@team-agent/installer 0.5.78 → 0.5.80

package/Cargo.lock

@@ -581,7 +581,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.78"
+version = "0.5.80"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.78"
+version = "0.5.80"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/models.rs

@@ -248,6 +248,37 @@ mod tests {
             None
         );
     }
+
+    #[cfg(unix)]
+    #[test]
+    fn search_survives_unrelated_spaced_model_ids() {
+        let catalog = include_str!("../lifecycle/tests/fixtures/pi_list_models_spaced_ids.stdout.txt");
+        let path = fixture(&format!("printf '%s' '{catalog}'"));
+        let result = cmd_models_with(
+            &ModelsArgs {
+                provider: "pi".into(),
+                search: Some("gpt-5.6-luna".into()),
+                json: true,
+            },
+            &path,
+            Duration::from_secs(10),
+            MAX_CATALOG_BYTES,
+        )
+        .unwrap();
+        cleanup_fixture(&path);
+        assert_eq!(result.exit, ExitCode::Ok);
+        let CmdOutput::Human(text) = result.output else {
+            panic!("expected JSON projection")
+        };
+        let value: Value = serde_json::from_str(&text).unwrap();
+        assert_eq!(value["ok"], true);
+        assert_eq!(value["auth"], "ok");
+        let models = value["models"].as_array().unwrap();
+        assert_eq!(models.len(), 2);
+        assert_eq!(models[0]["role_model"], "openai-codex/gpt-5.6-luna");
+        assert_eq!(models[1]["role_model"], "team-agent/gpt-5.6-luna");
+    }
+
     #[cfg(unix)]
     fn fixture(body: &str) -> std::path::PathBuf {
         use std::os::unix::fs::PermissionsExt;

package/crates/team-agent/src/cli/status_port/runtime.rs

@@ -58,7 +58,9 @@ pub(crate) fn compute_runtime_freshness(
             for (agent_id, entry) in watch {
                 let exited =
                     entry.get("worker_provider_exited").and_then(Value::as_bool) == Some(true);
-                if exited {
+                if exited
+                    && crate::state::abnormal_watch::matches_observation(state, agent_id, entry)
+                {
                     provider_exited_agents.insert(agent_id.clone());
                 }
             }

package/crates/team-agent/src/cli/status_port/tests.rs

@@ -28,7 +28,12 @@ fn health_fixture() -> crate::coordinator::HealthReport {
 
 #[test]
 fn runtime_freshness_provider_exit_requires_typed_positive_fact() {
-    let state = serde_json::json!({
+    let mut state = serde_json::json!({
+        "active_team_key": "status-team",
+        "agents": {
+            "pane_only": {"provider": "codex", "rollout_path": "/fixture/pane", "spawn_epoch": 1},
+            "typed_exit": {"provider": "codex", "rollout_path": "/fixture/typed", "spawn_epoch": 1}
+        },
         "coordinator": {
             "abnormal_exit_watch": {
                 "pane_only": {
@@ -43,6 +48,10 @@ fn runtime_freshness_provider_exit_requires_typed_positive_fact() {
         }
     });
 
+    for id in ["pane_only", "typed_exit"] {
+        state["coordinator"]["abnormal_exit_watch"][id]["watch_identity"] =
+            crate::state::abnormal_watch::observation_identity(&state, id).unwrap();
+    }
     let freshness = compute_runtime_freshness(
         Path::new("/nonexistent/status-port-typed-provider-exit-test"),
         &state,
@@ -52,3 +61,30 @@ fn runtime_freshness_provider_exit_requires_typed_positive_fact() {
     assert!(!freshness.provider_exited_agents.contains("pane_only"));
     assert!(freshness.provider_exited_agents.contains("typed_exit"));
 }
+
+#[test]
+fn runtime_freshness_rejects_foreign_legacy_and_unknown_watch_identity() {
+    let mut state = json!({
+        "active_team_key": "a",
+        "agents": {"w": {"provider": "codex", "rollout_path": "/fixture/w", "spawn_epoch": 1}},
+        "coordinator": {"abnormal_exit_watch": {"w": {"worker_provider_exited": true}}}
+    });
+    let path = Path::new("/nonexistent/status-watch-188");
+    assert!(compute_runtime_freshness(path, &state, &health_fixture())
+        .provider_exited_agents
+        .is_empty());
+    let identity = crate::state::abnormal_watch::observation_identity(&state, "w").unwrap();
+    state["coordinator"]["abnormal_exit_watch"]["w"]["watch_identity"] = identity;
+    for (pointer, value) in [
+        ("/active_team_key", json!("b")),
+        ("/agents/w/provider", json!("claude")),
+        ("/agents/w/spawn_epoch", json!(2)),
+        ("/agents/w/rollout_path", json!(null)),
+    ] {
+        let mut changed = state.clone();
+        *changed.pointer_mut(pointer).unwrap() = value;
+        assert!(compute_runtime_freshness(path, &changed, &health_fixture())
+            .provider_exited_agents
+            .is_empty());
+    }
+}

package/crates/team-agent/src/coordinator/steps/abnormal.rs

@@ -73,6 +73,8 @@ pub(crate) fn detect_abnormal_exits(
     let team = crate::state::projection::team_state_key(&snapshot);
     let session_name = snapshot.get("session_name").and_then(Value::as_str);
     for agent in abnormal_watch_agents(&snapshot) {
+        // Reject untrusted history without skipping a fresh provider/path observation.
+        crate::state::abnormal_watch::begin_observation(state, &agent.agent_id);
         // Pane/process liveness is independent of transcript content. A
         // frozen rollout is common after pane death, so probe before the
         // metadata dedupe gate; only the expensive tail scan stays deduped.
@@ -109,7 +111,7 @@ pub(crate) fn detect_abnormal_exits(
         // re-read below.
         if let (Some(mtime), Some(stored)) = (
             mtime_ns,
-            abnormal_watch_stored_metadata(&snapshot, &agent.agent_id),
+            abnormal_watch_stored_metadata(state, &agent.agent_id),
         ) {
             if stored == (size, mtime) {
                 refresh_abnormal_watch_liveness(state, &agent.agent_id, &liveness);
@@ -149,7 +151,7 @@ pub(crate) fn detect_abnormal_exits(
             .map(|fact| abnormal_error_observation_key(&agent, fact));
         let error_observation_cohort = fact.as_ref().map(|_| abnormal_error_cohort_key(&agent));
         let error_recency = abnormal_error_recency(
-            &snapshot,
+            state,
             &agent,
             error_observation_key.as_deref(),
             error_observation_cohort.as_deref(),
@@ -954,6 +956,9 @@ fn abnormal_watch_payload(
 }
 
 fn upsert_abnormal_watch(state: &mut Value, agent_id: &str, mut payload: Value) {
+    if let Some(identity) = crate::state::abnormal_watch::observation_identity(state, agent_id) {
+        payload["watch_identity"] = identity;
+    }
     let preserved = [
         "last_notified_key",
         "last_notified_at",
@@ -1413,6 +1418,121 @@ mod tests {
             crate::provider::get_adapter(provider)
         }
     }
+    #[test]
+    fn resource188_foreign_metadata_and_dedupe_cannot_skip_new_baseline() {
+        let dir = temp_abnormal_dir("188-foreign-watch");
+        let rollout = dir.join("rollout-w1.jsonl");
+        let error = "{\"method\":\"turn/completed\",\"params\":{\"turn\":{\"id\":\"old\",\"status\":\"failed\"}}}\n";
+        std::fs::write(&rollout, error).unwrap();
+        seed_abnormal_state(&dir, &rollout, "alive", 1);
+        let mut state = crate::state::persist::load_runtime_state(&dir).unwrap();
+        let metadata = std::fs::metadata(&rollout).unwrap();
+        let mut foreign = crate::state::abnormal_watch::observation_identity(&state, "w1").unwrap();
+        foreign["team_key"] = serde_json::json!("another-team");
+        state["coordinator"] = serde_json::json!({"abnormal_exit_watch": {"w1": {
+            "watch_identity": foreign,
+            "size": metadata.len(), "mtime_ns": metadata_mtime_ns(&metadata),
+            "last_notified_key": "foreign", "last_check_key": "foreign",
+            "last_error_observation_key": "foreign", "last_error_observation_cohort": "foreign"
+        }}});
+        let log = EventLog::new(&dir);
+        let transport = crate::transport::test_support::OfflineTransport::new();
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        let baseline = state["coordinator"]["abnormal_exit_watch"]["w1"].clone();
+        assert_eq!(baseline["error_recency"], "stale");
+        assert!(baseline.get("last_notified_key").is_none());
+        assert!(crate::state::abnormal_watch::matches_observation(
+            &state, "w1", &baseline
+        ));
+        let events = log.tail(0).unwrap();
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        assert_eq!(
+            log.tail(0).unwrap(),
+            events,
+            "unchanged baseline must not re-alarm"
+        );
+        assert!(find_event(&events, "worker.abnormal_exit").is_none());
+    }
+
+    #[test]
+    fn resource188_legacy_missing_cohort_still_observes_fresh_errors_and_dedupes() {
+        let dir = temp_abnormal_dir("188-legacy-cohort");
+        let rollout = dir.join("rollout-w1.jsonl");
+        let error = "{\"method\":\"turn/completed\",\"params\":{\"turn\":{\"id\":\"old\",\"status\":\"failed\"}}}\n";
+        std::fs::write(&rollout, error).unwrap();
+        seed_abnormal_state(&dir, &rollout, "alive", 1);
+        let mut state = crate::state::persist::load_runtime_state(&dir).unwrap();
+        state["agents"]["w1"]
+            .as_object_mut()
+            .unwrap()
+            .remove("spawn_epoch");
+        let log = EventLog::new(&dir);
+        let transport = crate::transport::test_support::OfflineTransport::new();
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        assert_eq!(
+            state["coordinator"]["abnormal_exit_watch"]["w1"]["error_recency"],
+            "stale"
+        );
+        assert!(find_event(&log.tail(0).unwrap(), "worker.abnormal_exit").is_none());
+        std::fs::OpenOptions::new()
+            .append(true)
+            .open(&rollout)
+            .unwrap()
+            .write_all(error.replace("old", "new-error").as_bytes())
+            .unwrap();
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        let events = log.tail(0).unwrap();
+        assert_eq!(
+            find_event(&events, "worker.abnormal_exit").unwrap()["error_recency"],
+            "fresh"
+        );
+        let notified =
+            state["coordinator"]["abnormal_exit_watch"]["w1"]["last_notified_key"].clone();
+        assert!(notified.is_string());
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        assert_eq!(log.tail(0).unwrap(), events);
+        assert_eq!(
+            state["coordinator"]["abnormal_exit_watch"]["w1"]["last_notified_key"],
+            notified
+        );
+        state["agents"]["w1"]["spawn_epoch"] = serde_json::json!(2);
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        let watch = &state["coordinator"]["abnormal_exit_watch"]["w1"];
+        assert_eq!(
+            watch["error_recency"], "stale",
+            "a known generation must rebaseline unchanged bytes"
+        );
+        assert!(watch.get("last_notified_key").is_none());
+        assert_eq!(
+            log.tail(0)
+                .unwrap()
+                .iter()
+                .filter(|event| event["event"] == "worker.abnormal_exit")
+                .count(),
+            1
+        );
+    }
+
+    #[test]
+    fn resource188_unknown_team_still_records_fresh_liveness_without_reusing_cache() {
+        let dir = temp_abnormal_dir("188-unknown-team");
+        let rollout = dir.join("rollout-w1.jsonl");
+        std::fs::write(&rollout, "").unwrap();
+        seed_abnormal_state(&dir, &rollout, "dead", 1);
+        let mut state = crate::state::persist::load_runtime_state(&dir).unwrap();
+        state.as_object_mut().unwrap().remove("active_team_key");
+        let log = EventLog::new(&dir);
+        let transport = crate::transport::test_support::OfflineTransport::new();
+        detect_abnormal_exits(&dir, &transport, &mut state, &log, &[]).unwrap();
+        assert_eq!(
+            state["coordinator"]["abnormal_exit_watch"]["w1"]["last_liveness"],
+            "dead"
+        );
+        assert!(state["coordinator"]["abnormal_exit_watch"]["w1"]
+            .get("watch_identity")
+            .is_none());
+    }
+
     #[test]
     fn abnormal_stale_error_baselines_then_fresh_alive_error_notifies() {
         let dir = temp_abnormal_dir("alive-fresh");

package/crates/team-agent/src/leader/start.rs

@@ -1412,13 +1412,6 @@ extern "C" fn managed_term_handler(_: libc::c_int) {
 }
 
 fn managed_attach_should_teardown(watch: &ManagedAttachWatch<'_>) -> bool {
-    let marker = crate::tmux_backend::leader_provider_exit_marker(watch.provider_label);
-    let target = Target::Pane(watch.spawned.pane_id.clone());
-    if let Ok(cap) = watch.transport.capture(&target, CaptureRange::Tail(80)) {
-        if cap.text.contains(&marker) || cap.text.contains("[team-agent] Provider exited") {
-            return true;
-        }
-    }
     matches!(
         leader_provider_health(
             watch.transport,
@@ -1674,65 +1667,21 @@ fn ensure_managed_provider_live_after_attach(
     )))
 }
 
-/// 0.4.x (CR C-3 P0): leader provider health reconciliation. The default
-/// `liveness()` check only proves the pane is ADDRESSABLE via tmux — it
-/// returns `Live` even when the provider has exited and the wrapper shell
-/// remains at its inert tail. This function distinguishes
-/// `provider_alive` from `provider_exited` by:
-///   1. Reading `pane_current_command` (tmux `#{pane_current_command}`).
-///   2. If the current command matches the expected provider binary (or
-///      one of its known aliases), report `Alive`.
-///   3. If the current command is a shell tail process AND the pane
-///      content contains the exit marker `[team-agent] <provider> exited`
-///      (emitted by `leader_shell_wrapper_command`), report
-///      `ProviderExited`.
-///   4. Otherwise (Unknown shell, no marker), report `Alive` as the
-///      conservative default — avoid false-positive exit alarms.
-///
-/// Note: when the leader shell wrapper is used (CR C-2), a provider exit
-/// leaves the pane as an inert `/bin/sh -c` tail with the exit marker in
-/// scrollback. Pre-wrapper code that hit `exec claude` would have left the
-/// pane as `[exited]` and `liveness()` would have returned `Dead`. The new
-/// failure mode requires this richer health check to surface
-/// `leader_provider_exited` as a distinct status.
+/// Reconcile real pane liveness with the supervising wrapper's exit receipt.
+/// Restored provider output may contain any exit-marker text; it is not process
+/// state and must never authorize destructive managed-window cleanup.
 pub fn leader_provider_health(
     transport: &dyn Transport,
     pane_id: &PaneId,
-    expected_provider_label: &str,
+    _expected_provider_label: &str,
 ) -> LeaderProviderHealth {
-    use crate::transport::{CaptureRange, PaneField, Target};
-    let liveness = transport.liveness(pane_id).ok();
-    if matches!(liveness, Some(PaneLiveness::Dead)) {
+    if matches!(transport.liveness(pane_id), Ok(PaneLiveness::Dead)) {
         return LeaderProviderHealth::Unreachable;
     }
-    let target = Target::Pane(pane_id.clone());
-    let current_command = transport
-        .query(&target, PaneField::PaneCurrentCommand)
-        .ok()
-        .flatten()
-        .map(|s| s.trim().to_lowercase())
-        .unwrap_or_default();
-    if !current_command.is_empty()
-        && (current_command == expected_provider_label
-            || current_command.contains(expected_provider_label))
-    {
-        return LeaderProviderHealth::Alive;
+    if matches!(transport.provider_exit_status(pane_id), Ok(Some(_))) {
+        return LeaderProviderHealth::ProviderExited;
     }
-    // Current command is NOT the provider — likely fell back to shell.
-    let is_shell = is_interactive_shell_basename(&current_command);
-    if is_shell {
-        // CR R6: marker text from single-source `leader_provider_exit_marker`
-        // so the wrapper printf and the health-check substring cannot drift.
-        let exit_marker_substr =
-            crate::tmux_backend::leader_provider_exit_marker(expected_provider_label);
-        if let Ok(cap) = transport.capture(&target, CaptureRange::Tail(200)) {
-            if cap.text.contains(&exit_marker_substr) {
-                return LeaderProviderHealth::ProviderExited;
-            }
-        }
-    }
-    // Conservative default — pane addressable, but couldn't positively
-    // confirm provider exit. Treat as Alive.
+    // Missing/unsupported receipts (including old wrappers) are not proof of exit.
     LeaderProviderHealth::Alive
 }
 
@@ -1750,7 +1699,6 @@ pub enum LeaderProviderHealth {
 
 /// 0.4.x (CR R6 + R3): single-source shell-tail detection.
 /// Used by:
-///   - `leader_provider_health` to decide "pane is at the shell tail"
 ///   - shutdown logic to recognise a leader pane in shell-tail mode
 ///     as still owned by the leader (not stray).
 ///
@@ -3001,6 +2949,7 @@ mod tests {
         screens: Mutex<Vec<String>>,
         sent: Mutex<Vec<(Target, Vec<Key>)>>,
         liveness: PaneLiveness,
+        exit_status: Option<u8>,
         targets: Vec<PaneInfo>,
         window_options: Mutex<Vec<(String, String)>>,
         window_option_error: Mutex<Option<String>>,
@@ -3014,6 +2963,7 @@ mod tests {
                 screens: Mutex::new(screens),
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3027,6 +2977,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3040,6 +2991,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness,
+                exit_status: None,
                 targets,
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3055,6 +3007,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(Some(error.to_string())),
@@ -3186,6 +3139,10 @@ mod tests {
             Ok(self.liveness)
         }
 
+        fn provider_exit_status(&self, _pane: &PaneId) -> Result<Option<u8>, TransportError> {
+            Ok(self.exit_status)
+        }
+
         fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
             Ok(self.targets.clone())
         }
@@ -3859,22 +3816,37 @@ mod tests {
     }
 
     #[test]
-    fn managed_attach_teardown_detects_provider_exit_marker() {
+    fn managed_attach_teardown_requires_exit_receipt_not_replayed_markers() {
         let spawned = managed_spawn_result();
-        let transport = ScriptedTransport::new(vec![
-            "[team-agent] claude exited with 1\n[team-agent] Provider exited; this pane no longer accepts input.".to_string(),
+        let mut transport = ScriptedTransport::new(vec![
+            "[team-agent] pi exited with 1\n[team-agent] Provider exited".to_string(),
         ]);
-        let watch = super::ManagedAttachWatch {
-            transport: &transport,
-            spawned: &spawned,
-            session: &spawned.session,
-            session_existed_before: false,
-            workspace: Path::new("/tmp"),
-            provider_label: "claude",
-        };
-        assert!(
-            super::managed_attach_should_teardown(&watch),
-            "exit marker in capture must trigger teardown"
+        transport.liveness = PaneLiveness::Live;
+        for exit_status in [None, Some(0), Some(17)] {
+            transport.exit_status = exit_status;
+            let watch = super::ManagedAttachWatch {
+                transport: &transport,
+                spawned: &spawned,
+                session: &spawned.session,
+                session_existed_before: false,
+                workspace: Path::new("/tmp"),
+                provider_label: "pi",
+            };
+            assert_eq!(
+                super::managed_attach_should_teardown(&watch),
+                exit_status.is_some()
+            );
+        }
+        assert_eq!(
+            transport.screens.lock().unwrap().len(),
+            1,
+            "health must not read history"
+        );
+        transport.liveness = PaneLiveness::Dead;
+        transport.exit_status = None;
+        assert_eq!(
+            super::leader_provider_health(&transport, &spawned.pane_id, "pi"),
+            super::LeaderProviderHealth::Unreachable
         );
     }
 

package/crates/team-agent/src/lifecycle/launch/pi_mcp.rs

@@ -151,14 +151,30 @@ pub(crate) fn parse_pi_list_models_table(bytes: &[u8]) -> Result<Vec<String>, Pr
         if line.trim().is_empty() {
             continue;
         }
-        let columns = line.split_whitespace().collect::<Vec<_>>();
-        if columns.len() < 2 || columns[0].is_empty() || columns[1].is_empty() {
-            return Err(ProviderError::Command(format!(
+        let malformed = || {
+            ProviderError::Command(format!(
                 "Pi model catalog row {} is malformed",
                 index + 2
-            )));
+            ))
+        };
+        let (provider, model) = line
+            .trim()
+            .split_once(char::is_whitespace)
+            .ok_or_else(malformed)?;
+        let mut model = model.trim();
+        // Pi prints the raw model id, which may contain spaces. Only the
+        // capability columns following it are single whitespace-free values.
+        for _ in 2..header_columns.len() {
+            model = model
+                .rsplit_once(char::is_whitespace)
+                .ok_or_else(malformed)?
+                .0
+                .trim_end();
+        }
+        if model.is_empty() {
+            return Err(malformed());
         }
-        let exact = format!("{}/{}", columns[0], columns[1]);
+        let exact = format!("{provider}/{model}");
         if !seen.insert(exact.clone()) {
             return Err(ProviderError::Command(format!(
                 "Pi model catalog contains duplicate exact id {exact:?}"

package/crates/team-agent/src/lifecycle/tests/fixtures/pi_list_models_spaced_ids.stdout.txt

@@ -0,0 +1,9 @@
+provider      model                         context  max-out  thinking  images
+cursor        claude-opus-4-7@1m:fast       1M       16.4K    yes       yes
+cursor        claude-opus-4-7@1m:slow       1M       16.4K    yes       yes
+openai-codex  gpt-5.6-luna                  272K     128K     yes       yes
+team-agent    Claude Opus 4.6 (Thinking)    200K     32.8K    yes       yes
+team-agent    Claude Sonnet 4.6 (Thinking)  200K     32.8K    yes       yes
+team-agent    Gemini 3.8 Flash              200K     32.8K    yes       yes
+team-agent    gpt-5.6-luna                  200K     32.8K    yes       yes
+team-agent    qwen3.8-27b                   262.1K   32.8K    yes       yes

package/crates/team-agent/src/lifecycle/tests/pi_catalog_red.rs

@@ -8,6 +8,77 @@ use crate::model::enums::ProviderEffort;
 use crate::provider::adapters::pi::{build_pi_command_argv, PiCommandRequest, PiSessionSelector};
 
 const CATALOG: &[u8] = include_bytes!("fixtures/pi_list_models_g0.stdout.txt");
+// Public pi --list-models rows captured for issue #186, preserving column widths.
+const SPACED_IDS_CATALOG: &[u8] = include_bytes!("fixtures/pi_list_models_spaced_ids.stdout.txt");
+
+#[test]
+fn pi_catalog_preserves_spaced_ids_and_qualified_slug_variants() {
+    let models = parse_pi_list_models_table(SPACED_IDS_CATALOG).expect("public catalog rows");
+    assert_eq!(
+        models,
+        vec![
+            "cursor/claude-opus-4-7@1m:fast",
+            "cursor/claude-opus-4-7@1m:slow",
+            "openai-codex/gpt-5.6-luna",
+            "team-agent/Claude Opus 4.6 (Thinking)",
+            "team-agent/Claude Sonnet 4.6 (Thinking)",
+            "team-agent/Gemini 3.8 Flash",
+            "team-agent/gpt-5.6-luna",
+            "team-agent/qwen3.8-27b",
+        ]
+    );
+    for exact in &models {
+        assert_eq!(select_exact_pi_model(&models, exact).unwrap(), *exact);
+        assert!(argv_has_pair(&command_for_model(exact), "--model", exact));
+    }
+}
+
+#[test]
+fn pi_catalog_still_rejects_duplicate_complete_spaced_ids() {
+    let text = std::str::from_utf8(SPACED_IDS_CATALOG).unwrap();
+    let repeated = text
+        .lines()
+        .find(|line| line.contains("Claude Opus 4.6 (Thinking)"))
+        .unwrap();
+    let duplicate = format!("{text}{repeated}\n");
+    let error = parse_pi_list_models_table(duplicate.as_bytes()).unwrap_err();
+    assert!(error
+        .to_string()
+        .contains("duplicate exact id \"team-agent/Claude Opus 4.6 (Thinking)\""));
+    let exact = "team-agent/Claude Opus 4.6 (Thinking)";
+    assert!(select_exact_pi_model(&[exact.into(), exact.into()], exact).is_err());
+}
+
+#[test]
+fn pi_catalog_preserves_internal_whitespace_with_compact_and_full_headers() {
+    for catalog in [
+        "provider model\r\nteam-agent\tClaude  Opus 4.6 (Thinking)  \r\n",
+        "provider model context max-out thinking images\r\nteam-agent\tClaude  Opus 4.6 (Thinking)\t200K  32.8K\tyes  yes  \r\n",
+    ] {
+        assert_eq!(
+            parse_pi_list_models_table(catalog.as_bytes()).unwrap(),
+            vec!["team-agent/Claude  Opus 4.6 (Thinking)"]
+        );
+    }
+}
+
+#[test]
+fn pi_catalog_rejects_rows_without_model_or_required_trailing_fields() {
+    for row in [
+        "team-agent",
+        "team-agent 200K 32.8K yes yes",
+        "team-agent gpt-5.6-luna 200K 32.8K yes",
+    ] {
+        let catalog = format!("provider model context max-out thinking images\n{row}\n");
+        assert!(
+            parse_pi_list_models_table(catalog.as_bytes())
+                .unwrap_err()
+                .to_string()
+                .contains("row 2 is malformed"),
+            "missing model or capability fields must refuse: {row}"
+        );
+    }
+}
 
 fn argv_has_pair(argv: &[String], flag: &str, value: &str) -> bool {
     argv.windows(2)