@team-agent/installer 0.5.92 → 0.5.94

package/crates/team-agent/src/coordinator/tick.rs

@@ -160,6 +160,40 @@ fn coordinator_team_scoped_state(
     crate::state::projection::select_runtime_state(workspace, Some(selected)).ok()
 }
 
+fn live_sibling_team_state(
+    state: &Value,
+    missing_session: &str,
+    transport: &dyn crate::transport::Transport,
+) -> Result<Option<(String, Value)>, crate::transport::TransportError> {
+    let Some(teams) = state.get("teams").and_then(Value::as_object) else {
+        return Ok(None);
+    };
+    for (team_key, team_state) in teams {
+        let status = team_state
+            .get("status")
+            .and_then(Value::as_str)
+            .map(|status| status.to_ascii_lowercase());
+        if status.is_some_and(|status| status != "alive" && status != "running") {
+            continue;
+        }
+        let Some(session_name) = team_state
+            .get("session_name")
+            .and_then(Value::as_str)
+            .filter(|session| !session.is_empty() && *session != missing_session)
+        else {
+            continue;
+        };
+        let session = crate::transport::SessionName::new(session_name);
+        if transport.has_session(&session)? {
+            return Ok(Some((
+                team_key.clone(),
+                crate::state::projection::project_top_level_view(state, team_key),
+            )));
+        }
+    }
+    Ok(None)
+}
+
 // ===========================================================================
 // Coordinator struct(daemon lifecycle + tick orchestration)
 // ===========================================================================
@@ -330,20 +364,40 @@ impl Coordinator {
             .get("session_name")
             .and_then(Value::as_str)
             .filter(|s| !s.is_empty())
+            .map(str::to_owned)
         {
-            let session = crate::transport::SessionName::new(session_name);
+            let session = crate::transport::SessionName::new(&session_name);
             if !self.transport.has_session(&session)? {
                 event_log.write(
                     "coordinator.session_missing",
                     serde_json::json!({"session": session_name}),
                 )?;
-                notify_session_missing(self.workspace.as_path(), &state, &event_log, session_name)?;
-                return Ok(empty_tick_report(
-                    false,
-                    true,
-                    Some(TickStopReason::TmuxSessionMissing),
-                    None,
-                ));
+                if let Some((sibling_team, sibling_state)) =
+                    live_sibling_team_state(&state, &session_name, self.transport.as_ref())?
+                {
+                    event_log.write(
+                        "coordinator.session_missing_sibling_alive",
+                        serde_json::json!({
+                            "session": session_name,
+                            "sibling_team": sibling_team,
+                            "action": "continue_with_sibling_team",
+                        }),
+                    )?;
+                    state = sibling_state;
+                } else {
+                    notify_session_missing(
+                        self.workspace.as_path(),
+                        &state,
+                        &event_log,
+                        &session_name,
+                    )?;
+                    return Ok(empty_tick_report(
+                        false,
+                        true,
+                        Some(TickStopReason::TmuxSessionMissing),
+                        None,
+                    ));
+                }
             }
         }
 

package/crates/team-agent/src/coordinator/types.rs

@@ -164,6 +164,8 @@ pub enum StopOutcome {
     Missing,
     /// pid 非整数 → 清文件返回(`lifecycle.py:238`)。
     InvalidPidRemoved,
+    /// The pid file points to a live process owned by another workspace.
+    NotOwned,
     /// SIGTERM 失败(`lifecycle.py:243`)。
     KillFailed,
     /// SIGTERM + 清 pid/meta 成功(`lifecycle.py:247`)。

package/crates/team-agent/src/kill_audit.rs

@@ -2,7 +2,7 @@
 
 use std::path::Path;
 
-use serde_json::json;
+use serde_json::{json, Value};
 
 use crate::event_log::{EventLog, EventLogError};
 use crate::transport::{BackendKind, Transport};
@@ -29,6 +29,45 @@ pub(crate) fn pre_kill_audit(
             "argv": argv,
             "endpoint": endpoint,
             "targets": targets,
+            "workspace": Value::Null,
+            "team": Value::Null,
+            "generation": Value::Null,
+            "owner_evidence": "legacy_unscoped",
+            "reason": "legacy_callsite",
+        }),
+    )?;
+    Ok(())
+}
+
+pub(crate) fn pre_kill_audit_scoped(
+    event_log: &EventLog,
+    transport: &dyn Transport,
+    caller: &str,
+    action: &str,
+    targets: &[String],
+    workspace: &Path,
+    team: Option<&str>,
+    generation: Option<&str>,
+    owner_evidence: &str,
+    reason: &str,
+) -> Result<(), EventLogError> {
+    let endpoint = transport.tmux_endpoint();
+    let argv = destructive_argv(transport.kind(), endpoint.as_deref(), action, targets);
+    event_log.write(
+        "transport.pre_kill_audit",
+        json!({
+            "phase": "pre_call",
+            "caller": caller,
+            "caller_pid": std::process::id(),
+            "action": action,
+            "argv": argv,
+            "endpoint": endpoint,
+            "targets": targets,
+            "workspace": workspace.to_string_lossy(),
+            "team": team,
+            "generation": generation,
+            "owner_evidence": owner_evidence,
+            "reason": reason,
         }),
     )?;
     Ok(())
@@ -57,7 +96,7 @@ fn destructive_argv(
         vec![format!("{kind:?}").to_ascii_lowercase()]
     };
     argv.push(action.to_string());
-    if action == KILL_SESSION {
+    if action == KILL_SESSION || action == "kill-pane" {
         for target in targets {
             argv.push("-t".to_string());
             argv.push(target.clone());

package/crates/team-agent/src/lifecycle/launch/quick_start.rs

@@ -124,11 +124,7 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
     }
 
     fn observe_command(&mut self, pane: &PaneId) -> Option<String> {
-        self.transport
-            .query(&Target::Pane(pane.clone()), PaneField::PaneCurrentCommand)
-            .ok()
-            .flatten()
-            .filter(|command| !command.trim().is_empty())
+        query_caller_pane_command(self.transport, pane)
     }
 
     fn attach(
@@ -142,7 +138,7 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
         self.applied_grant = None;
         self.registry_receipt = None;
         let event_log = crate::event_log::EventLog::new(workspace);
-        let targets = match self.transport.list_targets() {
+        let targets = match list_caller_targets(self.transport) {
             Ok(targets) => targets,
             Err(_) => {
                 self.last_failure_reason = Some("caller_pane_unobservable");
@@ -290,11 +286,19 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
             self.last_failure_reason = Some("receiver_missing");
             return false;
         };
+        let leader_transport = receiver
+            .get("tmux_socket")
+            .and_then(serde_json::Value::as_str)
+            .filter(|endpoint| !endpoint.is_empty())
+            .map(crate::transport_factory::leader_endpoint_transport);
+        let live_channel_transport: &dyn Transport = leader_transport
+            .as_deref()
+            .unwrap_or(self.transport);
         if !matches!(
             crate::messaging::resolve_live_leader_channel(
                 workspace,
                 receiver,
-                self.transport,
+                live_channel_transport,
             ),
             crate::messaging::LeaderChannelResolution::Live(_)
         ) {
@@ -875,6 +879,42 @@ fn existing_runtime_identity_view(
     state.clone()
 }
 
+fn caller_read_transport() -> Option<Box<dyn Transport>> {
+    let endpoint = crate::tmux_backend::socket_name_from_tmux_env()?;
+    // Unit tests use an injected transport even when they seed a synthetic TMUX
+    // tuple.  Never make those hermetic tests depend on a host tmux server; the
+    // production path below remains a read-only endpoint probe.
+    #[cfg(test)]
+    if !Path::new(&endpoint).exists() {
+        return None;
+    }
+    Some(Box::new(crate::tmux_backend::TmuxBackend::for_tmux_endpoint(
+        &endpoint,
+    )))
+}
+
+fn query_caller_pane_command(transport: &dyn Transport, pane: &PaneId) -> Option<String> {
+    let caller_transport = caller_read_transport();
+    let query_transport: &dyn Transport = caller_transport
+        .as_deref()
+        .unwrap_or(transport);
+    query_transport
+        .query(&Target::Pane(pane.clone()), PaneField::PaneCurrentCommand)
+        .ok()
+        .flatten()
+        .filter(|command| !command.trim().is_empty())
+}
+
+fn list_caller_targets(
+    transport: &dyn Transport,
+) -> Result<Vec<crate::transport::PaneInfo>, crate::transport::TransportError> {
+    if let Some(caller_transport) = caller_read_transport() {
+        caller_transport.list_targets()
+    } else {
+        transport.list_targets()
+    }
+}
+
 fn preflight_fresh_leader_identity(
     transport: &dyn Transport,
 ) -> Option<(String, Vec<String>, Vec<String>)> {
@@ -900,13 +940,7 @@ fn preflight_fresh_leader_identity(
             let Some(pane) = pane else {
                 return None;
             };
-            let command = transport
-                .query(
-                    &Target::Pane(PaneId::new(pane)),
-                    PaneField::PaneCurrentCommand,
-                )
-                .ok()
-                .flatten()
+            let command = query_caller_pane_command(transport, &PaneId::new(pane))
                 .unwrap_or_default();
             let explicit = std::env::var("TEAM_AGENT_LEADER_PROVIDER")
                 .ok()

package/crates/team-agent/src/lifecycle/launch/quick_start_transport.rs

@@ -3,7 +3,7 @@
 //! contract:
 //!   provides:
 //!     - name: quick_start_tmux_backend
-//!       what: 优先复用调用方所在 tmux socket，否则按 workspace 派生
+//!       what: 按 workspace 派生私有 socket；调用方 tmux 只用于 leader receiver 绑定
 //!     - name: annotate_runtime_transport
 //!       what: 把 transport 种类与来源写进 state，tmux 时再写 endpoint 三字段
 //!     - name: attach_commands_for_runtime_windows
@@ -37,15 +37,11 @@ use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest}
 use super::*;
 
 /// ---
-/// purpose: 定出 quick-start 使用的 tmux 后端
-/// returns: 调用方环境里有 socket 就复用它，否则按 workspace 派生一个
+/// purpose: 定出 quick-start 使用的私有 tmux 后端
+/// returns: 始终按 workspace 派生 endpoint；调用方 $TMUX 仅供 leader receiver 身份绑定
 /// ---
 pub(crate) fn quick_start_tmux_backend(workspace: &Path) -> crate::tmux_backend::TmuxBackend {
-    if let Some(endpoint) = crate::tmux_backend::socket_name_from_tmux_env() {
-        crate::tmux_backend::TmuxBackend::for_tmux_endpoint(&endpoint)
-    } else {
-        crate::tmux_backend::TmuxBackend::for_workspace(workspace)
-    }
+    crate::tmux_backend::TmuxBackend::for_workspace(workspace)
 }
 
 /// ---

package/crates/team-agent/src/lifecycle/launch.rs

@@ -146,6 +146,23 @@ pub fn launch_with_transport_in_workspace(
             transport,
             &started,
         )?;
+        let owner_team = load_runtime_state(workspace)
+            .ok()
+            .map(|state| crate::state::projection::team_state_key(&state))
+            .filter(|team| !team.is_empty())
+            .unwrap_or_else(|| session_name.as_str().to_string());
+        let generation = started
+            .first()
+            .map(|agent| agent.spawned_at.as_str())
+            .unwrap_or(session_name.as_str());
+        transport
+            .set_session_owner_with_generation(
+                &session_name,
+                workspace,
+                &owner_team,
+                generation,
+            )
+            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
         // 0.5.38: per-worker timing tags (source="launch") so operators can
         // trace which worker's spawn dominates wall time. Zeros for now on
         // the sub-timings — Step 1 first enables shape assertion; a later

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -2,6 +2,7 @@
 mod hermetic_guard;
 
 use super::*;
+use crate::tmux_backend::TmuxBackend;
 use crate::transport::test_support::OfflineTransport;
 use serde_json::json;
 use serial_test::serial;
@@ -1428,19 +1429,21 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
 
 #[test]
 #[serial(env)]
-fn quick_start_tmux_backend_prefers_absolute_tmux_env_endpoint() {
+fn quick_start_tmux_backend_uses_workspace_private_endpoint() {
     let leader_socket = "/tmp/team-agent-layout-leader-socket";
     let _tmux = EnvVarGuard::set("TMUX", &format!("{leader_socket},123,0"));
-    let backend = quick_start_tmux_backend(std::path::Path::new("/tmp/layout-workspace"));
+    let workspace = std::path::Path::new("/tmp/layout-workspace");
+    let backend = quick_start_tmux_backend(workspace);
+    let expected = TmuxBackend::for_workspace(workspace);
 
     assert_eq!(
-        crate::transport::Transport::tmux_endpoint(&backend).as_deref(),
-        Some(leader_socket),
-        "quick-start from inside tmux must use the caller's full $TMUX socket endpoint"
+        crate::transport::Transport::tmux_endpoint(&backend),
+        crate::transport::Transport::tmux_endpoint(&expected),
+        "quick-start workers must use the workspace-private socket, not ambient $TMUX"
     );
     assert_eq!(
-        selected_tmux_socket_source(&backend, std::path::Path::new("/tmp/layout-workspace")),
-        Some("leader_env")
+        selected_tmux_socket_source(&backend, workspace),
+        Some("workspace")
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/phase_golden.rs

@@ -5,7 +5,7 @@ use crate::cli::{
     SendArgs, StatusArgs,
 };
 use crate::transport::test_support::OfflineTransport;
-use crate::transport::WindowName;
+use crate::transport::{PaneId, PaneInfo, SessionName, WindowName};
 use serde_json::{json, Map, Value};
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
@@ -229,7 +229,21 @@ fn run_phase_golden(spec: PhaseGolden) -> Value {
     let team = two_worker_team_dir(&hermetic);
     let workspace = team.parent().expect("workspace").to_path_buf();
     seed_healthy_coordinator(&workspace);
-    let launch_transport = codex_ready_transport();
+    let _caller_pane = EnvVarGuard::set("TMUX_PANE", "%caller");
+    let launch_transport = codex_ready_transport().with_targets(vec![PaneInfo {
+        pane_id: PaneId::new("%caller"),
+        session: SessionName::new("caller"),
+        window_index: Some(0),
+        window_name: Some(WindowName::new("caller")),
+        pane_index: Some(0),
+        tty: None,
+        current_command: Some("codex".to_string()),
+        current_path: Some(workspace.clone()),
+        active: true,
+        pane_pid: None,
+        leader_env: BTreeMap::new(),
+    }])
+    .with_pane_current_command("%caller", "codex");
     let quick_start = quick_start_with_transport_in_workspace_with_display(
         &workspace,
         &team,
@@ -275,9 +289,49 @@ fn run_phase_golden(spec: PhaseGolden) -> Value {
         to_name: None,
         to_leader: None,
     });
+    let runtime_state = crate::state::persist::load_runtime_state(&workspace)
+        .expect("quick-start state written before shutdown fixture");
+    let generation = runtime_state
+        .get("generation")
+        .and_then(Value::as_str)
+        .or_else(|| {
+            runtime_state
+                .get("agents")
+                .and_then(Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(Value::as_str)
+                    })
+                })
+        })
+        .or_else(|| {
+            runtime_state
+                .pointer("/teams/teamdir/agents")
+                .and_then(Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(Value::as_str)
+                    })
+                })
+        })
+        .unwrap_or("phase-golden");
     let lifecycle_transport = codex_ready_transport()
         .with_session_present(true)
-        .with_windows(vec![WindowName::new("w1"), WindowName::new("w2")]);
+        .with_windows(vec![WindowName::new("w1"), WindowName::new("w2")])
+        .with_targets(vec![PaneInfo {
+            pane_id: PaneId::new("%w1"),
+            session: SessionName::new("team-phasegolden"),
+            window_index: Some(0),
+            window_name: Some(WindowName::new("w1")),
+            pane_index: Some(0),
+            tty: None,
+            current_command: Some("codex".to_string()),
+            current_path: Some(workspace.clone()),
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+        .with_session_owner(&workspace, "teamdir", generation);
     let lifecycle = (spec.lifecycle_op)(&workspace, &lifecycle_transport, spec.team_key);
     let shutdown = lifecycle_port::shutdown_with_transport(
         &workspace,
@@ -660,9 +714,12 @@ fn normalize_value(value: Value, ctx: &mut NormalizeCtx, key: Option<&str>) -> V
 
 fn normalize_string(text: String, ctx: &mut NormalizeCtx, key: Option<&str>) -> Value {
     let key = key.unwrap_or_default();
-    if key_is_timestamp(key) {
+    if key_is_timestamp(key) || key == "generation" {
         return json!("<TS>");
     }
+    if key == "workspace_hash" {
+        return json!("<ID>");
+    }
     if text == crate::packaging::Version::current().as_str() {
         return json!("<VERSION>");
     }
@@ -696,9 +753,39 @@ fn normalize_path_string(text: &str, ctx: &NormalizeCtx) -> String {
         out = out.replace(alias, "<TMP>");
     }
     out = normalize_tmux_socket_dir(&out);
+    out = normalize_hermetic_root(&out);
+    out = normalize_registry_hash(&out);
     normalize_socket_token(&out)
 }
 
+fn normalize_registry_hash(text: &str) -> String {
+    let Some(start) = text.rfind("/leaders/") else {
+        return text.to_string();
+    };
+    let file_start = start + "/leaders/".len();
+    let Some(separator) = text[file_start..].find("__") else {
+        return text.to_string();
+    };
+    let separator = file_start + separator;
+    text[..file_start].to_owned() + "<ID>" + &text[separator..]
+}
+
+fn normalize_hermetic_root(text: &str) -> String {
+    let marker = "ta-phase-golden-";
+    let Some(start) = text.find(marker) else {
+        return text.to_string();
+    };
+    let end = text[start..]
+        .find('/')
+        .map(|offset| start + offset)
+        .unwrap_or(text.len());
+    let segment = &text[start..end];
+    let Some(phase) = text[start + marker.len()..end].split('-').next() else {
+        return text.to_string();
+    };
+    text.replacen(segment, &format!("{marker}{phase}"), 1)
+}
+
 fn value_looks_like_endpoint_path(text: &str) -> bool {
     text.starts_with('/')
         || text.starts_with("ta-")

package/crates/team-agent/src/platform/process.rs

@@ -12,8 +12,8 @@
 //!   `GetExitCodeProcess`, `TerminateProcess`, Toolhelp snapshot,
 //!   Job Objects for shim-owned worker teardown)
 //!
-//! CR C-6: `terminate_pid` / `terminate_group` return
-//! `TerminationOutcome` so a caller that requested `TerminateGraceful`
+//! CR C-6: `terminate_pid` returns `TerminationOutcome` so a caller
+//! that requested `TerminateGraceful`
 //! can see that Windows downgraded to `TerminateForce` and emit a
 //! `platform.terminate_force_only` event (N38 交底).
 //!
@@ -41,7 +41,7 @@ pub enum SignalKind {
     TerminateForce,
 }
 
-/// Result of a `terminate_pid` / `terminate_group` call. `Graceful`
+/// Result of a `terminate_pid` call. `Graceful`
 /// means the OS honored the request kind; `ForceOnly` means Windows
 /// downgraded a `TerminateGraceful` to `TerminateProcess` (CR C-6
 /// N38 交底 — caller must emit a `platform.terminate_force_only`
@@ -55,7 +55,7 @@ pub enum TerminationOutcome {
     /// (no grace period). Includes a machine-readable reason so
     /// callers can log it in the audit event.
     ForceOnly { reason: &'static str },
-    /// The pid/group was already gone by the time the call resolved.
+    /// The pid was already gone by the time the call resolved.
     /// Not an error.
     AlreadyGone,
 }
@@ -216,34 +216,6 @@ mod unix_impl {
         }
     }
 
-    /// Send a signal to a process group (`kill(-pgid, ...)`).
-    /// Byte-equivalent to `cli/mod.rs:1854` (`libc::kill(-pgid, signal)`)
-    /// used by `send_process_signal_group`.
-    pub fn terminate_group(
-        group_id: u32,
-        kind: SignalKind,
-    ) -> Result<TerminationOutcome, io::Error> {
-        let signal = match kind {
-            SignalKind::TerminateGraceful => libc::SIGTERM,
-            SignalKind::TerminateForce => libc::SIGKILL,
-        };
-        let pgid_t = match libc::pid_t::try_from(group_id) {
-            Ok(p) => p,
-            Err(_) => return Ok(TerminationOutcome::AlreadyGone),
-        };
-        // `-pgid` targets every process in that group. Preserves the
-        // existing shutdown semantics inline in cli/mod.rs.
-        let rc = unsafe { libc::kill(-pgid_t, signal) };
-        if rc == 0 {
-            return Ok(TerminationOutcome::Requested);
-        }
-        let err = io::Error::last_os_error();
-        match err.raw_os_error() {
-            Some(code) if code == libc::ESRCH => Ok(TerminationOutcome::AlreadyGone),
-            _ => Err(err),
-        }
-    }
-
     /// Best-effort waitpid so a killed child doesn't accumulate as a
     /// zombie. Byte-equivalent to `coordinator/health.rs:350-358` and
     /// `cli/mod.rs:1871-1879`.
@@ -434,19 +406,6 @@ mod windows_impl {
         })
     }
 
-    pub fn terminate_group(
-        _group_id: u32,
-        _kind: SignalKind,
-    ) -> Result<TerminationOutcome, io::Error> {
-        // Windows has no `-pgid` sentinel. Design §Route B: "owned
-        // worker teardown: prefer Job Objects in the ConPTY shim".
-        // Job-object teardown is a shim-side concern, not a top-level
-        // API. Return AlreadyGone honestly here so shutdown code
-        // falls back to per-pid termination (the caller's outer
-        // loop retries per-pid after the group attempt is a no-op).
-        Ok(TerminationOutcome::AlreadyGone)
-    }
-
     pub fn reap_child_if_possible(_pid: u32) {
         // Windows has no zombie waitpid model. Child handles are
         // owned by the spawner and closed at drop; nothing to do.