@team-agent/installer 0.5.59 → 0.5.61

package/crates/team-agent/src/mcp_server/wire.rs

@@ -9,7 +9,6 @@ use crate::event_log::EventLog;
 use crate::messaging::MessageTarget;
 
 use super::helpers::{json_dumps_default, object_fields};
-use super::normalize::normalize_result_status;
 use super::tools::TeamOrchestratorTools;
 use super::types::{
     McpError, McpTool, RpcError, RpcId, RpcMethod, RpcResponse, Scope, SendOutcome,
@@ -369,7 +368,7 @@ fn python_repr(value: &str) -> String {
 fn tool_contract(tool: McpTool) -> Value {
     let (description, required) = match tool {
         McpTool::SendMessage => (
-            "Send a message to a teammate, the leader, or '*' for all other team members. Team Agent fills identity and delivery metadata; optional presentation routing is durable and never drops the message.",
+            "Send a message to a teammate, the leader, or '*' for all other team members. mailbox=true stores durably without live injection; the default is live delivery.",
             vec!["to", "content"],
         ),
         McpTool::AssignTask => ("Assign or update a task in the team graph and deliver it to its assignee.", vec!["task"]),
@@ -404,11 +403,7 @@ fn tool_properties(tool: McpTool) -> serde_json::Map<String, Value> {
     let mut properties = serde_json::Map::new();
     match tool {
         McpTool::AssignTask => {
-            insert_property(
-                &mut properties,
-                "task",
-                object_property("Task object to add or update."),
-            );
+            insert_property(&mut properties, "task", task_property());
             insert_property(
                 &mut properties,
                 "message",
@@ -424,8 +419,10 @@ fn tool_properties(tool: McpTool) -> serde_json::Map<String, Value> {
             insert_property(&mut properties, "content", string_property("Message body."));
             insert_property(
                 &mut properties,
-                "presentation",
-                presentation_property("Optional durable presentation routing."),
+                "mailbox",
+                boolean_property(
+                    "Set true to store durably without live injection; omit for default live delivery.",
+                ),
             );
         }
         McpTool::ReportResult => {
@@ -603,6 +600,25 @@ fn object_property(description: &str) -> Value {
     serde_json::json!({"type": "object", "description": description, "additionalProperties": true})
 }
 
+fn task_property() -> Value {
+    serde_json::json!({
+        "type": "object",
+        "description": "Task object to add or update.",
+        "properties": {
+            "result_route": {
+                "type": "string",
+                "enum": crate::messaging::results::ResultRoute::ALL
+                    .iter()
+                    .map(|route| route.as_str())
+                    .collect::<Vec<_>>(),
+                "default": crate::messaging::results::ResultRoute::default().as_str(),
+                "description": "Result destination chosen by the task assigner."
+            }
+        },
+        "additionalProperties": true
+    })
+}
+
 fn presentation_property(description: &str) -> Value {
     serde_json::json!({
         "type": "object",
@@ -646,6 +662,7 @@ pub(crate) fn dispatch_tool(
                 None,
                 None,
                 None,
+                args.get("mailbox"),
                 args.get("presentation"),
             )?;
             match outcome {
@@ -658,18 +675,7 @@ pub(crate) fn dispatch_tool(
         McpTool::ReportResult => tools.report_result_with_presentation(
             args.get("envelope"),
             args.get("summary").and_then(Value::as_str),
-            // cr verdict (T3-1 refined): an unknown status literal normalizes to
-            // Partial and is OBSERVABLE at this ingestion boundary, never silent.
-            {
-                let (status, unknown) =
-                    crate::mcp_server::normalize::normalize_result_status_observed(
-                        args.get("status").and_then(Value::as_str),
-                    );
-                if let Some(raw) = unknown {
-                    tools.note_unknown_result_status(&raw);
-                }
-                status
-            },
+            args.get("status").and_then(Value::as_str),
             args.get("changes")
                 .and_then(Value::as_array)
                 .map(Vec::as_slice),

package/crates/team-agent/src/messaging/delivery.rs

@@ -220,7 +220,12 @@ pub fn deliver_pending_message(
         }
         _ => state,
     };
-    if message.recipient == "leader" && message.status == "submitted_pending_acceptance" {
+    if message.recipient == "leader"
+        && matches!(
+            message.status.as_str(),
+            "submitted_pending_acceptance" | "injected_awaiting_receipt"
+        )
+    {
         return observe_pending_leader_acceptance(store, event_log, state, message_id);
     }
     if message.recipient == "leader" && message.status == "queued_until_leader_attach" {
@@ -341,6 +346,12 @@ pub fn deliver_pending_message(
                     .get("status")
                     .and_then(serde_json::Value::as_str)
                     .unwrap_or("unbound");
+                let refusal = match &reason {
+                    crate::messaging::LeaderChannelUnbound::PaneWorkspaceMismatch(_) => {
+                        DeliveryRefusal::PaneWorkspaceMismatch
+                    }
+                    _ => DeliveryRefusal::LeaderNotAttached,
+                };
                 store.mark(message_id, "failed", Some("leader_not_attached"))?;
                 event_log.write(
                     "leader_receiver.delivery_blocked",
@@ -349,7 +360,7 @@ pub fn deliver_pending_message(
                         "sender": message.sender,
                         "reason": "leader_receiver_not_attached",
                         "error": "leader_not_attached",
-                        "channel_reason": format!("{reason:?}"),
+                        "channel_reason": reason.reason_code(),
                         "channel": "rebind_required",
                         "action": "run team-agent attach-leader or team-agent takeover",
                         "status": receiver_status,
@@ -364,7 +375,7 @@ pub fn deliver_pending_message(
                         "run team-agent attach-leader or team-agent takeover".to_string(),
                     ),
                     stage: None,
-                    reason: Some(DeliveryRefusal::LeaderNotAttached),
+                    reason: Some(refusal),
                     channel: Some("rebind_required".to_string()),
                 });
             }
@@ -711,19 +722,30 @@ pub fn deliver_pending_message(
     }
     if is_leader_recipient {
         store.record_delivery_submission(message_id, readback_verified)?;
-        if !leader_transcript_has_token(state, message_id) {
-            store.mark(message_id, "submitted_pending_acceptance", None)?;
-            event_log.write(
-                "leader_receiver.acceptance_pending",
-                serde_json::json!({
-                    "message_id": message_id,
-                    "reason": "provider_receipt_not_observed",
-                }),
-            )?;
-            return Ok(leader_acceptance_pending_outcome(
-                message_id,
-                "submitted_pending_acceptance",
-            ));
+        match observe_leader_receipt(state, message_id) {
+            LeaderReceiptObservation::SourceUnavailable => {
+                store.mark_injected_awaiting_receipt(message_id)?;
+                event_log.write(
+                    "leader_receiver.receipt_source_unavailable",
+                    serde_json::json!({"message_id": message_id}),
+                )?;
+                return Ok(leader_receipt_source_unavailable_outcome(message_id));
+            }
+            LeaderReceiptObservation::TokenAbsent => {
+                store.mark(message_id, "submitted_pending_acceptance", None)?;
+                event_log.write(
+                    "leader_receiver.acceptance_pending",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "reason": "provider_receipt_not_observed",
+                    }),
+                )?;
+                return Ok(leader_acceptance_pending_outcome(
+                    message_id,
+                    "submitted_pending_acceptance",
+                ));
+            }
+            LeaderReceiptObservation::TokenObserved => {}
         }
         store.mark_delivered_with_receipt(message_id)?;
     } else {
@@ -2041,15 +2063,36 @@ fn leader_rollout_path(state: &serde_json::Value) -> Option<std::path::PathBuf>
         .map(std::path::PathBuf::from)
 }
 
-pub(crate) fn leader_transcript_has_token(state: &serde_json::Value, message_id: &str) -> bool {
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum LeaderReceiptObservation {
+    SourceUnavailable,
+    TokenAbsent,
+    TokenObserved,
+}
+
+pub(crate) fn observe_leader_receipt(
+    state: &serde_json::Value,
+    message_id: &str,
+) -> LeaderReceiptObservation {
     let Some(path) = leader_rollout_path(state) else {
-        return false;
+        return LeaderReceiptObservation::SourceUnavailable;
     };
-    rollout_tail_contains(
+    let Ok(observed) = rollout_tail_contains_result(
         &path,
         &format!("[team-agent-token:{message_id}]"),
         64 * 1024,
-    )
+    ) else {
+        return LeaderReceiptObservation::SourceUnavailable;
+    };
+    if observed {
+        LeaderReceiptObservation::TokenObserved
+    } else {
+        LeaderReceiptObservation::TokenAbsent
+    }
+}
+
+pub(crate) fn leader_transcript_has_token(state: &serde_json::Value, message_id: &str) -> bool {
+    observe_leader_receipt(state, message_id) == LeaderReceiptObservation::TokenObserved
 }
 
 fn leader_acceptance_pending_outcome(message_id: &str, status: &str) -> DeliveryOutcome {
@@ -2065,17 +2108,41 @@ fn leader_acceptance_pending_outcome(message_id: &str, status: &str) -> Delivery
     }
 }
 
+pub(crate) fn leader_receipt_source_unavailable_outcome(message_id: &str) -> DeliveryOutcome {
+    DeliveryOutcome {
+        ok: true,
+        status: DeliveryStatus::Blocked,
+        message_status: MessageStatusShadow("injected_awaiting_receipt".to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: Some("leader_receipt_source_unavailable".to_string()),
+        stage: Some(DeliveryStage::Submit),
+        reason: None,
+        channel: Some("leader_receipt_source_unavailable".to_string()),
+    }
+}
+
 fn observe_pending_leader_acceptance(
     store: &MessageStore,
     event_log: &EventLog,
     state: &serde_json::Value,
     message_id: &str,
 ) -> Result<DeliveryOutcome, MessagingError> {
-    if !leader_transcript_has_token(state, message_id) {
-        return Ok(leader_acceptance_pending_outcome(
-            message_id,
-            "submitted_pending_acceptance",
-        ));
+    match observe_leader_receipt(state, message_id) {
+        LeaderReceiptObservation::SourceUnavailable => {
+            store.mark_injected_awaiting_receipt(message_id)?;
+            event_log.write(
+                "leader_receiver.receipt_source_unavailable",
+                serde_json::json!({"message_id": message_id}),
+            )?;
+            return Ok(leader_receipt_source_unavailable_outcome(message_id));
+        }
+        LeaderReceiptObservation::TokenAbsent => {
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "submitted_pending_acceptance",
+            ));
+        }
+        LeaderReceiptObservation::TokenObserved => {}
     }
     store.mark_delivered_with_receipt(message_id)?;
     event_log.write(
@@ -2744,22 +2811,22 @@ fn claude_recipient_rollout(
 /// Silent on read errors — callers treat missing/unreadable as "token not
 /// present" which forces the unverified path.
 fn rollout_tail_contains(path: &std::path::Path, needle: &str, tail_bytes: u64) -> bool {
+    rollout_tail_contains_result(path, needle, tail_bytes).unwrap_or(false)
+}
+
+fn rollout_tail_contains_result(
+    path: &std::path::Path,
+    needle: &str,
+    tail_bytes: u64,
+) -> std::io::Result<bool> {
     use std::io::{Read, Seek, SeekFrom};
-    let Ok(mut file) = std::fs::File::open(path) else {
-        return false;
-    };
-    let Ok(metadata) = file.metadata() else {
-        return false;
-    };
+    let mut file = std::fs::File::open(path)?;
+    let metadata = file.metadata()?;
     let len = metadata.len();
     let start = len.saturating_sub(tail_bytes);
-    if file.seek(SeekFrom::Start(start)).is_err() {
-        return false;
-    }
+    file.seek(SeekFrom::Start(start))?;
     let mut buf = Vec::with_capacity(tail_bytes.min(len) as usize);
-    if file.take(tail_bytes).read_to_end(&mut buf).is_err() {
-        return false;
-    }
+    file.take(tail_bytes).read_to_end(&mut buf)?;
     let haystack = String::from_utf8_lossy(&buf);
-    haystack.contains(needle)
+    Ok(haystack.contains(needle))
 }

package/crates/team-agent/src/messaging/leader_channel.rs

@@ -3,6 +3,7 @@ use std::path::Path;
 use serde_json::Value;
 
 use crate::codex_app_server::AppServerBinding;
+use crate::model::pane_authority_refusal::PaneWorkspaceMismatchFacts;
 use crate::transport::{PaneInfo, Transport};
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -26,7 +27,7 @@ pub enum LeaderChannelResolution {
     ProbeFailed(String),
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub enum LeaderChannelUnbound {
     ReceiverNotAttached,
     TransportConflict,
@@ -34,10 +35,25 @@ pub enum LeaderChannelUnbound {
     NonCanonicalTmuxSocket,
     EndpointMismatch,
     PaneNotLive,
-    PaneWorkspaceMismatch,
+    PaneWorkspaceMismatch(PaneWorkspaceMismatchFacts),
     AppServerBindingInvalid,
 }
 
+impl LeaderChannelUnbound {
+    pub const fn reason_code(&self) -> &'static str {
+        match self {
+            Self::ReceiverNotAttached => "ReceiverNotAttached",
+            Self::TransportConflict => "TransportConflict",
+            Self::MissingPaneId => "MissingPaneId",
+            Self::NonCanonicalTmuxSocket => "NonCanonicalTmuxSocket",
+            Self::EndpointMismatch => "EndpointMismatch",
+            Self::PaneNotLive => "PaneNotLive",
+            Self::PaneWorkspaceMismatch(_) => "PaneWorkspaceMismatch",
+            Self::AppServerBindingInvalid => "AppServerBindingInvalid",
+        }
+    }
+}
+
 /// Resolve the canonical receiver's live physical channel without mutating
 /// ownership. For direct tmux, `(absolute socket, pane id)` plus an available
 /// pane cwd inside the target workspace is the authority. Session/window/tty/
@@ -79,11 +95,12 @@ pub fn resolve_live_leader_channel(
         .get("tmux_socket")
         .and_then(Value::as_str)
         .filter(|socket| !socket.is_empty());
+    let transport_endpoint = transport.tmux_endpoint();
     if tmux_socket.is_some_and(|socket| !std::path::Path::new(socket).is_absolute()) {
         return LeaderChannelResolution::Unbound(LeaderChannelUnbound::NonCanonicalTmuxSocket);
     }
     if let Some(expected) = tmux_socket {
-        if transport.tmux_endpoint().as_deref() != Some(expected) {
+        if transport_endpoint.as_deref() != Some(expected) {
             return LeaderChannelResolution::Unbound(LeaderChannelUnbound::EndpointMismatch);
         }
     }
@@ -97,13 +114,19 @@ pub fn resolve_live_leader_channel(
     else {
         return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneNotLive);
     };
-    if observed
-        .current_path
-        .as_deref()
-        .is_some_and(|path| !path_is_in_workspace(path, workspace))
-        && !explicit_claim_authority_matches(workspace, receiver, &observed)
-    {
-        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch);
+    if let Some(observed_pane_workspace) = observed.current_path.clone() {
+        if !path_is_in_workspace(&observed_pane_workspace, workspace)
+            && !explicit_claim_authority_matches(workspace, receiver, &observed)
+        {
+            return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch(
+                PaneWorkspaceMismatchFacts {
+                    requested_workspace: canonical_path(workspace),
+                    observed_pane_id: observed.pane_id.as_str().to_string(),
+                    observed_pane_workspace,
+                    endpoint: transport_endpoint.unwrap_or_else(|| "default".to_string()),
+                },
+            ));
+        }
     }
     let metadata_drift = receiver_metadata_drift(receiver, &observed);
     LeaderChannelResolution::Live(LiveLeaderChannel::DirectTmux(DirectTmuxLeaderChannel {

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -397,29 +397,46 @@ pub fn deliver_to_leader_fallback_pane(
             let readback_ok = super::delivery::pane_readback_verified(&report);
             if submit_ok {
                 store.record_delivery_submission(message_id, readback_ok)?;
-                if !super::delivery::leader_transcript_has_token(state, message_id) {
-                    store.mark(message_id, "submitted_pending_acceptance", None)?;
-                    event_log.write(
-                        "leader_receiver.acceptance_pending",
-                        serde_json::json!({
-                            "message_id": message_id,
-                            "result_id": result_id,
-                            "reason": "provider_receipt_not_observed",
-                            "channel": "fallback_pane",
-                        }),
-                    )?;
-                    return Ok(DeliveryOutcome {
-                        ok: true,
-                        status: DeliveryStatus::RetryScheduled,
-                        message_status: MessageStatusShadow(
-                            "submitted_pending_acceptance".to_string(),
-                        ),
-                        message_id: Some(message_id.to_string()),
-                        verification: Some("provider_receipt_not_observed".to_string()),
-                        stage: Some(DeliveryStage::Submit),
-                        reason: None,
-                        channel: Some("leader_acceptance_pending".to_string()),
-                    });
+                match super::delivery::observe_leader_receipt(state, message_id) {
+                    super::delivery::LeaderReceiptObservation::SourceUnavailable => {
+                        store.mark_injected_awaiting_receipt(message_id)?;
+                        event_log.write(
+                            "leader_receiver.receipt_source_unavailable",
+                            serde_json::json!({
+                                "message_id": message_id,
+                                "result_id": result_id,
+                                "channel": "fallback_pane",
+                            }),
+                        )?;
+                        return Ok(super::delivery::leader_receipt_source_unavailable_outcome(
+                            message_id,
+                        ));
+                    }
+                    super::delivery::LeaderReceiptObservation::TokenAbsent => {
+                        store.mark(message_id, "submitted_pending_acceptance", None)?;
+                        event_log.write(
+                            "leader_receiver.acceptance_pending",
+                            serde_json::json!({
+                                "message_id": message_id,
+                                "result_id": result_id,
+                                "reason": "provider_receipt_not_observed",
+                                "channel": "fallback_pane",
+                            }),
+                        )?;
+                        return Ok(DeliveryOutcome {
+                            ok: true,
+                            status: DeliveryStatus::RetryScheduled,
+                            message_status: MessageStatusShadow(
+                                "submitted_pending_acceptance".to_string(),
+                            ),
+                            message_id: Some(message_id.to_string()),
+                            verification: Some("provider_receipt_not_observed".to_string()),
+                            stage: Some(DeliveryStage::Submit),
+                            reason: None,
+                            channel: Some("leader_acceptance_pending".to_string()),
+                        });
+                    }
+                    super::delivery::LeaderReceiptObservation::TokenObserved => {}
                 }
                 store.mark_delivered_with_receipt(message_id)?;
                 event_log.write(

package/crates/team-agent/src/messaging/presentation.rs

@@ -98,6 +98,12 @@ pub struct PresentationDecision {
     pub policy_version: String,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SendPresentationInput {
+    pub request: PresentationRequest,
+    pub deprecation: Option<String>,
+}
+
 impl Default for PresentationRequest {
     fn default() -> Self {
         Self {
@@ -177,6 +183,79 @@ pub fn normalize_report_presentation(
     (request, None)
 }
 
+/// Normalize the one-bit send surface and the temporary S-011 compatibility
+/// input into the existing presentation disposition primitive.
+///
+/// S-011 sensitive: if the compatibility period is ended by a hard-cut
+/// decision, replace this table with one uniform legacy-input refusal.
+pub fn normalize_send_presentation(
+    mailbox: Option<&Value>,
+    legacy_presentation: Option<&Value>,
+) -> Result<SendPresentationInput, String> {
+    if mailbox.is_some() && legacy_presentation.is_some() {
+        return Err("mailbox_conflicts_with_deprecated_presentation".to_string());
+    }
+    if let Some(mailbox) = mailbox {
+        let Some(mailbox) = mailbox.as_bool() else {
+            return Err("mailbox_must_be_boolean".to_string());
+        };
+        return Ok(SendPresentationInput {
+            request: PresentationRequest {
+                sink: if mailbox {
+                    PresentationSink::Casefile
+                } else {
+                    PresentationSink::Leader
+                },
+                class: PresentationClass::Message,
+                case_id: None,
+            },
+            deprecation: None,
+        });
+    }
+    let Some(legacy) = legacy_presentation else {
+        return Ok(SendPresentationInput {
+            request: PresentationRequest::default(),
+            deprecation: None,
+        });
+    };
+    let Some(object) = legacy.as_object() else {
+        return Err("malformed_presentation".to_string());
+    };
+    let Some(class) = object.get("class").and_then(Value::as_str) else {
+        return Err("missing_class".to_string());
+    };
+    let Some(class) = PresentationClass::parse(class) else {
+        return Err(format!("unknown_class:{class}"));
+    };
+    let sink = match class {
+        PresentationClass::Message | PresentationClass::Blocking | PresentationClass::Timeout => {
+            PresentationSink::Leader
+        }
+        PresentationClass::Progress => PresentationSink::Casefile,
+        PresentationClass::StageResult
+        | PresentationClass::StagePass
+        | PresentationClass::Bounce
+        | PresentationClass::FinalReview => {
+            return Err(format!(
+                "deprecated_message_class:{}_requires_result_route",
+                class.as_str()
+            ));
+        }
+    };
+    Ok(SendPresentationInput {
+        request: PresentationRequest {
+            sink,
+            class: PresentationClass::Message,
+            case_id: None,
+        },
+        deprecation: Some(format!(
+            "message-class={} is deprecated; use mailbox={} instead",
+            class.as_str(),
+            sink != PresentationSink::Leader
+        )),
+    })
+}
+
 pub fn normalize_presentation(value: Option<&Value>) -> (PresentationRequest, Option<String>) {
     let Some(value) = value else {
         return (PresentationRequest::default(), None);
@@ -304,4 +383,34 @@ mod tests {
             "send normalization remains unchanged"
         );
     }
+
+    #[test]
+    fn send_mailbox_and_s011_compatibility_map_to_one_bit() {
+        let mailbox = normalize_send_presentation(Some(&json!(true)), None).unwrap();
+        assert_eq!(mailbox.request.sink, PresentationSink::Casefile);
+        assert_eq!(mailbox.deprecation, None);
+
+        for (class, sink) in [
+            ("message", PresentationSink::Leader),
+            ("progress", PresentationSink::Casefile),
+            ("blocking", PresentationSink::Leader),
+            ("timeout", PresentationSink::Leader),
+        ] {
+            let legacy = json!({"sink": "silent", "class": class});
+            let mapped = normalize_send_presentation(None, Some(&legacy)).unwrap();
+            assert_eq!(mapped.request.sink, sink, "{class}");
+            assert!(mapped.deprecation.is_some(), "{class}");
+        }
+    }
+
+    #[test]
+    fn s011_stage_classes_require_result_route() {
+        for class in ["stage_result", "stage_pass", "bounce", "final_review"] {
+            let legacy = json!({"sink": "leader", "class": class});
+            assert_eq!(
+                normalize_send_presentation(None, Some(&legacy)).unwrap_err(),
+                format!("deprecated_message_class:{class}_requires_result_route")
+            );
+        }
+    }
 }