@team-agent/installer 0.5.92 → 0.5.97

package/crates/team-agent/src/lifecycle/tests/phase_golden.rs

@@ -5,7 +5,7 @@ use crate::cli::{
     SendArgs, StatusArgs,
 };
 use crate::transport::test_support::OfflineTransport;
-use crate::transport::WindowName;
+use crate::transport::{PaneId, PaneInfo, SessionName, WindowName};
 use serde_json::{json, Map, Value};
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
@@ -229,7 +229,21 @@ fn run_phase_golden(spec: PhaseGolden) -> Value {
     let team = two_worker_team_dir(&hermetic);
     let workspace = team.parent().expect("workspace").to_path_buf();
     seed_healthy_coordinator(&workspace);
-    let launch_transport = codex_ready_transport();
+    let _caller_pane = EnvVarGuard::set("TMUX_PANE", "%caller");
+    let launch_transport = codex_ready_transport().with_targets(vec![PaneInfo {
+        pane_id: PaneId::new("%caller"),
+        session: SessionName::new("caller"),
+        window_index: Some(0),
+        window_name: Some(WindowName::new("caller")),
+        pane_index: Some(0),
+        tty: None,
+        current_command: Some("codex".to_string()),
+        current_path: Some(workspace.clone()),
+        active: true,
+        pane_pid: None,
+        leader_env: BTreeMap::new(),
+    }])
+    .with_pane_current_command("%caller", "codex");
     let quick_start = quick_start_with_transport_in_workspace_with_display(
         &workspace,
         &team,
@@ -275,9 +289,49 @@ fn run_phase_golden(spec: PhaseGolden) -> Value {
         to_name: None,
         to_leader: None,
     });
+    let runtime_state = crate::state::persist::load_runtime_state(&workspace)
+        .expect("quick-start state written before shutdown fixture");
+    let generation = runtime_state
+        .get("generation")
+        .and_then(Value::as_str)
+        .or_else(|| {
+            runtime_state
+                .get("agents")
+                .and_then(Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(Value::as_str)
+                    })
+                })
+        })
+        .or_else(|| {
+            runtime_state
+                .pointer("/teams/teamdir/agents")
+                .and_then(Value::as_object)
+                .and_then(|agents| {
+                    agents.values().find_map(|agent| {
+                        agent.get("spawned_at").and_then(Value::as_str)
+                    })
+                })
+        })
+        .unwrap_or("phase-golden");
     let lifecycle_transport = codex_ready_transport()
         .with_session_present(true)
-        .with_windows(vec![WindowName::new("w1"), WindowName::new("w2")]);
+        .with_windows(vec![WindowName::new("w1"), WindowName::new("w2")])
+        .with_targets(vec![PaneInfo {
+            pane_id: PaneId::new("%w1"),
+            session: SessionName::new("team-phasegolden"),
+            window_index: Some(0),
+            window_name: Some(WindowName::new("w1")),
+            pane_index: Some(0),
+            tty: None,
+            current_command: Some("codex".to_string()),
+            current_path: Some(workspace.clone()),
+            active: true,
+            pane_pid: None,
+            leader_env: BTreeMap::new(),
+        }])
+        .with_session_owner(&workspace, "teamdir", generation);
     let lifecycle = (spec.lifecycle_op)(&workspace, &lifecycle_transport, spec.team_key);
     let shutdown = lifecycle_port::shutdown_with_transport(
         &workspace,
@@ -660,9 +714,12 @@ fn normalize_value(value: Value, ctx: &mut NormalizeCtx, key: Option<&str>) -> V
 
 fn normalize_string(text: String, ctx: &mut NormalizeCtx, key: Option<&str>) -> Value {
     let key = key.unwrap_or_default();
-    if key_is_timestamp(key) {
+    if key_is_timestamp(key) || key == "generation" {
         return json!("<TS>");
     }
+    if key == "workspace_hash" {
+        return json!("<ID>");
+    }
     if text == crate::packaging::Version::current().as_str() {
         return json!("<VERSION>");
     }
@@ -696,9 +753,39 @@ fn normalize_path_string(text: &str, ctx: &NormalizeCtx) -> String {
         out = out.replace(alias, "<TMP>");
     }
     out = normalize_tmux_socket_dir(&out);
+    out = normalize_hermetic_root(&out);
+    out = normalize_registry_hash(&out);
     normalize_socket_token(&out)
 }
 
+fn normalize_registry_hash(text: &str) -> String {
+    let Some(start) = text.rfind("/leaders/") else {
+        return text.to_string();
+    };
+    let file_start = start + "/leaders/".len();
+    let Some(separator) = text[file_start..].find("__") else {
+        return text.to_string();
+    };
+    let separator = file_start + separator;
+    text[..file_start].to_owned() + "<ID>" + &text[separator..]
+}
+
+fn normalize_hermetic_root(text: &str) -> String {
+    let marker = "ta-phase-golden-";
+    let Some(start) = text.find(marker) else {
+        return text.to_string();
+    };
+    let end = text[start..]
+        .find('/')
+        .map(|offset| start + offset)
+        .unwrap_or(text.len());
+    let segment = &text[start..end];
+    let Some(phase) = text[start + marker.len()..end].split('-').next() else {
+        return text.to_string();
+    };
+    text.replacen(segment, &format!("{marker}{phase}"), 1)
+}
+
 fn value_looks_like_endpoint_path(text: &str) -> bool {
     text.starts_with('/')
         || text.starts_with("ta-")

package/crates/team-agent/src/lifecycle/tests/restart_build_before_destroy_0540_contract.rs

@@ -30,7 +30,7 @@ use team_agent::state::persist::{load_runtime_state, save_runtime_state};
 use team_agent::transport::{
     AttachOutcome, BackendKind, CaptureRange, CapturedText, InjectPayload, InjectReport,
     InjectStage, InjectVerification, Key, PaneField, PaneId, PaneInfo, PaneLiveness, SessionName,
-    SetEnvOutcome, SpawnResult, SubmitVerification, Target, Transport, TransportError,
+    SessionOwner, SetEnvOutcome, SpawnResult, SubmitVerification, Target, Transport, TransportError,
     TurnVerification, WindowName,
 };
 
@@ -130,6 +130,95 @@ fn server_exited_during_replacement_spawn_does_not_cascade_session_disappeared_a
     );
 }
 
+#[test]
+#[serial(env)]
+fn scoped_shutdown_after_restart_refreshes_owner_and_preserves_sibling() {
+    let case = RestartCase::new("restart-shutdown-owner", worker_ids(2), ProviderShape::Fake);
+    let transport = BuildBeforeDestroyTransport::recording(worker_ids(2));
+    for pane in transport.state.lock().unwrap().panes.values_mut() {
+        pane.current_path = Some(case.workspace.clone());
+        pane.pane_pid = None;
+    }
+    let session = SessionName::new(TEAM_SESSION);
+    let sibling_session = SessionName::new("team-sibling");
+    let mut state = case.read_state();
+    // Host and worker tmux servers may allocate the same pane ID. The host
+    // receiver must not protect the replacement worker on this transport.
+    state["leader_receiver"] = json!({
+        "pane_id": "%new-1", "tmux_socket": "/tmp/s4-host-only.sock"
+    });
+    state["team_owner"] = json!({"pane_id": "%new-1"});
+    state["teams"][TEAM]["leader_receiver"] = state["leader_receiver"].clone();
+    state["teams"][TEAM]["team_owner"] = state["team_owner"].clone();
+    state["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "session_name": sibling_session.as_str(),
+        "tmux_socket": TMUX_ENDPOINT,
+        "agents": {
+            "sibling-worker": {
+                "provider": "fake", "status": "running", "pane_id": "%sibling",
+                "spawned_at": "sibling-generation"
+            }
+        }
+    });
+    save_runtime_state(&case.workspace, &state).unwrap();
+    let sibling_before = case.read_state()["teams"]["sibling"].clone();
+    let mut sibling_pane = pane_info(
+        sibling_session.clone(), WindowName::new("sibling-worker"), PaneId::new("%sibling"),
+    );
+    sibling_pane.current_path = Some(case.workspace.clone());
+    sibling_pane.pane_pid = None;
+    transport.state.lock().unwrap().panes.insert("%sibling".to_string(), sibling_pane.clone());
+    transport.set_session_owner_with_generation(
+        &session, &case.workspace, TEAM, "2026-07-14T00:00:00+00:00",
+    ).unwrap();
+    transport.set_session_owner_with_generation(
+        &sibling_session, &case.workspace, "sibling", "sibling-generation",
+    ).unwrap();
+    let sibling_owner = transport.session_owner(&sibling_session).unwrap();
+
+    let report = restart_with_transport(&case.workspace, true, Some(TEAM), &transport).unwrap();
+    assert!(matches!(report, RestartReport::Restarted { .. }), "{report:?}");
+    let state = case.read_state();
+    let expected_generation = state["teams"][TEAM]["agents"]["w1"]["spawned_at"].as_str().unwrap();
+    assert_ne!(expected_generation, "2026-07-14T00:00:00+00:00");
+    let owner = transport.session_owner(&session).unwrap().unwrap();
+    assert_eq!(owner.workspace, case.workspace.canonicalize().unwrap().to_string_lossy());
+    assert_eq!(owner.team, TEAM);
+    assert_eq!(owner.generation, expected_generation);
+    assert_no_original_session_kill(&transport.ops(), "restart retains the session");
+
+    let out = team_agent::cli::lifecycle_port::shutdown_with_transport(
+        &case.workspace, true, Some(TEAM), &transport,
+    ).unwrap();
+    assert_eq!(out["ok"], true, "{out}");
+    assert_eq!(out["session_killed"], true, "{out}");
+    assert_eq!(out["spared_sessions"], json!([]), "{out}");
+    assert_eq!(out["coordinator_stop_reason"], "scoped_live_sibling_present", "{out}");
+    assert!(!transport.has_session(&session).unwrap());
+    assert!(transport.has_session(&sibling_session).unwrap());
+    assert_eq!(transport.session_owner(&sibling_session).unwrap(), sibling_owner);
+    assert_eq!(case.read_state()["teams"]["sibling"], sibling_before);
+    assert_eq!(transport.state.lock().unwrap().panes.get("%sibling"), Some(&sibling_pane));
+}
+
+#[test]
+#[serial(env)]
+fn failed_replacement_preserves_original_session_owner() {
+    let case = RestartCase::new("failed-restart-owner", worker_ids(1), ProviderShape::Fake);
+    let transport = BuildBeforeDestroyTransport::recording(worker_ids(1))
+        .with_spawn_failure("w1", "injected replacement spawn failure");
+    let session = SessionName::new(TEAM_SESSION);
+    transport.set_session_owner_with_generation(
+        &session, &case.workspace, TEAM, "2026-07-14T00:00:00+00:00",
+    ).unwrap();
+    let owner_before = transport.session_owner(&session).unwrap();
+    let report = restart_with_transport(&case.workspace, true, Some(TEAM), &transport).unwrap();
+    assert_restart_did_not_succeed(&report);
+    assert_eq!(transport.session_owner(&session).unwrap(), owner_before);
+    assert_eq!(transport.ops().iter().filter(|op| op.starts_with("set_session_owner:")).count(), 1);
+}
+
 struct RestartCase {
     env: hermetic_guard::HermeticTestEnv,
     workspace: PathBuf,
@@ -354,6 +443,7 @@ struct TransportState {
     session_present: bool,
     ops: Vec<String>,
     panes: BTreeMap<String, PaneInfo>,
+    owners: BTreeMap<String, SessionOwner>,
     next_pane: usize,
     spawns: usize,
 }
@@ -416,6 +506,7 @@ impl BuildBeforeDestroyTransport {
         kind: &'static str,
         session: &SessionName,
         window: &WindowName,
+        cwd: &Path,
     ) -> Result<SpawnResult, TransportError> {
         let mut state = self.state.lock().unwrap();
         state
@@ -434,10 +525,10 @@ impl BuildBeforeDestroyTransport {
         let pane_id = PaneId::new(format!("%new-{}", state.next_pane));
         state.next_pane += 1;
         state.session_present = true;
-        state.panes.insert(
-            pane_id.as_str().to_string(),
-            pane_info(session.clone(), window.clone(), pane_id.clone()),
-        );
+        let mut pane = pane_info(session.clone(), window.clone(), pane_id.clone());
+        pane.current_path = Some(cwd.to_path_buf());
+        pane.pane_pid = None;
+        state.panes.insert(pane_id.as_str().to_string(), pane);
         if self.server_exit_after_first_spawn && state.spawns == 1 {
             state.session_present = false;
         }
@@ -451,7 +542,12 @@ impl BuildBeforeDestroyTransport {
 
     fn real_tmux_has_session(&self, session: &SessionName) -> Result<bool, TransportError> {
         let Some(socket) = self.real_socket.as_ref() else {
-            return Ok(self.state.lock().unwrap().session_present);
+            let state = self.state.lock().unwrap();
+            return Ok(if session.as_str() == TEAM_SESSION {
+                state.session_present
+            } else {
+                state.panes.values().any(|pane| pane.session == *session)
+            });
         };
         Ok(Command::new("tmux")
             .args([
@@ -535,10 +631,10 @@ impl Transport for BuildBeforeDestroyTransport {
         session: &SessionName,
         window: &WindowName,
         _argv: &[String],
-        _cwd: &Path,
+        cwd: &Path,
         _env: &BTreeMap<String, String>,
     ) -> Result<SpawnResult, TransportError> {
-        self.spawn("spawn_first", session, window)
+        self.spawn("spawn_first", session, window, cwd)
     }
 
     fn spawn_into(
@@ -546,10 +642,10 @@ impl Transport for BuildBeforeDestroyTransport {
         session: &SessionName,
         window: &WindowName,
         _argv: &[String],
-        _cwd: &Path,
+        cwd: &Path,
         _env: &BTreeMap<String, String>,
     ) -> Result<SpawnResult, TransportError> {
-        self.spawn("spawn_into", session, window)
+        self.spawn("spawn_into", session, window, cwd)
     }
 
     fn inject(
@@ -648,6 +744,27 @@ impl Transport for BuildBeforeDestroyTransport {
         Ok(windows.into_iter().collect())
     }
 
+    fn set_session_owner_with_generation(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        generation: &str,
+    ) -> Result<(), TransportError> {
+        let mut state = self.state.lock().unwrap();
+        state.ops.push(format!("set_session_owner:{}", session.as_str()));
+        state.owners.insert(session.as_str().to_string(), SessionOwner {
+            workspace: workspace.canonicalize().unwrap().to_string_lossy().into_owned(),
+            team: team.to_string(),
+            generation: generation.to_string(),
+        });
+        Ok(())
+    }
+
+    fn session_owner(&self, session: &SessionName) -> Result<Option<SessionOwner>, TransportError> {
+        Ok(self.state.lock().unwrap().owners.get(session.as_str()).cloned())
+    }
+
     fn set_session_env(
         &self,
         _session: &SessionName,
@@ -665,7 +782,7 @@ impl Transport for BuildBeforeDestroyTransport {
             .push(format!("kill_session:{}", session.as_str()));
         if session.as_str() == TEAM_SESSION {
             self.state.lock().unwrap().session_present = false;
-            self.state.lock().unwrap().panes.clear();
+            self.state.lock().unwrap().panes.retain(|_, pane| pane.session != *session);
             if let Some(socket) = self.real_socket.as_ref() {
                 let status = Command::new("tmux")
                     .args([

package/crates/team-agent/src/platform/process.rs

@@ -12,8 +12,8 @@
 //!   `GetExitCodeProcess`, `TerminateProcess`, Toolhelp snapshot,
 //!   Job Objects for shim-owned worker teardown)
 //!
-//! CR C-6: `terminate_pid` / `terminate_group` return
-//! `TerminationOutcome` so a caller that requested `TerminateGraceful`
+//! CR C-6: `terminate_pid` returns `TerminationOutcome` so a caller
+//! that requested `TerminateGraceful`
 //! can see that Windows downgraded to `TerminateForce` and emit a
 //! `platform.terminate_force_only` event (N38 交底).
 //!
@@ -41,7 +41,7 @@ pub enum SignalKind {
     TerminateForce,
 }
 
-/// Result of a `terminate_pid` / `terminate_group` call. `Graceful`
+/// Result of a `terminate_pid` call. `Graceful`
 /// means the OS honored the request kind; `ForceOnly` means Windows
 /// downgraded a `TerminateGraceful` to `TerminateProcess` (CR C-6
 /// N38 交底 — caller must emit a `platform.terminate_force_only`
@@ -55,7 +55,7 @@ pub enum TerminationOutcome {
     /// (no grace period). Includes a machine-readable reason so
     /// callers can log it in the audit event.
     ForceOnly { reason: &'static str },
-    /// The pid/group was already gone by the time the call resolved.
+    /// The pid was already gone by the time the call resolved.
     /// Not an error.
     AlreadyGone,
 }
@@ -216,34 +216,6 @@ mod unix_impl {
         }
     }
 
-    /// Send a signal to a process group (`kill(-pgid, ...)`).
-    /// Byte-equivalent to `cli/mod.rs:1854` (`libc::kill(-pgid, signal)`)
-    /// used by `send_process_signal_group`.
-    pub fn terminate_group(
-        group_id: u32,
-        kind: SignalKind,
-    ) -> Result<TerminationOutcome, io::Error> {
-        let signal = match kind {
-            SignalKind::TerminateGraceful => libc::SIGTERM,
-            SignalKind::TerminateForce => libc::SIGKILL,
-        };
-        let pgid_t = match libc::pid_t::try_from(group_id) {
-            Ok(p) => p,
-            Err(_) => return Ok(TerminationOutcome::AlreadyGone),
-        };
-        // `-pgid` targets every process in that group. Preserves the
-        // existing shutdown semantics inline in cli/mod.rs.
-        let rc = unsafe { libc::kill(-pgid_t, signal) };
-        if rc == 0 {
-            return Ok(TerminationOutcome::Requested);
-        }
-        let err = io::Error::last_os_error();
-        match err.raw_os_error() {
-            Some(code) if code == libc::ESRCH => Ok(TerminationOutcome::AlreadyGone),
-            _ => Err(err),
-        }
-    }
-
     /// Best-effort waitpid so a killed child doesn't accumulate as a
     /// zombie. Byte-equivalent to `coordinator/health.rs:350-358` and
     /// `cli/mod.rs:1871-1879`.
@@ -434,19 +406,6 @@ mod windows_impl {
         })
     }
 
-    pub fn terminate_group(
-        _group_id: u32,
-        _kind: SignalKind,
-    ) -> Result<TerminationOutcome, io::Error> {
-        // Windows has no `-pgid` sentinel. Design §Route B: "owned
-        // worker teardown: prefer Job Objects in the ConPTY shim".
-        // Job-object teardown is a shim-side concern, not a top-level
-        // API. Return AlreadyGone honestly here so shutdown code
-        // falls back to per-pid termination (the caller's outer
-        // loop retries per-pid after the group attempt is a no-op).
-        Ok(TerminationOutcome::AlreadyGone)
-    }
-
     pub fn reap_child_if_possible(_pid: u32) {
         // Windows has no zombie waitpid model. Child handles are
         // owned by the spawner and closed at drop; nothing to do.

package/crates/team-agent/src/tmux_backend.rs

@@ -68,13 +68,16 @@ use crate::transport::{
     tmux_spawn_argv, AttachOutcome, BackendKind, BusySignalKind, CaptureRange,
     CaptureSampleOutcome, CapturedText, InjectPayload, InjectReport, InjectStage,
     InjectVerification, InputSurfaceProbe, Key, PaneField, PaneId, PaneInfo, PaneMode,
-    QueryOutcome, SessionName, SetEnvOutcome, SpawnResult, SubmitAttemptObservation,
-    SubmitConsumptionReason, SubmitDiagnostics, SubmitObserver, SubmitVerification, Target,
-    Transport, TransportError, TurnVerification, WindowName,
+    QueryOutcome, SessionName, SessionOwner, SetEnvOutcome, SpawnResult,
+    SubmitAttemptObservation, SubmitConsumptionReason, SubmitDiagnostics, SubmitObserver,
+    SubmitVerification, Target, Transport, TransportError, TurnVerification, WindowName,
 };
 
 pub const PANE_BINDING_NONCE_METADATA_KEY: &str = "TEAM_AGENT_PANE_BINDING_NONCE";
 const TMUX_PANE_BINDING_NONCE_OPTION: &str = "@team_agent_pane_binding_nonce";
+const TMUX_SESSION_OWNER_WORKSPACE_OPTION: &str = "@team_agent_owner_workspace";
+const TMUX_SESSION_OWNER_TEAM_OPTION: &str = "@team_agent_owner_team";
+const TMUX_SESSION_OWNER_GENERATION_OPTION: &str = "@team_agent_owner_generation";
 
 /// Result of running an external command — the typed output of the OS edge.
 #[derive(Debug, Clone)]
@@ -351,6 +354,87 @@ impl TmuxBackend {
         }
     }
 
+    fn set_session_owner_marker(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        generation: &str,
+    ) -> Result<(), TransportError> {
+        let workspace = workspace
+            .canonicalize()
+            .unwrap_or_else(|_| workspace.to_path_buf())
+            .to_string_lossy()
+            .into_owned();
+        for (option, value) in [
+            (TMUX_SESSION_OWNER_WORKSPACE_OPTION, workspace),
+            (TMUX_SESSION_OWNER_TEAM_OPTION, team.to_string()),
+            (TMUX_SESSION_OWNER_GENERATION_OPTION, generation.to_string()),
+        ] {
+            let argv = self.tmux_argv(&[
+                "tmux".to_string(),
+                "set-option".to_string(),
+                "-t".to_string(),
+                session.as_str().to_string(),
+                option.to_string(),
+                value,
+            ]);
+            let output = self.runner.run(&argv)?;
+            if !output.success {
+                return Err(subprocess_error(argv, output));
+            }
+        }
+        Ok(())
+    }
+
+    fn read_session_owner_option(
+        &self,
+        session: &SessionName,
+        option: &str,
+    ) -> Result<Option<String>, TransportError> {
+        let argv = self.tmux_argv(&[
+            "tmux".to_string(),
+            "show-options".to_string(),
+            "-qv".to_string(),
+            "-t".to_string(),
+            session.as_str().to_string(),
+            option.to_string(),
+        ]);
+        let output = self.runner.run(&argv)?;
+        if !output.success {
+            return Ok(None);
+        }
+        let value = output.stdout.trim();
+        Ok((!value.is_empty()).then(|| value.to_string()))
+    }
+
+    fn read_session_owner_marker(
+        &self,
+        session: &SessionName,
+    ) -> Result<Option<SessionOwner>, TransportError> {
+        let Some(workspace) = self.read_session_owner_option(
+            session,
+            TMUX_SESSION_OWNER_WORKSPACE_OPTION,
+        )? else {
+            return Ok(None);
+        };
+        let Some(team) = self.read_session_owner_option(session, TMUX_SESSION_OWNER_TEAM_OPTION)?
+        else {
+            return Ok(None);
+        };
+        let Some(generation) = self.read_session_owner_option(
+            session,
+            TMUX_SESSION_OWNER_GENERATION_OPTION,
+        )? else {
+            return Ok(None);
+        };
+        Ok(Some(SessionOwner {
+            workspace,
+            team,
+            generation,
+        }))
+    }
+
     /// ---
     /// purpose: 把 leader 认领的绑定 nonce 写进 pane 级 tmux 用户选项,给「这个 pane 实例是不是我绑的那个」留可核凭据
     /// params:
@@ -2986,6 +3070,32 @@ impl Transport for TmuxBackend {
             .map(|endpoint| endpoint.as_endpoint().to_string())
     }
 
+    fn set_session_owner(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+    ) -> Result<(), TransportError> {
+        self.set_session_owner_marker(session, workspace, team, session.as_str())
+    }
+
+    fn set_session_owner_with_generation(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        generation: &str,
+    ) -> Result<(), TransportError> {
+        self.set_session_owner_marker(session, workspace, team, generation)
+    }
+
+    fn session_owner(
+        &self,
+        session: &SessionName,
+    ) -> Result<Option<SessionOwner>, TransportError> {
+        self.read_session_owner_marker(session)
+    }
+
     fn spawn_first(
         &self,
         session: &SessionName,

package/crates/team-agent/src/transport/test_support.rs

@@ -55,6 +55,7 @@ struct OfflineState {
     /// 0.4.x (CR C-3 / CR C-5): pre-staged `query(PaneField::PaneCurrentCommand)`
     /// answer keyed by pane id. Used by leader provider health tests.
     pane_current_commands: BTreeMap<String, String>,
+    session_owner: Option<super::SessionOwner>,
 }
 
 impl Default for OfflineState {
@@ -81,6 +82,7 @@ impl Default for OfflineState {
             capture_text: BTreeMap::new(),
             capture_ranges: Vec::new(),
             pane_current_commands: BTreeMap::new(),
+            session_owner: None,
         }
     }
 }
@@ -159,6 +161,27 @@ impl OfflineTransport {
         self
     }
 
+    pub fn with_session_owner(
+        self,
+        workspace: &Path,
+        team: impl Into<String>,
+        generation: impl Into<String>,
+    ) -> Self {
+        let workspace = workspace
+            .canonicalize()
+            .unwrap_or_else(|_| workspace.to_path_buf())
+            .to_string_lossy()
+            .into_owned();
+        self.with_state(|state| {
+            state.session_owner = Some(super::SessionOwner {
+                workspace,
+                team: team.into(),
+                generation: generation.into(),
+            });
+        });
+        self
+    }
+
     /// U1-B: stage a `list_targets()` error to model tmux server jitter. While set,
     /// every call returns `Err(TransportError::MuxUnavailable{detail})`. Pass an
     /// empty string to clear via re-builder if needed.
@@ -532,6 +555,13 @@ impl Transport for OfflineTransport {
         }))
     }
 
+    fn session_owner(
+        &self,
+        _session: &SessionName,
+    ) -> Result<Option<super::SessionOwner>, TransportError> {
+        Ok(self.with_state(|state| state.session_owner.clone()))
+    }
+
     fn list_windows(&self, _session: &SessionName) -> Result<Vec<WindowName>, TransportError> {
         Ok(self.with_state(|state| {
             state.calls.push("list_windows");

package/crates/team-agent/src/transport.rs

@@ -325,6 +325,13 @@ pub struct SpawnResult {
 
 /// 全局枚举的一行(身份地基)。`leader_env` 在 tmux 后端靠反向读进程 env,在
 /// WezTerm/ConPTY 后端靠正向登记表投影(§4a)。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SessionOwner {
+    pub workspace: String,
+    pub team: String,
+    pub generation: String,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct PaneInfo {
     pub pane_id: PaneId,
@@ -1000,6 +1007,40 @@ pub trait Transport: Send + Sync {
     /// wezterm=`cli list --format json` + 正向登记表;conpty=daemon 内存表(仅自有,§4a)。
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError>;
 
+    /// Write an owner marker at the session scope after a new session is created.
+    /// Backends without a session-local metadata primitive may no-op, but then
+    /// shutdown must treat the missing marker as unknown and refuse destructive work.
+    fn set_session_owner(
+        &self,
+        _session: &SessionName,
+        _workspace: &Path,
+        _team: &str,
+    ) -> Result<(), TransportError> {
+        Ok(())
+    }
+
+    /// Write owner metadata including the launch generation when the backend
+    /// can persist one.  The default preserves compatibility for non-tmux
+    /// transports, which remain Unknown on reads.
+    fn set_session_owner_with_generation(
+        &self,
+        session: &SessionName,
+        workspace: &Path,
+        team: &str,
+        _generation: &str,
+    ) -> Result<(), TransportError> {
+        self.set_session_owner(session, workspace, team)
+    }
+
+    /// Read the session-local owner marker. `None` is an unknown/legacy session,
+    /// never proof that the caller owns it.
+    fn session_owner(
+        &self,
+        _session: &SessionName,
+    ) -> Result<Option<SessionOwner>, TransportError> {
+        Ok(None)
+    }
+
     fn has_session(&self, session: &SessionName) -> Result<bool, TransportError>;
 
     fn list_windows(&self, session: &SessionName) -> Result<Vec<WindowName>, TransportError>;