@team-agent/installer 0.5.92 → 0.5.97

package/crates/team-agent/src/coordinator/health.rs

@@ -332,6 +332,7 @@ pub fn start_coordinator_with_team(
         }
     }
     command
+        .current_dir(workspace.as_path())
         .stdin(Stdio::null())
         .stdout(Stdio::from(log))
         .stderr(Stdio::from(log_err));
@@ -432,6 +433,16 @@ pub fn stop_coordinator(workspace: &WorkspacePath) -> Result<StopReport, StopErr
             pid: Some(pid),
         });
     }
+    let metadata_owned = read_coordinator_metadata(workspace)
+        .as_ref()
+        .is_some_and(|metadata| metadata.pid == pid);
+    if !metadata_owned || !coordinator_pid_owned_by_workspace(workspace, pid) {
+        return Ok(StopReport {
+            ok: false,
+            status: StopOutcome::NotOwned,
+            pid: Some(pid),
+        });
+    }
     if pid.get() == std::process::id() {
         remove_file_if_exists(&pid_path)?;
         remove_file_if_exists(&coordinator_meta_path(workspace))?;
@@ -441,7 +452,7 @@ pub fn stop_coordinator(workspace: &WorkspacePath) -> Result<StopReport, StopErr
             pid: Some(pid),
         });
     }
-    if !terminate_pid(pid) {
+    if !terminate_pid_for_workspace(pid, workspace.as_path()) {
         return Ok(StopReport {
             ok: false,
             status: StopOutcome::KillFailed,
@@ -468,7 +479,7 @@ fn stop_discovered_coordinators(
     let mut stopped = None;
     let mut failed = None;
     for pid in pids {
-        if terminate_pid(pid) {
+        if terminate_pid_for_workspace(pid, workspace.as_path()) {
             stopped.get_or_insert(pid);
         } else {
             failed.get_or_insert(pid);
@@ -501,47 +512,98 @@ fn discover_coordinator_pids(workspace: &WorkspacePath) -> Vec<Pid> {
         _ => return Vec::new(),
     };
     let text = String::from_utf8_lossy(&output.stdout);
-    let candidates = workspace_match_candidates(workspace.as_path());
+    let metadata_pid = read_coordinator_metadata(workspace).map(|metadata| metadata.pid.get());
     text.lines()
         .filter_map(|line| parse_ps_command_line(line))
-        .filter(|(pid, command)| {
-            *pid != std::process::id()
-                && coordinator_command_matches_workspace(command, &candidates)
+        .filter(|(pid, _command)| {
+            metadata_pid == Some(*pid)
+                && *pid != std::process::id()
+                && coordinator_pid_owned_by_workspace(workspace, Pid::new(*pid))
         })
         .map(|(pid, _)| Pid::new(pid))
         .collect()
 }
 
-fn parse_ps_command_line(line: &str) -> Option<(u32, &str)> {
-    let line = line.trim_start();
-    let split = line.find(char::is_whitespace).unwrap_or(line.len());
-    let pid = line.get(..split)?.trim().parse::<u32>().ok()?;
-    let command = line.get(split..)?.trim();
-    Some((pid, command))
+fn coordinator_pid_owned_by_workspace(workspace: &WorkspacePath, pid: Pid) -> bool {
+    let workspace = workspace
+        .as_path()
+        .canonicalize()
+        .unwrap_or_else(|_| workspace.as_path().to_path_buf());
+    let Some(tokens) = crate::platform::argv::argv_tokens(pid.get()) else {
+        return false;
+    };
+    let is_team_agent = tokens.first().is_some_and(|token| is_team_agent_binary(token));
+    let is_coordinator = tokens.iter().any(|token| token == "coordinator");
+    let has_workspace = tokens.windows(2).any(|pair| {
+        pair[0] == "--workspace"
+            && Path::new(&pair[1])
+                .canonicalize()
+                .map(|path| path == workspace)
+                .unwrap_or(false)
+    });
+    is_team_agent && is_coordinator && has_workspace
 }
 
-fn workspace_match_candidates(workspace: &Path) -> Vec<String> {
-    let mut candidates = vec![workspace.to_string_lossy().to_string()];
-    if let Ok(canonical) = workspace.canonicalize() {
-        let text = canonical.to_string_lossy().to_string();
-        if !candidates.iter().any(|candidate| candidate == &text) {
-            candidates.push(text);
+fn terminate_pid_for_workspace(pid: Pid, workspace: &Path) -> bool {
+    if !coordinator_pid_owned_by_path(workspace, pid) {
+        return false;
+    }
+    let pids = process_tree_pids(pid)
+        .into_iter()
+        .filter(|candidate| coordinator_pid_owned_by_path(workspace, *candidate))
+        .collect::<Vec<_>>();
+    if pids.is_empty() {
+        return false;
+    }
+    for child in pids.iter().rev() {
+        let _ = crate::platform::process::terminate_pid(
+            child.get(),
+            crate::platform::process::SignalKind::TerminateGraceful,
+        );
+    }
+    if !wait_until_all_not_running(&pids, Duration::from_secs(5)) {
+        for child in pids.iter().rev() {
+            let _ = crate::platform::process::terminate_pid(
+                child.get(),
+                crate::platform::process::SignalKind::TerminateForce,
+            );
         }
     }
-    candidates
+    wait_until_all_not_running(&pids, Duration::from_secs(5))
 }
 
-fn coordinator_command_matches_workspace(command: &str, workspaces: &[String]) -> bool {
-    command
-        .split_whitespace()
-        .any(|token| token == "team-agent" || token.ends_with("/team-agent"))
-        && command
-            .split_whitespace()
-            .any(|token| token == "coordinator")
-        && command.contains("--workspace")
-        && workspaces
-            .iter()
-            .any(|workspace| command.contains(workspace))
+fn coordinator_pid_owned_by_path(workspace: &Path, pid: Pid) -> bool {
+    let workspace = workspace
+        .canonicalize()
+        .unwrap_or_else(|_| workspace.to_path_buf());
+    let Some(tokens) = crate::platform::argv::argv_tokens(pid.get()) else {
+        return false;
+    };
+    let is_team_agent = tokens.first().is_some_and(|token| is_team_agent_binary(token));
+    let is_coordinator = tokens.iter().any(|token| token == "coordinator");
+    let has_workspace = tokens.windows(2).any(|pair| {
+        pair[0] == "--workspace"
+            && Path::new(&pair[1])
+                .canonicalize()
+                .map(|path| path == workspace)
+                .unwrap_or(false)
+    });
+    is_team_agent && is_coordinator && has_workspace
+}
+
+fn is_team_agent_binary(token: &str) -> bool {
+    let Some(name) = Path::new(token).file_name().and_then(|name| name.to_str()) else {
+        return false;
+    };
+    name == "team-agent" || name == "team_agent" || name.starts_with("team-agent-")
+}
+
+fn parse_ps_command_line(line: &str) -> Option<(u32, &str)> {
+    let line = line.trim_start();
+    let split = line.find(char::is_whitespace).unwrap_or(line.len());
+    let pid = line.get(..split)?.trim().parse::<u32>().ok()?;
+    let command = line.get(split..)?.trim();
+    Some((pid, command))
 }
 
 fn terminate_pid(pid: Pid) -> bool {

package/crates/team-agent/src/coordinator/tick.rs

@@ -160,6 +160,40 @@ fn coordinator_team_scoped_state(
     crate::state::projection::select_runtime_state(workspace, Some(selected)).ok()
 }
 
+fn live_sibling_team_state(
+    state: &Value,
+    missing_session: &str,
+    transport: &dyn crate::transport::Transport,
+) -> Result<Option<(String, Value)>, crate::transport::TransportError> {
+    let Some(teams) = state.get("teams").and_then(Value::as_object) else {
+        return Ok(None);
+    };
+    for (team_key, team_state) in teams {
+        let status = team_state
+            .get("status")
+            .and_then(Value::as_str)
+            .map(|status| status.to_ascii_lowercase());
+        if status.is_some_and(|status| status != "alive" && status != "running") {
+            continue;
+        }
+        let Some(session_name) = team_state
+            .get("session_name")
+            .and_then(Value::as_str)
+            .filter(|session| !session.is_empty() && *session != missing_session)
+        else {
+            continue;
+        };
+        let session = crate::transport::SessionName::new(session_name);
+        if transport.has_session(&session)? {
+            return Ok(Some((
+                team_key.clone(),
+                crate::state::projection::project_top_level_view(state, team_key),
+            )));
+        }
+    }
+    Ok(None)
+}
+
 // ===========================================================================
 // Coordinator struct(daemon lifecycle + tick orchestration)
 // ===========================================================================
@@ -330,20 +364,40 @@ impl Coordinator {
             .get("session_name")
             .and_then(Value::as_str)
             .filter(|s| !s.is_empty())
+            .map(str::to_owned)
         {
-            let session = crate::transport::SessionName::new(session_name);
+            let session = crate::transport::SessionName::new(&session_name);
             if !self.transport.has_session(&session)? {
                 event_log.write(
                     "coordinator.session_missing",
                     serde_json::json!({"session": session_name}),
                 )?;
-                notify_session_missing(self.workspace.as_path(), &state, &event_log, session_name)?;
-                return Ok(empty_tick_report(
-                    false,
-                    true,
-                    Some(TickStopReason::TmuxSessionMissing),
-                    None,
-                ));
+                if let Some((sibling_team, sibling_state)) =
+                    live_sibling_team_state(&state, &session_name, self.transport.as_ref())?
+                {
+                    event_log.write(
+                        "coordinator.session_missing_sibling_alive",
+                        serde_json::json!({
+                            "session": session_name,
+                            "sibling_team": sibling_team,
+                            "action": "continue_with_sibling_team",
+                        }),
+                    )?;
+                    state = sibling_state;
+                } else {
+                    notify_session_missing(
+                        self.workspace.as_path(),
+                        &state,
+                        &event_log,
+                        &session_name,
+                    )?;
+                    return Ok(empty_tick_report(
+                        false,
+                        true,
+                        Some(TickStopReason::TmuxSessionMissing),
+                        None,
+                    ));
+                }
             }
         }
 

package/crates/team-agent/src/coordinator/types.rs

@@ -164,6 +164,8 @@ pub enum StopOutcome {
     Missing,
     /// pid 非整数 → 清文件返回(`lifecycle.py:238`)。
     InvalidPidRemoved,
+    /// The pid file points to a live process owned by another workspace.
+    NotOwned,
     /// SIGTERM 失败(`lifecycle.py:243`)。
     KillFailed,
     /// SIGTERM + 清 pid/meta 成功(`lifecycle.py:247`)。

package/crates/team-agent/src/kill_audit.rs

@@ -2,7 +2,7 @@
 
 use std::path::Path;
 
-use serde_json::json;
+use serde_json::{json, Value};
 
 use crate::event_log::{EventLog, EventLogError};
 use crate::transport::{BackendKind, Transport};
@@ -29,6 +29,45 @@ pub(crate) fn pre_kill_audit(
             "argv": argv,
             "endpoint": endpoint,
             "targets": targets,
+            "workspace": Value::Null,
+            "team": Value::Null,
+            "generation": Value::Null,
+            "owner_evidence": "legacy_unscoped",
+            "reason": "legacy_callsite",
+        }),
+    )?;
+    Ok(())
+}
+
+pub(crate) fn pre_kill_audit_scoped(
+    event_log: &EventLog,
+    transport: &dyn Transport,
+    caller: &str,
+    action: &str,
+    targets: &[String],
+    workspace: &Path,
+    team: Option<&str>,
+    generation: Option<&str>,
+    owner_evidence: &str,
+    reason: &str,
+) -> Result<(), EventLogError> {
+    let endpoint = transport.tmux_endpoint();
+    let argv = destructive_argv(transport.kind(), endpoint.as_deref(), action, targets);
+    event_log.write(
+        "transport.pre_kill_audit",
+        json!({
+            "phase": "pre_call",
+            "caller": caller,
+            "caller_pid": std::process::id(),
+            "action": action,
+            "argv": argv,
+            "endpoint": endpoint,
+            "targets": targets,
+            "workspace": workspace.to_string_lossy(),
+            "team": team,
+            "generation": generation,
+            "owner_evidence": owner_evidence,
+            "reason": reason,
         }),
     )?;
     Ok(())
@@ -57,7 +96,7 @@ fn destructive_argv(
         vec![format!("{kind:?}").to_ascii_lowercase()]
     };
     argv.push(action.to_string());
-    if action == KILL_SESSION {
+    if action == KILL_SESSION || action == "kill-pane" {
         for target in targets {
             argv.push("-t".to_string());
             argv.push(target.clone());

package/crates/team-agent/src/lifecycle/launch/quick_start.rs

@@ -124,11 +124,7 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
     }
 
     fn observe_command(&mut self, pane: &PaneId) -> Option<String> {
-        self.transport
-            .query(&Target::Pane(pane.clone()), PaneField::PaneCurrentCommand)
-            .ok()
-            .flatten()
-            .filter(|command| !command.trim().is_empty())
+        query_caller_pane_command(self.transport, pane)
     }
 
     fn attach(
@@ -142,7 +138,7 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
         self.applied_grant = None;
         self.registry_receipt = None;
         let event_log = crate::event_log::EventLog::new(workspace);
-        let targets = match self.transport.list_targets() {
+        let targets = match list_caller_targets(self.transport) {
             Ok(targets) => targets,
             Err(_) => {
                 self.last_failure_reason = Some("caller_pane_unobservable");
@@ -290,11 +286,19 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
             self.last_failure_reason = Some("receiver_missing");
             return false;
         };
+        let leader_transport = receiver
+            .get("tmux_socket")
+            .and_then(serde_json::Value::as_str)
+            .filter(|endpoint| !endpoint.is_empty())
+            .map(crate::transport_factory::leader_endpoint_transport);
+        let live_channel_transport: &dyn Transport = leader_transport
+            .as_deref()
+            .unwrap_or(self.transport);
         if !matches!(
             crate::messaging::resolve_live_leader_channel(
                 workspace,
                 receiver,
-                self.transport,
+                live_channel_transport,
             ),
             crate::messaging::LeaderChannelResolution::Live(_)
         ) {
@@ -875,6 +879,42 @@ fn existing_runtime_identity_view(
     state.clone()
 }
 
+fn caller_read_transport() -> Option<Box<dyn Transport>> {
+    let endpoint = crate::tmux_backend::socket_name_from_tmux_env()?;
+    // Unit tests use an injected transport even when they seed a synthetic TMUX
+    // tuple.  Never make those hermetic tests depend on a host tmux server; the
+    // production path below remains a read-only endpoint probe.
+    #[cfg(test)]
+    if !Path::new(&endpoint).exists() {
+        return None;
+    }
+    Some(Box::new(crate::tmux_backend::TmuxBackend::for_tmux_endpoint(
+        &endpoint,
+    )))
+}
+
+fn query_caller_pane_command(transport: &dyn Transport, pane: &PaneId) -> Option<String> {
+    let caller_transport = caller_read_transport();
+    let query_transport: &dyn Transport = caller_transport
+        .as_deref()
+        .unwrap_or(transport);
+    query_transport
+        .query(&Target::Pane(pane.clone()), PaneField::PaneCurrentCommand)
+        .ok()
+        .flatten()
+        .filter(|command| !command.trim().is_empty())
+}
+
+fn list_caller_targets(
+    transport: &dyn Transport,
+) -> Result<Vec<crate::transport::PaneInfo>, crate::transport::TransportError> {
+    if let Some(caller_transport) = caller_read_transport() {
+        caller_transport.list_targets()
+    } else {
+        transport.list_targets()
+    }
+}
+
 fn preflight_fresh_leader_identity(
     transport: &dyn Transport,
 ) -> Option<(String, Vec<String>, Vec<String>)> {
@@ -900,13 +940,7 @@ fn preflight_fresh_leader_identity(
             let Some(pane) = pane else {
                 return None;
             };
-            let command = transport
-                .query(
-                    &Target::Pane(PaneId::new(pane)),
-                    PaneField::PaneCurrentCommand,
-                )
-                .ok()
-                .flatten()
+            let command = query_caller_pane_command(transport, &PaneId::new(pane))
                 .unwrap_or_default();
             let explicit = std::env::var("TEAM_AGENT_LEADER_PROVIDER")
                 .ok()

package/crates/team-agent/src/lifecycle/launch/quick_start_transport.rs

@@ -3,7 +3,7 @@
 //! contract:
 //!   provides:
 //!     - name: quick_start_tmux_backend
-//!       what: 优先复用调用方所在 tmux socket，否则按 workspace 派生
+//!       what: 按 workspace 派生私有 socket；调用方 tmux 只用于 leader receiver 绑定
 //!     - name: annotate_runtime_transport
 //!       what: 把 transport 种类与来源写进 state，tmux 时再写 endpoint 三字段
 //!     - name: attach_commands_for_runtime_windows
@@ -37,15 +37,11 @@ use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest}
 use super::*;
 
 /// ---
-/// purpose: 定出 quick-start 使用的 tmux 后端
-/// returns: 调用方环境里有 socket 就复用它，否则按 workspace 派生一个
+/// purpose: 定出 quick-start 使用的私有 tmux 后端
+/// returns: 始终按 workspace 派生 endpoint；调用方 $TMUX 仅供 leader receiver 身份绑定
 /// ---
 pub(crate) fn quick_start_tmux_backend(workspace: &Path) -> crate::tmux_backend::TmuxBackend {
-    if let Some(endpoint) = crate::tmux_backend::socket_name_from_tmux_env() {
-        crate::tmux_backend::TmuxBackend::for_tmux_endpoint(&endpoint)
-    } else {
-        crate::tmux_backend::TmuxBackend::for_workspace(workspace)
-    }
+    crate::tmux_backend::TmuxBackend::for_workspace(workspace)
 }
 
 /// ---

package/crates/team-agent/src/lifecycle/launch.rs

@@ -146,6 +146,23 @@ pub fn launch_with_transport_in_workspace(
             transport,
             &started,
         )?;
+        let owner_team = load_runtime_state(workspace)
+            .ok()
+            .map(|state| crate::state::projection::team_state_key(&state))
+            .filter(|team| !team.is_empty())
+            .unwrap_or_else(|| session_name.as_str().to_string());
+        let generation = started
+            .first()
+            .map(|agent| agent.spawned_at.as_str())
+            .unwrap_or(session_name.as_str());
+        transport
+            .set_session_owner_with_generation(
+                &session_name,
+                workspace,
+                &owner_team,
+                generation,
+            )
+            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
         // 0.5.38: per-worker timing tags (source="launch") so operators can
         // trace which worker's spawn dominates wall time. Zeros for now on
         // the sub-timings — Step 1 first enables shape assertion; a later

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -1041,6 +1041,32 @@ fn restart_with_selected_team_and_transport(
             attach_commands,
         });
     }
+    // Respawn changes the generation used by shutdown's ownership check, even
+    // when build-before-destroy keeps the tmux session itself alive. Stamp only
+    // the selected session, after its replacement state is durable.
+    if let Some(generation) = state
+        .get("generation")
+        .and_then(serde_json::Value::as_str)
+        .or_else(|| {
+            state
+                .get("agents")
+                .and_then(serde_json::Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(serde_json::Value::as_str)
+                    })
+                })
+        })
+    {
+        transport
+            .set_session_owner_with_generation(
+                &session_name,
+                &selected.run_workspace,
+                &selected.team_key,
+                generation,
+            )
+            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+    }
     // RM-039-SESS-001 step 2 (architect verdict 2026-06-22): post-respawn
     // resume backing validation.
     //

package/crates/team-agent/src/lifecycle/tests/claude_profile_launch_red.rs

@@ -168,8 +168,10 @@ fn launch_restart_start_add_and_fork_all_delegate_to_the_profile_launch_resolver
 }
 
 #[test]
+#[serial_test::serial(env)]
 fn diagnose_missing_profile_is_rc1_ok_false_and_zero_token() {
-    let ws = tmp_dir("diagnose-missing-profile");
+    let env = hermetic_guard::HermeticTestEnv::enter("diagnose-missing-profile");
+    let ws = env.workspace("missing-profile");
     let team = write_claude_profile_team(&ws, "diagteam", "clauder");
     std::fs::remove_file(
         ws.join(".team")
@@ -180,7 +182,7 @@ fn diagnose_missing_profile_is_rc1_ok_false_and_zero_token() {
     .unwrap();
 
     let output = Command::new(crate::lifecycle::tests::test_binary_path())
-        .args(["diagnose", "--workspace", ws.to_str().unwrap(), "--json"])
+        .args(["diagnose", team.to_str().unwrap(), "--workspace", ws.to_str().unwrap(), "--json"])
         .current_dir(&team)
         .output()
         .expect("diagnose subprocess should run");
@@ -197,10 +199,14 @@ fn diagnose_missing_profile_is_rc1_ok_false_and_zero_token() {
         json!(false),
         "diagnose missing profile must emit ok:false JSON; stdout={stdout} stderr={stderr}"
     );
+    assert_eq!(json["profile_smoke"]["ok"], false, "{json}");
     assert!(
-        stdout.contains("profile") || stderr.contains("profile"),
-        "diagnose missing profile must name the profile problem without invoking Claude; stdout={stdout} stderr={stderr}"
+        json["profile_smoke"].to_string().contains("profile"),
+        "diagnose missing profile must identify the scoped configuration failure: {json}"
     );
+    assert!(json["providers"].as_object().unwrap().values().all(|provider| {
+        provider["probe_status"] == "not_run"
+    }));
     assert!(
         !stdout.contains("tokens") && !stderr.contains("tokens"),
         "diagnose dry-run must not consume provider tokens or report token usage; stdout={stdout} stderr={stderr}"

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -2,6 +2,7 @@
 mod hermetic_guard;
 
 use super::*;
+use crate::tmux_backend::TmuxBackend;
 use crate::transport::test_support::OfflineTransport;
 use serde_json::json;
 use serial_test::serial;
@@ -1428,19 +1429,21 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
 
 #[test]
 #[serial(env)]
-fn quick_start_tmux_backend_prefers_absolute_tmux_env_endpoint() {
+fn quick_start_tmux_backend_uses_workspace_private_endpoint() {
     let leader_socket = "/tmp/team-agent-layout-leader-socket";
     let _tmux = EnvVarGuard::set("TMUX", &format!("{leader_socket},123,0"));
-    let backend = quick_start_tmux_backend(std::path::Path::new("/tmp/layout-workspace"));
+    let workspace = std::path::Path::new("/tmp/layout-workspace");
+    let backend = quick_start_tmux_backend(workspace);
+    let expected = TmuxBackend::for_workspace(workspace);
 
     assert_eq!(
-        crate::transport::Transport::tmux_endpoint(&backend).as_deref(),
-        Some(leader_socket),
-        "quick-start from inside tmux must use the caller's full $TMUX socket endpoint"
+        crate::transport::Transport::tmux_endpoint(&backend),
+        crate::transport::Transport::tmux_endpoint(&expected),
+        "quick-start workers must use the workspace-private socket, not ambient $TMUX"
     );
     assert_eq!(
-        selected_tmux_socket_source(&backend, std::path::Path::new("/tmp/layout-workspace")),
-        Some("leader_env")
+        selected_tmux_socket_source(&backend, workspace),
+        Some("workspace")
     );
 }