@team-agent/installer 0.5.77 → 0.5.80

package/crates/team-agent/src/state/abnormal_watch.rs

@@ -0,0 +1,144 @@
+//! Scope and lifecycle boundaries for the abnormal-exit observation cache.
+use std::collections::BTreeSet;
+
+use serde_json::{json, Value};
+
+fn members(state: &Value) -> Option<BTreeSet<String>> {
+    Some(state.get("agents")?.as_object()?.keys().cloned().collect())
+}
+
+// A missing roster is unknown. Only a complete, lock-merged roster authorizes
+// discarding absent members; liveness, pause status and record age do not.
+fn scopes(state: &Value) -> Vec<(Option<String>, Option<BTreeSet<String>>)> {
+    let mut root = members(state);
+    if state.get("teams").is_some_and(|teams| !teams.is_object()) {
+        root = None;
+    }
+    let mut scopes = Vec::new();
+    if let Some(teams) = state.get("teams").and_then(Value::as_object) {
+        for (team, entry) in teams {
+            let roster = members(entry);
+            root = match (root, &roster) {
+                (Some(mut union), Some(keys)) => {
+                    union.extend(keys.iter().cloned());
+                    Some(union)
+                }
+                _ => None,
+            };
+            scopes.push((Some(team.clone()), roster));
+        }
+    }
+    scopes.push((None, root));
+    scopes
+}
+
+pub(crate) fn needs_compaction(state: &Value) -> bool {
+    scopes(state).into_iter().any(|(team, roster)| {
+        let entry = team.as_ref().map_or(state, |key| &state["teams"][key]);
+        roster.is_some_and(|keys| {
+            entry
+                .pointer("/coordinator/abnormal_exit_watch")
+                .and_then(Value::as_object)
+                .is_some_and(|watch| watch.keys().any(|key| !keys.contains(key)))
+        })
+    })
+}
+
+/// Call only after the persistence lock's latest-roster merge.
+pub(crate) fn compact_after_merge(state: &mut Value, latest: Option<&Value>, deleted: &[&str]) {
+    let latest_scopes = latest.map(scopes).unwrap_or_default();
+    for (team, mut roster) in scopes(state) {
+        // The normal merge may omit a roster row with no allowlisted stub
+        // fields, or a whole sibling absent from a stale input. Membership in
+        // lock-held latest still forbids pruning its observation. Only explicit
+        // deletion authority can subtract it from this retention union.
+        if let Some((_, latest_roster)) = latest_scopes.iter().find(|(key, _)| key == &team) {
+            roster = match (roster, latest_roster) {
+                (Some(mut keys), Some(latest_keys)) => {
+                    keys.extend(
+                        latest_keys
+                            .iter()
+                            .filter(|key| !deleted.contains(&key.as_str()))
+                            .cloned(),
+                    );
+                    Some(keys)
+                }
+                _ => None,
+            };
+        }
+        let Some(keys) = roster else { continue };
+        let entry = match team {
+            Some(team) => &mut state["teams"][&team],
+            None => &mut *state,
+        };
+        if let Some(watch) = entry
+            .pointer_mut("/coordinator/abnormal_exit_watch")
+            .and_then(Value::as_object_mut)
+        {
+            watch.retain(|key, _| keys.contains(key));
+        }
+    }
+}
+
+/// New observations carry their team and cohort, never just a bare agent id.
+pub(crate) fn observation_identity(state: &Value, agent_id: &str) -> Option<Value> {
+    let agent = state.get("agents")?.get(agent_id)?;
+    let provider = crate::provider::wire::parse_provider(agent.get("provider")?.as_str()?)?;
+    let path = ["rollout_path", "transcript_path", "session_log_path"]
+        .into_iter()
+        .find_map(|key| agent.get(key).and_then(Value::as_str))
+        .filter(|path| !path.is_empty())?;
+    let spawn_epoch = agent.get("spawn_epoch").and_then(Value::as_u64);
+    let spawned_at = agent
+        .get("spawned_at")
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty());
+    // Preserve the watcher's existing legacy cohort: missing spawn fields
+    // remain explicit nulls, never a fabricated generation. A later known
+    // cohort changes this identity and establishes a new baseline.
+    let team = state
+        .get("active_team_key")
+        .and_then(Value::as_str)
+        .filter(|team| !team.is_empty())
+        .map(str::to_string)
+        .or_else(|| {
+            let team = super::projection::team_state_key(state);
+            (team != super::projection::CURRENT_TEAM_ALIAS).then_some(team)
+        })?;
+    Some(json!({
+        "team_key": team,
+        "agent_id": agent_id,
+        "provider": crate::provider::wire::provider_wire(provider),
+        "path": path,
+        "spawn_epoch": spawn_epoch,
+        "spawned_at": spawned_at,
+    }))
+}
+
+pub(crate) fn matches_observation(state: &Value, agent_id: &str, row: &Value) -> bool {
+    observation_identity(state, agent_id)
+        .is_some_and(|identity| row.get("watch_identity") == Some(&identity))
+}
+
+/// Legacy/foreign-cohort facts cannot be reused as current observation evidence.
+/// This is invoked only when actually observing the member, not for paused or
+/// otherwise ineligible members. The next scan establishes the ordinary baseline.
+pub(crate) fn begin_observation(state: &mut Value, agent_id: &str) {
+    let identity = observation_identity(state, agent_id);
+    if let Some(watch) = state
+        .pointer_mut("/coordinator/abnormal_exit_watch")
+        .and_then(Value::as_object_mut)
+    {
+        if watch.get(agent_id).is_some_and(|row| {
+            identity
+                .as_ref()
+                .is_none_or(|identity| row.get("watch_identity") != Some(identity))
+        }) {
+            watch.remove(agent_id);
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod tests;

package/crates/team-agent/src/state/mod.rs

@@ -15,6 +15,7 @@
 //! 绝不 in-place truncate,绝不让审计/重试失败拖垮可见的原 state。
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
+pub(crate) mod abnormal_watch;
 pub mod identity;
 // Stage 0 of identity-boundary unified plan (architect direction 2026-06-23):
 // shared identity primitives. Pure additive — Stage 1+ consume these.

package/crates/team-agent/src/state/persist.rs

@@ -377,6 +377,7 @@ fn save_runtime_state_with_merge_options(
         exact_owner_seed_to_clear,
         None,
         None,
+        None,
     )
 }
 
@@ -399,6 +400,7 @@ pub(crate) fn save_runtime_state_with_receiver_authority_and_expected(
         None,
         Some((expected_owner, expected_receiver)),
         None,
+        None,
     )
 }
 
@@ -421,6 +423,38 @@ pub(crate) fn save_runtime_state_with_exact_owner_receiver_cleanup(
         None,
         None,
         Some((team_key, expected_owner, expected_receiver)),
+        None,
+    )
+}
+
+pub(crate) fn save_runtime_state_with_exact_owner_receiver_restore(
+    workspace: &Path,
+    state: &Value,
+    team_key: &str,
+    expected_owner: &Value,
+    expected_receiver: &Value,
+    previous_owner: &Value,
+    previous_receiver: &Value,
+) -> Result<(), StateError> {
+    persist_runtime_state_with_merge_options_and_expected(
+        workspace,
+        state,
+        &[],
+        None,
+        &[],
+        None,
+        &[],
+        Some(team_key),
+        None,
+        None,
+        None,
+        Some((
+            team_key,
+            expected_owner,
+            expected_receiver,
+            previous_owner,
+            previous_receiver,
+        )),
     )
 }
 
@@ -436,6 +470,7 @@ fn persist_runtime_state_with_merge_options_and_expected(
     exact_owner_seed_to_clear: Option<&Value>,
     expected_owner_receiver: Option<(&Value, &Value)>,
     exact_owner_receiver_to_clear: Option<(&str, &Value, &Value)>,
+    exact_owner_receiver_to_restore: Option<(&str, &Value, &Value, &Value, &Value)>,
 ) -> Result<(), StateError> {
     let path = runtime_state_path(workspace);
     // Python `state.py:497`:先对入参 state 跑 `_migrate_state_identity`(就地填缺失 leader uuid)。
@@ -457,9 +492,11 @@ fn persist_runtime_state_with_merge_options_and_expected(
     // Exact-seed cleanup must observe lock-held disk, not a pre-lock cache or
     // byte-equality hit. A matching in-memory document would otherwise no-op
     // and leave the seed, or skip copying a concurrent owner.
-    let skip_pre_lock_fast_path = exact_owner_seed_to_clear.is_some()
+    let skip_pre_lock_fast_path = super::abnormal_watch::needs_compaction(&migrated)
+        || exact_owner_seed_to_clear.is_some()
         || expected_owner_receiver.is_some()
-        || exact_owner_receiver_to_clear.is_some();
+        || exact_owner_receiver_to_clear.is_some()
+        || exact_owner_receiver_to_restore.is_some();
     if !skip_pre_lock_fast_path && cache_equals(&path, &migrated) {
         return Ok(());
     }
@@ -506,7 +543,7 @@ fn persist_runtime_state_with_merge_options_and_expected(
             ));
         }
     }
-    if let Some(latest) = latest {
+    if let Some(latest) = latest.as_ref() {
         let deleted = deleted_agent_ids
             .iter()
             .copied()
@@ -536,7 +573,7 @@ fn persist_runtime_state_with_merge_options_and_expected(
             .collect::<BTreeSet<_>>();
         apply_persist_merge_contract(
             &mut migrated,
-            &latest,
+            latest,
             &deleted,
             skip_capture_backfill_team_key,
             &skip_capture_backfill,
@@ -544,8 +581,10 @@ fn persist_runtime_state_with_merge_options_and_expected(
             &receiver_updates,
             receiver_update_team_key.zip(exact_owner_seed_to_clear),
             exact_owner_receiver_to_clear,
+            exact_owner_receiver_to_restore,
         )?;
     }
+    super::abnormal_watch::compact_after_merge(&mut migrated, latest.as_ref(), deleted_agent_ids);
     // Stage 3 save-output strip second pass (defence-in-depth): after the
     // `preserve_latest_roster_entries` lock-held merge, a future addition
     // to the preserve path could re-introduce root owner fields from the
@@ -613,6 +652,7 @@ fn apply_persist_merge_contract(
     receiver_updates: &BTreeSet<String>,
     exact_owner_seed_to_clear: Option<(&str, &Value)>,
     exact_owner_receiver_to_clear: Option<(&str, &Value, &Value)>,
+    exact_owner_receiver_to_restore: Option<(&str, &Value, &Value, &Value, &Value)>,
 ) -> Result<(), StateError> {
     // A0/R1: the projection gate only guards the TOP-LEVEL passes (top-level agents and
     // the top-level<->active-team cross projections depend on which team is active); the
@@ -745,6 +785,25 @@ fn apply_persist_merge_contract(
                     );
                 }
             }
+            if let Some((
+                restore_team,
+                expected_owner,
+                expected_receiver,
+                previous_owner,
+                previous_receiver,
+            )) = exact_owner_receiver_to_restore
+            {
+                if team == restore_team {
+                    apply_lock_held_exact_owner_receiver_restore(
+                        incoming_entry,
+                        latest_entry,
+                        expected_owner,
+                        expected_receiver,
+                        previous_owner,
+                        previous_receiver,
+                    );
+                }
+            }
             preserve_latest_endpoint_convergence_fields(incoming_entry, latest_entry);
         }
     }
@@ -919,6 +978,43 @@ fn apply_lock_held_exact_owner_receiver_cleanup(
     }
 }
 
+fn apply_lock_held_exact_owner_receiver_restore(
+    incoming: &mut Value,
+    latest: &Value,
+    expected_owner: &Value,
+    expected_receiver: &Value,
+    previous_owner: &Value,
+    previous_receiver: &Value,
+) {
+    let latest_owner = latest.get("team_owner");
+    let latest_receiver = latest.get("leader_receiver");
+    let Some(incoming_obj) = incoming.as_object_mut() else {
+        return;
+    };
+    if latest_owner == Some(expected_owner) && latest_receiver == Some(expected_receiver) {
+        incoming_obj.insert("team_owner".to_string(), previous_owner.clone());
+        incoming_obj.insert("leader_receiver".to_string(), previous_receiver.clone());
+        if let Some(epoch) = previous_owner
+            .get("owner_epoch")
+            .cloned()
+            .or_else(|| latest.get("owner_epoch").cloned())
+        {
+            incoming_obj.insert("owner_epoch".to_string(), epoch);
+        }
+        return;
+    }
+    for key in ["team_owner", "leader_receiver", "owner_epoch"] {
+        match latest.get(key) {
+            Some(value) => {
+                incoming_obj.insert(key.to_string(), value.clone());
+            }
+            None => {
+                incoming_obj.remove(key);
+            }
+        }
+    }
+}
+
 fn preserve_latest_endpoint_convergence_fields(incoming: &mut Value, latest: &Value) {
     if !latest_has_preferable_endpoint_convergence(incoming, latest) {
         return;
@@ -3113,6 +3209,7 @@ mod tests {
             &BTreeSet::new(),
             None,
             None,
+            None,
         )
         .unwrap();
 
@@ -3149,6 +3246,7 @@ mod tests {
             &receiver_updates,
             None,
             None,
+            None,
         )
         .unwrap();
 

package/crates/team-agent/src/state/projection.rs

@@ -486,7 +486,13 @@ pub fn project_top_level_view(state: &Value, team_key: &str) -> Value {
         .is_some_and(|o| o.contains_key("coordinator"))
         && !p.contains_key("coordinator")
     {
-        p.insert("coordinator".to_string(), state["coordinator"].clone());
+        let mut coordinator = state["coordinator"].clone();
+        // Workspace legacy watch facts have no proven owner in this team.
+        // Preserve other coordinator fields, but never broadcast this cache.
+        if let Some(coordinator) = coordinator.as_object_mut() {
+            coordinator.remove("abnormal_exit_watch");
+        }
+        p.insert("coordinator".to_string(), coordinator);
     }
     Value::Object(p)
 }

package/crates/team-agent/src/state/repository.rs

@@ -52,6 +52,8 @@ use super::persist::{
         as helper_write_root_with_receiver_authority_and_expected,
     save_runtime_state_with_exact_owner_receiver_cleanup
         as helper_write_root_with_exact_owner_receiver_cleanup,
+    save_runtime_state_with_exact_owner_receiver_restore
+        as helper_write_root_with_exact_owner_receiver_restore,
     save_runtime_state_with_team_tombstone_lifecycle_topology_authority as helper_write_root_with_team_tombstone_lifecycle_topology_authority,
     save_runtime_state_with_team_tombstoned_agents as helper_write_root_with_team_tombstoned_agents,
     save_runtime_state_without_migrations as helper_write_root_without_migrations,
@@ -224,9 +226,20 @@ pub enum StateWriteIntent<'a> {
         seed: &'a Value,
         expected_receiver: &'a Value,
     },
+    RestoreExactTeamOwnerAndReceiver {
+        team_key: &'a str,
+        expected_owner: &'a Value,
+        expected_receiver: &'a Value,
+        previous_owner: &'a Value,
+        previous_receiver: &'a Value,
+    },
     LeaderBindingRestoreNonTargetTeams {
         target_team_key: &'a str,
     },
+    /// Strip extra keys written by a failed or degraded quick-start bind attempt.
+    QuickStartBindingCleanup {
+        team_key: &'a str,
+    },
     LeaderStartBinding {
         team_key: &'a str,
         transport_kind: &'a str,
@@ -428,6 +441,22 @@ fn route_direct(
             seed,
             expected_receiver,
         ),
+        StateWriteIntent::RestoreExactTeamOwnerAndReceiver {
+            team_key,
+            expected_owner,
+            expected_receiver,
+            previous_owner,
+            previous_receiver,
+        } => helper_write_root_with_exact_owner_receiver_restore(
+            workspace,
+            state,
+            team_key,
+            expected_owner,
+            expected_receiver,
+            previous_owner,
+            previous_receiver,
+        ),
+        StateWriteIntent::QuickStartBindingCleanup { .. } => helper_write_root(workspace, state),
         StateWriteIntent::LeaderBindingRestoreNonTargetTeams { .. } => {
             helper_write_root_without_migrations(workspace, state)
         }

package/crates/team-agent/src/test_support/models_timeout_fixture.rs

@@ -1,16 +1,33 @@
 use std::fs::OpenOptions;
-use std::io::{Read, Write};
-use std::os::unix::net::{UnixListener, UnixStream};
+use std::io::Write;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
-use std::time::Duration;
+use std::time::{Duration, Instant};
 
 const CHILD_FLAG: &str = "--team-agent-models-timeout-child";
 const LIST_MODELS_FLAG: &str = "--list-models";
 const RECEIPT_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_RECEIPT";
+const STAGE_RECEIPT_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_STAGE_RECEIPT";
 const MODE_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_MODE";
-const READY_SOCKET_ENV: &str = "TEAM_AGENT_MODELS_TIMEOUT_READY_SOCKET";
 const STDOUT_MARKER: &[u8] = b"__team_agent_models_timeout_descendant_stdout_v1__\n";
+const PARENT_HANDOFF_TIMEOUT: Duration = Duration::from_secs(1);
+
+// Stage values are UNIX epoch milliseconds so the test process and helper use
+// one directly comparable clock. Stage writes are best-effort diagnostics and
+// never change the fixture's production-facing exit semantics.
+fn append_stage(key: &str) {
+    let Some(path) = std::env::var_os(STAGE_RECEIPT_ENV) else {
+        return;
+    };
+    let Some(milliseconds) = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .ok()
+        .map(|duration| duration.as_millis())
+    else {
+        return;
+    };
+    let _ = append_receipt(Path::new(&path), key, milliseconds);
+}
 
 fn receipt_path() -> PathBuf {
     std::env::var_os(RECEIPT_ENV)
@@ -27,14 +44,29 @@ fn append_receipt(path: &Path, key: &str, value: impl std::fmt::Display) -> Resu
     writeln!(receipt, "{key}={value}").map_err(|_| ())
 }
 
+fn wait_for_parent_handoff(receipt: &Path) {
+    let expected = format!("child_pid={}", std::process::id());
+    let deadline = Instant::now() + PARENT_HANDOFF_TIMEOUT;
+    loop {
+        if std::fs::read_to_string(receipt)
+            .ok()
+            .is_some_and(|text| text.lines().any(|line| line == expected))
+        {
+            return;
+        }
+        if Instant::now() >= deadline {
+            std::process::exit(5);
+        }
+        std::thread::sleep(Duration::from_millis(1));
+    }
+}
+
 fn child_main(args: &[String]) {
     if args.len() != 1 || args[0] != CHILD_FLAG {
         std::process::exit(5);
     }
     let receipt = receipt_path();
-    let socket = std::env::var_os(READY_SOCKET_ENV)
-        .map(PathBuf::from)
-        .unwrap_or_else(|| std::process::exit(5));
+    wait_for_parent_handoff(&receipt);
 
     let mut stdout = std::io::stdout();
     if stdout.write_all(STDOUT_MARKER).is_err() || stdout.flush().is_err() {
@@ -48,10 +80,6 @@ fn child_main(args: &[String]) {
         std::process::exit(5);
     }
 
-    let mut ready = UnixStream::connect(socket).unwrap_or_else(|_| std::process::exit(5));
-    if ready.write_all(b"1").is_err() {
-        std::process::exit(5);
-    }
     std::thread::sleep(Duration::from_secs(2));
 }
 
@@ -86,10 +114,8 @@ fn main() {
         Ok(_) | Err(std::env::VarError::NotUnicode(_)) => std::process::exit(2),
     }
 
+    append_stage("parent_entry_ms");
     let receipt = receipt_path();
-    let socket = PathBuf::from(format!("{}.sock", receipt.display()));
-    let _ = std::fs::remove_file(&socket);
-    let listener = UnixListener::bind(&socket).unwrap_or_else(|_| std::process::exit(4));
     if append_receipt(&receipt, "parent_started_once", 1).is_err()
         || append_receipt(&receipt, "parent_argv_exact", 1).is_err()
         || append_receipt(&receipt, "parent_pid", std::process::id()).is_err()
@@ -99,24 +125,20 @@ fn main() {
     }
 
     let executable = std::env::current_exe().unwrap_or_else(|_| std::process::exit(4));
+    append_stage("parent_before_child_spawn_ms");
     let child = Command::new(executable)
         .arg(CHILD_FLAG)
         .env(RECEIPT_ENV, &receipt)
-        .env(READY_SOCKET_ENV, &socket)
         .stdin(Stdio::null())
         .stdout(Stdio::inherit())
         .stderr(Stdio::null())
         .spawn()
         .unwrap_or_else(|_| std::process::exit(4));
-    let (mut ready, _) = listener.accept().unwrap_or_else(|_| std::process::exit(4));
-    let mut byte = [0_u8; 1];
-    if ready.read_exact(&mut byte).is_err() || byte != [b'1'] {
-        std::process::exit(4);
-    }
+    append_stage("parent_after_child_spawn_ms");
     if append_receipt(&receipt, "child_pid", child.id()).is_err() {
         std::process::exit(4);
     }
-    let _ = std::fs::remove_file(&socket);
+    append_stage("parent_before_exit_ms");
     // The parent exits successfully without waiting; the child retains the
     // inherited stdout pipe and self-exits after the real reader deadline.
 }