@team-agent/installer 0.5.65 → 0.5.68

package/crates/team-agent/src/messaging/helpers.rs

@@ -295,6 +295,7 @@ pub(crate) fn fail_leader_delivery(
             reason: Some(reason),
             channel: Some("fallback_log".to_string()),
             ack_forced_off: false,
+            turn_verification: None,
         });
     };
     store.mark(&message_id, "failed", error)?;
@@ -312,6 +313,7 @@ pub(crate) fn fail_leader_delivery(
         reason: Some(reason),
         channel: Some("fallback_inbox".to_string()),
         ack_forced_off: false,
+        turn_verification: None,
     })
 }
 

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -134,6 +134,7 @@ pub fn send_to_leader_receiver_with_presentation(
                 reason: Some(DeliveryRefusal::Duplicate),
                 channel: Some("leader_receiver".to_string()),
                 ack_forced_off: requires_ack,
+                turn_verification: None,
             });
         }
         PersistResolution::Persisted(persisted) => persisted.message_id,
@@ -176,6 +177,7 @@ pub fn send_to_leader_receiver_with_presentation(
                 reason: None,
                 channel: Some("leader_receiver".to_string()),
                 ack_forced_off: requires_ack,
+                turn_verification: None,
             });
         }
     }
@@ -213,6 +215,7 @@ pub fn send_to_leader_receiver_with_presentation(
         reason: None,
         channel: Some("leader_receiver".to_string()),
         ack_forced_off: requires_ack,
+        turn_verification: None,
     })
 }
 
@@ -259,6 +262,7 @@ pub fn deliver_to_leader_fallback_pane(
             reason: None,
             channel: Some("leader_receiver".to_string()),
             ack_forced_off: false,
+            turn_verification: None,
         });
     }
 
@@ -274,6 +278,7 @@ pub fn deliver_to_leader_fallback_pane(
             reason: None,
             channel: Some("leader_receiver".to_string()),
             ack_forced_off: false,
+            turn_verification: None,
         });
     }
 
@@ -316,6 +321,7 @@ pub fn deliver_to_leader_fallback_pane(
             reason: Some(DeliveryRefusal::LeaderNotAttached),
             channel: Some("fallback_pane".to_string()),
             ack_forced_off: false,
+            turn_verification: None,
         });
     };
 
@@ -390,9 +396,40 @@ pub fn deliver_to_leader_fallback_pane(
             reason: Some(DeliveryRefusal::LeaderNotAttached),
             channel: Some("rebind_required".to_string()),
             ack_forced_off: false,
+            turn_verification: None,
         });
     };
     let target = Target::Pane(PaneId::new(channel.pane_id));
+    if super::delivery::token_already_visible(
+        transport.as_ref(),
+        state,
+        "leader",
+        &target,
+        message_id,
+    ) {
+        event_log.write(
+            "leader_receiver.duplicate_token_refused",
+            serde_json::json!({
+                "message_id": message_id,
+                "result_id": result_id,
+                "pane_id": pane_id,
+                "reason": "message_token_already_visible",
+                "delivered_via": "fallback_pane",
+            }),
+        )?;
+        return Ok(DeliveryOutcome {
+            ok: true,
+            status: DeliveryStatus::AlreadyDelivered,
+            message_status: MessageStatusShadow("delivered".to_string()),
+            message_id: Some(message_id.to_string()),
+            verification: Some("message_token_already_visible".to_string()),
+            stage: Some(DeliveryStage::Submit),
+            reason: None,
+            channel: Some("fallback_pane".to_string()),
+            ack_forced_off: false,
+            turn_verification: None,
+        });
+    }
     let inject_result: Result<InjectReport, TransportError> =
         transport.inject(&target, &payload, Key::Enter, true);
 
@@ -443,6 +480,7 @@ pub fn deliver_to_leader_fallback_pane(
                             reason: None,
                             channel: Some("leader_acceptance_pending".to_string()),
                             ack_forced_off: false,
+                            turn_verification: None,
                         });
                     }
                     super::delivery::LeaderReceiptObservation::TokenObserved => {}
@@ -470,6 +508,7 @@ pub fn deliver_to_leader_fallback_pane(
                     reason: None,
                     channel: Some("fallback_pane".to_string()),
                     ack_forced_off: false,
+                    turn_verification: None,
                 })
             } else {
                 let reason = format!(
@@ -496,6 +535,7 @@ pub fn deliver_to_leader_fallback_pane(
                     reason: None,
                     channel: Some("fallback_pane".to_string()),
                     ack_forced_off: false,
+                    turn_verification: None,
                 })
             }
         }
@@ -538,6 +578,7 @@ pub fn deliver_to_leader_fallback_pane(
                 reason: Some(DeliveryRefusal::TmuxTargetMissing),
                 channel: Some(channel),
                 ack_forced_off: false,
+                turn_verification: None,
             })
         }
     }
@@ -656,7 +697,17 @@ fn message_already_delivered(
         .optional()?;
     Ok(matches!(
         status.as_deref(),
-        Some("delivered" | "acknowledged" | "submitted" | "submitted_unverified")
+        Some(
+            "delivered"
+                | "acknowledged"
+                | "submitted"
+                | "submitted_unverified"
+                | "submitted_pending_acceptance"
+                | "injected_awaiting_receipt"
+                | "visible"
+                | "injected"
+                | "consumed"
+        )
     ))
 }
 
@@ -730,5 +781,6 @@ pub fn enqueue_leader_mailbox_until_attach(
         reason: None,
         channel: Some("leader_mailbox".to_string()),
         ack_forced_off: false,
+        turn_verification: None,
     })
 }

package/crates/team-agent/src/messaging/results.rs

@@ -940,6 +940,7 @@ fn report_result_for_owner_team_inner(
                 reason: Some(crate::messaging::DeliveryRefusal::LeaderNotAttached),
                 channel: Some("codex_app_server".to_string()),
                 ack_forced_off: false,
+                turn_verification: None,
             }
         }
         Err(error) => {
@@ -1005,6 +1006,7 @@ fn report_result_for_owner_team_inner(
                         reason: None,
                         channel: Some("leader_receiver".to_string()),
                         ack_forced_off: false,
+                        turn_verification: None,
                     };
                     break;
                 }
@@ -1035,6 +1037,7 @@ fn report_result_for_owner_team_inner(
                         reason: None,
                         channel: Some("leader_receiver".to_string()),
                         ack_forced_off: false,
+                        turn_verification: None,
                     };
                     break;
                 }
@@ -1051,6 +1054,7 @@ fn report_result_for_owner_team_inner(
                         reason: None,
                         channel: Some("leader_receiver".to_string()),
                         ack_forced_off: false,
+                        turn_verification: None,
                     };
                     break;
                 }

package/crates/team-agent/src/messaging/send.rs

@@ -215,6 +215,7 @@ pub fn send_message(
                 reason: Some(crate::messaging::DeliveryRefusal::EmptyTargetList),
                 channel: None,
                 ack_forced_off: false,
+                turn_verification: None,
             });
         }
         MessageTarget::Fanout(recipients) => {
@@ -316,6 +317,7 @@ pub fn send_message(
             None,
         );
     }
+    capture_missing_sessions_after_send(workspace);
     if let Some(CoordinatorUnavailableGate {
         mut outcome,
         persist: true,
@@ -353,9 +355,34 @@ pub fn send_message(
         reason: None,
         channel: None,
         ack_forced_off: false,
+        turn_verification: None,
     })
 }
 
+fn capture_missing_sessions_after_send(workspace: &Path) {
+    let Ok(mut state) = crate::state::persist::load_runtime_state(workspace) else {
+        return;
+    };
+    let Ok(report) = crate::session_capture::capture_missing_provider_sessions_once(
+        &mut state,
+        &mut crate::provider::get_adapter,
+        false,
+        0,
+    ) else {
+        return;
+    };
+    if report.changed || !report.assigned.is_empty() {
+        // The post-send capture backfill routes through `StateRepository` with
+        // the `MessagingSessionCapture` intent; dispatch is the same root
+        // helper this callsite used directly before, and the error is still
+        // ignored because the capture is best-effort.
+        let _ = crate::state::repository::StateRepository::new(workspace).save(
+            crate::state::repository::StateWriteIntent::MessagingSessionCapture,
+            &state,
+        );
+    }
+}
+
 fn persist_stored_only_send(
     workspace: &Path,
     recipient: LogicalRecipient,
@@ -407,6 +434,7 @@ fn persist_stored_only_send(
         reason: None,
         channel: Some(presentation.effective_sink.as_str().to_string()),
         ack_forced_off: false,
+        turn_verification: None,
     })
 }
 
@@ -455,6 +483,7 @@ fn refused_outcome_with_id(reason: DeliveryRefusal, message_id: Option<String>)
         reason: Some(reason),
         channel: None,
         ack_forced_off: false,
+        turn_verification: None,
     }
 }
 
@@ -472,6 +501,7 @@ fn refused_outcome_with_verification(
         reason: Some(reason),
         channel: None,
         ack_forced_off: false,
+        turn_verification: None,
     }
 }
 
@@ -555,6 +585,7 @@ fn coordinator_unavailable_outcome(
             reason: Some(DeliveryRefusal::CoordinatorUnavailable),
             channel: Some("coordinator_unavailable".to_string()),
             ack_forced_off: false,
+            turn_verification: None,
         },
     }))
 }
@@ -580,6 +611,7 @@ fn rebind_required_outcome_with_verification(
         reason: Some(DeliveryRefusal::LeaderNotAttached),
         channel: Some("rebind_required".to_string()),
         ack_forced_off: false,
+        turn_verification: None,
     }
 }
 
@@ -812,6 +844,7 @@ pub(crate) fn session_drift_refusal(
         reason: Some(DeliveryRefusal::SessionDrift),
         channel: None,
         ack_forced_off: false,
+        turn_verification: None,
     }))
 }
 
@@ -933,5 +966,6 @@ fn fanout_send(
             channel_label.to_string()
         }),
         ack_forced_off: false,
+        turn_verification: None,
     })
 }

package/crates/team-agent/src/messaging/tests/dup_inject.rs

@@ -0,0 +1,406 @@
+//! ---
+//! purpose: 消息双投三机制回归——claim 闸、observer 落盘失败、token 幂等
+//! contract:
+//!   provides:
+//!     - name: dup-inject-unit
+//!       what: 同 message_id 二次 deliver 不得再 inject；observer 失败不返 Err 重投
+//!   requires:
+//!     - name: recording-transport
+//!       what: 捕获 pane 文本与 inject 次数
+//! boundary:
+//!   - 不作为活体验收；活体三臂装置在 scripts/repro/repro_dup_inject.sh
+//! maturity: wired
+//! ---
+
+use super::*;
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+
+use crate::event_log::EventLog;
+use crate::message_store::MessageStore;
+use crate::messaging::leader_receiver::deliver_to_leader_fallback_pane;
+use crate::transport::{
+    AttachOutcome, BackendKind, CaptureRange, CapturedText, InjectPayload, InjectReport,
+    InjectStage, InjectVerification, Key, PaneField, PaneId, PaneInfo, PaneLiveness, SessionName,
+    SetEnvOutcome, SpawnResult, SubmitVerification, Target, Transport, TransportError,
+    TurnVerification, WindowName,
+};
+
+#[test]
+fn error_retry_claim_is_single_winner_across_two_delivers() {
+    let case = WorkerCase::new("claim-gate", "fake");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_leader_to_worker("claim canary");
+    case.store
+        .mark(&message_id, "target_resolved", Some("probe_failed"))
+        .unwrap();
+
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("first retry after error");
+    assert!(
+        first.ok || first.status == DeliveryStatus::AlreadyDelivered,
+        "{first:?}"
+    );
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "first claim winner injects once"
+    );
+
+    case.store
+        .mark(&message_id, "target_resolved", Some("probe_failed"))
+        .unwrap();
+    let second = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("second retry after plant");
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "token already in pane must refuse the planted second inject: {second:?}"
+    );
+}
+
+#[test]
+fn observer_state_save_failure_after_enter_does_not_return_err() {
+    let case = WorkerCase::new("observer-degrade", "fake");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_leader_to_worker("observer canary");
+    poison_state_file(&case.workspace);
+
+    let outcome = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("physical Enter already sent; observer save must not reverse that into Err");
+    assert_eq!(transport.inject_count(), 1);
+    assert!(
+        case.events().contains("delivery.post_submit_state_degraded")
+            || outcome.ok
+            || outcome.status == DeliveryStatus::AlreadyDelivered,
+        "observer/state save failure must degrade, not reopen inject. outcome={outcome:?} events={}",
+        case.events()
+    );
+}
+
+#[test]
+fn pane_token_refuses_second_inject_for_claude_grok_cursor() {
+    for provider in ["claude", "grok", "cursor"] {
+        let case = WorkerCase::new(&format!("token-{provider}"), provider);
+        let transport = RecordingTransport::new("");
+        let message_id = case.seed_leader_to_worker(&format!("{provider} canary"));
+        let first = deliver_pending_message(
+            &case.workspace,
+            &case.store,
+            &transport,
+            &message_id,
+            &case.event_log,
+            &case.state,
+        )
+        .expect("first inject");
+        assert_eq!(
+            transport.inject_count(),
+            1,
+            "provider={provider} first inject failed: {first:?}"
+        );
+
+        case.store
+            .mark(&message_id, "target_resolved", Some("probe_failed"))
+            .unwrap();
+        let second = deliver_pending_message(
+            &case.workspace,
+            &case.store,
+            &transport,
+            &message_id,
+            &case.event_log,
+            &case.state,
+        )
+        .expect("second deliver");
+        assert_eq!(
+            transport.inject_count(),
+            1,
+            "provider={provider} pane token must refuse second inject: {second:?}"
+        );
+        assert!(
+            second.status == DeliveryStatus::AlreadyDelivered
+                || second.reason == Some(DeliveryRefusal::MessageAlreadyClaimed)
+                || case.events().contains("delivery.duplicate_token_refused"),
+            "provider={provider} missing duplicate refuse. outcome={second:?} events={}",
+            case.events()
+        );
+    }
+}
+
+#[test]
+fn transcript_token_refuses_second_inject() {
+    let case = WorkerCase::new("transcript", "claude");
+    let message_id = case.seed_leader_to_worker("transcript canary");
+    std::fs::write(
+        &case.rollout,
+        format!("user\n[team-agent-token:{message_id}]\n"),
+    )
+    .unwrap();
+    let transport = RecordingTransport::new("unrelated pane text");
+    case.store
+        .mark(&message_id, "target_resolved", Some("probe_failed"))
+        .unwrap();
+    let outcome = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("transcript hit");
+    assert_eq!(
+        transport.inject_count(),
+        0,
+        "transcript token must refuse inject: {outcome:?}"
+    );
+}
+
+#[test]
+fn fallback_already_delivered_uses_live_status_set() {
+    let workspace = tmp_ws("fallback-status");
+    let store = MessageStore::open(&workspace).unwrap();
+    let mid = store
+        .create_message(None, "w1", "leader", "fallback canary", None, false, None)
+        .unwrap();
+    store
+        .mark(&mid, "submitted_pending_acceptance", None)
+        .unwrap();
+
+    let event_log = EventLog::new(&workspace);
+    let state = serde_json::json!({
+        "active_team_key": "t",
+        "leader_receiver": {"pane_id": "%leader", "status": "attached"}
+    });
+    crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+    let outcome = deliver_to_leader_fallback_pane(
+        &workspace,
+        &state,
+        &mid,
+        None,
+        "fallback canary",
+        false,
+        Some("primary failed"),
+        &event_log,
+    )
+    .expect("fallback short-circuit");
+    assert_eq!(outcome.status, DeliveryStatus::AlreadyDelivered);
+}
+
+struct WorkerCase {
+    workspace: PathBuf,
+    rollout: PathBuf,
+    store: MessageStore,
+    event_log: EventLog,
+    state: serde_json::Value,
+}
+
+impl WorkerCase {
+    fn new(tag: &str, provider: &str) -> Self {
+        let workspace = tmp_ws(&format!("dup-inject-{tag}"));
+        let rollout = workspace.join(format!("{provider}-rollout.jsonl"));
+        std::fs::write(&rollout, "").unwrap();
+        let state = serde_json::json!({
+            "active_team_key": "dup-team",
+            "session_name": "team-dup",
+            "agents": {
+                "w1": {
+                    "pane_id": "%w1",
+                    "window": "w1",
+                    "provider": provider,
+                    "rollout_path": rollout,
+                }
+            }
+        });
+        crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+        let store = MessageStore::open(&workspace).unwrap();
+        let event_log = EventLog::new(&workspace);
+        Self {
+            workspace,
+            rollout,
+            store,
+            event_log,
+            state,
+        }
+    }
+
+    fn seed_leader_to_worker(&self, content: &str) -> String {
+        self.store
+            .create_message(None, "leader", "w1", content, None, false, None)
+            .unwrap()
+    }
+
+    fn events(&self) -> String {
+        self.event_log
+            .tail(0)
+            .unwrap()
+            .into_iter()
+            .map(|event| event.to_string())
+            .collect::<Vec<_>>()
+            .join("\n")
+    }
+}
+
+fn poison_state_file(workspace: &Path) {
+    let path = crate::state::persist::runtime_state_path(workspace);
+    let _ = std::fs::remove_file(&path);
+    std::fs::create_dir_all(&path).unwrap();
+}
+
+#[derive(Clone)]
+struct RecordingTransport {
+    injects: Arc<AtomicUsize>,
+    capture: Arc<Mutex<String>>,
+}
+
+impl RecordingTransport {
+    fn new(capture: &str) -> Self {
+        Self {
+            injects: Arc::new(AtomicUsize::new(0)),
+            capture: Arc::new(Mutex::new(capture.to_string())),
+        }
+    }
+
+    fn inject_count(&self) -> usize {
+        self.injects.load(Ordering::Relaxed)
+    }
+}
+
+impl Transport for RecordingTransport {
+    fn kind(&self) -> BackendKind {
+        BackendKind::Tmux
+    }
+
+    fn spawn_first(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("dup-inject tests do not spawn")
+    }
+
+    fn spawn_into(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _argv: &[String],
+        _cwd: &Path,
+        _env: &BTreeMap<String, String>,
+    ) -> Result<SpawnResult, TransportError> {
+        unreachable!("dup-inject tests do not spawn")
+    }
+
+    fn inject(
+        &self,
+        _target: &Target,
+        payload: &InjectPayload,
+        _submit: Key,
+        _bracketed_paste: bool,
+    ) -> Result<InjectReport, TransportError> {
+        self.injects.fetch_add(1, Ordering::Relaxed);
+        if let Some(text) = payload.text() {
+            self.capture.lock().unwrap().push_str(text);
+        }
+        Ok(InjectReport {
+            stage_reached: InjectStage::Submit,
+            inject_verification: InjectVerification::CaptureContainsToken,
+            submit_verification: SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            turn_verification: TurnVerification::NotYetObserved,
+            attempts: 1,
+            submit_diagnostics: None,
+        })
+    }
+
+    fn send_keys(&self, _target: &Target, _keys: &[Key]) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn capture(
+        &self,
+        _target: &Target,
+        range: CaptureRange,
+    ) -> Result<CapturedText, TransportError> {
+        Ok(CapturedText {
+            text: self.capture.lock().unwrap().clone(),
+            range,
+        })
+    }
+
+    fn query(&self, _target: &Target, _field: PaneField) -> Result<Option<String>, TransportError> {
+        Ok(None)
+    }
+
+    fn liveness(&self, _pane: &PaneId) -> Result<PaneLiveness, TransportError> {
+        Ok(PaneLiveness::Live)
+    }
+
+    fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
+        Ok(vec![PaneInfo {
+            pane_id: PaneId::new("%w1"),
+            session: SessionName::new("team-dup"),
+            window_index: None,
+            window_name: Some(WindowName::new("w1")),
+            pane_index: None,
+            tty: None,
+            current_command: Some("sleep".to_string()),
+            current_path: None,
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+    }
+
+    fn has_session(&self, _session: &SessionName) -> Result<bool, TransportError> {
+        Ok(true)
+    }
+
+    fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
+        Ok(vec![WindowName::new("w1")])
+    }
+
+    fn set_session_env(
+        &self,
+        _session: &SessionName,
+        _key: &str,
+        _value: &str,
+    ) -> Result<SetEnvOutcome, TransportError> {
+        Ok(SetEnvOutcome::Applied)
+    }
+
+    fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn kill_window(&self, _target: &Target) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    fn attach_session(&self, _session: &SessionName) -> Result<AttachOutcome, TransportError> {
+        Ok(AttachOutcome::Attached)
+    }
+}