@team-agent/installer 0.5.91 → 0.5.94

package/crates/team-agent/src/lifecycle/tests/phase_golden.rs

@@ -5,7 +5,7 @@ use crate::cli::{
     SendArgs, StatusArgs,
 };
 use crate::transport::test_support::OfflineTransport;
-use crate::transport::WindowName;
+use crate::transport::{PaneId, PaneInfo, SessionName, WindowName};
 use serde_json::{json, Map, Value};
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
@@ -229,7 +229,21 @@ fn run_phase_golden(spec: PhaseGolden) -> Value {
     let team = two_worker_team_dir(&hermetic);
     let workspace = team.parent().expect("workspace").to_path_buf();
     seed_healthy_coordinator(&workspace);
-    let launch_transport = codex_ready_transport();
+    let _caller_pane = EnvVarGuard::set("TMUX_PANE", "%caller");
+    let launch_transport = codex_ready_transport().with_targets(vec![PaneInfo {
+        pane_id: PaneId::new("%caller"),
+        session: SessionName::new("caller"),
+        window_index: Some(0),
+        window_name: Some(WindowName::new("caller")),
+        pane_index: Some(0),
+        tty: None,
+        current_command: Some("codex".to_string()),
+        current_path: Some(workspace.clone()),
+        active: true,
+        pane_pid: None,
+        leader_env: BTreeMap::new(),
+    }])
+    .with_pane_current_command("%caller", "codex");
     let quick_start = quick_start_with_transport_in_workspace_with_display(
         &workspace,
         &team,
@@ -275,9 +289,49 @@ fn run_phase_golden(spec: PhaseGolden) -> Value {
         to_name: None,
         to_leader: None,
     });
+    let runtime_state = crate::state::persist::load_runtime_state(&workspace)
+        .expect("quick-start state written before shutdown fixture");
+    let generation = runtime_state
+        .get("generation")
+        .and_then(Value::as_str)
+        .or_else(|| {
+            runtime_state
+                .get("agents")
+                .and_then(Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(Value::as_str)
+                    })
+                })
+        })
+        .or_else(|| {
+            runtime_state
+                .pointer("/teams/teamdir/agents")
+                .and_then(Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(Value::as_str)
+                    })
+                })
+        })
+        .unwrap_or("phase-golden");
     let lifecycle_transport = codex_ready_transport()
         .with_session_present(true)
-        .with_windows(vec![WindowName::new("w1"), WindowName::new("w2")]);
+        .with_windows(vec![WindowName::new("w1"), WindowName::new("w2")])
+        .with_targets(vec![PaneInfo {
+            pane_id: PaneId::new("%w1"),
+            session: SessionName::new("team-phasegolden"),
+            window_index: Some(0),
+            window_name: Some(WindowName::new("w1")),
+            pane_index: Some(0),
+            tty: None,
+            current_command: Some("codex".to_string()),
+            current_path: Some(workspace.clone()),
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+        .with_session_owner(&workspace, "teamdir", generation);
     let lifecycle = (spec.lifecycle_op)(&workspace, &lifecycle_transport, spec.team_key);
     let shutdown = lifecycle_port::shutdown_with_transport(
         &workspace,
@@ -660,9 +714,12 @@ fn normalize_value(value: Value, ctx: &mut NormalizeCtx, key: Option<&str>) -> V
 
 fn normalize_string(text: String, ctx: &mut NormalizeCtx, key: Option<&str>) -> Value {
     let key = key.unwrap_or_default();
-    if key_is_timestamp(key) {
+    if key_is_timestamp(key) || key == "generation" {
         return json!("<TS>");
     }
+    if key == "workspace_hash" {
+        return json!("<ID>");
+    }
     if text == crate::packaging::Version::current().as_str() {
         return json!("<VERSION>");
     }
@@ -696,9 +753,39 @@ fn normalize_path_string(text: &str, ctx: &NormalizeCtx) -> String {
         out = out.replace(alias, "<TMP>");
     }
     out = normalize_tmux_socket_dir(&out);
+    out = normalize_hermetic_root(&out);
+    out = normalize_registry_hash(&out);
     normalize_socket_token(&out)
 }
 
+fn normalize_registry_hash(text: &str) -> String {
+    let Some(start) = text.rfind("/leaders/") else {
+        return text.to_string();
+    };
+    let file_start = start + "/leaders/".len();
+    let Some(separator) = text[file_start..].find("__") else {
+        return text.to_string();
+    };
+    let separator = file_start + separator;
+    text[..file_start].to_owned() + "<ID>" + &text[separator..]
+}
+
+fn normalize_hermetic_root(text: &str) -> String {
+    let marker = "ta-phase-golden-";
+    let Some(start) = text.find(marker) else {
+        return text.to_string();
+    };
+    let end = text[start..]
+        .find('/')
+        .map(|offset| start + offset)
+        .unwrap_or(text.len());
+    let segment = &text[start..end];
+    let Some(phase) = text[start + marker.len()..end].split('-').next() else {
+        return text.to_string();
+    };
+    text.replacen(segment, &format!("{marker}{phase}"), 1)
+}
+
 fn value_looks_like_endpoint_path(text: &str) -> bool {
     text.starts_with('/')
         || text.starts_with("ta-")

package/crates/team-agent/src/platform/process.rs

@@ -12,8 +12,8 @@
 //!   `GetExitCodeProcess`, `TerminateProcess`, Toolhelp snapshot,
 //!   Job Objects for shim-owned worker teardown)
 //!
-//! CR C-6: `terminate_pid` / `terminate_group` return
-//! `TerminationOutcome` so a caller that requested `TerminateGraceful`
+//! CR C-6: `terminate_pid` returns `TerminationOutcome` so a caller
+//! that requested `TerminateGraceful`
 //! can see that Windows downgraded to `TerminateForce` and emit a
 //! `platform.terminate_force_only` event (N38 交底).
 //!
@@ -41,7 +41,7 @@ pub enum SignalKind {
     TerminateForce,
 }
 
-/// Result of a `terminate_pid` / `terminate_group` call. `Graceful`
+/// Result of a `terminate_pid` call. `Graceful`
 /// means the OS honored the request kind; `ForceOnly` means Windows
 /// downgraded a `TerminateGraceful` to `TerminateProcess` (CR C-6
 /// N38 交底 — caller must emit a `platform.terminate_force_only`
@@ -55,7 +55,7 @@ pub enum TerminationOutcome {
     /// (no grace period). Includes a machine-readable reason so
     /// callers can log it in the audit event.
     ForceOnly { reason: &'static str },
-    /// The pid/group was already gone by the time the call resolved.
+    /// The pid was already gone by the time the call resolved.
     /// Not an error.
     AlreadyGone,
 }
@@ -216,34 +216,6 @@ mod unix_impl {
         }
     }
 
-    /// Send a signal to a process group (`kill(-pgid, ...)`).
-    /// Byte-equivalent to `cli/mod.rs:1854` (`libc::kill(-pgid, signal)`)
-    /// used by `send_process_signal_group`.
-    pub fn terminate_group(
-        group_id: u32,
-        kind: SignalKind,
-    ) -> Result<TerminationOutcome, io::Error> {
-        let signal = match kind {
-            SignalKind::TerminateGraceful => libc::SIGTERM,
-            SignalKind::TerminateForce => libc::SIGKILL,
-        };
-        let pgid_t = match libc::pid_t::try_from(group_id) {
-            Ok(p) => p,
-            Err(_) => return Ok(TerminationOutcome::AlreadyGone),
-        };
-        // `-pgid` targets every process in that group. Preserves the
-        // existing shutdown semantics inline in cli/mod.rs.
-        let rc = unsafe { libc::kill(-pgid_t, signal) };
-        if rc == 0 {
-            return Ok(TerminationOutcome::Requested);
-        }
-        let err = io::Error::last_os_error();
-        match err.raw_os_error() {
-            Some(code) if code == libc::ESRCH => Ok(TerminationOutcome::AlreadyGone),
-            _ => Err(err),
-        }
-    }
-
     /// Best-effort waitpid so a killed child doesn't accumulate as a
     /// zombie. Byte-equivalent to `coordinator/health.rs:350-358` and
     /// `cli/mod.rs:1871-1879`.
@@ -434,19 +406,6 @@ mod windows_impl {
         })
     }
 
-    pub fn terminate_group(
-        _group_id: u32,
-        _kind: SignalKind,
-    ) -> Result<TerminationOutcome, io::Error> {
-        // Windows has no `-pgid` sentinel. Design §Route B: "owned
-        // worker teardown: prefer Job Objects in the ConPTY shim".
-        // Job-object teardown is a shim-side concern, not a top-level
-        // API. Return AlreadyGone honestly here so shutdown code
-        // falls back to per-pid termination (the caller's outer
-        // loop retries per-pid after the group attempt is a no-op).
-        Ok(TerminationOutcome::AlreadyGone)
-    }
-
     pub fn reap_child_if_possible(_pid: u32) {
         // Windows has no zombie waitpid model. Child handles are
         // owned by the spawner and closed at drop; nothing to do.

package/crates/team-agent/src/redaction.rs

@@ -55,7 +55,11 @@ pub(crate) fn redact_external_value(value: &serde_json::Value) -> serde_json::Va
             object
                 .iter()
                 .map(|(key, value)| {
-                    let value = if is_sensitive_env_key(key) {
+                    let value = if key.eq_ignore_ascii_case("auth")
+                        && value.as_str() == Some("unknown")
+                    {
+                        value.clone()
+                    } else if is_sensitive_env_key(key) {
                         Value::String(REDACTED.to_string())
                     } else if is_argument_array_key(key) {
                         redact_argument_array(value)

package/crates/team-agent/src/tmux_backend.rs

@@ -68,13 +68,16 @@ use crate::transport::{
     tmux_spawn_argv, AttachOutcome, BackendKind, BusySignalKind, CaptureRange,
     CaptureSampleOutcome, CapturedText, InjectPayload, InjectReport, InjectStage,
     InjectVerification, InputSurfaceProbe, Key, PaneField, PaneId, PaneInfo, PaneMode,
-    QueryOutcome, SessionName, SetEnvOutcome, SpawnResult, SubmitAttemptObservation,
-    SubmitConsumptionReason, SubmitDiagnostics, SubmitObserver, SubmitVerification, Target,
-    Transport, TransportError, TurnVerification, WindowName,
+    QueryOutcome, SessionName, SessionOwner, SetEnvOutcome, SpawnResult,
+    SubmitAttemptObservation, SubmitConsumptionReason, SubmitDiagnostics, SubmitObserver,
+    SubmitVerification, Target, Transport, TransportError, TurnVerification, WindowName,
 };
 
 pub const PANE_BINDING_NONCE_METADATA_KEY: &str = "TEAM_AGENT_PANE_BINDING_NONCE";
 const TMUX_PANE_BINDING_NONCE_OPTION: &str = "@team_agent_pane_binding_nonce";
+const TMUX_SESSION_OWNER_WORKSPACE_OPTION: &str = "@team_agent_owner_workspace";
+const TMUX_SESSION_OWNER_TEAM_OPTION: &str = "@team_agent_owner_team";
+const TMUX_SESSION_OWNER_GENERATION_OPTION: &str = "@team_agent_owner_generation";
 
 /// Result of running an external command — the typed output of the OS edge.
 #[derive(Debug, Clone)]
@@ -351,6 +354,87 @@ impl TmuxBackend {
         }
     }
 
+    fn set_session_owner_marker(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        generation: &str,
+    ) -> Result<(), TransportError> {
+        let workspace = workspace
+            .canonicalize()
+            .unwrap_or_else(|_| workspace.to_path_buf())
+            .to_string_lossy()
+            .into_owned();
+        for (option, value) in [
+            (TMUX_SESSION_OWNER_WORKSPACE_OPTION, workspace),
+            (TMUX_SESSION_OWNER_TEAM_OPTION, team.to_string()),
+            (TMUX_SESSION_OWNER_GENERATION_OPTION, generation.to_string()),
+        ] {
+            let argv = self.tmux_argv(&[
+                "tmux".to_string(),
+                "set-option".to_string(),
+                "-t".to_string(),
+                session.as_str().to_string(),
+                option.to_string(),
+                value,
+            ]);
+            let output = self.runner.run(&argv)?;
+            if !output.success {
+                return Err(subprocess_error(argv, output));
+            }
+        }
+        Ok(())
+    }
+
+    fn read_session_owner_option(
+        &self,
+        session: &SessionName,
+        option: &str,
+    ) -> Result<Option<String>, TransportError> {
+        let argv = self.tmux_argv(&[
+            "tmux".to_string(),
+            "show-options".to_string(),
+            "-qv".to_string(),
+            "-t".to_string(),
+            session.as_str().to_string(),
+            option.to_string(),
+        ]);
+        let output = self.runner.run(&argv)?;
+        if !output.success {
+            return Ok(None);
+        }
+        let value = output.stdout.trim();
+        Ok((!value.is_empty()).then(|| value.to_string()))
+    }
+
+    fn read_session_owner_marker(
+        &self,
+        session: &SessionName,
+    ) -> Result<Option<SessionOwner>, TransportError> {
+        let Some(workspace) = self.read_session_owner_option(
+            session,
+            TMUX_SESSION_OWNER_WORKSPACE_OPTION,
+        )? else {
+            return Ok(None);
+        };
+        let Some(team) = self.read_session_owner_option(session, TMUX_SESSION_OWNER_TEAM_OPTION)?
+        else {
+            return Ok(None);
+        };
+        let Some(generation) = self.read_session_owner_option(
+            session,
+            TMUX_SESSION_OWNER_GENERATION_OPTION,
+        )? else {
+            return Ok(None);
+        };
+        Ok(Some(SessionOwner {
+            workspace,
+            team,
+            generation,
+        }))
+    }
+
     /// ---
     /// purpose: 把 leader 认领的绑定 nonce 写进 pane 级 tmux 用户选项,给「这个 pane 实例是不是我绑的那个」留可核凭据
     /// params:
@@ -2986,6 +3070,32 @@ impl Transport for TmuxBackend {
             .map(|endpoint| endpoint.as_endpoint().to_string())
     }
 
+    fn set_session_owner(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+    ) -> Result<(), TransportError> {
+        self.set_session_owner_marker(session, workspace, team, session.as_str())
+    }
+
+    fn set_session_owner_with_generation(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        generation: &str,
+    ) -> Result<(), TransportError> {
+        self.set_session_owner_marker(session, workspace, team, generation)
+    }
+
+    fn session_owner(
+        &self,
+        session: &SessionName,
+    ) -> Result<Option<SessionOwner>, TransportError> {
+        self.read_session_owner_marker(session)
+    }
+
     fn spawn_first(
         &self,
         session: &SessionName,

package/crates/team-agent/src/topology.rs

@@ -32,6 +32,19 @@ pub fn issue_id(issue: &Value) -> Option<&str> {
     issue.get("id").and_then(Value::as_str)
 }
 
+pub fn endpoint_socket_conflict(state: &Value) -> Option<Value> {
+    let endpoint = non_empty_str(state, "tmux_endpoint")?;
+    let socket = non_empty_str(state, "tmux_socket")?;
+    if same_endpoint(endpoint, socket) {
+        return None;
+    }
+    Some(json!({
+        "id": TMUX_ENDPOINT_SOCKET_CONFLICT,
+        "tmux_endpoint": endpoint,
+        "tmux_socket": socket,
+    }))
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum EndpointConvergenceDecision {
     NoConflict,
@@ -338,21 +351,14 @@ fn classify_agents_for_observed_pane(
 }
 
 fn append_socket_split_issues(state: &Value, issues: &mut Vec<Value>, include_readiness: bool) {
-    let endpoint = non_empty_str(state, "tmux_endpoint");
-    let socket = non_empty_str(state, "tmux_socket");
-    let (Some(endpoint), Some(socket)) = (endpoint, socket) else {
+    let Some(conflict) = endpoint_socket_conflict(state) else {
         return;
     };
-    if same_endpoint(endpoint, socket) {
-        return;
-    }
+    let endpoint = non_empty_str(state, "tmux_endpoint").unwrap_or_default();
+    let socket = non_empty_str(state, "tmux_socket").unwrap_or_default();
 
     let session = non_empty_str(state, "session_name").unwrap_or_default();
-    issues.push(json!({
-        "id": TMUX_ENDPOINT_SOCKET_CONFLICT,
-        "tmux_endpoint": endpoint,
-        "tmux_socket": socket,
-    }));
+    issues.push(conflict);
 
     if state
         .get("leader_receiver")

package/crates/team-agent/src/transport/test_support.rs

@@ -55,6 +55,7 @@ struct OfflineState {
     /// 0.4.x (CR C-3 / CR C-5): pre-staged `query(PaneField::PaneCurrentCommand)`
     /// answer keyed by pane id. Used by leader provider health tests.
     pane_current_commands: BTreeMap<String, String>,
+    session_owner: Option<super::SessionOwner>,
 }
 
 impl Default for OfflineState {
@@ -81,6 +82,7 @@ impl Default for OfflineState {
             capture_text: BTreeMap::new(),
             capture_ranges: Vec::new(),
             pane_current_commands: BTreeMap::new(),
+            session_owner: None,
         }
     }
 }
@@ -159,6 +161,27 @@ impl OfflineTransport {
         self
     }
 
+    pub fn with_session_owner(
+        self,
+        workspace: &Path,
+        team: impl Into<String>,
+        generation: impl Into<String>,
+    ) -> Self {
+        let workspace = workspace
+            .canonicalize()
+            .unwrap_or_else(|_| workspace.to_path_buf())
+            .to_string_lossy()
+            .into_owned();
+        self.with_state(|state| {
+            state.session_owner = Some(super::SessionOwner {
+                workspace,
+                team: team.into(),
+                generation: generation.into(),
+            });
+        });
+        self
+    }
+
     /// U1-B: stage a `list_targets()` error to model tmux server jitter. While set,
     /// every call returns `Err(TransportError::MuxUnavailable{detail})`. Pass an
     /// empty string to clear via re-builder if needed.
@@ -532,6 +555,13 @@ impl Transport for OfflineTransport {
         }))
     }
 
+    fn session_owner(
+        &self,
+        _session: &SessionName,
+    ) -> Result<Option<super::SessionOwner>, TransportError> {
+        Ok(self.with_state(|state| state.session_owner.clone()))
+    }
+
     fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
         Ok(self.with_state(|state| {
             state.calls.push("list_windows");

package/crates/team-agent/src/transport.rs

@@ -325,6 +325,13 @@ pub struct SpawnResult {
 
 /// 全局枚举的一行(身份地基)。`leader_env` 在 tmux 后端靠反向读进程 env,在
 /// WezTerm/ConPTY 后端靠正向登记表投影(§4a)。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SessionOwner {
+    pub workspace: String,
+    pub team: String,
+    pub generation: String,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PaneInfo {
     pub pane_id: PaneId,
@@ -1000,6 +1007,40 @@ pub trait Transport: Send + Sync {
     /// wezterm=`cli list --format json` + 正向登记表;conpty=daemon 内存表(仅自有,§4a)。
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError>;
 
+    /// Write an owner marker at the session scope after a new session is created.
+    /// Backends without a session-local metadata primitive may no-op, but then
+    /// shutdown must treat the missing marker as unknown and refuse destructive work.
+    fn set_session_owner(
+        &self,
+        _session: &SessionName,
+        _workspace: &Path,
+        _team: &str,
+    ) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    /// Write owner metadata including the launch generation when the backend
+    /// can persist one.  The default preserves compatibility for non-tmux
+    /// transports, which remain Unknown on reads.
+    fn set_session_owner_with_generation(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        _generation: &str,
+    ) -> Result<(), TransportError> {
+        self.set_session_owner(session, workspace, team)
+    }
+
+    /// Read the session-local owner marker. `None` is an unknown/legacy session,
+    /// never proof that the caller owns it.
+    fn session_owner(
+        &self,
+        _session: &SessionName,
+    ) -> Result<Option<SessionOwner>, TransportError> {
+        Ok(None)
+    }
+
     fn has_session(&self, session: &SessionName) -> Result<bool, TransportError>;
 
     fn list_windows(&self, session: &SessionName) -> Result<Vec<WindowName>, TransportError>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.91",
+  "version": "0.5.94",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.91",
-    "@team-agent/cli-darwin-x64": "0.5.91",
-    "@team-agent/cli-linux-x64": "0.5.91"
+    "@team-agent/cli-darwin-arm64": "0.5.94",
+    "@team-agent/cli-darwin-x64": "0.5.94",
+    "@team-agent/cli-linux-x64": "0.5.94"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",