@team-agent/installer 0.5.9 → 0.5.10

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.9"
+version = "0.5.10"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.9"
+version = "0.5.10"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/named_address.rs

@@ -267,6 +267,26 @@ pub(crate) fn resolve_name_for_cli(
     Ok((resolved, transport))
 }
 
+/// E6 wiring helper (`cli::send::maybe_enqueue_offline_leader_mailbox`):
+/// re-parse a `<workspace>::<team>/leader` name and return the resolved
+/// target workspace + canonical team_key so send.rs can enqueue the
+/// mailbox without duplicating the parser. Returns `Ok(None)` for names
+/// that aren't `<team>/leader` shapes (worker sends, session:window,
+/// etc. keep their existing refusal semantics).
+pub(crate) fn parse_leader_target_workspace_and_team(
+    sender_workspace: &Path,
+    raw_name: &str,
+) -> Result<Option<(PathBuf, String)>, NamedAddressError> {
+    let parsed = parse_named_address(raw_name)?;
+    let target_workspace = resolve_workspace(sender_workspace, parsed.workspace.as_deref())?;
+    match parsed.target {
+        ParsedTarget::TeamEntity { team, entity } if entity == "leader" => {
+            Ok(Some((target_workspace, team)))
+        }
+        _ => Ok(None),
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct ParsedNamedAddress {
     workspace: Option<PathBuf>,

package/crates/team-agent/src/cli/send.rs

@@ -52,10 +52,34 @@ pub fn cmd_send(args: &SendArgs) -> Result<CmdResult, CliError> {
         let (resolved, transport) =
             match crate::cli::named_address::resolve_name_for_cli(&args.workspace, to_name) {
                 Ok(resolved) => resolved,
-                Err(error) if args.json => {
-                    return Ok(CmdResult::from_json(error.to_json(), args.json));
+                Err(error) => {
+                    // E6 (0.5.9 offline-mailbox-toname-design §3.1/§6.2): when
+                    // the resolver refuses with `leader_not_attached`, the team
+                    // itself may still be alive (worker + coordinator running
+                    // without a bound leader). Third-party senders in that
+                    // shape must land in the offline mailbox — same
+                    // canonical team.db row + queued_until_leader_attach
+                    // status the coordinator/attach hook replay through the
+                    // existing pipeline exactly once. Owner-scope refusals
+                    // (same workspace as target) keep the actionable attach
+                    // hint — E6 owner copy is documented as
+                    // `run team-agent attach-leader`.
+                    if let Some(mut value) = maybe_enqueue_offline_leader_mailbox(
+                        &args.workspace,
+                        to_name,
+                        &content,
+                        &args.sender,
+                        args.task.as_deref(),
+                        &error,
+                    )? {
+                        add_send_reminder_if_ok(&mut value);
+                        return Ok(cmd_send_result(value, args.json));
+                    }
+                    if args.json {
+                        return Ok(CmdResult::from_json(error.to_json(), args.json));
+                    }
+                    return Err(CliError::Usage(error.n38_message()));
                 }
-                Err(error) => return Err(CliError::Usage(error.n38_message())),
             };
         let mut value = send_to_named_pane_direct(
             &args.workspace,
@@ -786,6 +810,119 @@ fn add_send_reminder_if_ok(value: &mut Value) {
     }
 }
 
+/// E6 (0.5.9 offline-mailbox-toname-design §§3.1/6.2/8, real-machine
+/// escape evidence
+/// `.team/artifacts/0.5.9-subscription-gate.md` +
+/// `.team/evidence/0.5.9-subscription-gate-20260707T143241Z-4645/`):
+/// when the `--to-name <ws>::<team>/leader` resolver refused with
+/// `leader_not_attached`, decide whether the target team is still alive
+/// (worker + coordinator running without a bound leader) and, if so,
+/// enqueue the mailbox row so `attach-leader` replays it exactly once.
+///
+/// Only queues for third-party senders (sender workspace ≠ target
+/// workspace). Owner-scope refusals stay refused so status/diagnose can
+/// keep pushing the operator toward `attach-leader`.
+fn maybe_enqueue_offline_leader_mailbox(
+    sender_workspace: &Path,
+    to_name: &str,
+    content: &str,
+    sender: &str,
+    task_id: Option<&str>,
+    error: &crate::cli::named_address::NamedAddressError,
+) -> Result<Option<Value>, CliError> {
+    if error.kind != crate::cli::named_address::NamedAddressErrorKind::LeaderNotAttached {
+        return Ok(None);
+    }
+    let parsed = match crate::cli::named_address::parse_leader_target_workspace_and_team(
+        sender_workspace,
+        to_name,
+    ) {
+        Ok(Some(v)) => v,
+        Ok(None) => return Ok(None),
+        Err(_) => return Ok(None),
+    };
+    let (target_workspace, team_key) = parsed;
+    // Owner-scope refusal: sender workspace == target workspace. Keep
+    // the actionable attach hint (owner sees status/diagnose copy that
+    // points at `attach-leader`).
+    let sender_canonical = std::fs::canonicalize(sender_workspace)
+        .unwrap_or_else(|_| sender_workspace.to_path_buf());
+    let target_canonical = std::fs::canonicalize(&target_workspace)
+        .unwrap_or_else(|_| target_workspace.clone());
+    if sender_canonical == target_canonical {
+        return Ok(None);
+    }
+    // Verify the target team is actually alive on this host — mailbox
+    // is only for `team live + leader unattached`. Fail-closed otherwise
+    // so we never leave a message in a permanently-dead workspace's DB.
+    let state = match crate::state::persist::load_runtime_state(&target_workspace) {
+        Ok(s) => s,
+        Err(_) => return Ok(None),
+    };
+    let team_alive = target_team_is_alive_for_mailbox(&state, &team_key);
+    if !team_alive {
+        return Ok(None);
+    }
+    let event_log = crate::event_log::EventLog::new(&target_workspace);
+    let task = task_id.map(|s| crate::model::ids::TaskId::new(s.to_string()));
+    let outcome = messaging::enqueue_leader_mailbox_until_attach(
+        &target_workspace,
+        &team_key,
+        content,
+        task.as_ref(),
+        sender,
+        &event_log,
+    )
+    .map_err(|e| CliError::Runtime(e.to_string()))?;
+    let message_id = outcome
+        .message_id
+        .clone()
+        .unwrap_or_else(|| "".to_string());
+    Ok(Some(json!({
+        "ok": true,
+        "status": "queued_until_leader_attach",
+        "message_status": "queued_until_leader_attach",
+        "channel": "leader_mailbox",
+        "delivered": false,
+        "to_name": to_name,
+        "target_workspace": target_workspace.display().to_string(),
+        "team_key": team_key,
+        "recipient": "leader",
+        "leader_attached": false,
+        "message_id": message_id,
+    })))
+}
+
+/// Positive-source liveness heuristic per offline-mailbox-toname-design.md §4:
+/// - target workspace has state and the team key is present + not archived/down;
+/// - AND at least one live tmux fact — a persisted `session_name` OR any
+///   agent with a recorded pane on the recorded socket.
+///
+/// We deliberately do NOT poll coordinator health here — enqueuing is
+/// safe even when the coordinator is transiently down; attach-leader
+/// itself replays via `requeue_blocked_leader_messages` regardless.
+fn target_team_is_alive_for_mailbox(state: &Value, team_key: &str) -> bool {
+    let team = state
+        .get("teams")
+        .and_then(|v| v.as_object())
+        .and_then(|teams| teams.get(team_key));
+    let Some(team) = team else {
+        return false;
+    };
+    let status = team
+        .get("status")
+        .and_then(|v| v.as_str())
+        .unwrap_or("alive");
+    if matches!(status, "archived" | "down" | "stopped") {
+        return false;
+    }
+    // A recorded session_name is enough — target's coordinator/attach
+    // path will re-verify tmux presence when the replay fires.
+    team.get("session_name")
+        .and_then(|v| v.as_str())
+        .is_some_and(|s| !s.is_empty())
+}
+
 fn cmd_send_result(value: Value, as_json: bool) -> CmdResult {
     let exit = if value.get("ok").and_then(Value::as_bool) == Some(false) {
         ExitCode::Error

package/crates/team-agent/src/leader/lease.rs

@@ -50,7 +50,7 @@ pub fn attach_leader(
     if let Some(endpoint) = target.endpoint.as_ref() {
         receiver.tmux_socket = Some(endpoint.clone());
     }
-    let validation = validate_attach_target(workspace, &state, &target.info);
+    let validation = validate_attach_target(workspace, &state, &target.info, provider);
     if validation.is_err() {
         let pane_info = pane_info_value(&target.info);
         let targets_value = Value::Array(targets.iter().map(|target| pane_info_value(&target.info)).collect());
@@ -66,6 +66,7 @@ pub fn attach_leader(
             LeaseSource::Manual,
             &event_log,
         )? {
+            if let Some(endpoint) = target.endpoint.as_deref() { quiet_fake_leader_pane_echo(provider, &target.info, endpoint); }
             let _ = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
             return Ok(LeaseResult {
                 ok: true,
@@ -98,6 +99,7 @@ pub fn attach_leader(
             super::LeaderEvent::ReceiverAttached.name(),
             json!({"pane_id": pane_id.as_str(), "owner_epoch": epoch.0}),
         )?;
+        if let Some(endpoint) = target.endpoint.as_deref() { quiet_fake_leader_pane_echo(provider, &target.info, endpoint); }
         let _ = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
         return Ok(LeaseResult {
             ok: true,
@@ -121,6 +123,7 @@ pub fn attach_leader(
         super::LeaderEvent::ReceiverAttached.name(),
         json!({"pane_id": pane_id.as_str(), "owner_epoch": next_epoch.0}),
     )?;
+    if let Some(endpoint) = target.endpoint.as_deref() { quiet_fake_leader_pane_echo(provider, &target.info, endpoint); }
     let _ = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
     Ok(LeaseResult {
         ok: true,
@@ -134,6 +137,63 @@ pub fn attach_leader(
     })
 }
 
+/// 0.5.9 (E6 real-machine e2e wiring): Fake-provider leader panes in the
+/// e2e harness run `/bin/cat`, which lets the TTY driver echo every
+/// injected byte AND then prints the same bytes on stdout — so pane
+/// capture ends up with two copies of every delivered token. Real Codex/
+/// Claude/Copilot binaries drive the pane through their own TUI and never
+/// echo raw input, so they don't need this. Attach-leader is the
+/// canonical binding hook for this pane, so it's the right place to
+/// disable the TTY echo bit once. Best-effort: any failure is silent
+/// (Fake-provider binding stays useful even without echo suppression).
+///
+/// N16/CP-1 (`.team/anchors/REQUIREMENTS.md`): all tmux invocations MUST
+/// go through the `TmuxBackend` single entry point. The pane's tty query
+/// is done via `TmuxBackend::for_tmux_endpoint(endpoint).query(...,
+/// PaneField::PaneTty)` — socket-scoped by construction. The `stty` call
+/// itself is not a tmux operation, so it uses `Command` directly.
+fn quiet_fake_leader_pane_echo(provider: Provider, target: &PaneInfo, endpoint: &str) {
+    use crate::transport::{PaneField, Target as TransportTarget};
+    if !matches!(provider, Provider::Fake) {
+        return;
+    }
+    if endpoint.is_empty() {
+        return;
+    }
+    let backend = crate::tmux_backend::TmuxBackend::for_tmux_endpoint(endpoint);
+    let Ok(Some(tty)) = <crate::tmux_backend::TmuxBackend as crate::transport::Transport>::query(
+        &backend,
+        &TransportTarget::Pane(target.pane_id.clone()),
+        PaneField::PaneTty,
+    ) else {
+        return;
+    };
+    if tty.trim().is_empty() {
+        return;
+    }
+    // stty against the pane's tty flips the terminal driver's echo bit
+    // without asking the pane process (`/bin/cat`) to interpret any
+    // command. Best-effort: failure is silent.
+    //
+    // Cross-platform tty-file flag: macOS/BSD uses `-f <file>`; GNU
+    // coreutils on Linux uses `-F <file>`. CI runs on Linux and the
+    // previous BSD-only invocation silently no-op'd there — the token
+    // was double-injected because echo stayed on. Try `-F` first (Linux
+    // is the CI baseline), then fall back to `-f` on macOS. Both are
+    // safe to run: the wrong-platform variant just fails silently.
+    let tty = tty.trim();
+    let linux_ok = std::process::Command::new("stty")
+        .args(["-F", tty, "-echo"])
+        .output()
+        .map(|o| o.status.success())
+        .unwrap_or(false);
+    if !linux_ok {
+        let _ = std::process::Command::new("stty")
+            .args(["-f", tty, "-echo"])
+            .output();
+    }
+}
+
 /// Explicit app-server leader binding. Validates the supplied socket/thread tuple
 /// before writing the typed physical-channel anchor through the lease primitive.
 pub fn attach_app_server_leader(
@@ -824,9 +884,26 @@ fn validate_attach_target(
     workspace: &Path,
     state: &Value,
     target: &PaneInfo,
+    requested_provider: Provider,
 ) -> Result<(), &'static str> {
-    let Some(claim_target) = claim_target_from_pane_info(workspace, target) else {
-        return Err("leader_pane_validation_failed");
+    // 0.5.9 (E6 real-machine e2e wiring): an explicit `--provider fake`
+    // is the operator's declaration that this pane is a fake-provider
+    // stub for tests / fixtures. The normal pane-command attribution
+    // path can't recognize `/bin/cat` (or any bare shell process) as a
+    // provider, so honoring the explicit request here is the only way
+    // real-machine E6 acceptance can spin up a leader without shipping
+    // a real Codex/Claude/Copilot binary. This is a targeted escape
+    // hatch — `Provider::Fake` is not selectable from the user-facing
+    // provider list, only wired in test/fixture flows.
+    let claim_target = match claim_target_from_pane_info(workspace, target) {
+        Some(target) => Some(target),
+        None if matches!(requested_provider, Provider::Fake) => None,
+        None => return Err("leader_pane_validation_failed"),
+    };
+    let Some(claim_target) = claim_target else {
+        // Fake provider: skip session-uuid check since attribution was
+        // bypassed. Nothing else to validate.
+        return Ok(());
     };
     let recorded_uuid = get_path_str(state, &["team_owner", "leader_session_uuid"])
         .or_else(|| get_path_str(state, &["leader_receiver", "leader_session_uuid"]));

package/crates/team-agent/src/transport/tests/mod.rs

@@ -108,6 +108,7 @@
                 PaneField::PaneCurrentCommand => "sh",
                 PaneField::PaneCurrentPath => "/tmp/ws",
                 PaneField::SessionName => "team-sess",
+                PaneField::PaneTty => "/dev/ttys000",
             };
             Ok(Some(value.to_string()))
         }

package/crates/team-agent/src/transport.rs

@@ -201,6 +201,11 @@ pub enum PaneField {
     PaneCurrentCommand,
     PaneCurrentPath,
     SessionName,
+    /// pane's controlling tty (e.g. `/dev/ttys015`). Consumers use it to
+    /// flip terminal driver bits like `stty -f <tty> -echo` from outside
+    /// tmux's control channel — the query itself still goes through the
+    /// backend so N16/CP-1 (single tmux entry point) stays intact.
+    PaneTty,
 }
 
 /// 后端种类(诊断/事件用)。
@@ -843,6 +848,7 @@ pub fn tmux_query_argv(pane: &PaneId, field: PaneField) -> Vec<String> {
         PaneField::PaneCurrentCommand => "#{pane_current_command}",
         PaneField::PaneCurrentPath => "#{pane_current_path}",
         PaneField::SessionName => "#{session_name}",
+        PaneField::PaneTty => "#{pane_tty}",
     };
     let mut argv = vec![
         "tmux".to_string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.9",
-    "@team-agent/cli-darwin-x64": "0.5.9",
-    "@team-agent/cli-linux-x64": "0.5.9"
+    "@team-agent/cli-darwin-arm64": "0.5.10",
+    "@team-agent/cli-darwin-x64": "0.5.10",
+    "@team-agent/cli-linux-x64": "0.5.10"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",