@team-agent/installer 0.5.52 → 0.5.53

package/crates/team-agent/src/provider/session_scan/codex.rs

@@ -1,37 +1,47 @@
-use super::{CaptureSessionContext, CapturedSessionCandidate};
+pub(super) fn parse_spawned_at(raw: &str) -> Option<std::time::SystemTime> {
+    chrono::DateTime::parse_from_rfc3339(raw)
+        .ok()
+        .map(|dt| std::time::SystemTime::from(dt.with_timezone(&chrono::Utc)))
+}
 
-pub(super) fn apply_spawned_at_filter(
-    out: &mut Vec<CapturedSessionCandidate>,
-    context: &CaptureSessionContext,
+pub(super) fn rollout_created_at(path: &std::path::Path) -> Option<std::time::SystemTime> {
+    created_at_from_rollout_uuid(path)
+        .or_else(|| created_at_from_rollout_head(path))
+        .or_else(|| created_at_from_rollout_filename(path))
+}
+
+pub(super) fn retain_spawn_cwd(
+    context: &super::CaptureSessionContext,
+    out: &mut Vec<super::CapturedSessionCandidate>,
 ) {
-    let Some(spawned_at) = context.spawned_at.as_deref().and_then(parse_spawned_at) else {
-        return;
-    };
-    let grace = std::time::Duration::from_secs(5);
-    let cutoff = spawned_at.checked_sub(grace).unwrap_or(spawned_at);
     out.retain(|candidate| {
-        let path = match candidate.captured.rollout_path.as_ref() {
-            Some(p) => p.as_path(),
-            None => return false,
+        let Some(path) = candidate.captured.rollout_path.as_ref() else {
+            return false;
         };
-        match codex_rollout_created_at(path) {
-            Some(created_at) => created_at >= cutoff,
-            None => std::fs::metadata(path)
-                .and_then(|meta| meta.modified())
-                .map(|mtime| mtime >= cutoff)
-                .unwrap_or(false),
-        }
+        let Ok(text) =
+            super::common::read_head_text(path.as_path(), super::common::CAPTURE_HEAD_BYTES)
+        else {
+            return false;
+        };
+        super::common::parse_session_records(&text)
+            .iter()
+            .filter_map(super::common::record_cwd)
+            .any(|cwd| {
+                super::common::paths_equivalent(std::path::Path::new(&cwd), &context.spawn_cwd)
+            })
     });
 }
 
-pub(super) fn parse_spawned_at(raw: &str) -> Option<std::time::SystemTime> {
-    chrono::DateTime::parse_from_rfc3339(raw)
-        .ok()
-        .map(|dt| std::time::SystemTime::from(dt.with_timezone(&chrono::Utc)))
-}
-
-fn codex_rollout_created_at(path: &std::path::Path) -> Option<std::time::SystemTime> {
-    created_at_from_rollout_head(path).or_else(|| created_at_from_rollout_filename(path))
+fn created_at_from_rollout_uuid(path: &std::path::Path) -> Option<std::time::SystemTime> {
+    let name = path.file_name()?.to_str()?;
+    let stem = name.strip_suffix(".jsonl")?;
+    let uuid = stem.get(stem.len().checked_sub(36)?..)?;
+    if uuid.as_bytes().get(14).copied() != Some(b'7') {
+        return None;
+    }
+    let millis =
+        u64::from_str_radix(&format!("{}{}", uuid.get(..8)?, uuid.get(9..13)?), 16).ok()?;
+    std::time::SystemTime::UNIX_EPOCH.checked_add(std::time::Duration::from_millis(millis))
 }
 
 fn created_at_from_rollout_head(path: &std::path::Path) -> Option<std::time::SystemTime> {
@@ -77,6 +87,10 @@ fn created_at_from_rollout_filename(path: &std::path::Path) -> Option<std::time:
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::provider::session_scan::{common, CaptureSessionContext, CapturedSessionCandidate};
+    use crate::provider::Provider;
+    use crate::provider::{CaptureVia, CapturedSession, Confidence, RolloutPath, SessionId};
+    use std::path::PathBuf;
 
     #[test]
     fn parse_spawned_at_rfc3339_roundtrips_and_rejects_junk() {
@@ -84,4 +98,107 @@ mod tests {
         assert!(parse_spawned_at("not-a-date").is_none());
         assert!(parse_spawned_at("").is_none());
     }
+
+    fn candidate(path: PathBuf, session_id: &str) -> CapturedSessionCandidate {
+        CapturedSessionCandidate {
+            captured: CapturedSession {
+                session_id: Some(SessionId::new(session_id)),
+                rollout_path: Some(RolloutPath::new(path)),
+                captured_via: CaptureVia::FsWatch,
+                attribution_confidence: Confidence::High,
+                spawn_cwd: PathBuf::from("/tmp"),
+            },
+            embedded_agent_id: None,
+            positive_agent_id_match: false,
+            agent_path_match: false,
+        }
+    }
+
+    #[test]
+    fn spawned_at_filter_rejects_prior_round_and_accepts_current_rollout() {
+        let dir =
+            std::env::temp_dir().join(format!("ta-codex-spawn-filter-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let stale =
+            dir.join("rollout-2026-07-21T22-45-40-11111111-1111-4111-8111-111111111111.jsonl");
+        let fresh =
+            dir.join("rollout-2026-07-21T23-20-01-22222222-2222-4222-8222-222222222222.jsonl");
+        std::fs::write(&stale, "{}\n").unwrap();
+        std::fs::write(&fresh, "{}\n").unwrap();
+        let context = CaptureSessionContext {
+            agent_id: "worker".to_string(),
+            spawn_cwd: dir.clone(),
+            pane_id: None,
+            pane_pid: None,
+            spawned_at: Some("2026-07-21T23:20:00+00:00".to_string()),
+            expected_session_id: None,
+            provider_projects_root: None,
+        };
+        let mut out = vec![
+            candidate(stale, "11111111-1111-4111-8111-111111111111"),
+            candidate(fresh.clone(), "22222222-2222-4222-8222-222222222222"),
+        ];
+        common::apply_spawned_at_filter(Provider::Codex, &context, &mut out);
+        assert_eq!(out.len(), 1);
+        assert_eq!(
+            out[0].captured.rollout_path.as_ref().unwrap().as_path(),
+            fresh
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn spawned_at_filter_fails_closed_with_an_invalid_boundary() {
+        let mut out = vec![candidate(PathBuf::from("/tmp/old.jsonl"), "old")];
+        let mut context = CaptureSessionContext {
+            agent_id: "worker".to_string(),
+            spawn_cwd: PathBuf::from("/tmp"),
+            pane_id: None,
+            pane_pid: None,
+            spawned_at: None,
+            expected_session_id: None,
+            provider_projects_root: None,
+        };
+        common::apply_spawned_at_filter(Provider::Codex, &context, &mut out);
+        assert_eq!(out.len(), 1, "legacy direct scan has no cohort boundary");
+
+        context.spawned_at = Some("not-a-date".to_string());
+        common::apply_spawned_at_filter(Provider::Codex, &context, &mut out);
+        assert!(out.is_empty());
+    }
+
+    #[test]
+    fn unique_window_uses_created_at_not_active_sibling_mtime() {
+        let dir =
+            std::env::temp_dir().join(format!("ta-codex-created-window-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let stale =
+            dir.join("rollout-2026-07-22T03-12-13-11111111-1111-4111-8111-111111111111.jsonl");
+        let fresh =
+            dir.join("rollout-2026-07-22T03-15-30-22222222-2222-4222-8222-222222222222.jsonl");
+        std::fs::write(&stale, "{}\n").unwrap();
+        std::fs::write(&fresh, "{}\n").unwrap();
+        let context = CaptureSessionContext {
+            agent_id: "clone".to_string(),
+            spawn_cwd: dir.clone(),
+            pane_id: None,
+            pane_pid: None,
+            spawned_at: Some("2026-07-22T03:15:29+00:00".to_string()),
+            expected_session_id: None,
+            provider_projects_root: None,
+        };
+        let mut out = vec![
+            candidate(stale, "11111111-1111-4111-8111-111111111111"),
+            candidate(fresh.clone(), "22222222-2222-4222-8222-222222222222"),
+        ];
+        common::apply_spawn_time_window_if_unique(Provider::Codex, &context, &mut out);
+        assert_eq!(out.len(), 1);
+        assert_eq!(
+            out[0].captured.rollout_path.as_ref().unwrap().as_path(),
+            fresh
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }

package/crates/team-agent/src/provider/session_scan/common.rs

@@ -129,7 +129,41 @@ pub(super) fn parse_candidate_files(
     out
 }
 
+/// Reject provider files older than the persisted process-cohort boundary.
+pub(super) fn apply_spawned_at_filter(
+    provider: Provider,
+    context: &CaptureSessionContext,
+    out: &mut Vec<CapturedSessionCandidate>,
+) {
+    let Some(raw_spawned_at) = context.spawned_at.as_deref() else {
+        // Legacy direct capture_session_id callers have no cohort boundary;
+        // the canonical runtime capture path rejects such rows before scan.
+        return;
+    };
+    let Some(spawned_at) = super::codex::parse_spawned_at(raw_spawned_at) else {
+        out.clear();
+        return;
+    };
+    out.retain(|candidate| {
+        let Some(path) = candidate.captured.rollout_path.as_ref() else {
+            return false;
+        };
+        if matches!(provider, Provider::Codex) {
+            return super::codex::rollout_created_at(path.as_path())
+                .is_some_and(|created_at| created_at >= spawned_at);
+        }
+        candidate_mtime(path.as_path()).is_some_and(|mtime| mtime >= spawned_at)
+    });
+}
+
+fn candidate_mtime(path: &Path) -> Option<std::time::SystemTime> {
+    std::fs::metadata(path)
+        .and_then(|meta| meta.modified())
+        .ok()
+}
+
 pub(super) fn apply_spawn_time_window_if_unique(
+    provider: Provider,
     context: &CaptureSessionContext,
     out: &mut Vec<CapturedSessionCandidate>,
 ) {
@@ -150,12 +184,11 @@ pub(super) fn apply_spawn_time_window_if_unique(
                 .captured
                 .rollout_path
                 .as_ref()
-                .and_then(|p| {
-                    std::fs::metadata(p.as_path())
-                        .and_then(|m| m.modified())
-                        .ok()
+                .and_then(|p| match provider {
+                    Provider::Codex => super::codex::rollout_created_at(p.as_path()),
+                    _ => candidate_mtime(p.as_path()),
                 })
-                .is_some_and(|mtime| mtime >= spawned_at)
+                .is_some_and(|created_at| created_at >= spawned_at)
         })
         .cloned()
         .collect();
@@ -366,7 +399,7 @@ pub(super) fn record_cwd(record: &serde_json::Value) -> Option<String> {
         .map(ToString::to_string)
 }
 
-fn paths_equivalent(left: &Path, right: &Path) -> bool {
+pub(super) fn paths_equivalent(left: &Path, right: &Path) -> bool {
     if left == right {
         return true;
     }

package/crates/team-agent/src/provider/session_scan/copilot.rs

@@ -1,14 +1,14 @@
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
 use crate::provider::types::{CaptureVia, CapturedSession, Confidence, RolloutPath, SessionId};
 
 use super::{CaptureSessionContext, CapturedSessionCandidate};
 
 pub(super) fn scan_session_store(context: &CaptureSessionContext) -> Vec<CapturedSessionCandidate> {
-    let Some(home) = std::env::var_os("HOME").map(PathBuf::from) else {
+    let Ok(home) = crate::provider::adapters::copilot_fork::copilot_home() else {
         return Vec::new();
     };
-    let db_path = home.join(".copilot").join("session-store.db");
+    let db_path = home.join("session-store.db");
     if !db_path.exists() {
         return Vec::new();
     }
@@ -59,6 +59,7 @@ mod tests {
     #![allow(clippy::unwrap_used)]
 
     use super::*;
+    use std::path::PathBuf;
     use std::sync::atomic::{AtomicU64, Ordering};
 
     struct HomeGuard {
@@ -175,6 +176,49 @@ mod tests {
         let _ = std::fs::remove_dir_all(&base);
     }
 
+    #[test]
+    #[serial_test::serial(env)]
+    fn copilot_scanner_respects_copilot_home() {
+        let base = tmp_root("custom-home");
+        let copilot_home = base.join("isolated-copilot");
+        std::fs::create_dir_all(&copilot_home).unwrap();
+        let worker_id = "1142c4c2-0000-4000-8000-000000000001";
+        let conn = rusqlite::Connection::open(copilot_home.join("session-store.db")).unwrap();
+        conn.execute(
+            "create table sessions (id text primary key, cwd text, updated_at integer)",
+            [],
+        )
+        .unwrap();
+        conn.execute(
+            "insert into sessions (id, cwd, updated_at) values (?1, '/tmp/ws', 1)",
+            [worker_id],
+        )
+        .unwrap();
+        drop(conn);
+        let previous = std::env::var_os("COPILOT_HOME");
+        std::env::set_var("COPILOT_HOME", &copilot_home);
+        let ctx = CaptureSessionContext {
+            agent_id: "worker".to_string(),
+            spawn_cwd: base.join("ws"),
+            pane_id: None,
+            pane_pid: None,
+            spawned_at: None,
+            expected_session_id: Some(SessionId::new(worker_id)),
+            provider_projects_root: None,
+        };
+        let out = scan_session_store(&ctx);
+        assert_eq!(out.len(), 1);
+        assert_eq!(
+            out[0].captured.session_id.as_ref().unwrap().as_str(),
+            worker_id
+        );
+        match previous {
+            Some(value) => std::env::set_var("COPILOT_HOME", value),
+            None => std::env::remove_var("COPILOT_HOME"),
+        }
+        let _ = std::fs::remove_dir_all(&base);
+    }
+
     #[test]
     #[serial_test::serial(env)]
     fn copilot_no_expected_same_cwd_only_leader_row_returns_empty_not_leader() {

package/crates/team-agent/src/provider/session_scan.rs

@@ -64,16 +64,16 @@ pub(crate) fn scan_session_candidates_once(
 
     let candidates = common::candidate_session_files(provider, context)?;
     let mut out = common::parse_candidate_files(provider, context, candidates);
-
     if matches!(provider, Provider::Codex) {
-        codex::apply_spawned_at_filter(&mut out, context);
+        codex::retain_spawn_cwd(context, &mut out);
     }
+    common::apply_spawned_at_filter(provider, context, &mut out);
 
     if matches!(provider, Provider::Claude | Provider::ClaudeCode) {
         return claude::apply_expected_session_filter(context, out);
     }
 
-    common::apply_spawn_time_window_if_unique(context, &mut out);
+    common::apply_spawn_time_window_if_unique(provider, context, &mut out);
     common::sort_expected_first_if_needed(context, &mut out);
     Ok(out)
 }

package/crates/team-agent/src/provider/tests/copilot_fork.rs

@@ -0,0 +1,191 @@
+use std::path::Path;
+
+use rusqlite::Connection;
+
+#[test]
+#[serial_test::serial(env)]
+fn copilot_fork_copies_isolated_home_and_rekeys_every_session_table() {
+    use crate::provider::adapters::copilot_fork::materialize_copilot_fork;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    static COUNTER: AtomicU64 = AtomicU64::new(0);
+    let root = std::env::temp_dir().join(format!(
+        "ta-copilot-fork-{}-{}",
+        std::process::id(),
+        COUNTER.fetch_add(1, Ordering::Relaxed)
+    ));
+    let source_home = root.join("source-home");
+    let workspace = root.join("workspace");
+    std::fs::create_dir_all(&workspace).unwrap();
+    let source = SessionId::new("11111111-2222-4333-8444-555555555555");
+    seed_copilot_fork_fixture(&source_home, source.as_str(), None);
+    let source_events = std::fs::read(
+        source_home
+            .join("session-state")
+            .join(source.as_str())
+            .join("events.jsonl"),
+    )
+    .unwrap();
+    let previous = std::env::var_os("COPILOT_HOME");
+    std::env::set_var("COPILOT_HOME", &source_home);
+
+    let materialized = materialize_copilot_fork(&workspace, "fork-a", &source).unwrap();
+    assert_ne!(materialized.session_id(), &source);
+    assert!(materialized
+        .home()
+        .starts_with(workspace.join(".team/runtime/provider-session-forks/copilot/fork-a")));
+    let new_id = materialized.session_id().as_str();
+    let target_state = materialized.home().join("session-state").join(new_id);
+    assert!(target_state.is_dir());
+    assert_eq!(
+        std::fs::read_to_string(target_state.join("events.jsonl")).unwrap(),
+        format!("{{\"session_id\":\"{new_id}\"}}\n")
+    );
+    let per_session = Connection::open(target_state.join("session.db")).unwrap();
+    let recipient: String = per_session
+        .query_row(
+            "select recipient_session_id from inbox_entries",
+            [],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(recipient, new_id);
+
+    let central = Connection::open(materialized.home().join("session-store.db")).unwrap();
+    assert_eq!(session_count(&central, "sessions", "id", new_id), 1);
+    assert_eq!(
+        session_count(&central, "sessions", "id", source.as_str()),
+        0
+    );
+    for table in [
+        "turns",
+        "checkpoints",
+        "session_files",
+        "session_refs",
+        "forge_trajectory_events",
+        "search_index",
+    ] {
+        assert_eq!(session_count(&central, table, "session_id", new_id), 1);
+        assert_eq!(
+            session_count(&central, table, "session_id", source.as_str()),
+            0
+        );
+    }
+    assert_eq!(
+        std::fs::read(
+            source_home
+                .join("session-state")
+                .join(source.as_str())
+                .join("events.jsonl")
+        )
+        .unwrap(),
+        source_events,
+        "fork must not mutate source backing"
+    );
+
+    restore_env("COPILOT_HOME", previous);
+    let _ = std::fs::remove_dir_all(root);
+}
+
+#[test]
+#[serial_test::serial(env)]
+fn copilot_fork_fails_closed_when_a_required_session_table_is_missing() {
+    let root = std::env::temp_dir().join(format!("ta-copilot-fork-missing-{}", std::process::id()));
+    let source_home = root.join("source-home");
+    let workspace = root.join("workspace");
+    std::fs::create_dir_all(&workspace).unwrap();
+    let source = SessionId::new("aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee");
+    seed_copilot_fork_fixture(&source_home, source.as_str(), Some("session_refs"));
+    let previous = std::env::var_os("COPILOT_HOME");
+    std::env::set_var("COPILOT_HOME", &source_home);
+
+    let error = crate::provider::adapters::copilot_fork::materialize_copilot_fork(
+        &workspace, "fork-b", &source,
+    )
+    .unwrap_err();
+    assert!(error.to_string().contains("session_refs"), "{error}");
+    let managed_parent = workspace.join(".team/runtime/provider-session-forks/copilot/fork-b");
+    assert!(
+        !managed_parent.exists() || std::fs::read_dir(managed_parent).unwrap().next().is_none(),
+        "failed materialization must leave no clone home"
+    );
+
+    restore_env("COPILOT_HOME", previous);
+    let _ = std::fs::remove_dir_all(root);
+}
+
+fn seed_copilot_fork_fixture(home: &Path, source: &str, omitted: Option<&str>) {
+    let state = home.join("session-state").join(source);
+    std::fs::create_dir_all(state.join("checkpoints")).unwrap();
+    std::fs::write(
+        state.join("workspace.yaml"),
+        format!("session_id: {source}\n"),
+    )
+    .unwrap();
+    std::fs::write(
+        state.join("events.jsonl"),
+        format!("{{\"session_id\":\"{source}\"}}\n"),
+    )
+    .unwrap();
+    let session_db = Connection::open(state.join("session.db")).unwrap();
+    session_db
+        .execute_batch(
+            "create table inbox_entries (id text primary key, recipient_session_id text not null);",
+        )
+        .unwrap();
+    session_db
+        .execute("insert into inbox_entries values ('one', ?1)", [source])
+        .unwrap();
+
+    let db = Connection::open(home.join("session-store.db")).unwrap();
+    db.execute_batch(
+        "create table sessions (id text primary key);
+         create table turns (id integer primary key, session_id text not null);
+         create table checkpoints (id integer primary key, session_id text not null);
+         create table session_files (id integer primary key, session_id text not null);
+         create table session_refs (id integer primary key, session_id text not null);
+         create table forge_trajectory_events (id integer primary key, session_id text not null);
+         create virtual table search_index using fts5(content, session_id unindexed);",
+    )
+    .unwrap();
+    db.execute("insert into sessions values (?1)", [source])
+        .unwrap();
+    for table in [
+        "turns",
+        "checkpoints",
+        "session_files",
+        "session_refs",
+        "forge_trajectory_events",
+    ] {
+        if omitted != Some(table) {
+            db.execute(
+                &format!("insert into {table} (session_id) values (?1)"),
+                [source],
+            )
+            .unwrap();
+        } else {
+            db.execute(&format!("drop table {table}"), []).unwrap();
+        }
+    }
+    db.execute(
+        "insert into search_index (content, session_id) values ('x', ?1)",
+        [source],
+    )
+    .unwrap();
+}
+
+fn session_count(conn: &Connection, table: &str, column: &str, id: &str) -> i64 {
+    conn.query_row(
+        &format!("select count(*) from {table} where {column} = ?1"),
+        [id],
+        |row| row.get(0),
+    )
+    .unwrap()
+}
+
+fn restore_env(key: &str, value: Option<std::ffi::OsString>) {
+    match value {
+        Some(value) => std::env::set_var(key, value),
+        None => std::env::remove_var(key),
+    }
+}

package/crates/team-agent/src/provider/tests.rs

@@ -29,3 +29,4 @@ include!("tests/classify.rs");
 include!("tests/idle.rs");
 include!("tests/adapter.rs");
 include!("tests/faults.rs");
+include!("tests/copilot_fork.rs");

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -12,7 +12,9 @@ use std::os::unix::net::UnixListener;
 use std::path::Path;
 use std::sync::{Arc, Mutex};
 
-use super::{CommandOutput, CommandRunner, RealCommandRunner, TmuxBackend};
+use super::{
+    CommandOutput, CommandRunner, RealCommandRunner, TmuxBackend, PANE_BINDING_NONCE_METADATA_KEY,
+};
 use crate::model::enums::PaneLiveness;
 use crate::transport::{
     normalize_capture, tmux_capture_argv, tmux_query_argv, tmux_send_keys_argv, tmux_spawn_argv,
@@ -395,10 +397,7 @@ fn spawn_first_frames_via_new_session_builder_and_parses_pane_id() {
     let pane_inventory = "%3\tteamsess\t0\tw1\t0\t/dev/ttys003\tnode\t1\t/work/dir\t1\t0\t123\n";
     let (be, rec) = backend_with(
         MockResp::Out(ok("")),
-        vec![
-            MockResp::Out(ok("%3\n")),
-            MockResp::Out(ok(pane_inventory)),
-        ],
+        vec![MockResp::Out(ok("%3\n")), MockResp::Out(ok(pane_inventory))],
     );
     let s = SessionName::new("teamsess");
     let w = WindowName::new("w1");
@@ -443,10 +442,7 @@ fn spawn_into_frames_via_new_window_builder() {
     let pane_inventory = "%4\tteamsess\t1\tw2\t0\t/dev/ttys004\tnode\t1\t/work/dir\t1\t0\t124\n";
     let (be, rec) = backend_with(
         MockResp::Out(ok("")),
-        vec![
-            MockResp::Out(ok("%4\n")),
-            MockResp::Out(ok(pane_inventory)),
-        ],
+        vec![MockResp::Out(ok("%4\n")), MockResp::Out(ok(pane_inventory))],
     );
     let s = SessionName::new("teamsess");
     let w = WindowName::new("w2");
@@ -518,10 +514,7 @@ fn spawn_with_command_refuses_and_rolls_back_spawn_pane_owned_by_other_window()
     let pane_inventory = "%5\tteamsess\t1\tw2\t0\t/dev/ttys005\tnode\t1\t/work/dir\t1\t0\t125\n";
     let (be, rec) = backend_with(
         MockResp::Out(ok("")),
-        vec![
-            MockResp::Out(ok("%5\n")),
-            MockResp::Out(ok(pane_inventory)),
-        ],
+        vec![MockResp::Out(ok("%5\n")), MockResp::Out(ok(pane_inventory))],
     );
     let err = be
         .spawn_into(
@@ -1791,9 +1784,9 @@ fn query_single_field_argv_and_nonzero_maps_to_none() {
 // display-message N+1 fallback is gone). leader_env stays the reverse-env real-machine bit.
 #[test]
 fn list_targets_argv_and_parses_tmux_pane_format() {
-    const FMT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
-    let stdout = "%7__TA_FIELD__team-x__TA_FIELD__0__TA_FIELD__win0__TA_FIELD__0__TA_FIELD__/dev/ttys003__TA_FIELD__codex__TA_FIELD__1__TA_FIELD__/Users/me/work__TA_FIELD__1__TA_FIELD__0__TA_FIELD__41001\n\
-                      %8__TA_FIELD__team-x__TA_FIELD__1__TA_FIELD__win1__TA_FIELD__0__TA_FIELD__/dev/ttys004__TA_FIELD__node__TA_FIELD__0__TA_FIELD__/Users/me/other__TA_FIELD__0__TA_FIELD__0__TA_FIELD__41002\n";
+    const FMT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}__TA_FIELD__#{@team_agent_pane_binding_nonce}";
+    let stdout = "%7__TA_FIELD__team-x__TA_FIELD__0__TA_FIELD__win0__TA_FIELD__0__TA_FIELD__/dev/ttys003__TA_FIELD__codex__TA_FIELD__1__TA_FIELD__/Users/me/work__TA_FIELD__1__TA_FIELD__0__TA_FIELD__41001__TA_FIELD__nonce-7\n\
+                      %8__TA_FIELD__team-x__TA_FIELD__1__TA_FIELD__win1__TA_FIELD__0__TA_FIELD__/dev/ttys004__TA_FIELD__node__TA_FIELD__0__TA_FIELD__/Users/me/other__TA_FIELD__0__TA_FIELD__0__TA_FIELD__41002__TA_FIELD__\n";
     let (be, rec) = backend_with(MockResp::Out(ok(stdout)), vec![]);
     let panes = be.list_targets().expect("list_targets ok");
     assert_eq!(
@@ -1845,6 +1838,19 @@ fn list_targets_argv_and_parses_tmux_pane_format() {
         Some(41002),
         "field[11] -> pane_pid (second pane)"
     );
+    assert_eq!(
+        p.leader_env
+            .get(PANE_BINDING_NONCE_METADATA_KEY)
+            .map(String::as_str),
+        Some("nonce-7"),
+        "field[12] pane option -> pane-instance binding metadata"
+    );
+    assert!(
+        !panes[1]
+            .leader_env
+            .contains_key(PANE_BINDING_NONCE_METADATA_KEY),
+        "an empty pane option must remain absent"
+    );
 
     // nonzero exit -> empty vec (golden returncode != 0 -> []).
     let (be, _r) = backend_with(
@@ -1859,6 +1865,35 @@ fn list_targets_argv_and_parses_tmux_pane_format() {
     );
 }
 
+#[test]
+fn set_pane_binding_nonce_is_socket_scoped_and_pane_local() {
+    let rec = Arc::new(Mutex::new(Vec::new()));
+    let runner = MockCommandRunner {
+        recorded: Arc::clone(&rec),
+        stdin_recorded: Arc::new(Mutex::new(Vec::new())),
+        queue: Mutex::new(VecDeque::new()),
+        default: MockResp::Out(ok("")),
+    };
+    let be =
+        TmuxBackend::with_runner_for_tmux_endpoint(Box::new(runner), "/tmp/ta-pane-binding.sock");
+    be.set_pane_binding_nonce(&PaneId::new("%7"), "nonce-7")
+        .expect("set pane binding nonce");
+    assert_eq!(
+        rec.lock().unwrap()[0],
+        svec(&[
+            "tmux",
+            "-S",
+            "/tmp/ta-pane-binding.sock",
+            "set-option",
+            "-p",
+            "-t",
+            "%7",
+            "@team_agent_pane_binding_nonce",
+            "nonce-7",
+        ])
+    );
+}
+
 // ── 12. attach_session (TRANSPORT TRIO) — `tmux attach-session -t <s>` -> Attached ──────────────
 // Golden tmux attach is `tmux attach-session -t <session>`; a successful attach -> AttachOutcome::
 // Attached. RED today: attach_session is unimplemented!() -> PANIC. The in-process lock asserts the