@team-agent/installer 0.5.63 → 0.5.64

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.63"
+version = "0.5.64"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.63"
+version = "0.5.64"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -131,8 +131,35 @@ pub(crate) fn start_agent_at_paths(
             return Err(LifecycleError::RequirementUnmet(error));
         }
     }
-    let agent_live = if adaptive_layout {
-        agent_pane_live(transport, &raw_agent)
+    // A persisted window name is only a topology hint. Once a pane binding is
+    // recorded, the pane must be both physically live and owned by the
+    // intended session/window; a foreign pane must never make start-agent
+    // return Noop. A coordinator-provided pane_dead reason is also
+    // authoritative when a backend cannot answer the exact-pane probe.
+    let pane_marked_dead = raw_agent
+        .get("stale_reason")
+        .and_then(serde_json::Value::as_str)
+        .is_some_and(|reason| matches!(reason, "pane_dead" | "both"));
+    // A stale cached pane may still be recoverable without a spawn when the
+    // intended per-agent window has exactly one live pane. The pane found by
+    // this session/window lookup, not the cached id, is the binding that the
+    // Noop path refreshes. A foreign pane with no intended window still falls
+    // through to a real spawn.
+    let noop_pane = if adaptive_layout {
+        None
+    } else {
+        single_live_pane_for_window(transport, &session_name, &window)
+    };
+    let agent_live = if pane_marked_dead {
+        false
+    } else if adaptive_layout
+        || raw_agent
+            .get("pane_id")
+            .and_then(serde_json::Value::as_str)
+            .is_some_and(|pane| !pane.is_empty())
+    {
+        agent_pane_owned_and_live(transport, &raw_agent, &session_name, &window)
+            || noop_pane.is_some()
     } else {
         window_exists(transport, &session_name, &window)
     };
@@ -145,11 +172,6 @@ pub(crate) fn start_agent_at_paths(
     // state — assert_topology_invariants from Step 1 catches the
     // upstream corruption.
     let has_collision = pane_conflicts_with_leader_or_other(&state, agent_id, &raw_agent);
-    let noop_pane = if adaptive_layout {
-        None
-    } else {
-        single_live_pane_for_window(transport, &session_name, &window)
-    };
     if has_collision && noop_pane.is_none() {
         eprintln!(
             "team_agent::layout e51_collision_post_step2 agent_id=`{agent_id}` \
@@ -603,7 +625,12 @@ fn pane_socket_binding(value: &serde_json::Value) -> Option<PaneSocketBinding<'_
     })
 }
 
-fn agent_pane_live(transport: &dyn crate::transport::Transport, agent: &serde_json::Value) -> bool {
+fn agent_pane_owned_and_live(
+    transport: &dyn crate::transport::Transport,
+    agent: &serde_json::Value,
+    expected_session: &crate::transport::SessionName,
+    expected_window: &str,
+) -> bool {
     let Some(pane) = agent
         .get("pane_id")
         .and_then(serde_json::Value::as_str)
@@ -612,7 +639,22 @@ fn agent_pane_live(transport: &dyn crate::transport::Transport, agent: &serde_js
     else {
         return false;
     };
-    agent_pane_live_by_id(transport, &pane)
+    let Ok(targets) = transport.list_targets() else {
+        // Ownership is unknown when the topology snapshot fails. Preserve the
+        // base liveness direction: only positive death evidence may authorize
+        // a destructive respawn; otherwise fall back to the pane probe and
+        // leave retry authority to the operator.
+        return agent_pane_live_by_id(transport, &pane);
+    };
+    let owned = targets.iter().any(|target| {
+        target.pane_id == pane
+            && target.session.as_str() == expected_session.as_str()
+            && target
+                .window_name
+                .as_ref()
+                .is_some_and(|window| window.as_str() == expected_window)
+    });
+    owned && agent_pane_live_by_id(transport, &pane)
 }
 
 fn agent_pane_live_by_id(

package/crates/team-agent/src/lifecycle/restart/remove.rs

@@ -5,8 +5,8 @@ use super::*;
 use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
 
 /// `remove_agent(workspace, agent_id, from_spec, force, team)`(`lifecycle/agents.py:22`)。
-/// 从 spec/state/team_state/role-file/agent_health 原子摘除;`_RemoveRollback` 字节级快照
-/// 回滚全部。未传 from_spec 确认 / 运行中未传 force → 拒绝。
+/// 从 spec/state/team_state/agent_health 原子摘除；role markdown 是用户资产，始终保留。
+/// `_RemoveRollback` 字节级快照回滚全部运行时变更。未传 from_spec 确认 / 运行中未传 force → 拒绝。
 pub fn remove_agent(
     workspace: &Path,
     agent_id: &AgentId,
@@ -567,9 +567,6 @@ fn remove_agent_inner(
             write_remove_step_event(paths.run_workspace, agent_id, "stop", &target, Some(true))?;
         }
     }
-    let dynamic_role_path =
-        managed_dynamic_role_file_path(paths.run_workspace, &working_state, agent_id)?;
-    let dynamic_role_required = has_recorded_dynamic_role_file(&working_state, agent_id);
     // golden agents.py:81-83: removed_state = deepcopy(state); pop the agent; save_team_scoped_state
     // (team projection) — NOT a raw save, so other teams in a multi-team workspace are preserved.
     let mut removed_state = working_state;
@@ -623,22 +620,10 @@ fn remove_agent_inner(
         "team.spec.yaml",
         None,
     )?;
-    let role_file_removed = match dynamic_role_path.as_deref() {
-        Some(path) => remove_dynamic_role_file(path, dynamic_role_required)?,
-        None => false,
-    };
-    if role_file_removed {
-        let dynamic_role_path = dynamic_role_path.as_deref().expect("managed role path");
-        let resource = dynamic_role_path.to_string_lossy().to_string();
-        cleared_locations.push(serde_json::json!(resource));
-        write_remove_step_event(
-            paths.run_workspace,
-            agent_id,
-            "role_file",
-            &dynamic_role_path.to_string_lossy(),
-            None,
-        )?;
-    }
+    // Role markdown is user-owned input, including files under the registered
+    // dynamic-role path. Removing a seat only unregisters runtime state/spec;
+    // cleanup is intentionally not part of the default operation.
+    let role_file_removed = false;
     let agent_health_deleted = delete_agent_health(paths.run_workspace, team_key, agent_id)?;
     cleared_locations.push(serde_json::json!("agent_health"));
     write_remove_step_event(
@@ -976,92 +961,6 @@ fn task_without_agent_assignee(task: &YamlValue, agent_id: &AgentId) -> YamlValu
     )
 }
 
-fn remove_dynamic_role_file(path: &Path, required: bool) -> Result<bool, LifecycleError> {
-    match std::fs::remove_file(path) {
-        Ok(()) => Ok(true),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound && required => Err(
-            LifecycleError::StatePersist(format!("dynamic role file missing: {}", path.display())),
-        ),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(false),
-        Err(e) => Err(LifecycleError::StatePersist(format!(
-            "remove role file {}: {e}",
-            path.display()
-        ))),
-    }
-}
-
-fn dynamic_role_file_path(
-    workspace: &Path,
-    state: &serde_json::Value,
-    agent_id: &AgentId,
-) -> std::path::PathBuf {
-    if let Some(raw) = state
-        .get("agents")
-        .and_then(|v| v.get(agent_id.as_str()))
-        .and_then(|v| v.get("dynamic_role_file"))
-        .and_then(|v| v.as_str())
-        .filter(|s| !s.is_empty())
-    {
-        let path = std::path::PathBuf::from(raw);
-        if path.is_absolute() {
-            return path;
-        }
-        return workspace.join(path);
-    }
-    workspace
-        .join(".team")
-        .join("dynamic-role-files")
-        .join(format!("{}.md", agent_id.as_str()))
-}
-
-/// Resolve a deletable role artifact. `dynamic_role_file` may point at an
-/// external `--role-file`; only canonical children of the runtime-managed
-/// directory belong to remove/rollback. A symlink escape is external.
-fn managed_dynamic_role_file_path(
-    workspace: &Path,
-    state: &serde_json::Value,
-    agent_id: &AgentId,
-) -> Result<Option<std::path::PathBuf>, LifecycleError> {
-    let path = dynamic_role_file_path(workspace, state, agent_id);
-    let managed_root = workspace.join(".team").join("dynamic-role-files");
-    let canonical_root = match std::fs::canonicalize(&managed_root) {
-        Ok(path) => path,
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
-            return Ok(path.starts_with(&managed_root).then_some(path));
-        }
-        Err(error) => {
-            return Err(LifecycleError::StatePersist(format!(
-                "resolve managed role root {}: {error}",
-                managed_root.display()
-            )))
-        }
-    };
-    let canonical_path = match std::fs::canonicalize(&path) {
-        Ok(path) => path,
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
-            return Ok(path.starts_with(&managed_root).then_some(path));
-        }
-        Err(error) => {
-            return Err(LifecycleError::StatePersist(format!(
-                "resolve role file {}: {error}",
-                path.display()
-            )))
-        }
-    };
-    Ok(canonical_path
-        .starts_with(&canonical_root)
-        .then_some(canonical_path))
-}
-
-fn has_recorded_dynamic_role_file(state: &serde_json::Value, agent_id: &AgentId) -> bool {
-    state
-        .get("agents")
-        .and_then(|v| v.get(agent_id.as_str()))
-        .and_then(|v| v.get("dynamic_role_file"))
-        .and_then(|v| v.as_str())
-        .is_some_and(|s| !s.is_empty())
-}
-
 fn delete_agent_health(
     workspace: &Path,
     owner_team_id: &str,
@@ -1127,8 +1026,6 @@ struct RemoveRollback {
     state: serde_json::Value,
     team_state_text: Option<String>,
     team_state_path: std::path::PathBuf,
-    dynamic_role_bytes: Option<Vec<u8>>,
-    dynamic_role_path: Option<std::path::PathBuf>,
     /// golden agents.py:185: the agent_health row captured BEFORE delete, re-upserted on rollback.
     health: Option<CapturedHealth>,
     restore_running: bool,
@@ -1164,15 +1061,6 @@ impl RemoveRollback {
                 )))
             }
         };
-        let dynamic_role_path = managed_dynamic_role_file_path(workspace, state, agent_id)?;
-        let dynamic_role_bytes = match dynamic_role_path.as_deref() {
-            Some(path) => match std::fs::read(path) {
-                Ok(bytes) => Some(bytes),
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
-                Err(e) => return Err(LifecycleError::StatePersist(format!("read role file: {e}"))),
-            },
-            None => None,
-        };
         let health = select_agent_health(workspace, team_key, agent_id)?;
         Ok(Self {
             agent_id: agent_id.clone(),
@@ -1181,15 +1069,13 @@ impl RemoveRollback {
             state: state.clone(),
             team_state_text,
             team_state_path,
-            dynamic_role_bytes,
-            dynamic_role_path,
             health,
             restore_running: false,
         })
     }
 
     /// golden agents.py:189-227 `_RemoveRollback.restore`: BEST-EFFORT — wrap EACH artifact restore
-    /// (spec → workspace_state → team_state → role_file → agent_health) in its own try/except, append
+    /// (spec → workspace_state → team_state → agent_health) in its own try/except, append
     /// per-artifact failures to `errors`, and NEVER short-circuit on the first failure. The worker is
     /// only re-started when restore_running AND no errors. Returns the collected error strings (empty
     /// == ok); the caller re-raises the ORIGINAL operation error annotated with rollback_ok.
@@ -1236,24 +1122,6 @@ impl RemoveRollback {
         if let Err(e) = team_state_result {
             errors.push(format!("team_state:{e}"));
         }
-        // role_file
-        let role_file_result = match (&self.dynamic_role_path, &self.dynamic_role_bytes) {
-            (Some(path), Some(bytes)) => {
-                if let Some(parent) = path.parent() {
-                    let _ = std::fs::create_dir_all(parent);
-                }
-                std::fs::write(path, bytes)
-            }
-            (Some(path), None) => match std::fs::remove_file(path) {
-                Ok(()) => Ok(()),
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
-                Err(e) => Err(e),
-            },
-            (None, _) => Ok(()),
-        };
-        if let Err(e) = role_file_result {
-            errors.push(format!("role_file:{e}"));
-        }
         if self.restore_running && errors.is_empty() {
             if let Err(e) = start_agent_at_paths(
                 workspace,

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -1,6 +1,6 @@
 use super::launch_spawn::{
-    quick_start_team_dir, seed_healthy_coordinator, DELEG_ROLE_ALPHA, DELEG_ROLE_BRAVO,
-    QS_VALID_ROLE,
+    quick_start_team_dir, restart_ws_two_resumable_workers, seed_healthy_coordinator,
+    DELEG_ROLE_ALPHA, DELEG_ROLE_BRAVO, QS_VALID_ROLE,
 };
 use super::*;
 use crate::transport::test_support::OfflineTransport;
@@ -52,6 +52,149 @@ pub(super) fn lanea_team_ws(status: &str) -> PathBuf {
     ws
 }
 
+// A-31 RED: a stale pane must not be treated as a live seat merely because its
+// old window name still exists. The assertion is on the physical spawn record,
+// not on start-agent's success-shaped return value.
+#[test]
+fn start_agent_pane_dead_must_not_noop_on_live_window() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    state["agents"]["alpha"]["pane_id"] = json!("%dead");
+    state["agents"]["alpha"]["stale"] = json!(true);
+    state["agents"]["alpha"]["stale_reason"] = json!("pane_dead");
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")])
+        .with_pane_presence("%dead", false)
+        .with_liveness("%dead", crate::transport::PaneLiveness::Dead);
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        !transport.spawn_records().is_empty(),
+        "A-31: pane_dead must trigger a physical respawn even when the stale window remains; asserting only the command's success-shaped return would miss the Noop bug"
+    );
+}
+
+// A-31 RED: a live pane from another session is not this agent's live seat.
+// The assertion is on the physical spawn record, not on start-agent's
+// success-shaped return value.
+#[test]
+fn start_agent_foreign_live_pane_must_respawn_for_intended_window() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    state["agents"]["alpha"]["pane_id"] = json!("%foreign");
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let foreign = crate::transport::PaneInfo {
+        pane_id: crate::transport::PaneId::new("%foreign"),
+        session: crate::transport::SessionName::new("foreign-session"),
+        window_index: None,
+        window_name: Some(crate::transport::WindowName::new("foreign-window")),
+        pane_index: None,
+        tty: None,
+        current_command: None,
+        current_path: None,
+        active: true,
+        pane_pid: None,
+        leader_env: std::collections::BTreeMap::new(),
+    };
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")])
+        .with_targets(vec![foreign])
+        .with_pane_presence("%foreign", true)
+        .with_liveness("%foreign", crate::transport::PaneLiveness::Live);
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        !transport.spawn_records().is_empty(),
+        "A-31: a physically live pane owned by another session must trigger a physical respawn for alpha; start-agent must not Noop on foreign pane %foreign"
+    );
+}
+
+// A-35 mirror RED: an ownership query failure is missing evidence, not proof
+// that the cached live pane is foreign. start-agent must retain the base
+// conservative Noop direction and leave retry authority to the operator.
+#[test]
+fn start_agent_transport_ownership_query_failure_must_not_respawn_live_pane() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    state["agents"]["alpha"]["pane_id"] = json!("%transport-error");
+    state["agents"]["alpha"]["stale"] = json!(false);
+    state["agents"]["alpha"]["stale_reason"] = serde_json::Value::Null;
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")])
+        .with_pane_presence("%transport-error", true)
+        .with_liveness("%transport-error", crate::transport::PaneLiveness::Live)
+        .with_list_targets_error("simulated tmux snapshot failure");
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        transport.spawn_records().is_empty(),
+        "A-35 mirror: list_targets failure is missing ownership evidence, not proof of a foreign/dead pane; a physically live cached pane must not trigger a duplicate spawn"
+    );
+}
+
+// A-31 guard RED: an explicit pane_dead reason remains positive death
+// evidence even when the persisted pane tuple is absent.
+#[test]
+fn start_agent_pane_dead_reason_must_respawn_without_cached_pane_id() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    let agent = state["agents"]["alpha"].as_object_mut().unwrap();
+    agent.remove("pane_id");
+    agent.insert("stale".to_string(), json!(true));
+    agent.insert("stale_reason".to_string(), json!("pane_dead"));
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")]);
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        !transport.spawn_records().is_empty(),
+        "A-31 guard: stale_reason=pane_dead is positive death evidence and must trigger a physical respawn even when no cached pane_id remains"
+    );
+}
+
 // remove_agent [P0] — from_spec + force on a NON-running agent atomically removes it from state.agents
 // (golden agents.py: pop agents[agent_id] + save). Pure fs/state (non-running -> no stop/tmux). Today the
 // stub returns OwnerRefused and removes nothing -> RED.

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -1390,6 +1390,45 @@ fn remove_preserves_external_role_source_for_both_flag_forms() {
     }
 }
 
+// A-28 RED: the role markdown recorded for a seat is still a user asset. The
+// default remove path must unregister the seat without deleting the managed
+// registration-path document.
+#[test]
+fn remove_agent_preserves_registered_role_markdown_by_default() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": {
+            "status": "stopped",
+            "provider": "codex",
+            "window": "alpha",
+            "dynamic_role_file": ".team/dynamic-role-files/alpha.md"
+        },
+        "bravo": { "status": "stopped", "provider": "codex", "window": "bravo" }
+    }));
+    let role = ws.join(".team/dynamic-role-files/alpha.md");
+    std::fs::create_dir_all(role.parent().unwrap()).unwrap();
+    let original = b"user-authored registered role\n";
+    std::fs::write(&role, original).unwrap();
+
+    let result = remove_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        true,
+        None,
+        &LaneTransport::new("team-laneateam", &[]),
+    );
+    assert!(result.is_ok(), "remove-agent should unregister the seat: {result:?}");
+    assert!(
+        role.exists(),
+        "A-28: remove-agent must preserve the registered role markdown by default"
+    );
+    assert_eq!(
+        std::fs::read(&role).unwrap(),
+        original,
+        "A-28: remove-agent must preserve the registered role markdown by default"
+    );
+}
+
 #[cfg(unix)]
 #[test]
 fn remove_preserves_managed_path_symlink_escape() {
@@ -1564,26 +1603,19 @@ fn lanea_remove_rollback_restarts_force_stopped_worker() {
     );
 }
 
-// ── REMOVE #11 (remove-dynamic-role-path-and-required-8, warn) [RED] — missing REQUIRED role file raises
-// Golden agents.py:255-261 _remove_dynamic_role_file(path, required=True) RAISES "dynamic role file
-// missing: <path>" when the state recorded a dynamic_role_file but it is absent. Rust hardcodes the
-// default path and returns Ok(false) silently (restart.rs:951-953), losing the hard-fail+rollback. RED:
-// a dynamic agent whose recorded role file is MISSING must raise, not silently complete the removal.
+// A recorded role path is user-owned input, not a remove-agent precondition.
+// Missing role markdown therefore must not block unregistering the seat.
 #[test]
-fn lanea_remove_dynamic_role_file_missing_raises() {
+fn lanea_remove_dynamic_role_file_missing_does_not_block_unregister() {
     let ws = lanea_ws_agents(json!({
         "alpha": { "status": "stopped", "provider": "codex", "window": "alpha", "dynamic_role_file": ".team/dynamic-role-files/custom.md" }, // file NOT created
         "bravo": { "status": "stopped", "provider": "codex", "window": "bravo" }
     }));
     let tx = LaneTransport::new("team-laneateam", &[]);
-    let text = format!(
-        "{:?}",
-        remove_agent_with_transport(&ws, &aid("alpha"), true, true, None, &tx)
-    );
+    let result = remove_agent_with_transport(&ws, &aid("alpha"), true, true, None, &tx);
     assert!(
-        text.contains("dynamic role file missing"),
-        "golden agents.py:259-260: a state-recorded dynamic_role_file that is MISSING must RAISE 'dynamic role \
-         file missing: <path>' (required=true); Rust returns Ok(false) silently and completes the remove. got {text}"
+        result.is_ok(),
+        "remove-agent must unregister even when a recorded role path is missing; got {result:?}"
     );
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.63",
+  "version": "0.5.64",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.63",
-    "@team-agent/cli-darwin-x64": "0.5.63",
-    "@team-agent/cli-linux-x64": "0.5.63"
+    "@team-agent/cli-darwin-arm64": "0.5.64",
+    "@team-agent/cli-darwin-x64": "0.5.64",
+    "@team-agent/cli-linux-x64": "0.5.64"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",