@team-agent/installer 0.5.106 → 0.5.107

package/crates/team-agent/src/lifecycle/launch/pi_mcp.rs

@@ -1,5 +1,5 @@
 //! ---
-//! purpose: Pi executable/catalog/adapter 验证、per-seat wrapper 与共享启动计划物化
+//! purpose: Pi executable/catalog 验证、原生/公共 MCP 能力注册与共享启动计划物化
 //! contract:
 //!   provides:
 //!     - name: materialize_pi_plan
@@ -29,8 +29,6 @@ use crate::model::enums::{Provider, ProviderEffort};
 use crate::provider::adapters::pi::{build_pi_command_argv, PiCommandRequest, PiSessionSelector};
 use crate::provider::{CommandPlan, McpConfig, ProviderError, SessionId};
 
-const ADAPTER_NAME: &str = "pi-mcp-adapter";
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum PiExecutableFileType {
     Wrapper,
@@ -38,17 +36,6 @@ pub(crate) enum PiExecutableFileType {
     Binary,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct PiAdapterIdentity {
-    pub package_name: String,
-    pub version: String,
-    pub extension_entry: String,
-    pub package_json: PathBuf,
-    pub index_ts: PathBuf,
-    pub package_json_sha256: String,
-    pub index_ts_sha256: String,
-}
-
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct PiExecutableChain {
     pub path_entry: PathBuf,
@@ -57,7 +44,6 @@ pub(crate) struct PiExecutableChain {
     pub real_binary: PathBuf,
     pub pi_version: String,
     pub catalog_sha256: String,
-    pub adapter: PiAdapterIdentity,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -183,54 +169,9 @@ pub(crate) fn verify_started_pi_model(selected: &str, observed: &str) -> Result<
 }
 
 /// ---
-/// purpose: 校验 pi-mcp-adapter 的公共 package/entry 能力
-/// returns: package identity 与可解析的 absolute entry 完整时成功
-/// errors: package 或 entry 缺失时返回 ProviderError；version/digests 仅保留为观测值
-/// ---
-pub(crate) fn validate_pi_adapter_identity(
-    identity: &PiAdapterIdentity,
-) -> Result<(), ProviderError> {
-    if identity.package_name != ADAPTER_NAME
-        || identity.extension_entry.is_empty()
-        || !identity.package_json.is_absolute()
-        || !identity.index_ts.is_absolute()
-    {
-        return Err(ProviderError::Command(
-            "Pi MCP adapter package or extension entry is not resolvable".to_string(),
-        ));
-    }
-    let package_root = identity.package_json.parent().ok_or_else(|| {
-        ProviderError::Command("Pi MCP adapter package root is not resolvable".to_string())
-    })?;
-    let extension_entry = Path::new(&identity.extension_entry);
-    if extension_entry.is_absolute() {
-        return Err(ProviderError::Command(
-            "Pi MCP adapter extension entry must be package-relative".to_string(),
-        ));
-    }
-    let declared_entry =
-        std::fs::canonicalize(package_root.join(extension_entry)).map_err(|error| {
-            ProviderError::Io(format!(
-                "Pi MCP adapter extension entry {}: {error}",
-                identity.index_ts.display()
-            ))
-        })?;
-    let loaded_entry = std::fs::canonicalize(&identity.index_ts)
-        .map_err(|error| ProviderError::Io(format!("{}: {error}", identity.index_ts.display())))?;
-    if declared_entry != loaded_entry || !identity.package_json.is_file() {
-        return Err(ProviderError::Command(
-            "Pi MCP adapter package or extension entry is not loadable".to_string(),
-        ));
-    }
-    std::fs::read(&loaded_entry)
-        .map_err(|error| ProviderError::Io(format!("{}: {error}", loaded_entry.display())))?;
-    Ok(())
-}
-
-/// ---
-/// purpose: 校验 Pi launch/real path、catalog 与 adapter 公共能力
-/// returns: executable chain 与 capability receipts 完整时成功
-/// errors: 缺路径、catalog receipt 或 adapter capability 时返回 ProviderError
+/// purpose: 校验 Pi launch/real path 与 live catalog；MCP 能力在实际 Pi context 验证
+/// returns: executable chain 与 catalog receipt 完整时成功
+/// errors: 缺路径或 catalog receipt 时返回 ProviderError
 /// ---
 pub(crate) fn validate_pi_executable_chain(chain: &PiExecutableChain) -> Result<(), ProviderError> {
     if !chain.path_entry.is_absolute()
@@ -253,12 +194,11 @@ pub(crate) fn validate_pi_executable_chain(chain: &PiExecutableChain) -> Result<
             "Pi executable chain does not provide the required public protocol".to_string(),
         ));
     }
-    validate_pi_adapter_identity(&chain.adapter)
+    Ok(())
 }
 
 pub(crate) struct PiWrapperRequest<'a> {
     pub destination: &'a Path,
-    pub adapter: &'a PiAdapterIdentity,
     pub candidate_executable: &'a Path,
     pub mcp_config: &'a McpConfig,
     pub team_id: &'a str,
@@ -301,7 +241,17 @@ fn candidate_from_mcp_config(config: &McpConfig) -> Result<PathBuf, ProviderErro
 }
 
 fn render_pi_wrapper(request: &PiWrapperRequest<'_>) -> Result<String, ProviderError> {
-    validate_pi_adapter_identity(request.adapter)?;
+    let allowed = request.include_tools.iter().copied().collect::<BTreeSet<_>>();
+    if allowed.is_empty()
+        || allowed.len() != request.include_tools.len()
+        || allowed
+            .iter()
+            .any(|tool| !["send_message", "report_result", "get_team_status"].contains(tool))
+    {
+        return Err(ProviderError::Command(
+            "Pi MCP tools must be a non-empty subset of the three Team tools".to_string(),
+        ));
+    }
     let configured_candidate = candidate_from_mcp_config(request.mcp_config)?;
     let expected = std::fs::canonicalize(request.candidate_executable)
         .unwrap_or_else(|_| request.candidate_executable.to_path_buf());
@@ -349,63 +299,55 @@ fn render_pi_wrapper(request: &PiWrapperRequest<'_>) -> Result<String, ProviderE
         "TEAM_AGENT_OWNER_TEAM_ID".to_string(),
         serde_json::Value::String(request.team_id.to_string()),
     );
-    let definition = serde_json::to_string_pretty(&serde_json::Value::Object(server))
+    let definition = serde_json::to_string(&serde_json::Value::Object(server))
         .map_err(|error| ProviderError::Command(format!("serialize Pi MCP server: {error}")))?;
+    let receipt_root = request
+        .destination
+        .parent()
+        .filter(|path| path.is_absolute())
+        .ok_or_else(|| {
+            ProviderError::Command("Pi MCP wrapper requires an absolute seat directory".to_string())
+        })?;
+    let receipt_root = serde_json::to_string(&receipt_root.to_string_lossy())
+        .map_err(|error| ProviderError::Command(format!("serialize Pi MCP seat directory: {error}")))?;
     Ok(format!(
-        r#"const MCP_RUNTIME_REGISTER_EVENT = "pi-mcp-adapter:runtime-register:v1";
-
-export default function teamAgentMcp(pi: any) {{
-  let registration: {{ dispose(): Promise<void> }} | undefined;
-
-  pi.on("session_start", () => {{
-    if (registration) return;
-    const request: any = {{
-      version: 1,
-      name: "team_orchestrator",
-      definition: {definition},
-    }};
-    pi.events.emit(MCP_RUNTIME_REGISTER_EVENT, request);
-    if (!request.result) throw new Error("pi-mcp-adapter is not enabled");
-    if (!request.result.ok) throw request.result.error;
-    registration = request.result.registration;
-  }});
-
-  pi.on("session_shutdown", async () => {{
-    const current = registration;
-    registration = undefined;
-    await current?.dispose();
-  }});
-}}
-"#
+        "const teamMcpDefinition = {definition};\nconst teamMcpReceiptRoot = {receipt_root};\n\n{}",
+        include_str!("pi_mcp_extension.js")
     ))
 }
 
 /// ---
-/// purpose: 静态核对 wrapper 只做 per-seat runtime MCP registration
-/// returns: wrapper 保留 direct Pi 配置且冻结 seat identity 时成功
-/// errors: identity、runtime registration 或 candidate 缺失时返回 ProviderError
+/// purpose: 静态核对 wrapper 使用原生/公共 MCP 能力模板与指定 candidate
+/// returns: 模板完整且 candidate、seat 目录正确时成功
+/// errors: 模板、candidate 或 seat 目录不匹配时返回 ProviderError
 /// ---
 pub(crate) fn validate_pi_wrapper_source(
     source: &str,
-    adapter: &PiAdapterIdentity,
     candidate_executable: &Path,
 ) -> Result<(), ProviderError> {
-    validate_pi_adapter_identity(adapter)?;
-    let candidate = candidate_executable.to_string_lossy();
-    if !source.contains(candidate.as_ref())
-        || !source.contains("pi-mcp-adapter:runtime-register:v1")
-        || !source.contains("session_start")
-        || !source.contains("session_shutdown")
-        || !source.contains("team_orchestrator")
-        || !source.contains("includeTools")
-        || source.contains("createMcpAdapter")
-        || source.contains("directTools")
-        || source.contains("toolPrefix")
-        || source.contains("--mcp-config")
-    {
-        return Err(ProviderError::Command(
-            "Pi wrapper source does not preserve direct Pi plus per-seat runtime MCP".to_string(),
-        ));
+    let invalid = || {
+        ProviderError::Command(
+            "Pi wrapper source is not the owned MCP capability template".to_string(),
+        )
+    };
+    let prefix = source
+        .strip_suffix(include_str!("pi_mcp_extension.js"))
+        .ok_or_else(invalid)?;
+    let (definition, root) = prefix
+        .strip_prefix("const teamMcpDefinition = ")
+        .and_then(|value| value.split_once(";\nconst teamMcpReceiptRoot = "))
+        .ok_or_else(invalid)?;
+    let definition: serde_json::Value = serde_json::from_str(definition).map_err(|_| invalid())?;
+    let command = definition
+        .get("command")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(invalid)?;
+    let root: String = serde_json::from_str(root.strip_suffix(";\n\n").ok_or_else(invalid)?)
+        .map_err(|_| invalid())?;
+    let expected = std::fs::canonicalize(candidate_executable)
+        .unwrap_or_else(|_| candidate_executable.to_path_buf());
+    if Path::new(command) != expected || !Path::new(&root).is_absolute() {
+        return Err(invalid());
     }
     Ok(())
 }
@@ -424,7 +366,7 @@ pub(crate) fn write_pi_wrapper_with_publish(
     publish: impl FnOnce(&Path, &Path) -> std::io::Result<()>,
 ) -> Result<PathBuf, ProviderError> {
     let source = render_pi_wrapper(&request)?;
-    validate_pi_wrapper_source(&source, request.adapter, request.candidate_executable)?;
+    validate_pi_wrapper_source(&source, request.candidate_executable)?;
     let parent = request.destination.parent().ok_or_else(|| {
         ProviderError::Io("Pi wrapper destination has no parent directory".to_string())
     })?;
@@ -726,63 +668,8 @@ fn command_stdout(executable: &Path, args: &[&str]) -> Result<Vec<u8>, ProviderE
     Ok(output.stdout)
 }
 
-fn discover_pi_adapter(launch_executable: &Path) -> Result<PiAdapterIdentity, ProviderError> {
-    let listing = command_stdout(launch_executable, &["list"])?;
-    let listing = std::str::from_utf8(&listing).map_err(|error| {
-        ProviderError::Command(format!("Pi package list is not UTF-8: {error}"))
-    })?;
-    let mut lines = listing.lines();
-    let mut package_root = None;
-    while let Some(line) = lines.next() {
-        if line.trim() == "npm:pi-mcp-adapter" {
-            package_root = lines
-                .next()
-                .map(str::trim)
-                .filter(|path| Path::new(path).is_absolute())
-                .map(PathBuf::from);
-            break;
-        }
-    }
-    let package_root = package_root.ok_or_else(|| {
-        ProviderError::Command("Pi package list does not resolve npm:pi-mcp-adapter".to_string())
-    })?;
-    let package_json = package_root.join("package.json");
-    let package_bytes = std::fs::read(&package_json)
-        .map_err(|error| ProviderError::Io(format!("{}: {error}", package_json.display())))?;
-    let package: serde_json::Value = serde_json::from_slice(&package_bytes)
-        .map_err(|error| ProviderError::Command(format!("{}: {error}", package_json.display())))?;
-    let extension_entry = package
-        .pointer("/pi/extensions")
-        .and_then(serde_json::Value::as_array)
-        .and_then(|entries| entries.iter().find_map(serde_json::Value::as_str))
-        .unwrap_or("")
-        .to_string();
-    let index_ts = package_root.join(extension_entry.trim_start_matches("./"));
-    let index_bytes = std::fs::read(&index_ts)
-        .map_err(|error| ProviderError::Io(format!("{}: {error}", index_ts.display())))?;
-    let identity = PiAdapterIdentity {
-        package_name: package
-            .get("name")
-            .and_then(serde_json::Value::as_str)
-            .unwrap_or("")
-            .to_string(),
-        version: package
-            .get("version")
-            .and_then(serde_json::Value::as_str)
-            .unwrap_or("")
-            .to_string(),
-        extension_entry,
-        package_json,
-        index_ts,
-        package_json_sha256: sha256(&package_bytes),
-        index_ts_sha256: sha256(&index_bytes),
-    };
-    validate_pi_adapter_identity(&identity)?;
-    Ok(identity)
-}
-
 /// ---
-/// purpose: 从当前 PATH 环境测量 Pi launch/real executable、catalog 与 adapter
+/// purpose: 从当前 PATH 环境测量 Pi launch/real executable 与 live catalog，不检查 Pi packages
 /// returns: 已验证的 chain 与同次 live catalog exact ids
 /// errors: 缺失、命令失败或任一公共 protocol capability 缺失时返回 ProviderError
 /// ---
@@ -829,7 +716,6 @@ pub(crate) fn resolve_pi_executable_chain(
         })?;
     let catalog = command_stdout(&path_entry, &["--list-models"])?;
     let models = parse_pi_list_models_table(&catalog)?;
-    let adapter = discover_pi_adapter(&path_entry)?;
     let chain = PiExecutableChain {
         path_entry: path_entry.clone(),
         path_entry_type,
@@ -837,7 +723,6 @@ pub(crate) fn resolve_pi_executable_chain(
         real_binary,
         pi_version: version,
         catalog_sha256: sha256(&catalog),
-        adapter,
     };
     validate_pi_executable_chain(&chain)?;
     Ok((chain, models))
@@ -906,7 +791,7 @@ fn materialize_pi_plan_with_session(
     request: PiMaterializeRequest<'_>,
     resume: Option<(&SessionId, &Path, &Path)>,
 ) -> Result<CommandPlan, ProviderError> {
-    let (chain, catalog) = resolve_pi_executable_chain()?;
+    let (_chain, catalog) = resolve_pi_executable_chain()?;
     let model = request
         .model
         .map(|model| select_exact_pi_model(&catalog, model))
@@ -954,7 +839,6 @@ fn materialize_pi_plan_with_session(
     let candidate = candidate_from_mcp_config(request.mcp_config)?;
     let wrapper = write_pi_wrapper(PiWrapperRequest {
         destination: &paths.wrapper,
-        adapter: &chain.adapter,
         candidate_executable: &candidate,
         mcp_config: request.mcp_config,
         team_id: request.team_id,

package/crates/team-agent/src/lifecycle/launch/pi_mcp_extension.js

@@ -0,0 +1,226 @@
+// The Rust materializer prepends teamMcpDefinition and teamMcpReceiptRoot as JSON.
+// No package discovery, private extension events, settings writes or factory calls.
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+export default function teamAgentMcp(pi) {
+  // Keep full UUID entropy and all three native tool names below Pi's 64-character limit.
+  const alias = `team_${randomUUID().replaceAll("-", "")}`;
+  const wanted = teamMcpDefinition.includeTools;
+  const receipt = join(teamMcpReceiptRoot, `${alias}.json`);
+  let backend, surface, registration, timer, failure, bindingReady = false, stopped = false, starting = false;
+  let wireSuffix;
+  let nativeOwned = false;
+  const returned = new Set();
+  let frame = {
+    schema_version: "team-agent.pi-mcp.v1", alias,
+    api_shape: Object.fromEntries(["registerMcpServer", "unregisterMcpServer", "getCommands", "getAllTools", "getActiveTools"]
+      .map((name) => [name, typeof pi[name]])),
+    candidate: teamMcpDefinition.command, tools: wanted,
+    workspace: teamMcpDefinition.env.TEAM_AGENT_WORKSPACE,
+    agent_id: teamMcpDefinition.env.TEAM_AGENT_ID,
+    team_id: teamMcpDefinition.env.TEAM_AGENT_OWNER_TEAM_ID,
+  };
+
+  function publish(stage, extra = {}) {
+    frame = { ...frame, stage, backend, surface, ...extra };
+    const temp = `${receipt}.tmp`;
+    let written = false;
+    try {
+      writeFileSync(temp, JSON.stringify(frame) + "\n", { flag: "wx", mode: 0o600 });
+      written = true;
+      chmodSync(temp, 0o600);
+      renameSync(temp, receipt);
+    } catch (error) {
+      if (written) {
+        try { unlinkSync(temp); } catch { /* only the exact temporary file we created */ }
+      }
+      throw error;
+    }
+  }
+
+  function fail(ctx, stage, error) {
+    clearInterval(timer);
+    // Third-party error text can contain credentials: retain correlation, not its content.
+    const errorSha256 = createHash("sha256").update(String(error)).digest("hex");
+    failure = new Error(`Pi Team MCP unavailable at ${stage}; receipt ${receipt}`);
+    try { publish("Failed", { failed_stage: stage, error_sha256: errorSha256 }); }
+    catch { failure = new Error("Pi Team MCP failed and its owned receipt could not be written"); }
+    ctx.abort();
+    ctx.shutdown();
+    return failure;
+  }
+
+  function proxyAvailable() {
+    const tool = pi.getAllTools().find((tool) => tool.name === "mcp");
+    const properties = tool?.parameters?.properties;
+    return properties?.tool?.type === "string" && properties?.args
+      && pi.getActiveTools().includes("mcp");
+  }
+
+  function directBinding() {
+    const namespace = `mcp__${alias}`;
+    const tools = pi.getAllTools().filter((tool) => tool.namespace?.name === namespace && tool.exposure !== "hidden");
+    const active = new Set(pi.getActiveTools());
+    const names = wanted.map((name) => `mcp__${alias}__${name}`);
+    if (tools.length !== wanted.length) return undefined;
+    if (!names.every((name) => active.has(name) && tools.some((tool) => tool.name === name && tool.exposure === "direct"))) return undefined;
+    return names;
+  }
+
+  async function publicBridge(commands) {
+    const ownPath = realpathSync(fileURLToPath(import.meta.url));
+    const entries = new Set();
+    for (const command of commands) {
+      if (command.source !== "extension") continue;
+      const entry = command.sourceInfo?.path ?? command.path;
+      if (!entry || !isAbsolute(entry)) continue;
+      const canonical = realpathSync(entry);
+      if (canonical === ownPath) continue;
+      if (!statSync(canonical).isFile()) throw new Error("Loaded extension entry is not a regular file");
+      entries.add(canonical);
+    }
+    const bridges = [];
+    for (const entry of entries) {
+      // Import only the public exports of already-loaded entries, never their default factory.
+      const module = await import(pathToFileURL(entry).href);
+      if (typeof module.registerMcpServer === "function") bridges.push({ entry, register: module.registerMcpServer });
+    }
+    if (bridges.length > 1) throw new Error("Ambiguous loaded MCP registration capabilities");
+    return bridges[0];
+  }
+
+  pi.on("session_start", async (_event, ctx) => {
+    if (starting || backend || failure || stopped) return;
+    starting = true;
+    try {
+      publish("ExecutableCatalogReady");
+      const native = typeof pi.registerMcpServer === "function" && typeof pi.unregisterMcpServer === "function";
+      const commands = typeof pi.getCommands === "function" ? pi.getCommands() : [];
+      const builtin = commands.some((command) => command.source === "extension" && command.sourceInfo?.path === "builtin:mcp");
+      const deadline = performance.now() + 30_000;
+      let loadingTimeout;
+      let bridge;
+      try {
+        if (!(native && builtin)) {
+          bridge = await Promise.race([
+            publicBridge(commands),
+            new Promise((_resolve, reject) => { loadingTimeout = setTimeout(() => reject(new Error("Public MCP capability loading timed out")), 30_000); }),
+          ]);
+        }
+      } finally { clearTimeout(loadingTimeout); }
+      if (stopped || failure) return;
+      if (bridge) {
+        backend = "public-bridge";
+        surface = "proxy";
+        registration = bridge.register({ pi, name: alias, definition: teamMcpDefinition });
+        if (!registration || typeof registration.dispose !== "function") throw new Error("Public MCP registration has no owned dispose handle");
+        publish("RegistrationSelected", { bridge_entry: bridge.entry });
+      } else if (native) {
+        backend = "native-api";
+        const { command, args, env, cwd } = teamMcpDefinition;
+        pi.registerMcpServer(alias, {
+          command, args, env, ...(cwd ? { cwd } : {}),
+          exposure: "hidden", toolExposure: Object.fromEntries(wanted.map((name) => [name, "direct"])),
+        });
+        nativeOwned = true;
+        publish("RegistrationSelected");
+      } else {
+        throw new Error("No native MCP API or loaded public MCP registration bridge");
+      }
+      // Never await connection here: later session_start handlers may own the consumer.
+      timer = setInterval(() => {
+        if (stopped || failure) return;
+        try {
+          if (performance.now() > deadline) {
+            fail(ctx, "tools-ready-timeout", new Error("MCP consumer did not expose the registered tools"));
+            return;
+          }
+          const names = backend === "native-api" ? directBinding() : undefined;
+          if (names) {
+            surface = "direct";
+            bindingReady = true;
+            clearInterval(timer);
+            publish("ToolsAvailable", { actual_tool_names: names, evidence: "pi-runtime-tool-registry" });
+          } else if (!builtin && proxyAvailable()) {
+            surface = "proxy";
+            bindingReady = true;
+            clearInterval(timer);
+            publish("RegistrationSelected", { evidence: "proxy-present; owned MCP calls still pending" });
+          }
+        } catch (error) { fail(ctx, "tools-ready", error); }
+      }, 25);
+    } catch (error) { throw fail(ctx, "registration", error); }
+  });
+
+  async function waitForBinding() {
+    while (!bindingReady && !failure && !stopped) await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+
+  // before_agent_start exceptions are diagnostic in Pi; input must be handled to stop a new run.
+  pi.on("input", async (_event, ctx) => {
+    await waitForBinding();
+    if (failure || stopped) {
+      ctx.shutdown();
+      return { action: "handled" };
+    }
+    return { action: "continue" };
+  });
+
+  pi.on("before_agent_start", async (event, ctx) => {
+    await waitForBinding();
+    if (failure) throw failure;
+    if (stopped || !backend) throw fail(ctx, "wire-binding", new Error("No owned MCP registration"));
+    if (surface === "direct" && !directBinding()) throw fail(ctx, "wire-binding", new Error("Owned MCP tools became unreachable"));
+    if (surface === "proxy" && !proxyAvailable()) throw fail(ctx, "wire-binding", new Error("MCP proxy became unreachable"));
+    const examples = wanted.map((tool) => {
+      const args = tool === "send_message" ? { to: "leader", content: "..." }
+        : tool === "report_result" ? { summary: "..." } : {};
+      return surface === "direct"
+        ? `- ${tool}: mcp__${alias}__${tool}; arguments ${JSON.stringify(args)}`
+        : `- ${tool}: mcp(${JSON.stringify({ tool: `${alias}_${tool}`, args })})`;
+    });
+    const base = wireSuffix && event.systemPrompt.endsWith(wireSuffix)
+      ? event.systemPrompt.slice(0, -wireSuffix.length) : event.systemPrompt;
+    wireSuffix = "\n\n# Team Agent MCP wire binding\n"
+      + "Use these actual tools for the logical Team Agent operations above. Do not pass sender, task_id or schema_version.\n"
+      + examples.join("\n");
+    return { systemPrompt: base + wireSuffix };
+  });
+
+  pi.on("before_provider_request", (_event, ctx) => {
+    if (failure || stopped || !bindingReady) ctx.abort();
+  });
+
+  pi.on("tool_result", (event, ctx) => {
+    if (stopped || failure) return;
+    const name = event.toolName === "mcp" ? event.input?.tool : event.toolName;
+    const tool = wanted.find((tool) => name === (surface === "direct" ? `mcp__${alias}__${tool}` : `${alias}_${tool}`));
+    if (!tool) return;
+    if (event.isError === false) returned.add(tool);
+    try {
+      publish(returned.size === wanted.length ? "ToolsVerified" : frame.stage, {
+        returned_tools: [...returned], last_call_is_error: event.isError ?? null,
+        evidence: "owned tool-result events; business success requires the original results",
+      });
+    } catch (error) { throw fail(ctx, "tool-receipt", error); }
+  });
+
+  pi.on("session_shutdown", async (_event, ctx) => {
+    if (stopped) return;
+    stopped = true;
+    clearInterval(timer);
+    const current = registration;
+    registration = undefined;
+    try {
+      if (nativeOwned) {
+        nativeOwned = false;
+        pi.unregisterMcpServer(alias);
+      }
+      await current?.dispose();
+      publish(failure ? "Failed" : frame.stage, { shutdown: true });
+    } catch (error) { throw fail(ctx, "shutdown", error); }
+  });
+}

package/crates/team-agent/src/lifecycle/launch/quick_start.rs

@@ -2788,43 +2788,6 @@ mod fresh_quick_start_leader_binding_tests {
         let _ = std::fs::remove_dir_all(&workspace);
     }
 
-    #[test]
-    fn attach_registry_or_readback_failure_rolls_back_exact_state_bytes() {
-        assert_failure_rolls_back_this_attempt(
-            "attach-failure",
-            MockOps {
-                attach_ok: false,
-                ..MockOps::default()
-            },
-            1,
-            0,
-            0,
-            false,
-        );
-        assert_failure_rolls_back_this_attempt(
-            "registry-failure",
-            MockOps {
-                register_ok: false,
-                ..MockOps::default()
-            },
-            1,
-            1,
-            0,
-            true,
-        );
-        assert_failure_rolls_back_this_attempt(
-            "readback-failure",
-            MockOps {
-                readback_ok: false,
-                ..MockOps::default()
-            },
-            1,
-            1,
-            1,
-            true,
-        );
-    }
-
     #[test]
     fn attach_failure_rolls_back_exact_state_bytes() {
         assert_failure_rolls_back_this_attempt(

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -365,15 +365,6 @@ fn add_agent_joins_w2_into_running_roster_and_existing_session() {
     );
 }
 
-// REAL-MACHINE e2e boundary (rt-host-a verifies): after `add-agent w2`, the coordinator delivers
-// `send w2` and w2 reports a result (full round-trip). #[ignore] — needs a live tmux session + worker.
-#[test]
-#[ignore = "real-machine: add-agent then send w2 round-trips"]
-fn add_agent_then_send_w2_round_trips() {
-    // The framework asserts: add-agent w2 -> w2 in the live session + roster -> `send w2 <msg>` ->
-    // coordinator delivers -> w2 emits a result_envelope (results row). Not unit-testable in-process.
-}
-
 #[derive(Clone)]
 struct SocketRecordingRunner {
     recorded: std::sync::Arc<std::sync::Mutex<Vec<Vec<String>>>>,