@team-agent/installer 0.5.63 → 0.5.65

package/crates/team-agent/src/lifecycle/restart/remove.rs

@@ -5,8 +5,8 @@ use super::*;
 use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
 
 /// `remove_agent(workspace, agent_id, from_spec, force, team)`(`lifecycle/agents.py:22`)。
-/// 从 spec/state/team_state/role-file/agent_health 原子摘除;`_RemoveRollback` 字节级快照
-/// 回滚全部。未传 from_spec 确认 / 运行中未传 force → 拒绝。
+/// 从 spec/state/team_state/agent_health 原子摘除；role markdown 是用户资产，始终保留。
+/// `_RemoveRollback` 字节级快照回滚全部运行时变更。未传 from_spec 确认 / 运行中未传 force → 拒绝。
 pub fn remove_agent(
     workspace: &Path,
     agent_id: &AgentId,
@@ -567,9 +567,6 @@ fn remove_agent_inner(
             write_remove_step_event(paths.run_workspace, agent_id, "stop", &target, Some(true))?;
         }
     }
-    let dynamic_role_path =
-        managed_dynamic_role_file_path(paths.run_workspace, &working_state, agent_id)?;
-    let dynamic_role_required = has_recorded_dynamic_role_file(&working_state, agent_id);
     // golden agents.py:81-83: removed_state = deepcopy(state); pop the agent; save_team_scoped_state
     // (team projection) — NOT a raw save, so other teams in a multi-team workspace are preserved.
     let mut removed_state = working_state;
@@ -623,22 +620,10 @@ fn remove_agent_inner(
         "team.spec.yaml",
         None,
     )?;
-    let role_file_removed = match dynamic_role_path.as_deref() {
-        Some(path) => remove_dynamic_role_file(path, dynamic_role_required)?,
-        None => false,
-    };
-    if role_file_removed {
-        let dynamic_role_path = dynamic_role_path.as_deref().expect("managed role path");
-        let resource = dynamic_role_path.to_string_lossy().to_string();
-        cleared_locations.push(serde_json::json!(resource));
-        write_remove_step_event(
-            paths.run_workspace,
-            agent_id,
-            "role_file",
-            &dynamic_role_path.to_string_lossy(),
-            None,
-        )?;
-    }
+    // Role markdown is user-owned input, including files under the registered
+    // dynamic-role path. Removing a seat only unregisters runtime state/spec;
+    // cleanup is intentionally not part of the default operation.
+    let role_file_removed = false;
     let agent_health_deleted = delete_agent_health(paths.run_workspace, team_key, agent_id)?;
     cleared_locations.push(serde_json::json!("agent_health"));
     write_remove_step_event(
@@ -976,92 +961,6 @@ fn task_without_agent_assignee(task: &YamlValue, agent_id: &AgentId) -> YamlValu
     )
 }
 
-fn remove_dynamic_role_file(path: &Path, required: bool) -> Result<bool, LifecycleError> {
-    match std::fs::remove_file(path) {
-        Ok(()) => Ok(true),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound && required => Err(
-            LifecycleError::StatePersist(format!("dynamic role file missing: {}", path.display())),
-        ),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(false),
-        Err(e) => Err(LifecycleError::StatePersist(format!(
-            "remove role file {}: {e}",
-            path.display()
-        ))),
-    }
-}
-
-fn dynamic_role_file_path(
-    workspace: &Path,
-    state: &serde_json::Value,
-    agent_id: &AgentId,
-) -> std::path::PathBuf {
-    if let Some(raw) = state
-        .get("agents")
-        .and_then(|v| v.get(agent_id.as_str()))
-        .and_then(|v| v.get("dynamic_role_file"))
-        .and_then(|v| v.as_str())
-        .filter(|s| !s.is_empty())
-    {
-        let path = std::path::PathBuf::from(raw);
-        if path.is_absolute() {
-            return path;
-        }
-        return workspace.join(path);
-    }
-    workspace
-        .join(".team")
-        .join("dynamic-role-files")
-        .join(format!("{}.md", agent_id.as_str()))
-}
-
-/// Resolve a deletable role artifact. `dynamic_role_file` may point at an
-/// external `--role-file`; only canonical children of the runtime-managed
-/// directory belong to remove/rollback. A symlink escape is external.
-fn managed_dynamic_role_file_path(
-    workspace: &Path,
-    state: &serde_json::Value,
-    agent_id: &AgentId,
-) -> Result<Option<std::path::PathBuf>, LifecycleError> {
-    let path = dynamic_role_file_path(workspace, state, agent_id);
-    let managed_root = workspace.join(".team").join("dynamic-role-files");
-    let canonical_root = match std::fs::canonicalize(&managed_root) {
-        Ok(path) => path,
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
-            return Ok(path.starts_with(&managed_root).then_some(path));
-        }
-        Err(error) => {
-            return Err(LifecycleError::StatePersist(format!(
-                "resolve managed role root {}: {error}",
-                managed_root.display()
-            )))
-        }
-    };
-    let canonical_path = match std::fs::canonicalize(&path) {
-        Ok(path) => path,
-        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
-            return Ok(path.starts_with(&managed_root).then_some(path));
-        }
-        Err(error) => {
-            return Err(LifecycleError::StatePersist(format!(
-                "resolve role file {}: {error}",
-                path.display()
-            )))
-        }
-    };
-    Ok(canonical_path
-        .starts_with(&canonical_root)
-        .then_some(canonical_path))
-}
-
-fn has_recorded_dynamic_role_file(state: &serde_json::Value, agent_id: &AgentId) -> bool {
-    state
-        .get("agents")
-        .and_then(|v| v.get(agent_id.as_str()))
-        .and_then(|v| v.get("dynamic_role_file"))
-        .and_then(|v| v.as_str())
-        .is_some_and(|s| !s.is_empty())
-}
-
 fn delete_agent_health(
     workspace: &Path,
     owner_team_id: &str,
@@ -1127,8 +1026,6 @@ struct RemoveRollback {
     state: serde_json::Value,
     team_state_text: Option<String>,
     team_state_path: std::path::PathBuf,
-    dynamic_role_bytes: Option<Vec<u8>>,
-    dynamic_role_path: Option<std::path::PathBuf>,
     /// golden agents.py:185: the agent_health row captured BEFORE delete, re-upserted on rollback.
     health: Option<CapturedHealth>,
     restore_running: bool,
@@ -1164,15 +1061,6 @@ impl RemoveRollback {
                 )))
             }
         };
-        let dynamic_role_path = managed_dynamic_role_file_path(workspace, state, agent_id)?;
-        let dynamic_role_bytes = match dynamic_role_path.as_deref() {
-            Some(path) => match std::fs::read(path) {
-                Ok(bytes) => Some(bytes),
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
-                Err(e) => return Err(LifecycleError::StatePersist(format!("read role file: {e}"))),
-            },
-            None => None,
-        };
         let health = select_agent_health(workspace, team_key, agent_id)?;
         Ok(Self {
             agent_id: agent_id.clone(),
@@ -1181,15 +1069,13 @@ impl RemoveRollback {
             state: state.clone(),
             team_state_text,
             team_state_path,
-            dynamic_role_bytes,
-            dynamic_role_path,
             health,
             restore_running: false,
         })
     }
 
     /// golden agents.py:189-227 `_RemoveRollback.restore`: BEST-EFFORT — wrap EACH artifact restore
-    /// (spec → workspace_state → team_state → role_file → agent_health) in its own try/except, append
+    /// (spec → workspace_state → team_state → agent_health) in its own try/except, append
     /// per-artifact failures to `errors`, and NEVER short-circuit on the first failure. The worker is
     /// only re-started when restore_running AND no errors. Returns the collected error strings (empty
     /// == ok); the caller re-raises the ORIGINAL operation error annotated with rollback_ok.
@@ -1236,24 +1122,6 @@ impl RemoveRollback {
         if let Err(e) = team_state_result {
             errors.push(format!("team_state:{e}"));
         }
-        // role_file
-        let role_file_result = match (&self.dynamic_role_path, &self.dynamic_role_bytes) {
-            (Some(path), Some(bytes)) => {
-                if let Some(parent) = path.parent() {
-                    let _ = std::fs::create_dir_all(parent);
-                }
-                std::fs::write(path, bytes)
-            }
-            (Some(path), None) => match std::fs::remove_file(path) {
-                Ok(()) => Ok(()),
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
-                Err(e) => Err(e),
-            },
-            (None, _) => Ok(()),
-        };
-        if let Err(e) = role_file_result {
-            errors.push(format!("role_file:{e}"));
-        }
         if self.restore_running && errors.is_empty() {
             if let Err(e) = start_agent_at_paths(
                 workspace,

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -1,6 +1,6 @@
 use super::launch_spawn::{
-    quick_start_team_dir, seed_healthy_coordinator, DELEG_ROLE_ALPHA, DELEG_ROLE_BRAVO,
-    QS_VALID_ROLE,
+    quick_start_team_dir, restart_ws_two_resumable_workers, seed_healthy_coordinator,
+    DELEG_ROLE_ALPHA, DELEG_ROLE_BRAVO, QS_VALID_ROLE,
 };
 use super::*;
 use crate::transport::test_support::OfflineTransport;
@@ -52,6 +52,149 @@ pub(super) fn lanea_team_ws(status: &str) -> PathBuf {
     ws
 }
 
+// A-31 RED: a stale pane must not be treated as a live seat merely because its
+// old window name still exists. The assertion is on the physical spawn record,
+// not on start-agent's success-shaped return value.
+#[test]
+fn start_agent_pane_dead_must_not_noop_on_live_window() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    state["agents"]["alpha"]["pane_id"] = json!("%dead");
+    state["agents"]["alpha"]["stale"] = json!(true);
+    state["agents"]["alpha"]["stale_reason"] = json!("pane_dead");
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")])
+        .with_pane_presence("%dead", false)
+        .with_liveness("%dead", crate::transport::PaneLiveness::Dead);
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        !transport.spawn_records().is_empty(),
+        "A-31: pane_dead must trigger a physical respawn even when the stale window remains; asserting only the command's success-shaped return would miss the Noop bug"
+    );
+}
+
+// A-31 RED: a live pane from another session is not this agent's live seat.
+// The assertion is on the physical spawn record, not on start-agent's
+// success-shaped return value.
+#[test]
+fn start_agent_foreign_live_pane_must_respawn_for_intended_window() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    state["agents"]["alpha"]["pane_id"] = json!("%foreign");
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let foreign = crate::transport::PaneInfo {
+        pane_id: crate::transport::PaneId::new("%foreign"),
+        session: crate::transport::SessionName::new("foreign-session"),
+        window_index: None,
+        window_name: Some(crate::transport::WindowName::new("foreign-window")),
+        pane_index: None,
+        tty: None,
+        current_command: None,
+        current_path: None,
+        active: true,
+        pane_pid: None,
+        leader_env: std::collections::BTreeMap::new(),
+    };
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")])
+        .with_targets(vec![foreign])
+        .with_pane_presence("%foreign", true)
+        .with_liveness("%foreign", crate::transport::PaneLiveness::Live);
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        !transport.spawn_records().is_empty(),
+        "A-31: a physically live pane owned by another session must trigger a physical respawn for alpha; start-agent must not Noop on foreign pane %foreign"
+    );
+}
+
+// A-35 mirror RED: an ownership query failure is missing evidence, not proof
+// that the cached live pane is foreign. start-agent must retain the base
+// conservative Noop direction and leave retry authority to the operator.
+#[test]
+fn start_agent_transport_ownership_query_failure_must_not_respawn_live_pane() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    state["agents"]["alpha"]["pane_id"] = json!("%transport-error");
+    state["agents"]["alpha"]["stale"] = json!(false);
+    state["agents"]["alpha"]["stale_reason"] = serde_json::Value::Null;
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")])
+        .with_pane_presence("%transport-error", true)
+        .with_liveness("%transport-error", crate::transport::PaneLiveness::Live)
+        .with_list_targets_error("simulated tmux snapshot failure");
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        transport.spawn_records().is_empty(),
+        "A-35 mirror: list_targets failure is missing ownership evidence, not proof of a foreign/dead pane; a physically live cached pane must not trigger a duplicate spawn"
+    );
+}
+
+// A-31 guard RED: an explicit pane_dead reason remains positive death
+// evidence even when the persisted pane tuple is absent.
+#[test]
+fn start_agent_pane_dead_reason_must_respawn_without_cached_pane_id() {
+    let ws = restart_ws_two_resumable_workers();
+    let mut state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    let agent = state["agents"]["alpha"].as_object_mut().unwrap();
+    agent.remove("pane_id");
+    agent.insert("stale".to_string(), json!(true));
+    agent.insert("stale_reason".to_string(), json!("pane_dead"));
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_windows(vec![crate::transport::WindowName::new("alpha")]);
+    let _ = start_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        false,
+        false,
+        None,
+        &transport,
+    );
+
+    assert!(
+        !transport.spawn_records().is_empty(),
+        "A-31 guard: stale_reason=pane_dead is positive death evidence and must trigger a physical respawn even when no cached pane_id remains"
+    );
+}
+
 // remove_agent [P0] — from_spec + force on a NON-running agent atomically removes it from state.agents
 // (golden agents.py: pop agents[agent_id] + save). Pure fs/state (non-running -> no stop/tmux). Today the
 // stub returns OwnerRefused and removes nothing -> RED.
@@ -375,9 +518,9 @@ if [ "$track" != 1 ]; then
 fi
 # 0.5.39 Slice 2: worker spawn now goes through the worker shell
 # wrapper (tmux-server-death-locate §7 Slice 2), which embeds a
-# printf format literal containing "\n" bytes so the pane returns to
-# an interactive shell with an explicit exit marker instead of
-# collapsing to `[exited]`. Those embedded newlines land inside the
+# printf format literal containing "\n" bytes so the pane retains an
+# inert sh tail with an explicit exit marker instead of collapsing to
+# `[exited]`. Those embedded newlines land inside the
 # tmux argv payload, so a naive `printf '%s\n' "$*"` writes multiple
 # lines per tmux invocation and downstream `raw.lines()` scans see
 # fake "argv" lines that carry only the marker text. Escape newlines

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -1390,6 +1390,45 @@ fn remove_preserves_external_role_source_for_both_flag_forms() {
     }
 }
 
+// A-28 RED: the role markdown recorded for a seat is still a user asset. The
+// default remove path must unregister the seat without deleting the managed
+// registration-path document.
+#[test]
+fn remove_agent_preserves_registered_role_markdown_by_default() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": {
+            "status": "stopped",
+            "provider": "codex",
+            "window": "alpha",
+            "dynamic_role_file": ".team/dynamic-role-files/alpha.md"
+        },
+        "bravo": { "status": "stopped", "provider": "codex", "window": "bravo" }
+    }));
+    let role = ws.join(".team/dynamic-role-files/alpha.md");
+    std::fs::create_dir_all(role.parent().unwrap()).unwrap();
+    let original = b"user-authored registered role\n";
+    std::fs::write(&role, original).unwrap();
+
+    let result = remove_agent_with_transport(
+        &ws,
+        &aid("alpha"),
+        false,
+        true,
+        None,
+        &LaneTransport::new("team-laneateam", &[]),
+    );
+    assert!(result.is_ok(), "remove-agent should unregister the seat: {result:?}");
+    assert!(
+        role.exists(),
+        "A-28: remove-agent must preserve the registered role markdown by default"
+    );
+    assert_eq!(
+        std::fs::read(&role).unwrap(),
+        original,
+        "A-28: remove-agent must preserve the registered role markdown by default"
+    );
+}
+
 #[cfg(unix)]
 #[test]
 fn remove_preserves_managed_path_symlink_escape() {
@@ -1564,26 +1603,19 @@ fn lanea_remove_rollback_restarts_force_stopped_worker() {
     );
 }
 
-// ── REMOVE #11 (remove-dynamic-role-path-and-required-8, warn) [RED] — missing REQUIRED role file raises
-// Golden agents.py:255-261 _remove_dynamic_role_file(path, required=True) RAISES "dynamic role file
-// missing: <path>" when the state recorded a dynamic_role_file but it is absent. Rust hardcodes the
-// default path and returns Ok(false) silently (restart.rs:951-953), losing the hard-fail+rollback. RED:
-// a dynamic agent whose recorded role file is MISSING must raise, not silently complete the removal.
+// A recorded role path is user-owned input, not a remove-agent precondition.
+// Missing role markdown therefore must not block unregistering the seat.
 #[test]
-fn lanea_remove_dynamic_role_file_missing_raises() {
+fn lanea_remove_dynamic_role_file_missing_does_not_block_unregister() {
     let ws = lanea_ws_agents(json!({
         "alpha": { "status": "stopped", "provider": "codex", "window": "alpha", "dynamic_role_file": ".team/dynamic-role-files/custom.md" }, // file NOT created
         "bravo": { "status": "stopped", "provider": "codex", "window": "bravo" }
     }));
     let tx = LaneTransport::new("team-laneateam", &[]);
-    let text = format!(
-        "{:?}",
-        remove_agent_with_transport(&ws, &aid("alpha"), true, true, None, &tx)
-    );
+    let result = remove_agent_with_transport(&ws, &aid("alpha"), true, true, None, &tx);
     assert!(
-        text.contains("dynamic role file missing"),
-        "golden agents.py:259-260: a state-recorded dynamic_role_file that is MISSING must RAISE 'dynamic role \
-         file missing: <path>' (required=true); Rust returns Ok(false) silently and completes the remove. got {text}"
+        result.is_ok(),
+        "remove-agent must unregister even when a recorded role path is missing; got {result:?}"
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/startup_latency_contract.rs

@@ -167,13 +167,17 @@ fn restart_failure_aggregation_matches_serial_semantics_without_early_abort() {
         ["w1", "w2", "w4", "w5", "w6", "w7", "w8"],
         "R2: successful workers after w3 must still be spawned and reported"
     );
+    let mut observed_spawn_windows = transport
+        .spawn_calls()
+        .into_iter()
+        .map(|call| call.window)
+        .collect::<Vec<_>>();
+    let mut expected_spawn_windows = worker_ids(8);
+    observed_spawn_windows.sort();
+    expected_spawn_windows.sort();
     assert_eq!(
-        transport
-            .spawn_calls()
-            .iter()
-            .map(|call| call.window.as_str())
-            .collect::<Vec<_>>(),
-        worker_ids(8),
+        observed_spawn_windows,
+        expected_spawn_windows,
         "R2: failure aggregation must attempt the full plan; no early return after w3"
     );
 

package/crates/team-agent/src/lifecycle/tests.rs

@@ -24,17 +24,23 @@ fn sess(s: &str) -> SessionName {
 pub(crate) fn test_binary_path() -> &'static str {
     static PATH: OnceLock<String> = OnceLock::new();
     PATH.get_or_init(|| {
-        if let Ok(path) = std::env::var("CARGO_BIN_EXE_team-agent") {
-            return path;
-        }
-        let current = std::env::current_exe().expect("test executable path");
-        current
+        let path = if let Ok(path) = std::env::var("CARGO_BIN_EXE_team-agent") {
+            path
+        } else {
+            let current = std::env::current_exe().expect("test executable path");
+            current
             .parent()
             .and_then(|deps| deps.parent())
             .map(|target| target.join("team-agent"))
             .expect("team-agent test binary path")
             .to_string_lossy()
             .into_owned()
+        };
+        assert!(
+            std::path::Path::new(&path).is_file(),
+            "team-agent test binary does not exist: {path}; run `cargo build -p team-agent --bin team-agent` first"
+        );
+        path
     })
     .as_str()
 }

package/crates/team-agent/src/mcp_server/helpers.rs

@@ -211,6 +211,7 @@ pub(crate) fn delivery_outcome_value(out: &DeliveryOutcome) -> Value {
         "ok": out.ok,
         "status": enum_value(out.status),
         "message_id": out.message_id,
+        "ack_forced_off": out.ack_forced_off,
     });
     if let Some(obj) = value.as_object_mut() {
         if let Some(reason) = out.reason {