@team-agent/installer 0.5.91 → 0.5.92

package/Cargo.lock

@@ -581,7 +581,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.91"
+version = "0.5.92"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.91"
+version = "0.5.92"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/adapters.rs

@@ -500,7 +500,7 @@ pub fn cmd_diagnose(args: &DiagnoseArgs) -> Result<CmdResult, CliError> {
             .join(".team")
             .join("logs")
             .join("events.jsonl");
-        return Ok(CmdResult::from_json(
+        return Ok(crate::cli::triage::report(
             json!({
                 "event_log": event_log.to_string_lossy().to_string(),
                 "issues": issues,
@@ -518,9 +518,10 @@ pub fn cmd_diagnose(args: &DiagnoseArgs) -> Result<CmdResult, CliError> {
                 "suggested_repairs": suggested_repairs,
             }),
             args.json,
+            "diagnose",
         ));
     }
-    let selected = crate::state::selector::resolve_active_team(
+    let selected = crate::state::selector::resolve_active_team_readonly(
         &args.workspace,
         args.team.as_deref(),
         crate::state::selector::SelectorMode::RuntimeOnly,
@@ -555,7 +556,7 @@ pub fn cmd_diagnose(args: &DiagnoseArgs) -> Result<CmdResult, CliError> {
             Some(selected.team_key.as_str()),
         );
     let ok = issues.as_array().is_some_and(Vec::is_empty);
-    Ok(CmdResult::from_json(
+    Ok(crate::cli::triage::report(
         json!({
             "event_log": event_log.to_string_lossy().to_string(),
             "issues": issues,
@@ -573,6 +574,7 @@ pub fn cmd_diagnose(args: &DiagnoseArgs) -> Result<CmdResult, CliError> {
             "suggested_repairs": suggested_repairs,
         }),
         args.json,
+        "diagnose",
     ))
 }
 
@@ -1513,15 +1515,21 @@ pub fn cmd_doctor(args: &DoctorArgs) -> Result<CmdResult, CliError> {
             args.team.as_deref(),
             Some("comms"),
         )?;
+        let result = CmdResult::from_json(value, args.json);
         if !args.json {
-            let json_tail = serde_json::to_string_pretty(&sort_json(&value))?;
-            return Ok(CmdResult::human(format!(
-                "{COMMS_BOUNDARY_TEXT}\n{json_tail}"
-            )));
+            let json_tail = match &result.output {
+                CmdOutput::Json(value) => serde_json::to_string_pretty(&sort_json(value))?,
+                _ => String::new(),
+            };
+            return Ok(CmdResult {
+                output: CmdOutput::Human(format!("{COMMS_BOUNDARY_TEXT}\n{json_tail}")),
+                ..result
+            });
         }
-        return Ok(CmdResult::from_json(value, true));
+        return Ok(result);
     }
-    let value = if matches!(args.gate, Some(DoctorGate::Orphans)) {
+    let default_report = args.gate.is_none() && !args.cleanup_orphans && !args.fix_schema;
+    let mut value = if matches!(args.gate, Some(DoctorGate::Orphans)) {
         crate::diagnose::orphans::orphan_gate_json(&args.workspace, args.fix, args.confirm)?
     } else if args.cleanup_orphans {
         crate::diagnose::orphans::cleanup_orphans_json(&args.workspace, args.confirm)?
@@ -1541,7 +1549,32 @@ pub fn cmd_doctor(args: &DoctorArgs) -> Result<CmdResult, CliError> {
         );
         value
     };
-    Ok(CmdResult::from_json(value, args.json))
+    if default_report {
+        let base_ok = value.get("ok").and_then(Value::as_bool).unwrap_or(false);
+        let has_blocking_issues = value
+            .get("issues")
+            .and_then(Value::as_array)
+            .is_some_and(|issues| {
+                issues.iter().any(|issue| {
+                    let id = issue
+                        .as_str()
+                        .or_else(|| issue.get("id").and_then(Value::as_str));
+                    id != Some("leader_not_attached")
+                })
+            });
+        if let Some(object) = value.as_object_mut() {
+            object.insert(
+                "ok".to_string(),
+                Value::Bool(base_ok && !has_blocking_issues),
+            );
+        }
+    }
+    let result = CmdResult::from_json(value, args.json);
+    Ok(if default_report && !args.json {
+        crate::cli::triage::human_result(result, "doctor")
+    } else {
+        result
+    })
 }
 
 #[cfg(test)]

package/crates/team-agent/src/cli/diagnose.rs

@@ -96,12 +96,6 @@ pub(crate) fn classify_tmux_server_error(error_text: &str) -> &'static str {
 pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value, Value) {
     let mut issues = Vec::new();
     let mut repairs = Vec::new();
-    for issue in crate::topology::diagnose_topology_issues(state, backend) {
-        if let Some(id) = crate::topology::issue_id(&issue) {
-            repairs.push(topology_repair_hint(id));
-        }
-        issues.push(issue);
-    }
 
     if state
         .get("leader_receiver")
@@ -118,41 +112,63 @@ pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value
         ));
     }
 
-    if let Some(session_name) = state
+    // Probe the session before any topology enumeration. A missing session is
+    // terminal for all window/pane/socket probes; repeating those tmux calls
+    // only pays the dead-socket timeout again on every layer. The persisted
+    // endpoint/socket split is state-only, so preserve that fact before the
+    // short-circuit without probing either dead endpoint.
+    let persisted_socket_conflict = crate::topology::endpoint_socket_conflict(state);
+    let session_unavailable = state
         .get("session_name")
         .and_then(Value::as_str)
         .filter(|s| !s.is_empty())
-    {
-        match backend.has_session(&crate::transport::SessionName::new(
-            session_name.to_string(),
-        )) {
-            Ok(true) => {}
-            Ok(false) => {
-                issues.push(json!("tmux_session_missing"));
-                repairs.push(recovery_hint(
-                    session_name,
-                    "tmux_session_missing",
-                    "team-agent restart",
-                ));
-            }
-            Err(error) => {
-                // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B):
-                // when the transport error stderr matches "server exited
-                // unexpectedly", the physical layer that disappeared is
-                // the tmux server itself — not just this team's session.
-                // Surface `tmux_server_crashed` so the user's next
-                // action is a coordinator/host-level recovery, not a
-                // per-agent `restart <agent>`.
-                let error_str = error.to_string();
-                let issue_id = classify_tmux_server_error(&error_str);
-                issues.push(json!(issue_id));
-                let mut hint = recovery_hint(session_name, issue_id, "team-agent diagnose");
-                if let Some(obj) = hint.as_object_mut() {
-                    obj.insert("reason".to_string(), Value::String(error_str));
+        .is_some_and(|session_name| {
+            match backend.has_session(&crate::transport::SessionName::new(
+                session_name.to_string(),
+            )) {
+                Ok(true) => false,
+                Ok(false) => {
+                    issues.push(json!("tmux_session_missing"));
+                    repairs.push(recovery_hint(
+                        session_name,
+                        "tmux_session_missing",
+                        "team-agent restart",
+                    ));
+                    true
                 }
-                repairs.push(hint);
+                Err(error) => {
+                    // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B):
+                    // when the transport error stderr matches "server exited
+                    // unexpectedly", the physical layer that disappeared is
+                    // the tmux server itself — not just this team's session.
+                    let error_str = error.to_string();
+                    let issue_id = classify_tmux_server_error(&error_str);
+                    issues.push(json!(issue_id));
+                    let mut hint = recovery_hint(session_name, issue_id, "team-agent diagnose");
+                    if let Some(obj) = hint.as_object_mut() {
+                        obj.insert("reason".to_string(), Value::String(error_str));
+                    }
+                    repairs.push(hint);
+                    true
+                }
+            }
+        });
+
+    if session_unavailable {
+        if let Some(issue) = persisted_socket_conflict {
+            if let Some(id) = crate::topology::issue_id(&issue) {
+                repairs.push(topology_repair_hint(id));
             }
+            issues.push(issue);
+        }
+        return (Value::Array(issues), Value::Array(repairs));
+    }
+
+    for issue in crate::topology::diagnose_topology_issues(state, backend) {
+        if let Some(id) = crate::topology::issue_id(&issue) {
+            repairs.push(topology_repair_hint(id));
         }
+        issues.push(issue);
     }
 
     if leader_receiver_attached(state) {
@@ -624,6 +640,17 @@ pub(crate) fn append_registry_channel_unbound_to_report(
     repairs.push(recovery_hint(&team_key, issue_id, repair));
     object.insert("issues".to_string(), Value::Array(issues));
     object.insert("suggested_repairs".to_string(), Value::Array(repairs));
+    let is_healthy_unattached_host =
+        class == crate::lifecycle::launch::LeaderBindingClass::Unbound
+            && object.get("ok").and_then(Value::as_bool) == Some(true)
+            && object
+                .get("profile_smoke")
+                .and_then(|profile| profile.get("checks"))
+                .and_then(Value::as_array)
+                .is_some_and(|checks| !checks.is_empty());
+    if !is_healthy_unattached_host {
+        object.insert("ok".to_string(), Value::Bool(false));
+    }
 }
 
 pub(crate) fn append_selected_live_leader_workspace_mismatch(
@@ -652,7 +679,7 @@ fn selected_live_leader_workspace_mismatch(
     workspace: &std::path::Path,
     team: Option<&str>,
 ) -> Option<(Value, Value)> {
-    let selected = crate::state::selector::resolve_active_team(
+    let selected = crate::state::selector::resolve_active_team_readonly(
         workspace,
         team,
         crate::state::selector::SelectorMode::RuntimeOnly,
@@ -766,8 +793,10 @@ fn append_coordinator_health_issue(
     issues: &mut Value,
     repairs: &mut Value,
 ) {
+    // Diagnose must observe coordinator state without initializing or rewriting
+    // `.team/runtime/team.db`, including when the file is missing or empty.
     let workspace = crate::coordinator::WorkspacePath::new(workspace.to_path_buf());
-    let health = crate::coordinator::coordinator_health(&workspace);
+    let health = crate::coordinator::coordinator_health_read_only(&workspace);
     let Some(id) = coordinator_issue_id(state, &health) else {
         return;
     };
@@ -1910,14 +1939,24 @@ pub(crate) fn provider_doctor_checks() -> Value {
     ] {
         let adapter = crate::provider::get_adapter(provider);
         let name = provider_wire(provider);
-        let version = adapter.version().unwrap_or_else(|error| error.to_string());
+        let fake = matches!(provider, crate::provider::Provider::Fake);
+        let (auth, version) = if fake {
+            (crate::provider::AuthHintStatus::Present, "fake".to_string())
+        } else {
+            (
+                crate::provider::AuthHintStatus::Unknown,
+                "unknown".to_string(),
+            )
+        };
         providers.insert(
             name.to_string(),
             json!({
-                "auth": adapter.auth_hint(crate::provider::AuthMode::Subscription),
+                "auth": auth,
                 "command": provider_command(provider),
                 "installed": adapter.is_installed(),
                 "version": version,
+                "probe_status": "not_run",
+                "provider_probe_status": "not_run",
             }),
         );
     }

package/crates/team-agent/src/cli/mod.rs

@@ -66,6 +66,7 @@ pub mod profile;
 pub mod send;
 pub(crate) mod spec;
 pub mod status;
+pub(crate) mod triage;
 pub mod types;
 
 pub use adapters::*;
@@ -5050,17 +5051,44 @@ pub mod diagnose_port {
             return;
         }
         for (idx, line) in text.lines().enumerate() {
-            if line.contains("OPENAI_API_KEY=") || line.contains("ANTHROPIC_API_KEY=") {
-                let rel = path.strip_prefix(root).unwrap_or(path);
-                findings.push(json!({
-                    "path": rel.to_string_lossy().to_string(),
-                    "line": idx.saturating_add(1),
-                    "rule": "api_key_assignment",
-                    "match_excerpt": line.trim(),
-                }));
-            }
+            let Some(key) = secret_assignment_key(line) else {
+                continue;
+            };
+            let rel = path.strip_prefix(root).unwrap_or(path);
+            findings.push(json!({
+                "path": rel.to_string_lossy().to_string(),
+                "line": idx.saturating_add(1),
+                "rule": "api_key_assignment",
+                "match_excerpt": format!("{key}=<redacted>"),
+            }));
         }
     }
+
+    fn secret_assignment_key(line: &str) -> Option<&'static str> {
+        let line = line.trim_start();
+        let line = match line.strip_prefix("export") {
+            Some(rest) if rest.chars().next().is_some_and(char::is_whitespace) => rest.trim_start(),
+            _ => line,
+        };
+        ["OPENAI_API_KEY", "ANTHROPIC_API_KEY"]
+            .into_iter()
+            .find(|key| {
+                line.strip_prefix(*key)
+                    .and_then(|rest| rest.strip_prefix('='))
+                    .is_some_and(|rhs| {
+                        let rhs = rhs.trim();
+                        let rhs = rhs
+                            .strip_prefix('"')
+                            .and_then(|value| value.strip_suffix('"'))
+                            .or_else(|| {
+                                rhs.strip_prefix('\'')
+                                    .and_then(|value| value.strip_suffix('\''))
+                            })
+                            .unwrap_or(rhs);
+                        !rhs.is_empty()
+                    })
+            })
+    }
     ///
     /// `run_comms_selftest`(`--comms`/`--gate comms`)。**纯 state-read,零 token**(MUST-NOT-13)。
     #[cfg(test)]

package/crates/team-agent/src/cli/triage.rs

@@ -0,0 +1,183 @@
+//! Command-specific human triage projections for `doctor` and `diagnose`.
+//!
+//! The JSON report remains the source of truth. This renderer only projects its
+//! stable issue and repair entries; it does not perform I/O or recompute health.
+
+use serde_json::Value;
+
+use super::{CmdOutput, CmdResult};
+
+const LINE_LIMIT_BYTES: usize = 160;
+
+pub(crate) fn report(value: Value, as_json: bool, command: &str) -> CmdResult {
+    let result = CmdResult::from_json(value, as_json);
+    if as_json {
+        result
+    } else {
+        human_result(result, command)
+    }
+}
+
+pub(crate) fn human_result(result: CmdResult, command: &str) -> CmdResult {
+    let text = match &result.output {
+        CmdOutput::Json(report) => render(command, report),
+        CmdOutput::Human(text) => text.clone(),
+        CmdOutput::None => String::new(),
+    };
+    CmdResult {
+        output: CmdOutput::Human(text),
+        ..result
+    }
+}
+
+pub(crate) fn render(command: &str, report: &Value) -> String {
+    // Keep the renderer downstream of the external redaction boundary. The
+    // generic emitter redacts again for defense in depth.
+    let report = crate::redaction::redact_external_value(report);
+    let ok = report.get("ok").and_then(Value::as_bool).unwrap_or(false);
+    let mut lines = vec![bounded(format!(
+        "{command}: {}",
+        if ok { "ok" } else { "needs attention" }
+    ))];
+
+    if command == "doctor" {
+        for finding in array_items(
+            report
+                .get("secret_scan")
+                .and_then(|scan| scan.get("findings")),
+        ) {
+            let Some(object) = finding.as_object() else {
+                continue;
+            };
+            let (Some(rule), Some(path), Some(line)) = (
+                object.get("rule").and_then(Value::as_str),
+                object.get("path").and_then(Value::as_str),
+                object.get("line").and_then(Value::as_u64),
+            ) else {
+                continue;
+            };
+            lines.push(bounded(format!("warn: {rule} in {path}:{line}")));
+        }
+    }
+
+    for issue in array_items(report.get("issues")) {
+        lines.push(bounded(format!("issue: {}", summarize(issue, false))));
+    }
+    for repair in array_items(report.get("suggested_repairs")) {
+        lines.push(bounded(format!("repair: {}", summarize(repair, true))));
+    }
+    if let Some(error) = report.get("error").filter(|value| !value.is_null()) {
+        lines.push(bounded(format!("detail: {}", summarize(error, false))));
+    }
+    if lines.len() == 1 {
+        lines.push(bounded("detail: no issues detected".to_string()));
+    }
+    lines.join("\n")
+}
+
+fn array_items(value: Option<&Value>) -> &[Value] {
+    value.and_then(Value::as_array).map(Vec::as_slice).unwrap_or(&[])
+}
+
+fn summarize(value: &Value, repair: bool) -> String {
+    match value {
+        Value::String(value) => value.clone(),
+        Value::Null => "null".to_string(),
+        Value::Bool(value) => value.to_string(),
+        Value::Number(value) => value.to_string(),
+        Value::Array(values) => format!("{} entries", values.len()),
+        Value::Object(object) => {
+            let keys = if repair {
+                ["action", "hint_action", "next_action", "issue", "code", "reason"]
+                    .as_slice()
+            } else {
+                ["code", "issue", "id", "type", "status", "reason", "message"]
+                    .as_slice()
+            };
+            let mut parts = Vec::new();
+            for key in keys {
+                if let Some(value) = object.get(*key).and_then(Value::as_str) {
+                    parts.push(format!("{key}={value}"));
+                }
+            }
+            if parts.is_empty() {
+                let mut names = object.keys().cloned().collect::<Vec<_>>();
+                names.sort_unstable();
+                format!("fields={}", names.join(","))
+            } else {
+                parts.join("; ")
+            }
+        }
+    }
+}
+
+fn bounded(line: String) -> String {
+    let clean = line
+        .chars()
+        .map(|ch| if ch.is_control() { ' ' } else { ch })
+        .collect::<String>();
+    if clean.len() <= LINE_LIMIT_BYTES {
+        return clean;
+    }
+    let budget = LINE_LIMIT_BYTES.saturating_sub('…'.len_utf8());
+    let mut end = 0;
+    for (index, ch) in clean.char_indices() {
+        let next = index + ch.len_utf8();
+        if next > budget {
+            break;
+        }
+        end = next;
+    }
+    format!("{}…", &clean[..end.min(budget)])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn renderer_projects_each_issue_and_repair_without_dumping_runtime() {
+        let report = json!({
+            "ok": false,
+            "issues": ["short_issue", {"code": "object_issue", "message": "detail"}],
+            "suggested_repairs": [{"issue": "object_issue", "action": "run repair"}],
+            "providers": {"claude": {"version": "secret"}},
+            "runtime": {"workspace": "/tmp/secret"}
+        });
+        let output = render("diagnose", &report);
+        assert!(output.contains("issue: short_issue"));
+        assert!(output.contains("issue: code=object_issue"));
+        assert!(output.contains("repair: action=run repair"));
+        assert!(!output.contains("providers:"));
+        assert!(!output.contains("runtime:"));
+    }
+
+    #[test]
+    fn renderer_sanitizes_and_bounds_utf8_lines() {
+        let report = json!({"ok": false, "issues": ["问题\n".to_string() + &"x".repeat(200)]});
+        for line in render("doctor", &report).lines() {
+            assert!(line.len() <= LINE_LIMIT_BYTES);
+            assert!(!line.chars().any(char::is_control));
+        }
+    }
+
+    #[test]
+    fn renderer_projects_secret_findings_without_values() {
+        let report = json!({
+            "ok": false,
+            "secret_scan": {
+                "findings": [{
+                    "rule": "api_key_assignment",
+                    "path": "leaky-role.md",
+                    "line": 7,
+                    "match_excerpt": "OPENAI_API_KEY=secret"
+                }]
+            }
+        });
+        let output = render("doctor", &report);
+        assert!(output.contains("warn: api_key_assignment in leaky-role.md:7"));
+        assert!(!output.contains("match_excerpt"));
+        assert!(!output.contains("OPENAI_API_KEY=secret"));
+    }
+}

package/crates/team-agent/src/coordinator/health.rs

@@ -74,7 +74,19 @@ use super::types::{
 /// returns: HealthReport。ok = 进程在跑 ∧ metadata 三元全等 ∧ 二进制身份一致 ∧ schema 兼容；service_available 刻意排除二进制身份，表示「这个 daemon 还能处理本队队列」；status 区分 Missing / InvalidPid / Running / Stale
 /// ---
 pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
-    let schema = message_store_schema_health(workspace);
+    coordinator_health_with_schema(workspace, message_store_schema_health(workspace))
+}
+
+/// Read-only coordinator health for diagnose. Unlike the lifecycle path, this
+/// never opens MessageStore and therefore cannot initialize or rewrite team.db.
+pub fn coordinator_health_read_only(workspace: &WorkspacePath) -> HealthReport {
+    coordinator_health_with_schema(workspace, message_store_schema_health_read_only(workspace))
+}
+
+fn coordinator_health_with_schema(
+    workspace: &WorkspacePath,
+    schema: SchemaHealth,
+) -> HealthReport {
     let current_binary_identity = current_coordinator_binary_identity();
     let pid_path = coordinator_pid_path(workspace);
     let pid = read_pid_file(&pid_path);
@@ -1004,6 +1016,34 @@ pub(crate) fn message_store_schema_health(workspace: &WorkspacePath) -> SchemaHe
     }
 }
 
+fn message_store_schema_health_read_only(workspace: &WorkspacePath) -> SchemaHealth {
+    let action = Some("run team-agent doctor --fix-schema --json".to_string());
+    match crate::db::migration::schema_diagnosis_workspace_read_only(workspace.as_path()) {
+        Ok(diagnosis) if diagnosis.ok && diagnosis.status == "ok" => SchemaHealth {
+            ok: true,
+            schema_version: crate::db::schema::SCHEMA_VERSION,
+            error: None,
+            action: None,
+        },
+        Ok(diagnosis) => SchemaHealth {
+            ok: false,
+            schema_version: crate::db::schema::SCHEMA_VERSION,
+            error: Some(SchemaError::InitFailed {
+                message: format!("team.db status: {}", diagnosis.status),
+            }),
+            action,
+        },
+        Err(error) => SchemaHealth {
+            ok: false,
+            schema_version: crate::db::schema::SCHEMA_VERSION,
+            error: Some(SchemaError::InitFailed {
+                message: error.to_string(),
+            }),
+            action,
+        },
+    }
+}
+
 fn read_pid_file(path: &Path) -> Option<Pid> {
     let text = std::fs::read_to_string(path).ok()?;
     let raw = text.trim().parse::<u32>().ok()?;

package/crates/team-agent/src/db/migration.rs

@@ -8,7 +8,7 @@
 
 use std::path::{Path, PathBuf};
 
-use rusqlite::Connection;
+use rusqlite::{Connection, OpenFlags};
 
 use crate::db::schema::{ensure_schema_indexes, table_layout, SCHEMA_VERSION};
 use crate::db::DbError;
@@ -423,22 +423,33 @@ pub fn ensure_table_layout(
 /// `schema_migration.py:schema_diagnosis`:只读判定(不变更 DB)。
 fn schema_diagnosis(db_path: &Path, schema_version: i64) -> Result<Diagnosis, DbError> {
     if !db_path.exists() {
-        // T3-3 cr verdict (A parity lock, 2026-06-10): a missing db is the LEGAL
-        // first-use state — ok:true is layered with the explicit status axis and the
-        // recommended_action guidance (Python schema_migration.py:180-190 verbatim),
-        // never a silent fake-green.
-        return Ok(Diagnosis {
-            ok: true,
-            status: "missing".to_string(),
-            user_version: 0,
-            layout_diffs: vec![],
-            recommended_action:
-                "No team.db exists yet; initialize_schema will create it on first use.".to_string(),
-        });
+        return Ok(missing_schema_diagnosis());
     }
     let conn = Connection::open(db_path)?;
-    let uv = pragma_user_version(&conn)?;
-    let diffs = layout_diffs(&conn)?;
+    schema_diagnosis_from_connection(&conn, schema_version)
+}
+
+fn missing_schema_diagnosis() -> Diagnosis {
+    // T3-3 cr verdict (A parity lock, 2026-06-10): a missing db is the LEGAL
+    // first-use state — ok:true is layered with the explicit status axis and the
+    // recommended_action guidance (Python schema_migration.py:180-190 verbatim),
+    // never a silent fake-green.
+    Diagnosis {
+        ok: true,
+        status: "missing".to_string(),
+        user_version: 0,
+        layout_diffs: vec![],
+        recommended_action:
+            "No team.db exists yet; initialize_schema will create it on first use.".to_string(),
+    }
+}
+
+fn schema_diagnosis_from_connection(
+    conn: &Connection,
+    schema_version: i64,
+) -> Result<Diagnosis, DbError> {
+    let uv = pragma_user_version(conn)?;
+    let diffs = layout_diffs(conn)?;
     let diff_tables: Vec<String> = diffs.iter().map(|d| d.table.to_string()).collect();
     let ok = diffs.is_empty() && uv == schema_version;
     Ok(Diagnosis {
@@ -466,6 +477,16 @@ pub fn schema_diagnosis_workspace(workspace: &Path) -> Result<Diagnosis, DbError
     )
 }
 
+/// 对 workspace 的 team.db 执行严格只读 diagnosis，不创建或初始化缺失/空文件。
+pub fn schema_diagnosis_workspace_read_only(workspace: &Path) -> Result<Diagnosis, DbError> {
+    let db_path = workspace.join(".team").join("runtime").join("team.db");
+    if !db_path.exists() {
+        return Ok(missing_schema_diagnosis());
+    }
+    let conn = Connection::open_with_flags(&db_path, OpenFlags::SQLITE_OPEN_READ_ONLY)?;
+    schema_diagnosis_from_connection(&conn, SCHEMA_VERSION)
+}
+
 /// `schema_migration.py:_workspace_from_db_path`:`<ws>/.team/runtime/team.db` → `<ws>`。
 fn workspace_from_db_path(db_path: &Path) -> Option<PathBuf> {
     let parts: Vec<_> = db_path.iter().collect();

package/crates/team-agent/src/redaction.rs

@@ -55,7 +55,11 @@ pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Va
             object
                 .iter()
                 .map(|(key, value)| {
-                    let value = if is_sensitive_env_key(key) {
+                    let value = if key.eq_ignore_ascii_case("auth")
+                        && value.as_str() == Some("unknown")
+                    {
+                        value.clone()
+                    } else if is_sensitive_env_key(key) {
                         Value::String(REDACTED.to_string())
                     } else if is_argument_array_key(key) {
                         redact_argument_array(value)

package/crates/team-agent/src/topology.rs

@@ -32,6 +32,19 @@ pub fn issue_id(issue: &Value) -> Option<&str> {
     issue.get("id").and_then(Value::as_str)
 }
 
+pub fn endpoint_socket_conflict(state: &Value) -> Option<Value> {
+    let endpoint = non_empty_str(state, "tmux_endpoint")?;
+    let socket = non_empty_str(state, "tmux_socket")?;
+    if same_endpoint(endpoint, socket) {
+        return None;
+    }
+    Some(json!({
+        "id": TMUX_ENDPOINT_SOCKET_CONFLICT,
+        "tmux_endpoint": endpoint,
+        "tmux_socket": socket,
+    }))
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum EndpointConvergenceDecision {
     NoConflict,
@@ -338,21 +351,14 @@ fn classify_agents_for_observed_pane(
 }
 
 fn append_socket_split_issues(state: &Value, issues: &mut Vec<Value>, include_readiness: bool) {
-    let endpoint = non_empty_str(state, "tmux_endpoint");
-    let socket = non_empty_str(state, "tmux_socket");
-    let (Some(endpoint), Some(socket)) = (endpoint, socket) else {
+    let Some(conflict) = endpoint_socket_conflict(state) else {
         return;
     };
-    if same_endpoint(endpoint, socket) {
-        return;
-    }
+    let endpoint = non_empty_str(state, "tmux_endpoint").unwrap_or_default();
+    let socket = non_empty_str(state, "tmux_socket").unwrap_or_default();
 
     let session = non_empty_str(state, "session_name").unwrap_or_default();
-    issues.push(json!({
-        "id": TMUX_ENDPOINT_SOCKET_CONFLICT,
-        "tmux_endpoint": endpoint,
-        "tmux_socket": socket,
-    }));
+    issues.push(conflict);
 
     if state
         .get("leader_receiver")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.91",
+  "version": "0.5.92",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.91",
-    "@team-agent/cli-darwin-x64": "0.5.91",
-    "@team-agent/cli-linux-x64": "0.5.91"
+    "@team-agent/cli-darwin-arm64": "0.5.92",
+    "@team-agent/cli-darwin-x64": "0.5.92",
+    "@team-agent/cli-linux-x64": "0.5.92"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",