@team-agent/installer 0.5.56 → 0.5.58

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.56"
+version = "0.5.58"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.56"
+version = "0.5.58"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/mod.rs

@@ -2484,6 +2484,7 @@ pub mod lifecycle_port {
                 "new_agent_id": report.new_agent_id.as_str(),
                 "session_id": report.session_id.as_ref().map(|session| session.as_str()),
                 "new_session_id": report.session_id.as_ref().map(|session| session.as_str()),
+                "backing_state": report.backing_state,
             })),
             Err(e) => Ok(error_value(e)),
         }

package/crates/team-agent/src/db/message_store.rs

@@ -52,8 +52,14 @@ pub enum MessageStoreError {
     Sqlite(#[from] rusqlite::Error),
     #[error("io: {0}")]
     Io(#[from] std::io::Error),
+    #[error("event log: {0}")]
+    EventLog(#[from] crate::event_log::EventLogError),
     #[error("delivery receipt missing for message: {0}")]
     DeliveryReceiptMissing(String),
+    #[error("invalid message transition from {from} to {to}")]
+    InvalidTransition { from: String, to: String },
+    #[error("submitted recovery refused: {0}")]
+    RecoveryRefused(&'static str),
 }
 
 /// Outcome of [`MessageStore::claim_leader_notification_delivery`]
@@ -88,19 +94,96 @@ pub enum MessageRowStatus {
     StoredOnly,
     QueuedUntilLeaderAttach,
     QueuedCoordinatorUnavailable,
+    QueuedPaneMissing,
+    TargetResolved,
+    SubmittedAwaitingReceipt,
+    SubmittedUnverified,
+    Delivered,
+    Acknowledged,
+    Consumed,
+    Failed,
+    BlockedLeaderUnbound,
+    BlockedWorkerPaneMissing,
 }
 
 impl MessageRowStatus {
+    pub const ALL: &[Self] = &[
+        Self::Accepted,
+        Self::StoredOnly,
+        Self::QueuedUntilLeaderAttach,
+        Self::QueuedCoordinatorUnavailable,
+        Self::QueuedPaneMissing,
+        Self::TargetResolved,
+        Self::SubmittedAwaitingReceipt,
+        Self::SubmittedUnverified,
+        Self::Delivered,
+        Self::Acknowledged,
+        Self::Consumed,
+        Self::Failed,
+        Self::BlockedLeaderUnbound,
+        Self::BlockedWorkerPaneMissing,
+    ];
+
     pub const fn as_str(self) -> &'static str {
         match self {
             Self::Accepted => "accepted",
             Self::StoredOnly => "stored_only",
             Self::QueuedUntilLeaderAttach => "queued_until_leader_attach",
             Self::QueuedCoordinatorUnavailable => "queued_coordinator_unavailable",
+            Self::QueuedPaneMissing => "queued_pane_missing",
+            Self::TargetResolved => "target_resolved",
+            Self::SubmittedAwaitingReceipt => "submitted_pending_acceptance",
+            Self::SubmittedUnverified => "submitted_unverified",
+            Self::Delivered => "delivered",
+            Self::Acknowledged => "acknowledged",
+            Self::Consumed => "consumed",
+            Self::Failed => "failed",
+            Self::BlockedLeaderUnbound => "blocked_leader_unbound",
+            Self::BlockedWorkerPaneMissing => "queued_pane_missing",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct BlockedLeaderRequeueCounts {
+    pub blocked_leader_unbound: usize,
+    pub queued_until_leader_attach: usize,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct RecoveryBudget {
+    pub attempt_budget: u32,
+    pub max_age_seconds: u64,
+    pub owner_epoch: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PaneAvailable {
+    pub agent_id: String,
+    pub pane_id: String,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RedisplayKind {
+    FrameworkReplay,
+    ProviderRerender,
+}
+
+impl RedisplayKind {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::FrameworkReplay => "framework_replay",
+            Self::ProviderRerender => "provider_rerender",
         }
     }
 }
 
+impl BlockedLeaderRequeueCounts {
+    pub const fn total(self) -> usize {
+        self.blocked_leader_unbound + self.queued_until_leader_attach
+    }
+}
+
 /// Fully resolved durable-message insert. Grammar, scope and transport data do
 /// not belong here; callers must resolve those before crossing this boundary.
 pub struct PersistMessageInput<'a> {
@@ -294,7 +377,7 @@ impl MessageStore {
     ) -> Result<(), MessageStoreError> {
         let conn = crate::db::schema::open_db(&self.path)?;
         let now = now_ts();
-        conn.execute(
+        let changed = conn.execute(
             "update messages
              set status = case
                  when status = 'acknowledged'
@@ -310,9 +393,55 @@ impl MessageStore {
              end,
              acknowledged_at = case when ?2 = 'acknowledged' then ?3 else acknowledged_at end,
              error = case when ?2 = 'delivered' then null else coalesce(?4, error) end
-             where message_id = ?1",
+             where message_id = ?1
+               and status not in ('acknowledged', 'consumed', 'submitted_pending_acceptance')
+               and (status != 'delivered' or ?2 in ('delivered', 'acknowledged'))
+               and (?2 != 'acknowledged' or status = 'delivered')",
             params![message_id, status, now, error],
         )?;
+        if changed == 0 {
+            let prior: Option<String> = conn
+                .query_row(
+                    "select status from messages where message_id = ?1",
+                    params![message_id],
+                    |row| row.get(0),
+                )
+                .optional()?;
+            let workspace = self
+                .path
+                .parent()
+                .and_then(Path::parent)
+                .and_then(Path::parent)
+                .unwrap_or(Path::new("."));
+            if status == MessageRowStatus::Acknowledged.as_str()
+                && prior.as_deref() != Some(MessageRowStatus::Delivered.as_str())
+            {
+                crate::event_log::EventLog::new(workspace).write(
+                    "message.mark_refused",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "prior_status": prior,
+                        "requested_status": status,
+                        "reason": "invalid_acknowledgement_transition",
+                    }),
+                )?;
+                return Err(MessageStoreError::InvalidTransition {
+                    from: prior.unwrap_or_else(|| "missing".to_string()),
+                    to: status.to_string(),
+                });
+            }
+            let event_log = crate::event_log::EventLog::new(workspace);
+            event_log.write(
+                "message.mark_refused",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "prior_status": prior,
+                    "requested_status": status,
+                    "reason": "protected_prior_state",
+                }),
+            )?;
+            return Ok(());
+        }
         Ok(())
     }
 
@@ -397,6 +526,155 @@ impl MessageStore {
         Ok(rows == 1)
     }
 
+    /// Read inbox rows through [`Self::inbox`]; recovery transitions below are
+    /// separate repository owners and are not claim eligibility.
+    pub fn requeue_blocked_leader_messages(
+        &self,
+        owner_team_id: &str,
+    ) -> Result<BlockedLeaderRequeueCounts, MessageStoreError> {
+        let mut conn = crate::db::schema::open_db(&self.path)?;
+        let tx = conn.transaction()?;
+        let now = now_ts();
+        let blocked_leader_unbound = tx.execute(
+            "update messages
+             set status = 'accepted', error = null, updated_at = ?1
+             where recipient = 'leader'
+               and owner_team_id = ?2
+               and status = ?3
+               and error = 'leader_not_attached'",
+            params![now, owner_team_id, MessageRowStatus::Failed.as_str()],
+        )?;
+        let queued_until_leader_attach = tx.execute(
+            "update messages
+             set status = 'accepted', error = null, updated_at = ?1
+             where recipient = 'leader'
+               and owner_team_id = ?2
+               and status = ?3",
+            params![
+                now,
+                owner_team_id,
+                MessageRowStatus::QueuedUntilLeaderAttach.as_str()
+            ],
+        )?;
+        tx.commit()?;
+        Ok(BlockedLeaderRequeueCounts {
+            blocked_leader_unbound,
+            queued_until_leader_attach,
+        })
+    }
+
+    pub fn recover_worker_pane_available(
+        &self,
+        agent_id: &str,
+        owner_team_id: Option<&str>,
+    ) -> Result<Vec<String>, MessageStoreError> {
+        let mut conn = crate::db::schema::open_db(&self.path)?;
+        let tx = conn.transaction()?;
+        let ids = {
+            let mut stmt = tx.prepare(
+                "select message_id from messages
+                 where recipient = ?1
+                   and status = ?2
+                   and error = 'tmux_target_missing'
+                   and (
+                       (?3 is null and owner_team_id is null)
+                       or owner_team_id = ?3
+                   )
+                 order by created_at, message_id",
+            )?;
+            let rows = stmt
+                .query_map(
+                    params![
+                        agent_id,
+                        MessageRowStatus::QueuedPaneMissing.as_str(),
+                        owner_team_id
+                    ],
+                    |row| row.get::<_, String>(0),
+                )?
+                .collect::<Result<Vec<_>, _>>()?;
+            rows
+        };
+        let now = now_ts();
+        for message_id in &ids {
+            tx.execute(
+                "update messages
+                 set status = ?1, error = null, updated_at = ?2
+                 where message_id = ?3",
+                params![MessageRowStatus::Accepted.as_str(), now, message_id],
+            )?;
+        }
+        tx.commit()?;
+        Ok(ids)
+    }
+
+    pub fn retry_submitted_explicit(
+        &self,
+        message_id: &str,
+        incident_id: &str,
+        operator_reason: &str,
+        budget: RecoveryBudget,
+    ) -> Result<bool, MessageStoreError> {
+        if incident_id.trim().is_empty() || operator_reason.trim().is_empty() {
+            return Err(MessageStoreError::RecoveryRefused(
+                "incident_id_and_operator_reason_required",
+            ));
+        }
+        if budget.attempt_budget == 0 || budget.max_age_seconds == 0 || budget.owner_epoch <= 0 {
+            return Err(MessageStoreError::RecoveryRefused(
+                "invalid_recovery_budget",
+            ));
+        }
+        let conn = crate::db::schema::open_db(&self.path)?;
+        let row: Option<(String, i64, String)> = conn
+            .query_row(
+                "select status, delivery_attempts, updated_at
+                 from messages where message_id = ?1",
+                params![message_id],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
+            )
+            .optional()?;
+        let Some((status, attempts, updated_at)) = row else {
+            return Ok(false);
+        };
+        if status != MessageRowStatus::SubmittedAwaitingReceipt.as_str()
+            && status != MessageRowStatus::SubmittedUnverified.as_str()
+        {
+            return Err(MessageStoreError::RecoveryRefused(
+                "message_not_submitted_recoverable",
+            ));
+        }
+        if attempts >= i64::from(budget.attempt_budget) {
+            return Err(MessageStoreError::RecoveryRefused(
+                "attempt_budget_exhausted",
+            ));
+        }
+        let updated_at = chrono::DateTime::parse_from_rfc3339(&updated_at)
+            .map_err(|_| MessageStoreError::RecoveryRefused("invalid_updated_at"))?;
+        let age = chrono::Utc::now()
+            .signed_duration_since(updated_at.with_timezone(&chrono::Utc))
+            .num_seconds();
+        if age < 0 || u64::try_from(age).unwrap_or(u64::MAX) > budget.max_age_seconds {
+            return Err(MessageStoreError::RecoveryRefused("message_too_old"));
+        }
+        let changed = conn.execute(
+            "update messages
+             set status = ?1, error = ?2, updated_at = ?3
+             where message_id = ?4
+               and status in (?5, ?6)
+               and delivery_attempts < ?7",
+            params![
+                MessageRowStatus::Accepted.as_str(),
+                format!("explicit_recovery:{incident_id}:{operator_reason}"),
+                now_ts(),
+                message_id,
+                MessageRowStatus::SubmittedAwaitingReceipt.as_str(),
+                MessageRowStatus::SubmittedUnverified.as_str(),
+                budget.attempt_budget
+            ],
+        )?;
+        Ok(changed == 1)
+    }
+
     /// Read inbox rows for an agent. This projection intentionally has no owner-team
     /// filter when the caller does not provide one: legacy/CLI inbox must surface
     /// NULL-owner messages stored for the agent.
@@ -863,6 +1141,7 @@ mod tests {
         let mid = s
             .create_message(Some("t"), "s", "r", "c", None, true, None)
             .unwrap();
+        s.mark(&mid, "delivered", None).unwrap();
         s.mark(&mid, "acknowledged", None).unwrap();
         assert_eq!(status_of(&read(&s), &mid), "acknowledged");
         assert!(col_str(&read(&s), &mid, "acknowledged_at").is_some());
@@ -882,15 +1161,15 @@ mod tests {
     }
 
     #[test]
-    fn mark_acknowledged_then_failed_overwrites() {
-        // 'failed' is NOT in the guarded delivery set → it overwrites acknowledged.
+    fn mark_acknowledged_then_failed_stays_terminal() {
         let s = store();
         let mid = s
             .create_message(Some("t"), "s", "r", "c", None, true, None)
             .unwrap();
+        s.mark(&mid, "delivered", None).unwrap();
         s.mark(&mid, "acknowledged", None).unwrap();
         s.mark(&mid, "failed", Some("x")).unwrap();
-        assert_eq!(status_of(&read(&s), &mid), "failed");
+        assert_eq!(status_of(&read(&s), &mid), "acknowledged");
     }
 
     #[test]

package/crates/team-agent/src/leader/incident.rs

@@ -0,0 +1,5 @@
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LeaderIncident {
+    LeaderAttached,
+    LeaderClaimed,
+}

package/crates/team-agent/src/leader/mod.rs

@@ -76,6 +76,7 @@ use crate::state::StateError;
 
 // ── submodules(by responsibility) ──────────────────────────────────────────
 mod helpers;
+pub mod incident;
 pub mod inject;
 pub mod lease;
 pub mod owner_bind;
@@ -87,6 +88,7 @@ pub mod takeover;
 pub mod types;
 
 // ── RE-EXPORT INVARIANT:每个先前 root-visible 项原路径不变 ────────────────────
+pub use incident::*;
 pub use inject::*;
 pub use lease::*;
 pub use owner_bind::*;

package/crates/team-agent/src/lifecycle/launch/fork_agent.rs

@@ -57,66 +57,13 @@ pub fn fork_agent_with_transport(
     let text = std::fs::read_to_string(&read_spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", read_spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
-    if find_spec_agent(&spec, as_agent_id).is_some() || leader_id_matches(&spec, as_agent_id) {
+    if fork_spec_agent(&spec, as_agent_id).is_some() || leader_id_matches(&spec, as_agent_id) {
         return Err(LifecycleError::RequirementUnmet(format!(
             "agent id already exists: {as_agent_id}"
         )));
     }
-    let source_agent = find_spec_agent(&spec, source_agent_id).ok_or_else(|| {
-        LifecycleError::RequirementUnmet(format!("unknown worker agent id: {source_agent_id}"))
-    })?;
-    // Fork requires the complete source tuple before treating session_id as
-    // resumable truth; a scalar-only row has no confirmed backing.
-    let source_agent_state = state
-        .get("agents")
-        .and_then(|v| v.get(source_agent_id.as_str()))
-        .ok_or_else(|| {
-            LifecycleError::Provider(format!(
-                "cannot fork {source_agent_id}: source agent row not in state"
-            ))
-        })?;
-    let tuple_field_ok = |field: &str| -> bool {
-        source_agent_state
-            .get(field)
-            .and_then(|v| v.as_str())
-            .is_some_and(|s| !s.is_empty())
-    };
-    let session_id_str = source_agent_state
-        .get("session_id")
-        .and_then(|v| v.as_str())
-        .filter(|s| !s.is_empty());
-    let rollout_path_str = source_agent_state
-        .get("rollout_path")
-        .and_then(|v| v.as_str())
-        .filter(|s| !s.is_empty());
-    if session_id_str.is_none()
-        || rollout_path_str.is_none()
-        || !tuple_field_ok("captured_at")
-        || !tuple_field_ok("captured_via")
-    {
-        return Err(LifecycleError::Provider(format!(
-            "cannot fork {source_agent_id}: source session backing is missing or incomplete \
-             (session_id+rollout_path+captured_at+captured_via required)"
-        )));
-    }
-    let Some(source_backing_raw) = rollout_path_str else {
-        return Err(LifecycleError::Provider(format!(
-            "cannot fork {source_agent_id}: source session backing is missing"
-        )));
-    };
-    let source_backing = Path::new(source_backing_raw);
-    if !source_backing.is_file() {
-        return Err(LifecycleError::Provider(format!(
-            "cannot fork {source_agent_id}: source session backing is not readable: {}",
-            source_backing.display()
-        )));
-    }
-    let Some(source_session_id) = session_id_str else {
-        return Err(LifecycleError::Provider(format!(
-            "cannot fork {source_agent_id}: source session id is missing"
-        )));
-    };
-    let session_id = crate::provider::SessionId::new(source_session_id.to_string());
+    // Source existence authority: state.get("agents"), matching clone-agent.
+    let (session_id, source_backing) = fork_source_tuple(&state, source_agent_id)?;
     let session_name = state
         .get("session_name")
         .and_then(|v| v.as_str())
@@ -158,7 +105,7 @@ pub fn fork_agent_with_transport(
     crate::model::spec::validate_spec(&new_spec, &validate_ws)
         .map_err(|e| LifecycleError::Compile(e.to_string()))?;
     write_spec_atomic(&spec_path, &new_spec)?;
-    let new_agent = find_spec_agent(&new_spec, as_agent_id).ok_or_else(|| {
+    let new_agent = fork_spec_agent(&new_spec, as_agent_id).ok_or_else(|| {
         LifecycleError::RequirementUnmet(format!("unknown worker agent id: {as_agent_id}"))
     })?;
     let provider = new_agent
@@ -296,13 +243,21 @@ pub fn fork_agent_with_transport(
         plan.provider_projects_root = source_backing.parent().map(Path::to_path_buf);
     }
     let window = WindowName::new(as_agent_id.as_str());
+    let mut claude_fork = prepare_claude_fork_backing(
+        provider,
+        &plan,
+        &source_backing,
+        &session_id,
+    )
+    .map_err(|error| {
+        let _ = std::fs::write(&spec_path, text.as_bytes());
+        cleanup_fork_mcp_artifacts(&workspace, as_agent_id, &mcp_config_path, &profile_launch);
+        error
+    })?;
+    // The framework-created Claude snapshot is only fork input, not provider
+    // proof. Observe changes made after materialization so a spawn-only
+    // provider cannot turn the copied source backing into a Verified result.
     let backing_before = crate::provider::session::ContextBackingSnapshot::capture(provider, &plan);
-    let mut claude_fork = prepare_claude_fork_backing(provider, &plan, source_backing, &session_id)
-        .map_err(|error| {
-            let _ = std::fs::write(&spec_path, text.as_bytes());
-            cleanup_fork_mcp_artifacts(&workspace, as_agent_id, &mcp_config_path, &profile_launch);
-            error
-        })?;
     let mut env =
         inherited_env_with_team_overrides(&workspace, as_agent_id.as_str(), Some(&fork_team));
     apply_profile_launch_env(&mut env, &profile_launch);
@@ -401,7 +356,7 @@ pub fn fork_agent_with_transport(
     })?;
     let convergence_deadline =
         crate::provider::session::context_fork_convergence_deadline(provider);
-    let context_proof = match crate::provider::session::verify_context_fork(
+    let context_outcome = crate::provider::session::observe_context_fork(
         provider,
         &session_id,
         &plan,
@@ -411,9 +366,40 @@ pub fn fork_agent_with_transport(
         &workspace,
         &spawned_at,
         convergence_deadline,
-    ) {
-        Ok(proof) => proof,
-        Err(error) => {
+    );
+    let context_proof = match context_outcome {
+        crate::provider::session::ContextForkOutcome::Verified(proof) => Some(proof),
+        crate::provider::session::ContextForkOutcome::Pending(pending) => {
+            if let Err(error) = finalize_pending_fork_state(ForkPendingFinalizeInput {
+                workspace: &workspace,
+                team_key: &fork_team,
+                source_agent_id,
+                agent_id: as_agent_id,
+                spec_agent: new_agent,
+                safety: &safety,
+                plan: &plan,
+                profile_launch: &profile_launch,
+                spawn: &spawn,
+                profile_dir: &profile_dir,
+                dynamic_role_file: materialized_role.path(),
+                pending: &pending,
+                spawn_epoch,
+            }) {
+                rollback_fork_after_spawn(
+                    &workspace,
+                    transport,
+                    &session_name,
+                    &window,
+                    &mcp_config_path,
+                    as_agent_id,
+                    &profile_launch,
+                    &fork_team,
+                );
+                return Err(error);
+            }
+            None
+        }
+        crate::provider::session::ContextForkOutcome::Rejected(error) => {
             rollback_fork_after_spawn(
                 &workspace,
                 transport,
@@ -427,33 +413,35 @@ pub fn fork_agent_with_transport(
             return Err(LifecycleError::Provider(error.to_string()));
         }
     };
-    if let Err(error) = finalize_fork_state(ForkFinalizeInput {
-        workspace: &workspace,
-        team_key: &fork_team,
-        source_agent_id,
-        agent_id: as_agent_id,
-        spec_agent: new_agent,
-        safety: &safety,
-        plan: &plan,
-        profile_launch: &profile_launch,
-        spawn: &spawn,
-        profile_dir: &profile_dir,
-        dynamic_role_file: materialized_role.path(),
-        context_proof: &context_proof,
-        spawned_at: &spawned_at,
-        spawn_epoch,
-    }) {
-        rollback_fork_after_spawn(
-            &workspace,
-            transport,
-            &session_name,
-            &window,
-            &mcp_config_path,
-            as_agent_id,
-            &profile_launch,
-            &fork_team,
-        );
-        return Err(error);
+    if let Some(context_proof) = context_proof.as_ref() {
+        if let Err(error) = finalize_fork_state(ForkFinalizeInput {
+            workspace: &workspace,
+            team_key: &fork_team,
+            source_agent_id,
+            agent_id: as_agent_id,
+            spec_agent: new_agent,
+            safety: &safety,
+            plan: &plan,
+            profile_launch: &profile_launch,
+            spawn: &spawn,
+            profile_dir: &profile_dir,
+            dynamic_role_file: materialized_role.path(),
+            context_proof: &context_proof,
+            spawned_at: &spawned_at,
+            spawn_epoch,
+        }) {
+            rollback_fork_after_spawn(
+                &workspace,
+                transport,
+                &session_name,
+                &window,
+                &mcp_config_path,
+                as_agent_id,
+                &profile_launch,
+                &fork_team,
+            );
+            return Err(error);
+        }
     }
     if let Err(error) =
         verify_fork_registration(&workspace, &fork_team, as_agent_id, &spawn, &window)
@@ -487,6 +475,11 @@ pub fn fork_agent_with_transport(
     if let Some(materialized) = copilot_fork.as_mut() {
         materialized.keep();
     }
+    let backing_state = if context_proof.is_some() {
+        ForkBackingState::Verified
+    } else {
+        ForkBackingState::PendingContextFork
+    };
     Ok(ForkAgentReport {
         source_agent_id: source_agent_id.clone(),
         new_agent_id: as_agent_id.clone(),
@@ -495,6 +488,7 @@ pub fn fork_agent_with_transport(
             state_file: crate::state::persist::runtime_state_path(&workspace),
             coordinator_started,
         },
-        session_id: Some(context_proof.new_session_id),
+        session_id: context_proof.map(|proof| proof.new_session_id),
+        backing_state,
     })
 }