@team-agent/installer 0.5.66 → 0.5.68

package/crates/team-agent/src/lifecycle/tests/startup_latency_contract.rs

@@ -1,3 +1,18 @@
+//! ---
+//! purpose: restart spawn overlap and identity contracts
+//! contract:
+//!   provides:
+//!     - name: restart_spawn_overlap_identity
+//!       what: controlled transport facts prove overlapping worker spawns and stable persisted identities
+//!   depends:
+//!     - crate::lifecycle::restart
+//!     - hermetic fake transport with spawn trace
+//!   boundary:
+//!     - overlap/max-in-flight facts replace scheduler-sensitive total-time thresholds
+//!     - no production scheduler, pool, or state-machine changes
+//! maturity: wired
+//! ---
+//!
 //! 0.5.38 RED contract: startup latency instrumentation and bounded worker spawn.
 //!
 //! References:
@@ -83,6 +98,10 @@ fn restart_records_parallel_spawn_overlap_and_deterministic_state() {
             "expected at least two new-window spawns to overlap after the initial session creator; calls={calls:?}"
         ));
     }
+    assert!(
+        transport.max_in_flight() >= 2,
+        "expected at least two concurrent spawn calls; calls={calls:?}"
+    );
     let agent_keys = state
         .pointer("/agents")
         .and_then(Value::as_object)
@@ -272,7 +291,6 @@ fn eight_worker_restart_with_100ms_spawn_delay_beats_serial_baseline() {
     let delay = Duration::from_millis(100);
     let transport = StartupLatencyTransport::new().with_spawn_delay(delay);
 
-    let started = Instant::now();
     let report = restart_with_transport_with_readiness_deadline(
         &case.workspace,
         true,
@@ -281,7 +299,6 @@ fn eight_worker_restart_with_100ms_spawn_delay_beats_serial_baseline() {
         Some(2_000),
     )
     .expect("R4 setup: restart should complete against delayed transport");
-    let elapsed = started.elapsed();
     assert!(
         matches!(report, RestartReport::Restarted { .. }),
         "R4 setup: restart must reach Restarted; report={report:?}"
@@ -293,14 +310,18 @@ fn eight_worker_restart_with_100ms_spawn_delay_beats_serial_baseline() {
         8,
         "R4 setup: timing smoke must exercise all 8 workers; calls={calls:?}"
     );
-    let serial_baseline = delay * calls.len() as u32;
     assert!(
-        serial_baseline >= Duration::from_millis(800),
-        "R4 setup: serial baseline must represent 8 workers * 100ms; baseline={serial_baseline:?}"
+        has_overlap(
+            &calls
+                .iter()
+                .filter(|call| call.kind == "spawn_into")
+                .collect::<Vec<_>>(),
+        ),
+        "R4: bounded-concurrency restart must overlap spawn calls; calls={calls:?}"
     );
     assert!(
-        elapsed < serial_baseline - Duration::from_millis(150),
-        "R4: bounded-concurrency restart should complete below the serial spawn sum; elapsed={elapsed:?} serial_baseline={serial_baseline:?} calls={calls:?}"
+        transport.max_in_flight() >= 2,
+        "R4: max in-flight spawn count must prove overlap; calls={calls:?}"
     );
     assert_phase_events(&case.events(), "restart.phase", &["spawn_all", "completed"]);
 }
@@ -583,6 +604,8 @@ struct TransportState {
     calls: Vec<SpawnCall>,
     panes: BTreeMap<String, PaneInfo>,
     next_pane: usize,
+    in_flight: usize,
+    max_in_flight: usize,
 }
 
 #[derive(Clone)]
@@ -625,6 +648,10 @@ impl StartupLatencyTransport {
         self.state.lock().unwrap().calls.clone()
     }
 
+    fn max_in_flight(&self) -> usize {
+        self.state.lock().unwrap().max_in_flight
+    }
+
     fn pane_snapshot(&self) -> Vec<Value> {
         self.state
             .lock()
@@ -648,11 +675,17 @@ impl StartupLatencyTransport {
         window: &WindowName,
     ) -> Result<SpawnResult, TransportError> {
         let start = Instant::now();
+        {
+            let mut state = self.state.lock().unwrap();
+            state.in_flight += 1;
+            state.max_in_flight = state.max_in_flight.max(state.in_flight);
+        }
         if !self.spawn_delay.is_zero() {
             std::thread::sleep(self.spawn_delay);
         }
         let end = Instant::now();
         let mut state = self.state.lock().unwrap();
+        state.in_flight -= 1;
         let pane_id = PaneId::new(format!("%{}", state.next_pane));
         state.next_pane += 1;
         state.calls.push(SpawnCall {

package/crates/team-agent/src/lifecycle/tests/test_isolation_escape_contract.rs

@@ -1,3 +1,7 @@
+//! purpose: contracts that tests touching product side effects stay inside one hermetic HOME/registry/socket/env boundary
+//! contract: R1-R6 source guards; R6 needles match as identifiers, not as substrings of longer names
+//! boundary: does not own HermeticTestEnv; does not drop or whitelist R6 needles
+//!
 //! task#8 RED contract: tests that exercise Team Agent product side effects
 //! must run inside one HOME/registry/socket/env hermetic boundary.
 //!
@@ -233,6 +237,40 @@ fn r6_static_guard_rejects_dangerous_tests_without_hermetic_boundary() {
     );
 }
 
+#[test]
+fn r6_mcp_tool_name_literal_is_not_message_plane_send() {
+    let source = r#"
+        assert!(prompt.contains("mcp__team_orchestrator__send_message"));
+        assert!(prompt.contains("team_orchestrator__send_message"));
+    "#;
+    assert!(
+        static_guard_offenders([(
+            "synthetic_mcp_tool_name_literal.rs".to_string(),
+            source.to_string()
+        )])
+        .is_empty(),
+        "MCP tool-name literals are not the send_message surface"
+    );
+}
+
+#[test]
+fn r6_bare_send_message_identifier_without_hermetic_is_still_offender() {
+    let source = r#"
+        fn tap() {
+            let _ = send_message("to", "body");
+        }
+    "#;
+    let offenders = static_guard_offenders([(
+        "synthetic_bare_send_message.rs".to_string(),
+        source.to_string(),
+    )]);
+    assert!(
+        offenders.iter().any(|offender| offender.path == "synthetic_bare_send_message.rs"
+            && offender.signals.contains(&"send_message")),
+        "bare send_message identifier without HermeticTestEnv must remain an offender; offenders={offenders:?}"
+    );
+}
+
 fn assert_contains_all(label: &str, source: &str, needles: &[&str], message: &str) {
     let missing = needles
         .iter()
@@ -315,10 +353,30 @@ fn dangerous_signals(source: &str) -> Vec<&'static str> {
         "attach-leader",
     ]
     .into_iter()
-    .filter(|needle| source.contains(needle))
+    .filter(|needle| contains_identifier(source, needle))
     .collect()
 }
 
+fn contains_identifier(source: &str, ident: &str) -> bool {
+    let bytes = source.as_bytes();
+    let mut start = 0;
+    while let Some(rel) = source[start..].find(ident) {
+        let idx = start + rel;
+        let before_ok = idx == 0 || !is_ident_char(bytes[idx - 1]);
+        let after = idx + ident.len();
+        let after_ok = after == bytes.len() || !is_ident_char(bytes[after]);
+        if before_ok && after_ok {
+            return true;
+        }
+        start = idx + 1;
+    }
+    false
+}
+
+fn is_ident_char(b: u8) -> bool {
+    matches!(b, b'0'..=b'9' | b'A'..=b'Z' | b'a'..=b'z' | b'_')
+}
+
 fn dangerous_test_files() -> Vec<(String, String)> {
     let root = repo_root();
     let mut files = Vec::new();

package/crates/team-agent/src/lifecycle/tests/worker_spawn_env_red.rs

@@ -114,7 +114,8 @@ fn worker_spawn_scrubs_cross_provider_process_identity_but_keeps_config_env() {
         ("NODE_EXTRA_CA_CERTS", "/canary/ca.pem"),
     ]);
 
-    let launch_team = compiled_team_dir("cross-launch", &[("worker_a", "Launch Worker")]);
+    let launch_team =
+        compiled_team_dir_for_provider("cross-launch", &[("worker_a", "Launch Worker")], "claude");
     let launch_transport = RecordingTransport::new().with_session_present(false);
     launch_with_transport(
         &launch_team.join("team.spec.yaml"),
@@ -125,16 +126,25 @@ fn worker_spawn_scrubs_cross_provider_process_identity_but_keeps_config_env() {
     )
     .expect("launch fixture should spawn worker");
 
-    let restart_team = compiled_team_dir("cross-restart", &[("worker_a", "Restart Worker")]);
-    seed_restart_state(&restart_team, "worker_a");
+    let restart_team = compiled_team_dir_for_provider(
+        "cross-restart",
+        &[("worker_a", "Restart Worker")],
+        "claude",
+    );
+    seed_restart_state_as(&restart_team, "worker_a", "claude");
     let restart_transport = RecordingTransport::new().with_session_present(false);
     restart_with_transport(&restart_team, true, None, &restart_transport)
         .expect("restart fixture should spawn worker");
 
-    let add_team = compiled_team_dir("cross-add", &[("worker_a", "Existing Worker")]);
-    seed_running_add_agent_state(&add_team, "worker_a");
+    let add_team =
+        compiled_team_dir_for_provider("cross-add", &[("worker_a", "Existing Worker")], "claude");
+    seed_running_add_agent_state_as(&add_team, "worker_a", "claude");
     let role_file = add_team.parent().unwrap().join("worker_b.md");
-    std::fs::write(&role_file, role_doc("worker_b", "Added Worker")).unwrap();
+    std::fs::write(
+        &role_file,
+        role_doc_for_provider("worker_b", "Added Worker", "claude"),
+    )
+    .unwrap();
     let add_transport = RecordingTransport::new().with_session_present(true);
     add_agent_with_transport(
         &add_team,
@@ -146,25 +156,10 @@ fn worker_spawn_scrubs_cross_provider_process_identity_but_keeps_config_env() {
     )
     .expect("add-agent fixture should spawn worker");
 
-    let fork_team = compiled_team_dir("cross-fork", &[("worker_a", "Fork Source")]);
-    seed_forkable_source_state(&fork_team, "worker_a");
-    let fork_transport = RecordingTransport::new().with_session_present(true);
-    fork_agent_with_transport(
-        &fork_team,
-        &AgentId::new("worker_a"),
-        &AgentId::new("worker_fork"),
-        None,
-        false,
-        None,
-        &fork_transport,
-    )
-    .expect("fork-agent fixture should spawn worker");
-
     let failures = [
         ("quick-start launch", launch_transport.single_spawn()),
         ("restart", restart_transport.single_spawn()),
         ("add-agent", add_transport.single_spawn()),
-        ("fork-agent", fork_transport.single_spawn()),
     ]
     .into_iter()
     .flat_map(|(surface, spawn)| cross_provider_identity_failures(surface, &spawn))
@@ -177,6 +172,36 @@ fn worker_spawn_scrubs_cross_provider_process_identity_but_keeps_config_env() {
     );
 }
 
+#[test]
+#[serial(env)]
+fn worker_spawn_codex_in_window_fork_reports_unverified_not_unsupported() {
+    // 已废除的行为：旧实现把 codex in-window fork 当成已验证能力（或报「不支持」），此断言证明它确实没了。
+    // 本轮裁定：codex 走这条路必须明确报「未验证」，不是「不支持」。
+    let _home = hermetic_guard::HermeticTestEnv::enter("codex-fork-unverified");
+    let team = compiled_team_dir("codex-fork-tombstone", &[("worker_a", "Fork Source")]);
+    seed_forkable_source_state(&team, "worker_a");
+    let transport = RecordingTransport::new().with_session_present(true);
+    let err = fork_agent_with_transport(
+        &team,
+        &AgentId::new("worker_a"),
+        &AgentId::new("worker_a"),
+        None,
+        false,
+        None,
+        &transport,
+    )
+    .expect_err("codex in-window fork must refuse as unverified");
+    let text = err.to_string();
+    assert!(
+        text.contains("未验证") && text.contains("unverified"),
+        "codex in-window fork must report 未验证; err={text}"
+    );
+    assert!(
+        !text.contains("不支持") && !text.contains("does not support"),
+        "the ruling is unverified, not unsupported; err={text}"
+    );
+}
+
 #[test]
 #[serial(env)]
 fn worker_spawn_stays_out_of_coordinator_tick_and_daemon_preserves_parent_env() {
@@ -304,17 +329,23 @@ fn cross_provider_identity_failures(surface: &str, spawn: &RecordedSpawn) -> Vec
 }
 
 fn compiled_team_dir(label: &str, agents: &[(&str, &str)]) -> PathBuf {
+    compiled_team_dir_for_provider(label, agents, "codex")
+}
+
+fn compiled_team_dir_for_provider(label: &str, agents: &[(&str, &str)], provider: &str) -> PathBuf {
     let team = tmp_dir(label).join("teamdir");
     std::fs::create_dir_all(team.join("agents")).unwrap();
     std::fs::write(
         team.join("TEAM.md"),
-        "---\nname: envteam\nobjective: Worker spawn env contract.\nprovider: codex\n---\n\nTeam.\n",
+        format!(
+            "---\nname: envteam\nobjective: Worker spawn env contract.\nprovider: {provider}\n---\n\nTeam.\n"
+        ),
     )
     .unwrap();
     for (name, role) in agents {
         std::fs::write(
             team.join("agents").join(format!("{name}.md")),
-            role_doc(name, role),
+            role_doc_for_provider(name, role, provider),
         )
         .unwrap();
     }
@@ -328,12 +359,20 @@ fn compiled_team_dir(label: &str, agents: &[(&str, &str)]) -> PathBuf {
 }
 
 fn role_doc(name: &str, role: &str) -> String {
+    role_doc_for_provider(name, role, "codex")
+}
+
+fn role_doc_for_provider(name: &str, role: &str, provider: &str) -> String {
     format!(
-        "---\nname: {name}\nrole: {role}\nprovider: codex\nmodel: codex-test-model\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{role}.\n"
+        "---\nname: {name}\nrole: {role}\nprovider: {provider}\nmodel: {provider}-test-model\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{role}.\n"
     )
 }
 
 fn seed_restart_state(team: &Path, agent_id: &str) {
+    seed_restart_state_as(team, agent_id, "codex");
+}
+
+fn seed_restart_state_as(team: &Path, agent_id: &str, provider: &str) {
     team_agent::state::persist::save_runtime_state(
         team,
         &json!({
@@ -344,7 +383,7 @@ fn seed_restart_state(team: &Path, agent_id: &str) {
             "agents": {
                 agent_id: {
                     "status": "running",
-                    "provider": "codex",
+                    "provider": provider,
                     "role": "Restart Worker",
                     "tools": ["mcp_team"],
                     "window": agent_id,
@@ -360,6 +399,10 @@ fn seed_restart_state(team: &Path, agent_id: &str) {
 }
 
 fn seed_running_add_agent_state(team: &Path, agent_id: &str) {
+    seed_running_add_agent_state_as(team, agent_id, "codex");
+}
+
+fn seed_running_add_agent_state_as(team: &Path, agent_id: &str, provider: &str) {
     let workspace = team_agent::model::paths::team_workspace(team).unwrap();
     team_agent::state::persist::save_runtime_state(
         &workspace,
@@ -371,7 +414,7 @@ fn seed_running_add_agent_state(team: &Path, agent_id: &str) {
             "agents": {
                 agent_id: {
                     "status": "running",
-                    "provider": "codex",
+                    "provider": provider,
                     "role": "Existing Worker",
                     "tools": ["mcp_team"],
                     "window": agent_id,

package/crates/team-agent/src/lifecycle/tests.rs

@@ -45,30 +45,44 @@ pub(crate) fn test_binary_path() -> &'static str {
     .as_str()
 }
 
+mod acceptance_b_batch_red;
 mod agent_ops;
-mod core;
-mod lane_ops;
-mod launch_spawn;
-mod lifecycle_lock;
-mod main_preserved;
-mod phase_b_contracts;
-mod phase_golden;
-mod restart;
 mod b0_legacy_snapshot_nonauthority_contract;
 mod b0_reader_hideone_audit_contract;
 mod behavioral_diff_264_red;
+mod claude_compatible_config_red;
 mod claude_profile_launch_red;
+mod clone_agent_preserves_source_tools;
+mod clone_fork_copilot_perms_red;
 mod codex_weak_window_attribution_red;
+mod communication_mode_runtime_contract_red;
 mod copilot_provider_red;
-mod display_adaptive_red;
+mod core;
 mod core_034_real_red;
+mod cursor_mcp_overlay;
+mod cursor_require_explicit_model_red;
+mod cursor_restart_resume_red;
+mod display_adaptive_red;
 mod f032_startup_prompt_best_effort_red;
+mod g1_silent_faces;
+mod grok_effort_argv_red;
+mod grok_mcp_overlay_red;
+mod grok_require_explicit_model_red;
+mod grok_restart_resume_red;
 mod harvest2_a_batch_red;
 mod host_cotenant_death_p0_contract;
+mod lane_ops;
+mod launch_spawn;
+mod lifecycle_lock;
 mod lifecycle_rollback_red;
+mod main_preserved;
+mod mcp_tool_name_format_red;
+mod phase_b_contracts;
+mod phase_golden;
 mod quick_start_worker_readiness_red;
 mod realmachine_clusters_1_6_red;
 mod realmachine_residual_g1_g4_red;
+mod restart;
 mod restart_build_before_destroy_0540_contract;
 mod restart_liveness_red;
 mod restart_rebind_hotfix_252_red;
@@ -88,7 +102,3 @@ mod test_isolation_escape_contract;
 mod upgrade_compat_0211_red;
 mod verify_rs031_window_consistency_red;
 mod worker_spawn_env_red;
-mod acceptance_b_batch_red;
-mod claude_compatible_config_red;
-mod communication_mode_runtime_contract_red;
-mod clone_fork_copilot_perms_red;

package/crates/team-agent/src/lifecycle/types.rs

@@ -1,3 +1,27 @@
+//! ---
+//! purpose: lifecycle 的数据类型集中定义，newtype、枚举、报告结构、错误与事件名常量
+//! contract:
+//!   provides:
+//!     - name: PlanId
+//!       what: 受正则约束的 plan 标识，构造时拒斜杠空格与路径穿越
+//!     - name: PlanCondition
+//!       what: plan 推进条件的封闭文法，只认 any 与 report_result 字段相等
+//!     - name: LifecycleError
+//!       what: 本模块所有对外错误的统一枚举
+//!     - name: CoordinatorStartSummary
+//!       what: coordinator 启动结果在 lifecycle 报告里的投影
+//!     - name: event_names
+//!       what: lifecycle/restart/display 稳定事件名常量集
+//!   depends:
+//!     - crate::model::ids
+//!     - crate::provider
+//!     - crate::transport
+//!     - crate::coordinator
+//! boundary:
+//!   - 只定义类型与解析，不做 IO、不 spawn、不落盘
+//!   - 事件名只声明常量，实际写事件由各行为文件负责
+//! maturity: wired
+//! ---
 //! lifecycle 数据类型:newtype / enum / data struct / error / outcome-report 集中定义。
 
 use std::collections::BTreeMap;
@@ -40,6 +64,9 @@ pub mod event_names {
     pub const DISPLAY_ADAPTIVE_BLOCKED: &str = "display.adaptive_blocked";
     pub const DISPLAY_ADAPTIVE_REBUILT: &str = "display.adaptive_rebuilt";
     pub const DISPLAY_ADAPTIVE_CLOSED: &str = "display.adaptive_closed";
+    /// Directory-scoped grok toml dropped leftover per-seat `TEAM_AGENT_*` keys.
+    /// Fields: `path` (file), `keys` (names only — never values).
+    pub const GROK_TOML_PER_SEAT_KEYS_CLEARED: &str = "lifecycle.grok_toml.per_seat_keys_cleared";
 }
 
 // ===========================================================================
@@ -54,6 +81,14 @@ pub mod event_names {
 pub struct PlanId(String);
 
 impl PlanId {
+/// ---
+/// purpose: 校验并构造 PlanId
+/// params:
+///   raw: 原始 plan 名，首字符须字母数字，其余只许字母数字与下划线点横线，长度不超过 64
+/// returns: 通过校验的 PlanId
+/// errors: 不满足上述形状时返回 InvalidPlanId
+/// contract_id: lifecycle.types.plan_id_parse
+/// ---
     /// `sanitize_plan_id`(`orchestrator/state.py:18`):正则校验,失败 → `Err`。
     pub fn parse(raw: &str) -> Result<Self, LifecycleError> {
         let mut chars = raw.chars();
@@ -70,6 +105,10 @@ impl PlanId {
             )))
         }
     }
+/// ---
+/// purpose: 取 PlanId 的原始字符串
+/// returns: 构造时保存的原文
+/// ---
     pub fn as_str(&self) -> &str {
         &self.0
     }
@@ -92,6 +131,12 @@ pub struct CoordinatorStartSummary {
 }
 
 impl CoordinatorStartSummary {
+/// ---
+/// purpose: 把 coordinator 的 StartReport 投影成 lifecycle 报告用的摘要
+/// params:
+///   report: coordinator 启动返回的原始报告
+/// returns: 摘要，status 已转成稳定 wire 字符串，binary_identity_relation 原样带出
+/// ---
     pub fn from_start_report(report: &crate::coordinator::StartReport) -> Self {
         Self {
             ok: report.ok,
@@ -117,6 +162,10 @@ fn coordinator_start_status_wire(status: crate::coordinator::StartOutcome) -> &'
     }
 }
 
+/// ---
+/// purpose: 把 coordinator 启动摘要序列化成 JSON 对象
+/// returns: 含 ok、status、pid、binary 路径与版本、rotation_reason、binary_identity_relation 的 JSON
+/// ---
 pub fn coordinator_start_summary_value(summary: &CoordinatorStartSummary) -> serde_json::Value {
     serde_json::json!({
         "ok": summary.ok,
@@ -142,6 +191,10 @@ impl std::fmt::Display for PlanId {
 pub struct DisplaySessionName(pub String);
 
 impl DisplaySessionName {
+/// ---
+/// purpose: 取 ghostty 派生 display session 名的原始字符串
+/// returns: 内部保存的名字
+/// ---
     pub fn as_str(&self) -> &str {
         &self.0
     }
@@ -353,6 +406,14 @@ pub enum PlanCondition {
 }
 
 impl PlanCondition {
+/// ---
+/// purpose: 解析 plan 推进条件的封闭文法
+/// params:
+///   expr: any，或 report_result.<字段> == <值>，值须带单引号或双引号
+/// returns: Any 或 FieldEq
+/// errors: 前缀不对、缺等号、字段名非法或值未带引号时返回 InvalidPlan
+/// contract_id: lifecycle.types.plan_condition_parse
+/// ---
     /// 解析封闭条件文法。越界 raise `InvalidPlan`(`orchestrator/plan.py:_is_supported_condition`)。
     pub fn parse(expr: &str) -> Result<Self, LifecycleError> {
         let trimmed = expr.trim();