@team-agent/installer 0.5.73 → 0.5.75

package/crates/team-agent/src/leader/registry.rs

@@ -20,7 +20,9 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
+use std::fmt;
 use std::path::{Path, PathBuf};
+use std::time::{Duration, Instant};
 
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
@@ -100,10 +102,45 @@ pub const AMBIGUOUS_NAMES_FIELD: &str = "ambiguous_names";
 /// a fully-qualified form.
 pub const REASON_AMBIGUOUS: &str = "name_ambiguous";
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RegistryRollback {
+    Restored,
+    Superseded,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RegistryRollbackError {
+    InvalidReceipt,
+    LockUnavailable,
+    ReadFailed,
+    RestoreFailed,
+    DeleteFailed,
+}
+
+impl fmt::Display for RegistryRollbackError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let reason = match self {
+            Self::InvalidReceipt => "invalid receipt",
+            Self::LockUnavailable => "registry lock unavailable",
+            Self::ReadFailed => "registry receipt read failed",
+            Self::RestoreFailed => "registry restore failed",
+            Self::DeleteFailed => "registry delete failed",
+        };
+        f.write_str(reason)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RegistryWriteReceipt {
+    pub path: PathBuf,
+    pub bytes: Vec<u8>,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RegistryWriteOutcome {
     pub status: &'static str,
     pub path: Option<PathBuf>,
+    pub receipt: Option<RegistryWriteReceipt>,
     pub team_key: String,
     pub workspace_hash: String,
     pub source: String,
@@ -242,13 +279,8 @@ pub fn register_binding_from_state_best_effort(
         chrono::Utc::now().to_rfc3339(),
     );
     let event_log = crate::event_log::EventLog::new(workspace);
-    let write_result = write_entry_best_effort(&entry);
-    // Fresh quick-start is acquisition-only: it must never displace another
-    // same-pane row. Its caller performs a validated-LIVE check before this
-    // write; manual/restart ownership paths keep existing behavior.
-    if write_result.is_some() && source != "quick-start" {
-        let _ = mark_displaced_same_pane_entries_unbound(&entry);
-    }
+    let write_receipt = write_entry_best_effort_with_receipt(&entry);
+    let write_result = write_receipt.as_ref().map(|receipt| receipt.path.clone());
     let status = if let Some(path) = &write_result {
         let _ = event_log.write(
             EVENT_REGISTERED,
@@ -274,6 +306,7 @@ pub fn register_binding_from_state_best_effort(
     Some(RegistryWriteOutcome {
         status,
         path: write_result,
+        receipt: write_receipt,
         team_key,
         workspace_hash: entry.workspace_hash,
         source: source.to_string(),
@@ -281,81 +314,25 @@ pub fn register_binding_from_state_best_effort(
     })
 }
 
-/// Stored registry status after another workspace claimed the same pane.
-pub const REGISTRY_STATUS_UNBOUND: &str = "unbound";
-
-/// When workspace B claims a pane, every other attached registry row that
-/// still names that pane is no longer deliverable. Mark those rows unbound.
-/// Does not change pane-side authorization storage.
-pub fn mark_displaced_same_pane_entries_unbound(winner: &LeaderRegistryEntry) -> Vec<PathBuf> {
-    let Some(winner_pane) = winner
-        .channel
-        .get("pane_id")
-        .and_then(Value::as_str)
-        .filter(|pane| !pane.is_empty())
-    else {
-        return Vec::new();
-    };
-    let winner_socket = winner
-        .channel
-        .get("tmux_socket")
-        .and_then(Value::as_str)
-        .filter(|socket| !socket.is_empty());
-    let mut displaced = Vec::new();
-    for (path, mut entry) in read_all_entries() {
-        if entry.workspace_hash == winner.workspace_hash && entry.team_key == winner.team_key {
-            continue;
-        }
-        if entry.status != "attached" {
-            continue;
-        }
-        let Some(pane) = entry
-            .channel
-            .get("pane_id")
-            .and_then(Value::as_str)
-            .filter(|pane| !pane.is_empty())
-        else {
-            continue;
-        };
-        if pane != winner_pane {
-            continue;
-        }
-        let Some(socket) = entry
-            .channel
-            .get("tmux_socket")
-            .and_then(Value::as_str)
-            .filter(|socket| !socket.is_empty())
-        else {
-            continue;
-        };
-        let Some(winner_socket) = winner_socket else {
-            continue;
-        };
-        if socket != winner_socket {
-            continue;
-        }
-        entry.status = REGISTRY_STATUS_UNBOUND.to_string();
-        entry.updated_at = chrono::Utc::now().to_rfc3339();
-        if write_entry_best_effort(&entry).is_some() {
-            displaced.push(path);
-        }
-    }
-    displaced
-}
-
 fn entry_filename(entry: &LeaderRegistryEntry) -> String {
     format!("{}__{}.json", entry.workspace_hash, entry.team_key)
 }
 
 /// Registry write is best-effort. Writes to `.<file>.tmp-<pid>-<counter>`
 /// first, then atomically renames to `<workspace_hash>__<team_key>.json`.
-/// Returns the final path when the write succeeded, `None` otherwise —
-/// the binding command must never fail on registry errors.
+/// Every writer uses the registry lock so conditional rollback can compare
+/// and restore without racing a concurrent publish.
 pub fn write_entry_best_effort(entry: &LeaderRegistryEntry) -> Option<PathBuf> {
-    let dir = registry_dir()?;
-    if let Err(_error) = std::fs::create_dir_all(&dir) {
-        return None;
-    }
+    write_entry_best_effort_with_receipt(entry).map(|receipt| receipt.path)
+}
+
+fn write_entry_best_effort_with_receipt(
+    entry: &LeaderRegistryEntry,
+) -> Option<RegistryWriteReceipt> {
+    with_registry_lock(|dir| write_entry_locked(dir, entry)).flatten()
+}
+
+fn write_entry_locked(dir: &Path, entry: &LeaderRegistryEntry) -> Option<RegistryWriteReceipt> {
     let final_path = dir.join(entry_filename(entry));
     let tmp_name = format!(
         ".{}.tmp-{}-{}",
@@ -364,8 +341,8 @@ pub fn write_entry_best_effort(entry: &LeaderRegistryEntry) -> Option<PathBuf> {
         rand_suffix()
     );
     let tmp_path = dir.join(tmp_name);
-    let serialized = serde_json::to_string_pretty(entry).ok()?;
-    if std::fs::write(&tmp_path, serialized).is_err() {
+    let serialized = serde_json::to_vec_pretty(entry).ok()?;
+    if std::fs::write(&tmp_path, &serialized).is_err() {
         let _ = std::fs::remove_file(&tmp_path);
         return None;
     }
@@ -373,7 +350,118 @@ pub fn write_entry_best_effort(entry: &LeaderRegistryEntry) -> Option<PathBuf> {
         let _ = std::fs::remove_file(&tmp_path);
         return None;
     }
-    Some(final_path)
+    Some(RegistryWriteReceipt {
+        path: final_path,
+        bytes: serialized,
+    })
+}
+
+/// Restore one registry path only when it still contains this writer's exact
+/// receipt. The comparison and restore/delete are held under the same lock as
+/// ordinary registry writers, so a winner cannot slip in between them.
+pub fn restore_entry_if_current_matches(
+    receipt: &RegistryWriteReceipt,
+    previous: Option<&[u8]>,
+) -> Result<RegistryRollback, RegistryRollbackError> {
+    with_registry_lock_result(|dir| {
+        if receipt.path.parent() != Some(dir) {
+            return Err(RegistryRollbackError::InvalidReceipt);
+        }
+        let current = std::fs::read(&receipt.path)
+            .map_err(|_| RegistryRollbackError::ReadFailed)?;
+        if current != receipt.bytes {
+            return Ok(RegistryRollback::Superseded);
+        }
+        match previous {
+            Some(bytes) if replace_entry_bytes_locked(&receipt.path, bytes) => {
+                Ok(RegistryRollback::Restored)
+            }
+            Some(_) => Err(RegistryRollbackError::RestoreFailed),
+            None if std::fs::remove_file(&receipt.path).is_ok() => {
+                Ok(RegistryRollback::Restored)
+            }
+            None => Err(RegistryRollbackError::DeleteFailed),
+        }
+    })
+}
+
+fn remove_entry_if_matches(path: &Path, expected: &LeaderRegistryEntry) -> bool {
+    with_registry_lock(|_| {
+        let Ok(bytes) = std::fs::read(path) else {
+            return false;
+        };
+        let Ok(current) = serde_json::from_slice::<LeaderRegistryEntry>(&bytes) else {
+            return false;
+        };
+        current == *expected && std::fs::remove_file(path).is_ok()
+    })
+    .unwrap_or(false)
+}
+
+fn replace_entry_bytes_locked(path: &Path, bytes: &[u8]) -> bool {
+    let tmp = path.with_extension(format!(
+        "rollback-{}-{}",
+        std::process::id(),
+        rand_suffix()
+    ));
+    if std::fs::write(&tmp, bytes).is_err() {
+        let _ = std::fs::remove_file(&tmp);
+        return false;
+    }
+    if std::fs::rename(&tmp, path).is_err() {
+        let _ = std::fs::remove_file(&tmp);
+        return false;
+    }
+    true
+}
+
+struct RegistryLock {
+    file: std::fs::File,
+}
+
+impl RegistryLock {
+    fn acquire(dir: &Path) -> Option<Self> {
+        let path = dir.join(".registry.lock");
+        let file = std::fs::OpenOptions::new()
+            .create(true)
+            .read(true)
+            .write(true)
+            .truncate(false)
+            .open(path)
+            .ok()?;
+        let started = Instant::now();
+        loop {
+            match crate::platform::file_lock::try_lock_once_nonblocking(&file) {
+                Ok(true) => return Some(Self { file }),
+                Ok(false) if started.elapsed() < Duration::from_secs(2) => {
+                    std::thread::sleep(Duration::from_millis(10));
+                }
+                Ok(false) | Err(_) => return None,
+            }
+        }
+    }
+}
+
+impl Drop for RegistryLock {
+    fn drop(&mut self) {
+        let _ = crate::platform::file_lock::unlock(&self.file);
+    }
+}
+
+fn with_registry_lock<T>(f: impl FnOnce(&Path) -> T) -> Option<T> {
+    let dir = registry_dir()?;
+    std::fs::create_dir_all(&dir).ok()?;
+    let _lock = RegistryLock::acquire(&dir)?;
+    Some(f(&dir))
+}
+
+fn with_registry_lock_result<T>(
+    f: impl FnOnce(&Path) -> Result<T, RegistryRollbackError>,
+) -> Result<T, RegistryRollbackError> {
+    let dir = registry_dir().ok_or(RegistryRollbackError::LockUnavailable)?;
+    std::fs::create_dir_all(&dir).map_err(|_| RegistryRollbackError::LockUnavailable)?;
+    let _lock = RegistryLock::acquire(&dir).ok_or(RegistryRollbackError::LockUnavailable)?;
+    f(&dir)
 }
 
 fn rand_suffix() -> String {
@@ -392,14 +480,16 @@ fn rand_suffix() -> String {
 /// success — the invariant is "no registry entry after unbind", not
 /// "must have found something to delete".
 pub fn unregister_entry(workspace: &Path, team_key: &str) -> Option<PathBuf> {
-    let dir = registry_dir()?;
-    let hash = workspace_hash(workspace);
-    let path = dir.join(format!("{hash}__{team_key}.json"));
-    if path.exists() {
-        std::fs::remove_file(&path).ok()?;
-        return Some(path);
-    }
-    None
+    with_registry_lock(|dir| {
+        let hash = workspace_hash(workspace);
+        let path = dir.join(format!("{hash}__{team_key}.json"));
+        if path.exists() {
+            std::fs::remove_file(&path).ok()?;
+            return Some(path);
+        }
+        None
+    })
+    .flatten()
 }
 
 /// Read and deserialize every `*.json` file under the registry directory.
@@ -538,7 +628,7 @@ pub fn list_validated_with_gc() -> Vec<(LeaderRegistryEntry, &'static str, Optio
                     || r == "team_not_alive"
             })
         {
-            let _ = std::fs::remove_file(&path);
+            let _ = remove_entry_if_matches(&path, &entry);
             continue;
         }
         out.push((entry, status, reason));
@@ -546,27 +636,6 @@ pub fn list_validated_with_gc() -> Vec<(LeaderRegistryEntry, &'static str, Optio
     out
 }
 
-/// Refuse a fresh quick-start binding when the caller pane already backs a
-/// canonically LIVE receiver for another workspace/team. This is read-only:
-/// quick-start never displaces or takes over an existing binding.
-#[must_use]
-pub(crate) fn live_same_pane_binding_elsewhere(
-    pane_id: &str,
-    workspace: &Path,
-    team_key: &str,
-) -> bool {
-    let workspace = std::fs::canonicalize(workspace).unwrap_or_else(|_| workspace.to_path_buf());
-    list_validated_no_gc().into_iter().any(|(entry, status, _)| {
-        status == "LIVE"
-            && entry
-                .channel
-                .get("pane_id")
-                .and_then(Value::as_str)
-                == Some(pane_id)
-            && (entry.workspace != workspace || entry.team_key != team_key)
-    })
-}
-
 /// Same as `list_validated_with_gc` but preserves all entries. `send
 /// --to-leader` needs to see stale entries so it can refuse with
 /// `registry_stale` (and never silently fall through to

package/crates/team-agent/src/lifecycle/launch/pi_mcp.rs

@@ -602,7 +602,18 @@ pub(crate) fn run_pi_catalog(
         .stdout(Stdio::piped())
         .stderr(Stdio::null())
         .spawn()
-        .map_err(|_| "Pi executable is unavailable on PATH".to_string())?;
+        .map_err(|error| {
+            #[cfg(test)]
+            {
+                eprintln!(
+                    "run_pi_catalog spawn failed kind={:?} raw_os_error={:?}",
+                    error.kind(),
+                    error.raw_os_error()
+                );
+            }
+            let _ = error;
+            "Pi executable is unavailable on PATH".to_string()
+        })?;
     let stdout = child.stdout.take().ok_or_else(|| {
         let _ = child.kill();
         let _ = child.wait();