivery_blocked",
-            serde_json::json!({
-                "message_id": message_id,
-                "sender": message.sender,
-                "reason": "leader_not_attached",
-                "channel": "rebind_required",
-                "action": "run team-agent claim-leader or team-agent takeover",
-                "error": "leader_receiver.tmux_socket is not a canonical full socket path",
-            }),
-        )?;
-        return Ok(DeliveryOutcome {
-            ok: false,
-            status: DeliveryStatus::Refused,
-            message_status: MessageStatusShadow("failed".to_string()),
-            message_id: Some(message_id.to_string()),
-            verification: Some("run team-agent claim-leader or team-agent takeover".to_string()),
-            stage: None,
-            reason: Some(DeliveryRefusal::LeaderNotAttached),
-            channel: Some("rebind_required".to_string()),
-        });
-    }
     let delivery_transport =
         delivery_transport_for_recipient(workspace, transport, state, &message.recipient);
     let transport = delivery_transport.as_transport();
@@ -369,32 +414,6 @@ pub fn deliver_pending_message(
             });
         }
     };
-    // Do not inject queued leader messages into a synthetic "leader" window.
-    if message.recipient == "leader"
-        && !leader_receiver_pane_is_usable(transport, state, &live_targets)
-    {
-        store.mark(message_id, "failed", Some("leader_not_attached"))?;
-        event_log.write(
-            "leader_receiver.delivery_blocked",
-            serde_json::json!({
-                "message_id": message_id,
-                "sender": message.sender,
-                "reason": "leader_not_attached",
-                "channel": "rebind_required",
-                "action": "run team-agent claim-leader or team-agent takeover",
-            }),
-        )?;
-        return Ok(DeliveryOutcome {
-            ok: false,
-            status: DeliveryStatus::Refused,
-            message_status: MessageStatusShadow("failed".to_string()),
-            message_id: Some(message_id.to_string()),
-            verification: Some("run team-agent claim-leader or team-agent takeover".to_string()),
-            stage: None,
-            reason: Some(DeliveryRefusal::LeaderNotAttached),
-            channel: Some("rebind_required".to_string()),
-        });
-    }
     let resolved = resolve_inject_target(state, &message.recipient, transport, &live_targets);
     if let Some(stale) = resolved.stale_binding.as_ref() {
         event_log.write(
@@ -1533,32 +1552,6 @@ fn leader_receiver_pane_binding(state: &serde_json::Value) -> Option<PaneSocketB
         .or_else(|| only_team_entry(state).and_then(leader_receiver_pane_binding_in_state))
 }
 
-/// `state` is "usable" for leader delivery when the bound `leader_receiver.pane_id`
-/// is present and alive (in `live_targets` or `liveness` probe returns not-Dead).
-///
-/// **0.3.24 excision (U1-A real-machine RED v2)**: the wave-2 session+window drift
-/// fallback was removed. Drift now fails loudly as `leader_not_attached` —
-/// see resolve_inject_target and `.team/artifacts/u1-a-realmachine-v2-fix-or-excise.md`.
-fn leader_receiver_pane_is_usable(
-    transport: &dyn Transport,
-    state: &serde_json::Value,
-    live_targets: &[PaneInfo],
-) -> bool {
-    let Some(pane_id) = leader_receiver_pane_id(state) else {
-        return false;
-    };
-    if live_targets
-        .iter()
-        .any(|target| target.pane_id.as_str() == pane_id)
-    {
-        return true;
-    }
-    !matches!(
-        transport.liveness(&PaneId::new(pane_id)),
-        Ok(PaneLiveness::Dead)
-    )
-}
-
 /// 0.5.x Phase 1d Batch 4: the `Owned` variant now carries a boxed
 /// `Transport` trait object rather than a concrete `TmuxBackend`. All
 /// existing leader-fallback sites still supply a `TmuxBackend` here
@@ -1631,7 +1624,7 @@ fn delivery_transport_for_recipient<'a>(
         // switching transports on a match can cross the team/tmux boundary and
         // inject A's leader traffic into team B's leader pane. If the pane is
         // absent on the recorded endpoint, let the downstream
-        // `leader_receiver_pane_is_usable` guard produce `rebind_required`
+        // the shared leader-channel resolver produce `rebind_required`
         // instead of falling back to another server.
         let endpoint_backend = crate::transport_factory::tmux_endpoint_transport(socket);
         DeliveryTransport::Owned(Box::new(endpoint_backend))
@@ -1673,20 +1666,6 @@ fn leader_receiver_tmux_socket(state: &serde_json::Value) -> Option<&str> {
     leader_receiver_field(state, "tmux_socket")
 }
 
-/// 0.5.4 gate054 cross-team leak fix: read the bound `leader_receiver.status`
-/// through the same team-scope resolution as [`leader_receiver_tmux_socket`].
-/// Restart marks demoted receivers as `"rebind_required"`
-/// (lifecycle/restart/rebuild.rs:1311); delivery must refuse before injecting
-/// or cross-server pane-id probing (delivery.rs:1150-1201).
-fn leader_receiver_status(state: &serde_json::Value) -> Option<&str> {
-    leader_receiver_field(state, "status")
-}
-
-fn leader_receiver_has_noncanonical_tmux_socket(state: &serde_json::Value) -> bool {
-    leader_receiver_tmux_socket(state)
-        .is_some_and(|socket| socket != "default" && !std::path::Path::new(socket).is_absolute())
-}
-
 fn leader_receiver_field<'a>(state: &'a serde_json::Value, field: &str) -> Option<&'a str> {
     leader_receiver_field_in_state(state, field)
         .or_else(|| {

package/crates/team-agent/src/messaging/leader_channel.rs

@@ -0,0 +1,198 @@
+use std::path::Path;
+
+use serde_json::Value;
+
+use crate::codex_app_server::AppServerBinding;
+use crate::transport::{PaneInfo, Transport};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LiveLeaderChannel {
+    DirectTmux(DirectTmuxLeaderChannel),
+    CodexAppServer(AppServerBinding),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DirectTmuxLeaderChannel {
+    pub pane_id: String,
+    pub tmux_socket: Option<String>,
+    pub observed: PaneInfo,
+    pub metadata_drift: Vec<&'static str>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LeaderChannelResolution {
+    Live(LiveLeaderChannel),
+    Unbound(LeaderChannelUnbound),
+    ProbeFailed(String),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LeaderChannelUnbound {
+    ReceiverNotAttached,
+    TransportConflict,
+    MissingPaneId,
+    NonCanonicalTmuxSocket,
+    EndpointMismatch,
+    PaneNotLive,
+    PaneWorkspaceMismatch,
+    AppServerBindingInvalid,
+}
+
+/// Resolve the canonical receiver's live physical channel without mutating
+/// ownership. For direct tmux, `(absolute socket, pane id)` plus an available
+/// pane cwd inside the target workspace is the authority. Session/window/tty/
+/// fingerprint are observations and can only report drift.
+pub fn resolve_live_leader_channel(
+    workspace: &Path,
+    receiver: &Value,
+    transport: &dyn Transport,
+) -> LeaderChannelResolution {
+    if receiver
+        .get("status")
+        .and_then(Value::as_str)
+        .is_some_and(|status| status != "attached")
+    {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::ReceiverNotAttached);
+    }
+    if receiver_transport_conflicts(receiver) {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::TransportConflict);
+    }
+    if crate::codex_app_server::receiver_is_app_server(receiver) {
+        return match crate::codex_app_server::binding_from_receiver(receiver) {
+            Ok(binding) => {
+                LeaderChannelResolution::Live(LiveLeaderChannel::CodexAppServer(binding))
+            }
+            Err(_) => {
+                LeaderChannelResolution::Unbound(LeaderChannelUnbound::AppServerBindingInvalid)
+            }
+        };
+    }
+
+    let Some(pane_id) = receiver
+        .get("pane_id")
+        .and_then(Value::as_str)
+        .filter(|pane| !pane.is_empty())
+    else {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::MissingPaneId);
+    };
+    let tmux_socket = receiver
+        .get("tmux_socket")
+        .and_then(Value::as_str)
+        .filter(|socket| !socket.is_empty());
+    if tmux_socket.is_some_and(|socket| !std::path::Path::new(socket).is_absolute()) {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::NonCanonicalTmuxSocket);
+    }
+    if let Some(expected) = tmux_socket {
+        if transport.tmux_endpoint().as_deref() != Some(expected) {
+            return LeaderChannelResolution::Unbound(LeaderChannelUnbound::EndpointMismatch);
+        }
+    }
+    let targets = match transport.list_targets() {
+        Ok(targets) => targets,
+        Err(error) => return LeaderChannelResolution::ProbeFailed(error.to_string()),
+    };
+    let Some(observed) = targets
+        .into_iter()
+        .find(|target| target.pane_id.as_str() == pane_id)
+    else {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneNotLive);
+    };
+    if observed
+        .current_path
+        .as_deref()
+        .is_some_and(|path| !path_is_in_workspace(path, workspace))
+        && !explicit_claim_authority_matches(workspace, receiver, &observed)
+    {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch);
+    }
+    let metadata_drift = receiver_metadata_drift(receiver, &observed);
+    LeaderChannelResolution::Live(LiveLeaderChannel::DirectTmux(DirectTmuxLeaderChannel {
+        pane_id: pane_id.to_string(),
+        tmux_socket: tmux_socket.map(str::to_string),
+        observed,
+        metadata_drift,
+    }))
+}
+
+fn explicit_claim_authority_matches(
+    workspace: &Path,
+    receiver: &Value,
+    observed: &PaneInfo,
+) -> bool {
+    if string_field(receiver, "scope_authority") != Some("explicit_claim") {
+        return false;
+    }
+    let Some(authorized_workspace) = string_field(receiver, "authorized_team_workspace") else {
+        return false;
+    };
+    if canonical_path(Path::new(authorized_workspace)) != canonical_path(workspace) {
+        return false;
+    }
+    let Some(recorded_nonce) = string_field(receiver, "binding_nonce") else {
+        return false;
+    };
+    observed
+        .leader_env
+        .get(crate::tmux_backend::PANE_BINDING_NONCE_METADATA_KEY)
+        .filter(|nonce| !nonce.is_empty())
+        .is_some_and(|live_nonce| live_nonce == recorded_nonce)
+}
+
+pub(crate) fn path_is_in_workspace(path: &Path, workspace: &Path) -> bool {
+    let path = canonical_path(path);
+    let workspace = canonical_path(workspace);
+    path == workspace || path.starts_with(workspace)
+}
+
+fn canonical_path(path: &Path) -> std::path::PathBuf {
+    path.canonicalize().unwrap_or_else(|_| path.to_path_buf())
+}
+
+fn receiver_transport_conflicts(receiver: &Value) -> bool {
+    let mode = receiver.get("mode").and_then(Value::as_str);
+    let transport_kind = receiver.get("transport_kind").and_then(Value::as_str);
+    matches!((mode, transport_kind), (Some(mode), Some(kind)) if !mode.is_empty() && !kind.is_empty() && mode != kind)
+}
+
+fn receiver_metadata_drift(receiver: &Value, observed: &PaneInfo) -> Vec<&'static str> {
+    let mut drift = Vec::new();
+    if string_field(receiver, "session_name")
+        .is_some_and(|expected| expected != observed.session.as_str())
+    {
+        drift.push("session_name");
+    }
+    if string_field(receiver, "window_name").is_some_and(|expected| {
+        observed.window_name.as_ref().map(|value| value.as_str()) != Some(expected)
+    }) {
+        drift.push("window_name");
+    }
+    if string_field(receiver, "pane_tty")
+        .is_some_and(|expected| observed.tty.as_deref() != Some(expected))
+    {
+        drift.push("pane_tty");
+    }
+    let observed_fingerprint = format!(
+        "{}|{}|{}|{}",
+        observed.session.as_str(),
+        observed
+            .window_index
+            .map_or_else(String::new, |value| value.to_string()),
+        observed
+            .pane_index
+            .map_or_else(String::new, |value| value.to_string()),
+        observed.tty.as_deref().unwrap_or("")
+    );
+    if string_field(receiver, "fingerprint")
+        .is_some_and(|expected| expected != observed_fingerprint)
+    {
+        drift.push("fingerprint");
+    }
+    drift
+}
+
+fn string_field<'a>(value: &'a Value, key: &str) -> Option<&'a str> {
+    value
+        .get(key)
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+}