@team-agent/installer 0.5.112 → 0.5.114

package/crates/team-agent/src/cli/tests/base.rs

@@ -420,7 +420,7 @@ fn format_status_csv_preserves_agent_order_and_collapses_errors() {
     });
     assert_eq!(
             format_status_csv(&data),
-            "zeta,空闲\nalpha,工作\nerr_failed,错误\nerr_missing_pane,错误\nerr_unknown,错误\nerr_stopped,错误"
+            "zeta,idle\nalpha,working\nerr_failed,error\nerr_missing_pane,error\nerr_unknown,error\nerr_stopped,error"
         );
 }
 
@@ -489,7 +489,7 @@ fn cli_error_payload_plain_runtime() {
     assert_eq!(payload.error, "some other error");
     assert_eq!(
         payload.action,
-        "先运行 team-agent doctor --workspace . 检查所选队伍，或查看此处列出的错误日志。"
+        "Run team-agent doctor --workspace . for the selected team, or inspect the error log shown here."
     );
     assert_eq!(payload.log, "/tmp/y.log");
     assert_eq!(payload.reason, None);
@@ -511,7 +511,7 @@ fn cli_error_payload_tmux_conflict_quick_start_enrichment() {
     // context reset is only through restart --allow-fresh with explicit consent.
     assert_eq!(
             payload.action,
-            "终端会话 `my-team` 已存在，可能是你的已有队伍。恢复用 team-agent restart；只有明确同意丢弃旧对话才用 --allow-fresh。另建队伍请修改 TEAM.md 的 name 后再 quick-start；不要关闭已有队伍凑成功。"
+            "Terminal session `my-team` already exists and may belong to your existing team. Resume with team-agent restart; use --allow-fresh only after explicitly accepting loss of saved context. To create another team, change the name in TEAM.md before quick-start. Do not shut down an existing team to bypass this refusal."
         );
     let next = payload.next_actions.as_ref().unwrap();
     assert_eq!(next.len(), 2);
@@ -529,11 +529,11 @@ fn cli_error_payload_tmux_conflict_non_quick_start_enrichment() {
     assert_eq!(payload.session_name.as_deref(), Some("my-team"));
     assert_eq!(
         payload.action,
-        "终端会话 `my-team` 已存在，可能属于运行中的队伍。不要关闭它；请使用另一个队伍名称后再启动。"
+        "Terminal session `my-team` already exists and may belong to a running team. Do not shut it down; choose another team name before starting."
     );
     let next = payload.next_actions.as_ref().unwrap();
     assert_eq!(next.len(), 1);
-    assert!(next[0].contains("队伍") && next[0].contains("名称"));
+    assert!(next[0].contains("team") && next[0].contains("name"));
 }
 
 #[test]
@@ -749,7 +749,7 @@ fn cmd_leader_passthrough_help_is_pure_human_guidance() {
             let result = cmd_leader_passthrough(provider, &[alias.into()], &cwd).unwrap();
             assert_eq!(result.exit, ExitCode::Ok);
             assert!(
-                matches!(&result.output, CmdOutput::Human(text) if text.contains(provider) && text.contains("用法") && text.contains("Examples") && text.contains("下一步"))
+                matches!(&result.output, CmdOutput::Human(text) if text.contains(provider) && text.contains("Usage") && text.contains("Examples") && text.contains("Next Action"))
             );
         }
     }
@@ -797,3 +797,91 @@ fn cmd_leader_passthrough_maps_grok_and_cursor_not_claude() {
     assert_eq!(leader_passthrough_provider("cursor_agent"), None);
     assert_eq!(leader_passthrough_provider("not-a-passthrough"), None);
 }
+
+#[cfg(unix)]
+#[test]
+#[serial_test::serial(env)]
+fn kiro_doctor_inventory_is_read_only_and_does_not_claim_native_readiness() {
+    use std::os::unix::fs::PermissionsExt;
+    let env = crate::cli::hermetic_test_support::HermeticTestEnv::enter("kiro-inventory");
+    let bin = env.workspace("bin");
+    let _path = env.with_env("PATH", &bin.to_string_lossy());
+    let inventory = provider_doctor_checks();
+    assert_eq!(inventory["kiro"]["installed"], false);
+    assert_eq!(inventory["codex"]["command"], "codex");
+    let launcher = bin.join("kiro-cli");
+    std::fs::write(
+        &launcher,
+        "#!/bin/sh\nprintf called > \"$0.called\"\nexit 0\n",
+    )
+    .unwrap();
+    for (mode, installed) in [(0o600, false), (0o700, true)] {
+        std::fs::set_permissions(&launcher, std::fs::Permissions::from_mode(mode)).unwrap();
+        assert_eq!(
+            provider_doctor_checks()["kiro"],
+            json!({
+                "auth": "unknown",
+                "command": "kiro-cli",
+                "installed": installed,
+                "version": "unknown",
+                "probe_status": "not_run",
+                "provider_probe_status": "not_run",
+            })
+        );
+    }
+    assert!(!bin.join("kiro-cli.called").exists());
+    assert!(env.registry_entries().is_empty());
+}
+
+#[cfg(unix)]
+#[test]
+#[serial_test::serial(env)]
+fn kiro_leader_entry_has_help_and_typed_refusal_without_native_or_fallback_effects() {
+    use std::os::unix::fs::PermissionsExt;
+    let env = crate::cli::hermetic_test_support::HermeticTestEnv::enter("kiro-leader-gate");
+    let cwd = env.workspace("empty");
+    let bin = env.workspace("bin");
+    for tool in ["kiro-cli", "kiro-cli-chat", "codex", "pi", "tmux"] {
+        let path = bin.join(tool);
+        std::fs::write(&path, "#!/bin/sh\nprintf called > \"$0.called\"\nexit 0\n").unwrap();
+        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700)).unwrap();
+    }
+    let _path = env.with_env("PATH", &bin.to_string_lossy());
+    assert!(!crate::cli::emit::is_leader_passthrough_command("kiro"));
+    assert_eq!(leader_passthrough_provider("kiro"), None);
+    let help = crate::cli::emit::command_help(Some("kiro"));
+    assert!(help.contains("team-agent kiro [--json]"));
+    assert!(help.contains("kiro_leader_not_admitted"));
+    assert!(crate::cli::emit::default_help().contains("Check Kiro leader launch admission"));
+    for alias in ["-h", "--help"] {
+        assert_eq!(
+            crate::cli::run(&["kiro".into(), alias.into()], &cwd),
+            ExitCode::Ok
+        );
+    }
+    let cases: &[&[&str]] = &[&[], &["--json"], &["--attach-existing", "--confirm"]];
+    for values in cases {
+        let args: Vec<String> = values.iter().map(|arg| (*arg).into()).collect();
+        let result = cmd_kiro_leader(&args);
+        assert_eq!(result.exit, ExitCode::Error);
+        assert_eq!(result.as_json, values.contains(&"--json"));
+        let CmdOutput::Json(value) = result.output else {
+            panic!("expected structured capability refusal");
+        };
+        assert_eq!(value["schema_version"], "leader_launch.v1");
+        assert_eq!(value["ok"], false);
+        assert_eq!(value["provider"], "kiro");
+        assert_eq!(value["capability"], "leader_launch");
+        assert_eq!(value["reason"], "kiro_leader_not_admitted");
+        let mut argv = vec!["kiro".into()];
+        argv.extend(args);
+        assert_eq!(crate::cli::run(&argv, &cwd), ExitCode::Error);
+    }
+    assert_eq!(std::fs::read_dir(&cwd).unwrap().count(), 0);
+    assert_eq!(
+        std::fs::read_dir(&bin).unwrap().count(),
+        5,
+        "no tool invoked"
+    );
+    assert!(env.registry_entries().is_empty());
+}

package/crates/team-agent/src/cli/tests/divergence.rs

@@ -457,7 +457,7 @@ fn red_send_target_none_is_not_broadcast() {
     assert_eq!(send_target(None, Some("*")), MessageTarget::Broadcast);
 }
 
-// Unified doctor human output is triage only, including the comms gate.
+// Doctor retains bounded triage navigation plus complete diagnostic details.
 #[test]
 fn cmd_doctor_comms_human_is_compact_triage_without_boundary_prefix() {
     let mut args = DoctorArgs {
@@ -483,8 +483,9 @@ fn cmd_doctor_comms_human_is_compact_triage_without_boundary_prefix() {
     };
     assert_eq!(text, crate::cli::triage::render("doctor", &report));
     assert!(text.starts_with("doctor:"));
-    assert_eq!(text.lines().count(), 1 + report["issues"].as_array().unwrap().len()
+    assert_eq!(text.lines().count(), 2 + report["issues"].as_array().unwrap().len()
         + report["suggested_repairs"].as_array().unwrap().len());
+    assert!(text.lines().last().unwrap().starts_with("details: "));
 }
 
 // ---- #13 / #27 (P2): run() must NOT treat 'claude_code' as a passthrough trigger ----

package/crates/team-agent/src/cli/tests/lane_c.rs

@@ -257,7 +257,7 @@ fn inbox_excludes_leader_stage_result_notifications() {
 // the deterministic check sub-shapes (run_id is a random uuid; not value-locked). ────────────────
 #[test]
 fn comms_selftest_golden_boundary_scope_and_check_shapes() {
-    let boundary = "这里只检查终端连接是否一致，不实际发送消息，也不证明队友已回复。";
+    let boundary = "This checks terminal connection consistency only; it does not send a message or prove that a worker replied.";
     let ws = tmp_workspace();
     let v = diagnose_port::comms_selftest(&ws, None, None).expect("comms_selftest");
     let obj = v.as_object().expect("comms dict");

package/crates/team-agent/src/cli/tests/named_address.rs

@@ -377,21 +377,21 @@ fn send_to_name_mutual_exclusion() {
     let args = named_send_args(&cwd, Some("team-a/qa"), Some("%1"), None, &["hello"]);
     let err = cmd_send(&args).unwrap_err();
     assert!(
-        matches!(err, CliError::Usage(ref message) if message.contains("--to-name/--pane/--to") && message.contains("不能同时")),
+        matches!(err, CliError::Usage(ref message) if message.contains("--to-name/--pane/--to") && message.contains("cannot be combined")),
         "expected --to-name mutual exclusion, got {err:?}"
     );
 
     let args = named_send_args(&cwd, Some("team-a/qa"), None, Some("worker"), &["hello"]);
     let err = cmd_send(&args).unwrap_err();
     assert!(
-        matches!(err, CliError::Usage(ref message) if message.contains("--to-name/--pane/--to") && message.contains("不能同时")),
+        matches!(err, CliError::Usage(ref message) if message.contains("--to-name/--pane/--to") && message.contains("cannot be combined")),
         "expected --to-name/--to mutual exclusion, got {err:?}"
     );
 
     let args = named_send_args(&cwd, Some("team-a/qa"), None, None, &[]);
     let err = cmd_send(&args).unwrap_err();
     assert!(
-        matches!(err, CliError::Usage(ref message) if message == "请填写任务内容；--to-name 不能发送空消息"),
+        matches!(err, CliError::Usage(ref message) if message == "Provide a task message; --to-name cannot send an empty message"),
         "expected empty-message usage error, got {err:?}"
     );
     let _ = std::fs::remove_dir_all(&cwd);

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -436,6 +436,8 @@ fn leader_attach_command_for_plan_uses_plan_leader_window() {
         )),
         argv: Vec::new(),
         provider_argv: Vec::new(),
+        leader_prompt: None,
+        session_capture: None,
         leader_window: Some(crate::transport::WindowName::new("claude_code")),
         is_external_leader: false,
         leader_env: std::collections::BTreeMap::new(),
@@ -641,11 +643,11 @@ fn cmd_send_joins_message_with_single_space() {
                 // 应立即失败以强制重新审视，而不是悄悄跑一条从未验过的分支。
                 assert!(
                     !delivered,
-                    "hermetic seed 不应产生 delivered=true；tier 假设变了"
+                    "hermetic seed must not produce delivered=true; the fixture assumption changed"
                 );
                 assert_eq!(
                     v.get("reminder").and_then(|reminder| reminder.as_str()),
-                    Some("任务已收下，但还未确认送到队友对话。查看 team-agent status/doctor，等真实回复，不反复重发。")
+                    Some("Task accepted, but delivery is unconfirmed. Check team-agent status/doctor; wait for an actual reply without repeated sends.")
                 );
             }
         }
@@ -665,15 +667,15 @@ fn cmd_send_default_human_output_is_brief_without_false_delivered() {
         "send must separate outcome and next action: {text}"
     );
     assert!(
-        lines[0].contains("任务已收下") && lines[0].contains("还未送到队友的对话"),
+        lines[0].contains("Task accepted") && lines[0].contains("delivery to the agent's conversation is still pending"),
         "queued send must report its true pending outcome: {text}"
     );
     assert!(
-        lines[1].contains("下一步")
+        lines[1].contains("Next:")
             && lines[1].contains("team-agent status")
             && lines[1].contains("doctor")
-            && lines[1].contains("等真实回复")
-            && lines[1].contains("不反复重发"),
+            && lines[1].contains("wait for an actual reply")
+            && lines[1].contains("without repeated sends"),
         "queued send must give honest next steps: {text}"
     );
     assert!(
@@ -951,7 +953,7 @@ fn cmd_send_unknown_task_surfaces_golden_error_envelope_not_silent() {
     );
     assert_eq!(
         payload.action,
-        "先运行 team-agent doctor --workspace . 检查所选队伍，或查看此处列出的错误日志。"
+        "Run team-agent doctor --workspace . for the selected team, or inspect the error log shown here."
     );
     let _ = std::fs::remove_dir_all(&ws);
 }

package/crates/team-agent/src/cli/triage.rs

@@ -56,9 +56,34 @@ pub(crate) fn render(command: &str, report: &Value) -> String {
     for repair in repairs {
         lines.push(bounded(format!("repair: {}", summarize(repair, true))));
     }
+    // Short triage lines are navigation, not the authoritative refusal. Retain
+    // complete causes/actions as JSON, without dumping unrelated runtime or
+    // provider diagnostics. Values have already crossed the redaction boundary.
+    let details = diagnostic_details(&report);
+    if details.as_object().is_some_and(|details| !details.is_empty()) {
+        lines.push(format!("details: {details}"));
+    }
     lines.join("\n")
 }
 
+// Shared by doctor/diagnose and send. Never include message bodies, profiles or
+// unrelated runtime/provider dumps in a command's diagnostic output.
+pub(crate) fn diagnostic_details(report: &Value) -> Value {
+    let report = crate::redaction::redact_external_value(report);
+    let mut details = serde_json::Map::new();
+    for key in [
+        "error", "status", "summary", "reason", "blockers", "action",
+        "next_action", "next_actions", "issues", "suggested_repairs",
+        "state_path", "log", "schema_error", "stage", "delivery_status",
+        "message_status", "verification", "channel", "turn_verification",
+    ] {
+        if let Some(value) = report.get(key) {
+            details.insert(key.to_string(), value.clone());
+        }
+    }
+    Value::Object(details)
+}
+
 fn array_items(value: Option<&Value>) -> &[Value] {
     value.and_then(Value::as_array).map(Vec::as_slice).unwrap_or(&[])
 }
@@ -126,6 +151,7 @@ fn bounded(line: String) -> String {
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used)]
     use super::*;
     use serde_json::json;
 
@@ -149,12 +175,37 @@ mod tests {
     #[test]
     fn renderer_sanitizes_and_bounds_utf8_lines() {
         let report = json!({"ok": false, "issues": ["问题\n".to_string() + &"x".repeat(200)]});
-        for line in render("doctor", &report).lines() {
-            assert!(line.len() <= LINE_LIMIT_BYTES);
+        let output = render("doctor", &report);
+        for line in output.lines() {
+            if let Some(details) = line.strip_prefix("details: ") {
+                let parsed: Value = serde_json::from_str(details).unwrap();
+                assert_eq!(parsed.get("issues"), report.get("issues"));
+            } else {
+                assert!(line.len() <= LINE_LIMIT_BYTES);
+            }
             assert!(!line.chars().any(char::is_control));
         }
     }
 
+    #[test]
+    fn renderer_preserves_typed_failure_details_and_long_actions() {
+        let action = "inspect the precise failure ".repeat(20);
+        let report = json!({
+            "ok": false,
+            "status": "preflight_blocked",
+            "reason": "exact refusal",
+            "blockers": [{"stage": "database", "reason": "permission denied"}],
+            "next_actions": [action],
+            "state_path": "/tmp/workspace/.team/runtime/state.json"
+        });
+        let output = render("doctor", &report);
+        let details = output.lines().find_map(|line| line.strip_prefix("details: ")).unwrap();
+        let parsed: Value = serde_json::from_str(details).unwrap();
+        for key in ["status", "reason", "blockers", "next_actions", "state_path"] {
+            assert_eq!(parsed.get(key), report.get(key), "lost {key}");
+        }
+    }
+
     #[test]
     fn renderer_projects_secret_findings_without_values() {
         let report = json!({

package/crates/team-agent/src/cli/types.rs

@@ -84,7 +84,7 @@ impl CliError {
             ok: false,
             error: error.clone(),
             action: if super::spec::command_spec(command).is_some() {
-                "先运行 team-agent doctor --workspace . 检查所选队伍，或查看此处列出的错误日志。"
+                "Run team-agent doctor --workspace . for the selected team, or inspect the error log shown here."
             } else {
                 "run `team-agent doctor` or inspect the log path shown here"
             }
@@ -99,27 +99,27 @@ impl CliError {
             payload.session_name = Some(session.clone());
             if command == "quick-start" {
                 payload.action = format!(
-                    "终端会话 `{session}` 已存在，可能是你的已有队伍。恢复用 team-agent restart；只有明确同意丢弃旧对话才用 --allow-fresh。另建队伍请修改 TEAM.md 的 name 后再 quick-start；不要关闭已有队伍凑成功。"
+                    "Terminal session `{session}` already exists and may belong to your existing team. Resume with team-agent restart; use --allow-fresh only after explicitly accepting loss of saved context. To create another team, change the name in TEAM.md before quick-start. Do not shut down an existing team to bypass this refusal."
                 );
                 payload.next_actions = Some(vec![
-                    "如果是自己的已有队伍，使用 team-agent restart 恢复。".to_string(),
-                    "如要另建队伍，修改 TEAM.md 的 name 后再运行 team-agent quick-start。"
+                    "If this is your existing team, resume it with team-agent restart.".to_string(),
+                    "To create another team, change the name in TEAM.md before running team-agent quick-start."
                         .to_string(),
                 ]);
             } else {
                 payload.action = format!(
-                    "终端会话 `{session}` 已存在，可能属于运行中的队伍。不要关闭它；请使用另一个队伍名称后再启动。"
+                    "Terminal session `{session}` already exists and may belong to a running team. Do not shut it down; choose another team name before starting."
                 );
-                payload.next_actions = Some(vec!["请使用另一个队伍名称后再启动。".to_string()]);
+                payload.next_actions = Some(vec!["Choose another team name before starting.".to_string()]);
             }
         } else if error.contains("Team Agent launcher flag")
             && error.contains("must appear before --")
         {
             payload.action =
-                String::from("将主控启动选项放在 -- 前面；-- 后面只能是工具自己的参数。");
+                String::from("Place Team Agent launcher options before --; only native provider arguments belong after --.");
         } else if error.contains("managed launcher refuses a different ambient tmux server") {
             payload.action = String::from(
-                "先退出当前 tmux 客户端再重试；只有明确需要嵌套连接时才在 -- 前加 --allow-nested-attach。",
+                "Leave the current tmux client before retrying. Add --allow-nested-attach before -- only when nested attachment is intentional.",
             );
         }
         payload

package/crates/team-agent/src/compiler/tests.rs

@@ -7,6 +7,18 @@ use std::sync::atomic::{AtomicU32, Ordering};
 
 static COUNTER: AtomicU32 = AtomicU32::new(0);
 
+#[test]
+fn cursor_effort_is_rejected_by_shared_admission_for_every_level() {
+    for effort in ["low", "medium", "high", "xhigh", "max", "ultra"] {
+        let role = write_tmp("cursor.md", &format!("---\nprovider: cursor_agent\neffort: {effort}\n---\nRole\n"));
+        let error = compile_role_agent(&role, &Value::Map(Vec::new()), "/workspace")
+            .err()
+            .expect("Cursor must reject effort before command construction");
+        assert!(error.to_string().contains("cursor_agent does not support effort; the Cursor CLI has no --effort flag"));
+        fs::remove_dir_all(role.parent().unwrap()).unwrap();
+    }
+}
+
 fn unique_base() -> PathBuf {
     let n = COUNTER.fetch_add(1, Ordering::Relaxed);
     std::env::temp_dir().join(format!("ta_rs_compile_{}_{}", std::process::id(), n))

package/crates/team-agent/src/compiler.rs

@@ -42,10 +42,16 @@ pub struct IgnoredTeamField {
 pub fn read_front_matter(path: &Path) -> Result<(Value, String), ModelError> {
     let text = fs::read_to_string(path)
         .map_err(|e| ModelError::Runtime(format!("{}: {e}", path.display())))?;
+    Ok(split_front_matter(&text))
+}
+
+/// Parse the same captured bytes that a prompt receipt hashes; the existing
+/// path-based compiler keeps its original normalization/plain-text fallback.
+pub(crate) fn split_front_matter(text: &str) -> (Value, String) {
     let text = text.replace("\r\n", "\n").replace('\r', "\n");
     let empty_meta = || Value::Map(Vec::new());
     let Some(rest) = text.strip_prefix("---\n") else {
-        return Ok((empty_meta(), text));
+        return (empty_meta(), text);
     };
 
     let mut offset = 0;
@@ -58,7 +64,7 @@ pub fn read_front_matter(path: &Path) -> Result<(Value, String), ModelError> {
         offset += line.len();
     }
     let Some(close) = close else {
-        return Ok((empty_meta(), text));
+        return (empty_meta(), text);
     };
     let raw_meta = &rest[..close];
     let meta = if raw_meta.trim().is_empty() {
@@ -66,11 +72,11 @@ pub fn read_front_matter(path: &Path) -> Result<(Value, String), ModelError> {
     } else {
         match yaml::loads(raw_meta) {
             Ok(meta) if meta.is_map() => meta,
-            _ => return Ok((empty_meta(), text)),
+            _ => return (empty_meta(), text),
         }
     };
     let after_marker = &rest[close + 3..];
-    Ok((meta, after_marker.trim_start_matches('\n').to_string()))
+    (meta, after_marker.trim_start_matches('\n').to_string())
 }
 
 pub fn ignored_owner_team_id_from_team_md(
@@ -489,6 +495,17 @@ fn compile_role_agent_with_mode(
         .filter(|provider| !provider.trim().is_empty())
         .unwrap_or_else(|| "pi".to_string());
     let is_pi = parse_canonical_provider(&provider) == Some(Provider::Pi);
+    #[cfg(unix)]
+    let contract = crate::contract_runtime::registry::descriptor(&provider);
+    #[cfg(unix)]
+    let contract_role = contract.is_some();
+    #[cfg(not(unix))]
+    let contract_role = false;
+    #[cfg(unix)]
+    let skip_team_effort =
+        contract.is_some_and(|descriptor| !descriptor.effort.inherit_team_default);
+    #[cfg(not(unix))]
+    let skip_team_effort = false;
     validate_pi_role_fields(&meta, role_path, &provider)?;
     let model = string_field(&meta, "model")
         .filter(|value| !value.trim().is_empty())
@@ -567,7 +584,7 @@ fn compile_role_agent_with_mode(
         Some(raw) if !raw.trim().is_empty() => ProviderEffort::parse(raw.trim()),
         _ => None,
     };
-    let resolved_effort = if is_pi {
+    let resolved_effort = if is_pi || skip_team_effort {
         role_effort
     } else {
         role_effort.or(team_effort)
@@ -582,22 +599,30 @@ fn compile_role_agent_with_mode(
                 _ => None,
             })
             .unwrap_or("");
-        let provider_enum = parse_canonical_provider(provider_str).unwrap_or(Provider::Codex);
-        if let Err(reason) = effort.resolve_for_provider(provider_enum) {
-            return Err(ModelError::Validation(format!(
-                "{}: {reason} (effort: {}; provider: {provider_str})",
-                role_path.display(),
-                effort.as_str()
-            )));
+        #[cfg(unix)]
+        if let Some(descriptor) = contract {
+            use team_agent_contract::contract::descriptor::{Effort, EffortAdmission};
+            let native_effort = Effort::parse(effort.as_str())
+                .map_err(|error| ModelError::Validation(error.to_string()))?;
+            if let EffortAdmission::Reject(reason) =
+                descriptor.effort.admission[native_effort.index()]
+            {
+                return Err(ModelError::Validation(format!(
+                    "{}: {}",
+                    role_path.display(),
+                    reason.message
+                )));
+            }
         }
-        if provider_enum == Provider::CursorAgent {
-            return Err(ModelError::Validation(format!(
-                "{}: cursor_agent does not support effort '{}'. \
-The Cursor CLI has no `--effort` flag; the framework must not drop the field and still launch. \
-Remove effort from the role file (do not map it into `--model[effort=]` until that form is measured).",
-                role_path.display(),
-                effort.as_str()
-            )));
+        if !contract_role {
+            let provider_enum = parse_canonical_provider(provider_str).unwrap_or(Provider::Codex);
+            if let Err(reason) = effort.resolve_for_provider(provider_enum) {
+                return Err(ModelError::Validation(format!(
+                    "{}: {reason} (effort: {}; provider: {provider_str})",
+                    role_path.display(),
+                    effort.as_str()
+                )));
+            }
         }
         agent_items.push(("effort", Value::Str(effort.as_str().to_string())));
     }
@@ -721,12 +746,17 @@ mod pi_preflight_tests {
 
     #[test]
     fn omitted_qualified_and_non_pi_do_not_discover() {
-        for meta in [role("pi", None), role("pi", Some("openai/gpt-5")), role("codex", Some("gpt-5"))] {
+        for meta in [
+            role("pi", None),
+            role("pi", Some("openai/gpt-5")),
+            role("codex", Some("gpt-5")),
+        ] {
             let calls = Cell::new(0);
             assert!(preflight_pi_role_model_with(&meta, |_| {
                 calls.set(calls.get() + 1);
                 Ok(vec![])
-            }).is_ok());
+            })
+            .is_ok());
             assert_eq!(calls.get(), 0);
         }
     }
@@ -737,12 +767,21 @@ mod pi_preflight_tests {
         let error = preflight_pi_role_model_with(&role("pi", Some("gpt-5.6-sol")), |requested| {
             calls.set(calls.get() + 1);
             assert_eq!(requested, "gpt-5.6-sol");
-            Ok(vec!["openai-codex/gpt-5.6-sol".into(), "azure/gpt-5.6-sol".into()])
-        }).expect_err("unqualified model must fail closed");
+            Ok(vec![
+                "openai-codex/gpt-5.6-sol".into(),
+                "azure/gpt-5.6-sol".into(),
+            ])
+        })
+        .expect_err("unqualified model must fail closed");
         assert_eq!(calls.get(), 1);
-        assert_eq!(error.candidates, vec!["openai-codex/gpt-5.6-sol", "azure/gpt-5.6-sol"]);
+        assert_eq!(
+            error.candidates,
+            vec!["openai-codex/gpt-5.6-sol", "azure/gpt-5.6-sol"]
+        );
         assert!(!error.not_ready);
-        assert!(error.action.contains("team-agent models --provider pi --search gpt-5.6-sol"));
+        assert!(error
+            .action
+            .contains("team-agent models --provider pi --search gpt-5.6-sol"));
     }
 
     #[test]