@team-agent/installer 0.5.74 → 0.5.77

package/crates/team-agent/src/state/persist.rs

@@ -364,6 +364,78 @@ fn save_runtime_state_with_merge_options(
     topology_update_agent_ids: &[&str],
     receiver_update_team_key: Option<&str>,
     exact_owner_seed_to_clear: Option<&Value>,
+) -> Result<(), StateError> {
+    persist_runtime_state_with_merge_options_and_expected(
+        workspace,
+        state,
+        deleted_agent_ids,
+        skip_capture_backfill_team_key,
+        skip_capture_backfill_agent_ids,
+        topology_update_team_key,
+        topology_update_agent_ids,
+        receiver_update_team_key,
+        exact_owner_seed_to_clear,
+        None,
+        None,
+    )
+}
+
+pub(crate) fn save_runtime_state_with_receiver_authority_and_expected(
+    workspace: &Path,
+    state: &Value,
+    receiver_team_key: &str,
+    expected_owner: &Value,
+    expected_receiver: &Value,
+) -> Result<(), StateError> {
+    persist_runtime_state_with_merge_options_and_expected(
+        workspace,
+        state,
+        &[],
+        None,
+        &[],
+        None,
+        &[],
+        Some(receiver_team_key),
+        None,
+        Some((expected_owner, expected_receiver)),
+        None,
+    )
+}
+
+pub(crate) fn save_runtime_state_with_exact_owner_receiver_cleanup(
+    workspace: &Path,
+    state: &Value,
+    team_key: &str,
+    expected_owner: &Value,
+    expected_receiver: &Value,
+) -> Result<(), StateError> {
+    persist_runtime_state_with_merge_options_and_expected(
+        workspace,
+        state,
+        &[],
+        None,
+        &[],
+        None,
+        &[],
+        Some(team_key),
+        None,
+        None,
+        Some((team_key, expected_owner, expected_receiver)),
+    )
+}
+
+fn persist_runtime_state_with_merge_options_and_expected(
+    workspace: &Path,
+    state: &Value,
+    deleted_agent_ids: &[&str],
+    skip_capture_backfill_team_key: Option<&str>,
+    skip_capture_backfill_agent_ids: &[&str],
+    topology_update_team_key: Option<&str>,
+    topology_update_agent_ids: &[&str],
+    receiver_update_team_key: Option<&str>,
+    exact_owner_seed_to_clear: Option<&Value>,
+    expected_owner_receiver: Option<(&Value, &Value)>,
+    exact_owner_receiver_to_clear: Option<(&str, &Value, &Value)>,
 ) -> Result<(), StateError> {
     let path = runtime_state_path(workspace);
     // Python `state.py:497`:先对入参 state 跑 `_migrate_state_identity`(就地填缺失 leader uuid)。
@@ -385,7 +457,9 @@ fn save_runtime_state_with_merge_options(
     // Exact-seed cleanup must observe lock-held disk, not a pre-lock cache or
     // byte-equality hit. A matching in-memory document would otherwise no-op
     // and leave the seed, or skip copying a concurrent owner.
-    let skip_pre_lock_fast_path = exact_owner_seed_to_clear.is_some();
+    let skip_pre_lock_fast_path = exact_owner_seed_to_clear.is_some()
+        || expected_owner_receiver.is_some()
+        || exact_owner_receiver_to_clear.is_some();
     if !skip_pre_lock_fast_path && cache_equals(&path, &migrated) {
         return Ok(());
     }
@@ -418,7 +492,21 @@ fn save_runtime_state_with_merge_options(
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)?;
     }
-    if let Some(latest) = read_latest_state_under_lock(workspace, &path) {
+    let latest = read_latest_state_under_lock(workspace, &path);
+    if let Some((expected_owner, expected_receiver)) = expected_owner_receiver {
+        let expected_matches = latest.as_ref().is_some_and(|latest| {
+            latest_team_owner_receiver(latest, receiver_update_team_key)
+                .is_some_and(|(owner, receiver)| {
+                    owner == expected_owner && receiver == expected_receiver
+                })
+        });
+        if !expected_matches {
+            return Err(StateError::SaveConflict(
+                "fresh caller owner/receiver changed before commit".to_string(),
+            ));
+        }
+    }
+    if let Some(latest) = latest {
         let deleted = deleted_agent_ids
             .iter()
             .copied()
@@ -455,6 +543,7 @@ fn save_runtime_state_with_merge_options(
             &topology_updates,
             &receiver_updates,
             receiver_update_team_key.zip(exact_owner_seed_to_clear),
+            exact_owner_receiver_to_clear,
         )?;
     }
     // Stage 3 save-output strip second pass (defence-in-depth): after the
@@ -523,6 +612,7 @@ fn apply_persist_merge_contract(
     topology_updates: &BTreeSet<(String, String)>,
     receiver_updates: &BTreeSet<String>,
     exact_owner_seed_to_clear: Option<(&str, &Value)>,
+    exact_owner_receiver_to_clear: Option<(&str, &Value, &Value)>,
 ) -> Result<(), StateError> {
     // A0/R1: the projection gate only guards the TOP-LEVEL passes (top-level agents and
     // the top-level<->active-team cross projections depend on which team is active); the
@@ -645,6 +735,16 @@ fn apply_persist_merge_contract(
                     apply_lock_held_exact_owner_cleanup(incoming_entry, latest_entry, seed);
                 }
             }
+            if let Some((clear_team, seed, expected_receiver)) = exact_owner_receiver_to_clear {
+                if team == clear_team {
+                    apply_lock_held_exact_owner_receiver_cleanup(
+                        incoming_entry,
+                        latest_entry,
+                        seed,
+                        Some(expected_receiver),
+                    );
+                }
+            }
             preserve_latest_endpoint_convergence_fields(incoming_entry, latest_entry);
         }
     }
@@ -776,14 +876,26 @@ fn preserve_latest_ownership_fields(
 }
 
 fn apply_lock_held_exact_owner_cleanup(incoming: &mut Value, latest: &Value, seed: &Value) {
-    // Compare the lock-held disk owner to the attempt-local seed. Equal-epoch
-    // concurrent owners must survive; only the exact seed is cleared, and the
-    // epoch is not bumped so a same-epoch takeover cannot be overwritten.
+    apply_lock_held_exact_owner_receiver_cleanup(incoming, latest, seed, None);
+}
+
+fn apply_lock_held_exact_owner_receiver_cleanup(
+    incoming: &mut Value,
+    latest: &Value,
+    seed: &Value,
+    expected_receiver: Option<&Value>,
+) {
+    // Compare the lock-held disk owner and, when supplied, receiver to the
+    // attempt-local grant. A same-owner receiver update is a concurrent
+    // winner and must survive cleanup just like a different owner/epoch.
     let latest_owner = latest.get("team_owner");
+    let receiver_matches = expected_receiver.is_none_or(|expected| {
+        latest.get("leader_receiver") == Some(expected)
+    });
     let Some(incoming_obj) = incoming.as_object_mut() else {
         return;
     };
-    if latest_owner == Some(seed) {
+    if latest_owner == Some(seed) && receiver_matches {
         incoming_obj.insert("team_owner".to_string(), Value::Null);
         incoming_obj.insert("leader_receiver".to_string(), Value::Null);
         if let Some(epoch) = latest
@@ -873,6 +985,21 @@ fn latest_has_preferable_ownership(
         && (ownership_attached(latest) || !ownership_attached(incoming))
 }
 
+fn latest_team_owner_receiver<'a>(
+    latest: &'a Value,
+    team_key: Option<&str>,
+) -> Option<(&'a Value, &'a Value)> {
+    let entry = if let Some(team_key) = team_key {
+        latest
+            .get("teams")
+            .and_then(Value::as_object)
+            .and_then(|teams| teams.get(team_key))?
+    } else {
+        latest
+    };
+    Some((entry.get("team_owner")?, entry.get("leader_receiver")?))
+}
+
 fn ownership_epoch(state: &Value) -> u64 {
     state
         .get("owner_epoch")
@@ -2985,6 +3112,7 @@ mod tests {
             &BTreeSet::new(),
             &BTreeSet::new(),
             None,
+            None,
         )
         .unwrap();
 
@@ -3020,6 +3148,7 @@ mod tests {
             &BTreeSet::new(),
             &receiver_updates,
             None,
+            None,
         )
         .unwrap();
 
@@ -3219,6 +3348,37 @@ mod tests {
         );
     }
 
+    #[test]
+    fn lock_held_exact_seed_receiver_cleanup_preserves_same_owner_receiver_update() {
+        let ws = temp_ws();
+        save_runtime_state(
+            &ws,
+            &team_state_with_binding(&ws, seed_owner(1), seed_receiver(1), 1),
+        )
+        .unwrap();
+        let seed = persisted_fresh_owner(&ws);
+        let seeded_receiver = load_runtime_state(&ws).unwrap()["teams"]["fresh"]
+            ["leader_receiver"]
+            .clone();
+        let mut winner = team_state_with_binding(&ws, seed_owner(1), takeover_receiver(1), 1);
+        winner["teams"]["fresh"]["team_owner"] = seed.clone();
+        save_runtime_state_with_receiver_authority(&ws, &winner, "fresh", None).unwrap();
+        save_runtime_state_with_exact_owner_receiver_cleanup(
+            &ws,
+            &tombstone_incoming(&ws, 1),
+            "fresh",
+            &seed,
+            &seeded_receiver,
+        )
+        .unwrap();
+        assert_fresh_binding(
+            &load_runtime_state(&ws).unwrap(),
+            &seed,
+            &takeover_receiver(1),
+            1,
+        );
+    }
+
     #[test]
     fn lock_held_exact_seed_cleanup_preserves_epoch2_takeover_binding() {
         let ws = temp_ws();

package/crates/team-agent/src/state/projection.rs

@@ -16,7 +16,8 @@ use serde_json::{json, Map, Value};
 
 use super::StateError;
 use crate::state::persist::{
-    load_runtime_state, save_runtime_state_with_deleted_agents,
+    load_runtime_state, load_runtime_state_without_migrations,
+    save_runtime_state_with_deleted_agents,
     save_runtime_state_with_lifecycle_topology_authority,
     save_runtime_state_with_lifecycle_topology_authority_and_capture_backfill_skip,
     save_runtime_state_with_team_tombstone_lifecycle_topology_authority,
@@ -504,7 +505,22 @@ pub fn resolve_runtime_team_scope(
     workspace: &Path,
     team: Option<&str>,
 ) -> Result<TeamScopeResolution, StateError> {
-    let state = load_runtime_state(workspace)?;
+    resolve_runtime_team_scope_loaded(load_runtime_state(workspace)?, team)
+}
+
+/// Same team selection as [`resolve_runtime_team_scope`], but never migrates or
+/// writes runtime state. Status and other read-only CLI surfaces must use this.
+pub fn resolve_runtime_team_scope_readonly(
+    workspace: &Path,
+    team: Option<&str>,
+) -> Result<TeamScopeResolution, StateError> {
+    resolve_runtime_team_scope_loaded(load_runtime_state_without_migrations(workspace)?, team)
+}
+
+fn resolve_runtime_team_scope_loaded(
+    state: Value,
+    team: Option<&str>,
+) -> Result<TeamScopeResolution, StateError> {
     let alive = team_state_candidates(&state);
     // Python `if team:` —— 空串 falsy,等同无 team(对抗 P1:此前 Some("") 误入 team 分支,空
     // team_dir 匹配致歧义/未找到错误串漂移)。

package/crates/team-agent/src/state/repository.rs

@@ -48,6 +48,10 @@ use super::persist::{
     save_runtime_state_with_lifecycle_topology_authority as helper_write_root_with_lifecycle_topology_authority,
     save_runtime_state_with_lifecycle_topology_authority_and_capture_backfill_skip as helper_write_root_with_lifecycle_topology_authority_and_capture_backfill_skip,
     save_runtime_state_with_receiver_authority as helper_write_root_with_receiver_authority,
+    save_runtime_state_with_receiver_authority_and_expected
+        as helper_write_root_with_receiver_authority_and_expected,
+    save_runtime_state_with_exact_owner_receiver_cleanup
+        as helper_write_root_with_exact_owner_receiver_cleanup,
     save_runtime_state_with_team_tombstone_lifecycle_topology_authority as helper_write_root_with_team_tombstone_lifecycle_topology_authority,
     save_runtime_state_with_team_tombstoned_agents as helper_write_root_with_team_tombstoned_agents,
     save_runtime_state_without_migrations as helper_write_root_without_migrations,
@@ -206,10 +210,20 @@ pub enum StateWriteIntent<'a> {
     ClaimLeader {
         team_key: &'a str,
     },
+    ClaimLeaderFreshCaller {
+        team_key: &'a str,
+        expected_owner: &'a Value,
+        expected_receiver: &'a Value,
+    },
     ClearExactTeamOwner {
         team_key: &'a str,
         seed: &'a Value,
     },
+    ClearExactTeamOwnerAndReceiver {
+        team_key: &'a str,
+        seed: &'a Value,
+        expected_receiver: &'a Value,
+    },
     LeaderBindingRestoreNonTargetTeams {
         target_team_key: &'a str,
     },
@@ -389,9 +403,31 @@ fn route_direct(
         StateWriteIntent::ClaimLeader { team_key } => {
             helper_write_root_with_receiver_authority(workspace, state, team_key, None)
         }
+        StateWriteIntent::ClaimLeaderFreshCaller {
+            team_key,
+            expected_owner,
+            expected_receiver,
+        } => helper_write_root_with_receiver_authority_and_expected(
+            workspace,
+            state,
+            team_key,
+            expected_owner,
+            expected_receiver,
+        ),
         StateWriteIntent::ClearExactTeamOwner { team_key, seed } => {
             helper_write_root_with_receiver_authority(workspace, state, team_key, Some(seed))
         }
+        StateWriteIntent::ClearExactTeamOwnerAndReceiver {
+            team_key,
+            seed,
+            expected_receiver,
+        } => helper_write_root_with_exact_owner_receiver_cleanup(
+            workspace,
+            state,
+            team_key,
+            seed,
+            expected_receiver,
+        ),
         StateWriteIntent::LeaderBindingRestoreNonTargetTeams { .. } => {
             helper_write_root_without_migrations(workspace, state)
         }

package/crates/team-agent/src/state/selector.rs

@@ -7,7 +7,9 @@ use serde_json::Value;
 
 use crate::model::paths::{canonical_run_workspace, runtime_spec_path, team_workspace};
 use crate::state::persist::runtime_state_path;
-use crate::state::projection::resolve_runtime_team_scope;
+use crate::state::projection::{
+    resolve_runtime_team_scope, resolve_runtime_team_scope_readonly, TeamScopeResolution,
+};
 use crate::state::StateError;
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -35,6 +37,24 @@ pub fn resolve_active_team(
     input: &Path,
     team: Option<&str>,
     mode: SelectorMode,
+) -> Result<SelectedTeam, StateError> {
+    resolve_active_team_with(input, team, mode, resolve_runtime_team_scope)
+}
+
+/// Status-path selector: in-memory projection only, no runtime-state writeback.
+pub fn resolve_active_team_readonly(
+    input: &Path,
+    team: Option<&str>,
+    mode: SelectorMode,
+) -> Result<SelectedTeam, StateError> {
+    resolve_active_team_with(input, team, mode, resolve_runtime_team_scope_readonly)
+}
+
+fn resolve_active_team_with(
+    input: &Path,
+    team: Option<&str>,
+    mode: SelectorMode,
+    resolve_scope: fn(&Path, Option<&str>) -> Result<TeamScopeResolution, StateError>,
 ) -> Result<SelectedTeam, StateError> {
     let explicit_spec = input.join("team.spec.yaml");
     let (run_workspace, resolved) = if explicit_spec.exists() {
@@ -44,7 +64,7 @@ pub fn resolve_active_team(
         } else {
             team_run
         };
-        let resolved = resolve_runtime_team_scope(&run, team)?;
+        let resolved = resolve_scope(&run, team)?;
         (run, resolved)
     } else {
         let run =
@@ -59,7 +79,7 @@ pub fn resolve_active_team(
                 input.display()
             )));
         }
-        let resolved = resolve_runtime_team_scope(&run, team)?;
+        let resolved = resolve_scope(&run, team)?;
         (run, resolved)
     };
     let state = resolved.state;

package/crates/team-agent/src/test_support/models_timeout_fixture.rs

@@ -0,0 +1,122 @@
+use std::fs::OpenOptions;
+use std::io::{Read, Write};
+use std::os::unix::net::{UnixListener, UnixStream};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::time::Duration;
+
+const CHILD_FLAG: &str = "--team-agent-models-timeout-child";
+const LIST_MODELS_FLAG: &str = "--list-models";
+const RECEIPT_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_RECEIPT";
+const MODE_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_MODE";
+const READY_SOCKET_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_READY_SOCKET";
+const STDOUT_MARKER: &[u8] = b"__team_agent_models_timeout_descendant_stdout_v1__\n";
+
+fn receipt_path() -> PathBuf {
+    std::env::var_os(RECEIPT_ENV)
+        .map(PathBuf::from)
+        .unwrap_or_else(|| std::process::exit(4))
+}
+
+fn append_receipt(path: &Path, key: &str, value: impl std::fmt::Display) -> Result<(), ()> {
+    let mut receipt = OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(path)
+        .map_err(|_| ())?;
+    writeln!(receipt, "{key}={value}").map_err(|_| ())
+}
+
+fn child_main(args: &[String]) {
+    if args.len() != 1 || args[0] != CHILD_FLAG {
+        std::process::exit(5);
+    }
+    let receipt = receipt_path();
+    let socket = std::env::var_os(READY_SOCKET_ENV)
+        .map(PathBuf::from)
+        .unwrap_or_else(|| std::process::exit(5));
+
+    let mut stdout = std::io::stdout();
+    if stdout.write_all(STDOUT_MARKER).is_err() || stdout.flush().is_err() {
+        std::process::exit(5);
+    }
+    if append_receipt(&receipt, "child_argv_exact", 1).is_err()
+        || append_receipt(&receipt, "descendant_pid", std::process::id()).is_err()
+        || append_receipt(&receipt, "descendant_started", 1).is_err()
+        || append_receipt(&receipt, "descendant_stdout_inherited", 1).is_err()
+    {
+        std::process::exit(5);
+    }
+
+    let mut ready = UnixStream::connect(socket).unwrap_or_else(|_| std::process::exit(5));
+    if ready.write_all(b"1").is_err() {
+        std::process::exit(5);
+    }
+    std::thread::sleep(Duration::from_secs(2));
+}
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    if args.first().is_some_and(|arg| arg == CHILD_FLAG) {
+        child_main(&args);
+        return;
+    }
+    if args.len() != 1 || args[0] != LIST_MODELS_FLAG {
+        std::process::exit(2);
+    }
+
+    match std::env::var(MODE_ENV) {
+        Ok(mode) if mode == "exit7" => {
+            eprintln!("sensitive-token");
+            std::process::exit(7);
+        }
+        Ok(mode) if mode == "oversize" => {
+            let mut stdout = std::io::stdout();
+            let bytes = [b'x'; 64];
+            let _ = stdout.write_all(&bytes);
+            let _ = stdout.flush();
+            return;
+        }
+        Ok(mode) if mode == "sleep" => {
+            std::thread::sleep(Duration::from_secs(2));
+            return;
+        }
+        Ok(mode) if mode == "descendant" => {}
+        Err(std::env::VarError::NotPresent) => {}
+        Ok(_) | Err(std::env::VarError::NotUnicode(_)) => std::process::exit(2),
+    }
+
+    let receipt = receipt_path();
+    let socket = PathBuf::from(format!("{}.sock", receipt.display()));
+    let _ = std::fs::remove_file(&socket);
+    let listener = UnixListener::bind(&socket).unwrap_or_else(|_| std::process::exit(4));
+    if append_receipt(&receipt, "parent_started_once", 1).is_err()
+        || append_receipt(&receipt, "parent_argv_exact", 1).is_err()
+        || append_receipt(&receipt, "parent_pid", std::process::id()).is_err()
+        || append_receipt(&receipt, "child_spawn_attempts", 1).is_err()
+    {
+        std::process::exit(4);
+    }
+
+    let executable = std::env::current_exe().unwrap_or_else(|_| std::process::exit(4));
+    let child = Command::new(executable)
+        .arg(CHILD_FLAG)
+        .env(RECEIPT_ENV, &receipt)
+        .env(READY_SOCKET_ENV, &socket)
+        .stdin(Stdio::null())
+        .stdout(Stdio::inherit())
+        .stderr(Stdio::null())
+        .spawn()
+        .unwrap_or_else(|_| std::process::exit(4));
+    let (mut ready, _) = listener.accept().unwrap_or_else(|_| std::process::exit(4));
+    let mut byte = [0_u8; 1];
+    if ready.read_exact(&mut byte).is_err() || byte != [b'1'] {
+        std::process::exit(4);
+    }
+    if append_receipt(&receipt, "child_pid", child.id()).is_err() {
+        std::process::exit(4);
+    }
+    let _ = std::fs::remove_file(&socket);
+    // The parent exits successfully without waiting; the child retains the
+    // inherited stdout pipe and self-exits after the real reader deadline.
+}