@team-agent/installer 0.5.114 → 0.5.115

package/crates/team-agent/src/contract_runtime/registry.rs

@@ -1,9 +1,140 @@
-//! The sole new-runtime provider registration. This is not an admission claim:
+//! The sole new-runtime provider registry. This is not an admission claim:
 //! the descriptor's Unverified gates still apply to each requested operation.
-use team_agent_contract::contract::descriptor::ProviderDescriptor;
-use team_agent_contract::kiro::KIRO_DESCRIPTOR;
+use std::collections::BTreeMap;
+use std::path::PathBuf;
+use team_agent_contract::contract::{
+    descriptor::{PromptCarrier, ProviderDescriptor, ToolNaming},
+    hooks::{PlanHook, ProviderHooks},
+    plan::{LaunchPlan, ResolvedLaunch},
+    types::{ContractError, Support},
+};
+use team_agent_contract::kiro::{self, KiroAdapter, KIRO_DESCRIPTOR};
+use team_agent_contract::providers::cursor::{self, CursorAdapter, CURSOR_DESCRIPTOR};
+use team_agent_contract::runtime::{delivery::ControlDefinition, native_panel::NativePanelPolicy};
 
-const DESCRIPTORS: &[&ProviderDescriptor] = &[&KIRO_DESCRIPTOR];
+const DESCRIPTORS: &[&ProviderDescriptor] = &[&KIRO_DESCRIPTOR, &CURSOR_DESCRIPTOR];
+
+/// Leaf selection stays here; the framework, lifecycle and outbox remain shared.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(super) enum NativeProvider {
+    Kiro,
+    Cursor,
+}
+
+impl NativeProvider {
+    pub fn descriptor(self) -> &'static ProviderDescriptor {
+        match self {
+            Self::Kiro => &KIRO_DESCRIPTOR,
+            Self::Cursor => &CURSOR_DESCRIPTOR,
+        }
+    }
+
+    pub fn action_budget(self) -> std::time::Duration {
+        // Kiro's existing budget is unchanged; Cursor's measured cold-ready
+        // path needs a larger finite bound, not an unbounded readiness wait.
+        std::time::Duration::from_secs(match self { Self::Kiro => 30, Self::Cursor => 90 })
+    }
+
+    pub fn controls(self) -> &'static [ControlDefinition] {
+        match self {
+            Self::Kiro => kiro::interaction::CONTROLS,
+            Self::Cursor => cursor::interaction::CONTROLS,
+        }
+    }
+
+    /// A terminal instruction bridge needs one durable, authorized first packet
+    /// before the native client can demonstrate its Team-tool registry.
+    pub fn first_business_bootstrap(self) -> bool {
+        matches!(self.descriptor().prompt.carrier, Support::Supported(PromptCarrier::RuntimeBridge))
+    }
+
+    /// Cursor has no measured neutral TUI tools panel. Its protocol binding
+    /// must come from the separately fenced native tool-roundtrip ledger.
+    pub fn uses_tool_roundtrips(self) -> bool {
+        matches!(self, Self::Cursor)
+    }
+
+    pub fn tool_panel(self) -> Result<&'static NativePanelPolicy, ContractError> {
+        match self {
+            Self::Kiro => Ok(&kiro::interaction::TOOL_PANEL),
+            Self::Cursor => Err(ContractError::Unverified {
+                field: "Cursor native Team-tool inspector",
+                reason: cursor::UNVERIFIED,
+            }),
+        }
+    }
+
+    pub fn server_key(self) -> Result<&'static str, ContractError> {
+        match self.descriptor().tool_names.naming.require("tool naming")? {
+            ToolNaming::StaticServer { key } => Ok(key),
+            ToolNaming::RuntimeBound => Err(ContractError::Invalid("runtime server-key receipt required")),
+        }
+    }
+
+    pub fn adapter(
+        self,
+        executable: PathBuf,
+        arguments: Vec<String>,
+        environment: BTreeMap<String, String>,
+    ) -> Result<NativeAdapter, ContractError> {
+        match self {
+            Self::Kiro => KiroAdapter::new(kiro::McpStdio {
+                executable, arguments, environment,
+            }).map(NativeAdapter::Kiro),
+            Self::Cursor => CursorAdapter::new(cursor::McpStdio {
+                executable, arguments, environment,
+            }).map(NativeAdapter::Cursor),
+        }
+    }
+}
+
+pub(super) enum NativeAdapter {
+    Kiro(KiroAdapter),
+    Cursor(CursorAdapter),
+}
+
+impl NativeAdapter {
+    pub fn with_launch_context(
+        self,
+        project: PathBuf,
+        runtime: Option<cursor::native::RuntimeInstallation>,
+    ) -> Result<Self, ContractError> {
+        match self {
+            Self::Kiro(adapter) if runtime.is_none() => Ok(Self::Kiro(adapter)),
+            Self::Kiro(_) => Err(ContractError::Mismatch("native runtime provider")),
+            Self::Cursor(adapter) => {
+                let adapter = adapter.with_project(project)?;
+                Ok(Self::Cursor(match runtime {
+                    Some(runtime) => adapter.with_runtime(runtime),
+                    None => adapter,
+                }))
+            }
+        }
+    }
+
+    pub fn hooks(&self) -> ProviderHooks<'_> {
+        match self {
+            Self::Kiro(adapter) => adapter.hooks(),
+            Self::Cursor(adapter) => adapter.hooks(),
+        }
+    }
+
+    pub fn plan(&self, request: &ResolvedLaunch) -> Result<LaunchPlan, ContractError> {
+        match self {
+            Self::Kiro(adapter) => adapter.plan(request),
+            Self::Cursor(adapter) => adapter.plan(request),
+        }
+    }
+}
+
+pub(super) fn provider(key: &str) -> Result<NativeProvider, ContractError> {
+    let descriptor = descriptor(key).ok_or(ContractError::Invalid("unregistered contract provider"))?;
+    match descriptor.identity.id {
+        "kiro" => Ok(NativeProvider::Kiro),
+        "cursor" => Ok(NativeProvider::Cursor),
+        _ => Err(ContractError::Invalid("contract provider dispatcher")),
+    }
+}
 
 pub(crate) fn descriptors() -> &'static [&'static ProviderDescriptor] {
     DESCRIPTORS
@@ -28,3 +159,39 @@ pub fn recognizes(key: &str) -> bool {
                 .any(|alias| alias.eq_ignore_ascii_case(key))
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn canonical_cursor_does_not_reclassify_legacy_names() {
+        assert_eq!(provider("cursor").unwrap(), NativeProvider::Cursor);
+        assert_eq!(provider("kiro").unwrap(), NativeProvider::Kiro);
+        for legacy in ["cursor_agent", "agent", "pi", "codex"] {
+            assert!(descriptor(legacy).is_none());
+            assert!(!recognizes(legacy));
+            assert!(provider(legacy).is_err());
+        }
+        assert!(recognizes(" Cursor "));
+        assert!(descriptor("Cursor").is_none());
+        for descriptor in descriptors() {
+            assert_eq!(provider(descriptor.identity.id).unwrap().descriptor(), *descriptor);
+        }
+    }
+
+    #[test]
+    fn cursor_has_no_kiro_control_or_tool_inspector_fallback() {
+        assert!(NativeProvider::Cursor.controls().is_empty());
+        assert!(matches!(NativeProvider::Cursor.tool_panel(), Err(ContractError::Unverified { .. })));
+        assert_eq!(NativeProvider::Cursor.server_key().unwrap(), "team");
+        assert!(NativeProvider::Cursor.first_business_bootstrap());
+        assert!(NativeProvider::Cursor.uses_tool_roundtrips());
+        assert!(!NativeProvider::Kiro.first_business_bootstrap());
+        assert!(!NativeProvider::Kiro.uses_tool_roundtrips());
+        let kiro_panel = NativeProvider::Kiro.tool_panel().unwrap();
+        assert_eq!(kiro_panel.server_key, NativeProvider::Kiro.server_key().unwrap());
+        assert_eq!(kiro_panel.policy_sha256, kiro::interaction::POLICY);
+        assert!(!NativeProvider::Kiro.controls().is_empty());
+    }
+}

package/crates/team-agent/src/contract_runtime/workspace.rs

@@ -0,0 +1,160 @@
+//! Stable per-seat primary cwd. The project stays an additional directory;
+//! private MCP files never overwrite a shared project or another seat's config.
+use std::io::{Read, Write};
+use std::os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt};
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+use team_agent_contract::contract::{session::CwdIdentity, types::SeatId};
+use team_agent_contract::host::process::resolve_cwd;
+
+use super::backend::{root_for, BackendError, Binding};
+
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CwdRecord {
+    version: u32,
+    seat: SeatId,
+    cwd: CwdIdentity,
+}
+
+/// Requires an already owned framework root. Existing unrecorded directories
+/// are refused, not adopted. A replaced inode or any symlink is a hard error.
+pub(super) fn prepare(binding: &Binding, seat: &SeatId) -> Result<CwdIdentity, BackendError> {
+    let root = root_for(&binding.workspace.path, &binding.scope);
+    validate_directory(&root)?;
+    let parent = root.join("workspaces");
+    let path = parent.join(seat.as_str());
+    let record_path = root.join(format!("cwd-{}.json", seat.as_str()));
+    match std::fs::symlink_metadata(&record_path) {
+        Ok(metadata) => {
+            if !metadata.is_file() || metadata.file_type().is_symlink() {
+                return Err(BackendError::Metadata);
+            }
+            let mut file = std::fs::OpenOptions::new().read(true)
+                .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC).open(&record_path)?;
+            let opened = file.metadata()?;
+            if opened.dev() != metadata.dev() || opened.ino() != metadata.ino() {
+                return Err(BackendError::Metadata);
+            }
+            let mut bytes = Vec::new();
+            Read::by_ref(&mut file).take(65537).read_to_end(&mut bytes)?;
+            if bytes.len() > 65536 {
+                return Err(BackendError::Metadata);
+            }
+            let record: CwdRecord = serde_json::from_slice(&bytes).map_err(|_| BackendError::Metadata)?;
+            if record.version != 1 || record.seat != *seat || record.cwd.path != path {
+                return Err(BackendError::Metadata);
+            }
+            validate_directory(&parent)?;
+            validate_directory(&path)?;
+            if resolve_cwd(&path)? != record.cwd {
+                return Err(BackendError::Metadata);
+            }
+            return Ok(record.cwd);
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error.into()),
+    }
+    match std::fs::symlink_metadata(&parent) {
+        Ok(_) => validate_directory(&parent)?,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            std::fs::DirBuilder::new().mode(0o700).create(&parent)?;
+        }
+        Err(error) => return Err(error.into()),
+    }
+    // Exclusive create is deliberate: missing record + existing path is not
+    // enough evidence that this framework owns the previous incarnation.
+    std::fs::DirBuilder::new().mode(0o700).create(&path)?;
+    validate_directory(&path)?;
+    let cwd = resolve_cwd(&path)?;
+    let record = CwdRecord { version: 1, seat: seat.clone(), cwd: cwd.clone() };
+    let bytes = serde_json::to_vec(&record).map_err(|_| BackendError::Metadata)?;
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true)
+        .mode(0o600).custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC).open(record_path)?;
+    file.write_all(&bytes)?;
+    file.sync_all()?;
+    Ok(cwd)
+}
+
+fn validate_directory(path: &Path) -> Result<(), BackendError> {
+    let metadata = std::fs::symlink_metadata(path)?;
+    if !metadata.is_dir() || metadata.file_type().is_symlink() || path.canonicalize()? != path
+        || metadata.uid() != unsafe { libc::geteuid() } || metadata.mode() & 0o077 != 0
+    {
+        return Err(BackendError::Metadata);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use team_agent_contract::contract::types::{Digest, ScopeId};
+
+    static SEQUENCE: AtomicU64 = AtomicU64::new(0);
+    struct Fixture { path: PathBuf, binding: Binding }
+    impl Fixture {
+        fn new() -> Self {
+            let path = std::env::temp_dir().canonicalize().unwrap().join(format!(
+                "contract-cwd-{}-{}-{}", std::process::id(),
+                std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos(),
+                SEQUENCE.fetch_add(1, Ordering::Relaxed),
+            ));
+            std::fs::DirBuilder::new().mode(0o700).create(&path).unwrap();
+            let binding = Binding {
+                version: 1, workspace: resolve_cwd(&path).unwrap(), team: "test".into(),
+                scope: ScopeId::new("cwd-test").unwrap(), endpoint: "framework:cwd-test".into(),
+                candidate: "/controlled/candidate".into(), candidate_sha256: Digest([1; 32]),
+                tmux: "/controlled/tmux".into(), transport_root: path.join("transport"),
+            };
+            let root = root_for(&path, &binding.scope);
+            std::fs::create_dir_all(root.parent().unwrap()).unwrap();
+            std::fs::DirBuilder::new().mode(0o700).create(&root).unwrap();
+            Self { path, binding }
+        }
+    }
+    impl Drop for Fixture {
+        fn drop(&mut self) { let _ = std::fs::remove_dir_all(&self.path); }
+    }
+
+    #[test]
+    fn stable_cwd_is_reused_and_distinct_seats_do_not_share_a_primary() {
+        let f = Fixture::new();
+        let a = SeatId::new("a").unwrap();
+        let b = SeatId::new("b").unwrap();
+        let first = prepare(&f.binding, &a).unwrap();
+        assert_eq!(prepare(&f.binding, &a).unwrap(), first);
+        let second = prepare(&f.binding, &b).unwrap();
+        assert_ne!(first.path, second.path);
+        assert_ne!(first.identity, second.identity);
+        assert!(!f.path.join(".cursor").exists());
+    }
+
+    #[test]
+    fn replaced_inode_or_symlink_is_not_adopted_on_resume() {
+        let f = Fixture::new();
+        let seat = SeatId::new("worker").unwrap();
+        let original = prepare(&f.binding, &seat).unwrap();
+        let retained = original.path.with_extension("old");
+        std::fs::rename(&original.path, &retained).unwrap();
+        std::fs::DirBuilder::new().mode(0o700).create(&original.path).unwrap();
+        assert!(prepare(&f.binding, &seat).is_err());
+        std::fs::remove_dir(&original.path).unwrap();
+        std::os::unix::fs::symlink(&retained, &original.path).unwrap();
+        assert!(prepare(&f.binding, &seat).is_err());
+    }
+
+    #[test]
+    fn unrecorded_existing_directory_is_not_claimed() {
+        let f = Fixture::new();
+        let root = root_for(&f.path, &f.binding.scope);
+        let parent = root.join("workspaces");
+        std::fs::DirBuilder::new().mode(0o700).create(&parent).unwrap();
+        std::fs::DirBuilder::new().mode(0o700).create(parent.join("worker")).unwrap();
+        assert!(prepare(&f.binding, &SeatId::new("worker").unwrap()).is_err());
+        assert!(!root.join("cwd-worker.json").exists());
+    }
+}

package/crates/team-agent/src/leader/start.rs

@@ -2140,10 +2140,8 @@ fn persist_exec_provider_leader_binding(
             "active_team_key".to_string(),
             serde_json::json!(identity.team_id.as_str()),
         );
-        obj.insert(
-            "session_name".to_string(),
-            serde_json::json!(target.session.as_str()),
-        );
+        // The ambient session identifies the leader receiver, not workers.
+        // Leave any existing worker session untouched, including unknown state.
         obj.insert("tmux_endpoint".to_string(), serde_json::json!(socket));
         obj.insert("tmux_socket".to_string(), serde_json::json!(socket));
         obj.insert(
@@ -3062,7 +3060,8 @@ mod tests {
         execute_leader_plan_after_ambient_authority, format_launcher_failure,
         handle_exec_provider_startup_prompts, is_interactive_shell_basename,
         lock_down_window_rename, managed_client_argv, managed_leader_window_from_occupied,
-        persist_managed_leader_binding, push_bounded_stderr, shlex_quote,
+        persist_exec_provider_leader_binding, persist_managed_leader_binding,
+        push_bounded_stderr, shlex_quote,
         write_window_rename_lockdown_event, ManagedClientAttachMode, VerifiedAmbientPaneAuthority,
         LEADER_STDERR_LIMIT,
     };
@@ -3495,6 +3494,95 @@ mod tests {
         let _ = std::fs::remove_dir_all(&workspace);
     }
 
+    fn exec_binding_fixture(workspace: &Path) -> (LeaderStartPlan, VerifiedAmbientPaneAuthority) {
+        let identity = LeaderIdentity {
+            leader_session_uuid: LeaderSessionUuid::derive(
+                "fp", &workspace.to_string_lossy(), "tester", "current",
+            ).unwrap(),
+            leader_session_uuid_source: LeaderSessionUuidSource::Derived,
+            machine_fingerprint: "fp".into(), workspace_abspath: workspace.into(),
+            os_user: "tester".into(), team_id: TeamKey::new("current"),
+        };
+        let plan = LeaderStartPlan {
+            mode: LeaderStartMode::ExecProvider, provider: Provider::Pi,
+            workspace: workspace.into(), socket: LeaderLaunchSocket::Workspace,
+            session_name: None, argv: vec![], provider_argv: vec!["pi".into()],
+            leader_prompt: None, session_capture: None, leader_window: None,
+            is_external_leader: false, leader_env: BTreeMap::new(),
+            identity: Some(identity), detached: false,
+        };
+        let authority = VerifiedAmbientPaneAuthority {
+            pane_id: PaneId::new("%77"),
+            observed: PaneInfo {
+                pane_id: PaneId::new("%77"), session: SessionName::new("cursor-gate-leader"),
+                window_index: Some(0), window_name: Some(WindowName::new("pi")),
+                pane_index: Some(0), tty: Some("/dev/ttys077".into()),
+                current_command: Some("pi".into()), current_path: Some(workspace.into()),
+                active: true, pane_pid: None, leader_env: BTreeMap::new(),
+            },
+            endpoint: "/private/tmp/fixture-exec-leader.sock".into(),
+            tmux: "/private/tmp/fixture-exec-leader.sock,123,0".into(),
+        };
+        (plan, authority)
+    }
+
+    fn exec_binding_workspace() -> std::path::PathBuf {
+        let workspace = std::env::temp_dir().join(format!("ta-exec-bootstrap-{}-{}",
+            std::process::id(), std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos()));
+        std::fs::create_dir(&workspace).unwrap();
+        workspace
+    }
+
+    #[test]
+    fn exec_provider_non_prefixed_receiver_produces_fresh_quick_start_bootstrap() {
+        let workspace = exec_binding_workspace();
+        let (plan, authority) = exec_binding_fixture(&workspace);
+        persist_exec_provider_leader_binding(&plan, &workspace, &authority, false).unwrap();
+        let state = crate::state::persist::load_runtime_state(&workspace).unwrap();
+        let before = state.clone();
+        assert!(state["session_name"].is_null());
+        assert!(state["teams"]["current"]["session_name"].is_null());
+        assert_eq!(state["teams"]["current"]["leader_receiver"]["session_name"], "cursor-gate-leader");
+        assert!(!crate::lifecycle::launch::quick_start_has_runtime_for_test(&state, "current"));
+        assert_eq!(state, before);
+        std::fs::remove_dir_all(workspace).unwrap();
+    }
+
+    #[test]
+    fn exec_provider_preserves_existing_workers_and_never_clears_runtime_markers() {
+        for status in ["running", "stopped", "unknown"] {
+            let workspace = exec_binding_workspace();
+            let (plan, authority) = exec_binding_fixture(&workspace);
+            let path = crate::state::persist::runtime_state_path(&workspace);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(&path, serde_json::json!({
+                "active_team_key":"current", "session_name":"team-existing-workers",
+                "spec_path":"/fixture/spec.yml", "team_dir":"/fixture/roles",
+                "agents":{"worker":{"agent_id":"worker","provider":"pi","status":status}},
+                "tasks":[{"task_id":"existing-task"}],
+            }).to_string()).unwrap();
+            persist_exec_provider_leader_binding(&plan, &workspace, &authority, false).unwrap();
+            let state = crate::state::persist::load_runtime_state(&workspace).unwrap();
+            for row in [&state, &state["teams"]["current"]] {
+                assert_eq!(row["session_name"], "team-existing-workers");
+                assert_eq!(row["agents"]["worker"]["status"], status);
+                assert_eq!(row["spec_path"], "/fixture/spec.yml");
+                assert_eq!(row["team_dir"], "/fixture/roles");
+                assert_eq!(row["tasks"][0]["task_id"], "existing-task");
+            }
+            // Ownership writers update only the canonical team record, not the
+            // legacy root view that retains the existing worker runtime.
+            assert_eq!(
+                state["teams"]["current"]["leader_receiver"]["session_name"],
+                "cursor-gate-leader"
+            );
+            assert!(state["leader_receiver"].is_null());
+            assert!(crate::lifecycle::launch::quick_start_has_runtime_for_test(&state, "current"));
+            std::fs::remove_dir_all(workspace).unwrap();
+        }
+    }
+
     #[test]
     #[serial_test::serial(env)]
     fn default_exec_provider_persists_current_pane_binding_before_provider_exec() {

package/crates/team-agent/src/lifecycle/launch/quick_start.rs

@@ -120,7 +120,12 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
     }
 
     fn tmux_endpoint(&mut self) -> Option<String> {
-        self.transport.tmux_endpoint()
+        // Bind the endpoint we use to observe the caller, not the worker server.
+        let caller_transport = caller_read_transport();
+        caller_transport
+            .as_deref()
+            .unwrap_or(self.transport)
+            .tmux_endpoint()
     }
 
     fn observe_command(&mut self, pane: &PaneId) -> Option<String> {
@@ -3128,6 +3133,99 @@ mod fresh_quick_start_leader_binding_tests {
         })
     }
 
+    #[cfg(unix)]
+    #[test]
+    #[serial_test::serial(env)]
+    fn runtime_binding_endpoint_matches_caller_socket_without_redirecting_workers() {
+        let hermetic = HermeticTestEnv::enter("runtime-caller-endpoint");
+        let workspace = hermetic.root();
+        let caller_socket = workspace.join("leader.sock");
+        // Select the real caller-read backend without depending on a host tmux
+        // server. This marker is not evidence of pane liveness.
+        std::fs::write(&caller_socket, "fixture endpoint; no tmux server").unwrap();
+        let caller_endpoint = caller_socket.to_str().unwrap();
+        let tmux = hermetic.with_env("TMUX", &format!("{caller_endpoint},1,0"));
+        let _pane = hermetic.with_env("TMUX_PANE", "%0");
+        let worker_endpoint = "ta-fixture-workers";
+        let transport = OfflineTransport::new()
+            .with_tmux_endpoint(worker_endpoint)
+            .with_pane_current_command("%0", "pi");
+        let mut ops = RuntimeFreshQuickStartLeaderBindingOps {
+            transport: &transport,
+            last_failure_reason: None,
+            cas_conflict: false,
+            applied_grant: None,
+            registry_receipt: None,
+            frozen_owner: None,
+            frozen_receiver: None,
+            nonce_writer: None,
+        };
+        let endpoint = ops.tmux_endpoint().unwrap();
+        assert_eq!(endpoint, caller_endpoint);
+        assert_eq!(
+            caller_read_transport().unwrap().tmux_endpoint().as_deref(),
+            Some(endpoint.as_str())
+        );
+        assert_eq!(transport.tmux_endpoint().as_deref(), Some(worker_endpoint));
+        let state = native_persisted_binding(workspace, caller_endpoint);
+        let before = state.clone();
+        assert!(persisted_binding_matches_verified_pane(
+            &state,
+            workspace,
+            &PaneId::new("%0"),
+            Provider::Pi,
+            Some(&endpoint),
+        ));
+        assert_eq!(state, before);
+        drop(tmux);
+        assert!(caller_read_transport().is_none());
+        assert_eq!(ops.tmux_endpoint().as_deref(), Some(worker_endpoint));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    #[serial_test::serial(env)]
+    fn runtime_binding_endpoint_rejects_foreign_socket_with_same_pane_identity() {
+        let hermetic = HermeticTestEnv::enter("runtime-foreign-endpoint");
+        let workspace = hermetic.root();
+        let caller_socket = workspace.join("leader.sock");
+        std::fs::write(&caller_socket, "fixture endpoint; no tmux server").unwrap();
+        let caller_endpoint = caller_socket.to_str().unwrap();
+        let _tmux = hermetic.with_env("TMUX", &format!("{caller_endpoint},1,0"));
+        let _pane = hermetic.with_env("TMUX_PANE", "%0");
+        let worker_endpoint = "ta-fixture-workers";
+        let transport = OfflineTransport::new()
+            .with_tmux_endpoint(worker_endpoint)
+            .with_pane_current_command("%0", "pi");
+        let mut ops = RuntimeFreshQuickStartLeaderBindingOps {
+            transport: &transport,
+            last_failure_reason: None,
+            cas_conflict: false,
+            applied_grant: None,
+            registry_receipt: None,
+            frozen_owner: None,
+            frozen_receiver: None,
+            nonce_writer: None,
+        };
+        let endpoint = ops.tmux_endpoint().unwrap();
+        assert_eq!(endpoint, caller_endpoint);
+        let foreign_socket = workspace.join("foreign").join("leader.sock");
+        for socket in [worker_endpoint, foreign_socket.to_str().unwrap()] {
+            let state = native_persisted_binding(workspace, socket);
+            let before = state.clone();
+            // Both servers may have %0; the shared owner/provider/UUID/epoch
+            // cannot make a foreign endpoint authoritative.
+            assert!(!persisted_binding_matches_verified_pane(
+                &state,
+                workspace,
+                &PaneId::new("%0"),
+                Provider::Pi,
+                Some(&endpoint),
+            ));
+            assert_eq!(state, before);
+        }
+    }
+
     #[cfg(unix)]
     #[test]
     #[serial_test::serial(env)]

package/crates/team-agent/src/lifecycle/launch/state_projection.rs

@@ -120,15 +120,13 @@ pub(super) fn persist_spawn_agent_state(
             continue;
         };
         #[cfg(unix)]
-        if agent
+        if let Some(descriptor) = agent
             .get("provider")
             .and_then(Value::as_str)
-            .is_some_and(|provider| {
-                crate::contract_runtime::registry::descriptor(provider).is_some()
-            })
+            .and_then(crate::contract_runtime::registry::descriptor)
         {
             let projected = if agent_is_paused(agent) {
-                serde_json::json!({"agent_id":id,"provider":"kiro","runtime_family":"contract","status":"paused","pane_id":null})
+                serde_json::json!({"agent_id":id,"provider":descriptor.identity.id,"runtime_family":"contract","status":"paused","paused":true,"contract_instance":null,"pane_id":null})
             } else {
                 crate::contract_runtime::framework::project_seat(workspace, &team_id, id)
                     .map_err(|error| LifecycleError::StatePersist(error.to_string()))?

package/crates/team-agent/src/lifecycle/launch.rs

@@ -383,6 +383,12 @@ pub use worker_env::{apply_cursor_subscription_proxy_env, CursorProxyPresence};
 
 mod identity;
 pub(super) use identity::*;
+
+// Test-only seam for the real leader producer -> unchanged bootstrap classifier.
+#[cfg(test)]
+pub(crate) fn quick_start_has_runtime_for_test(state: &serde_json::Value, team: &str) -> bool {
+    identity::runtime_state_has_quick_start_team(state, team)
+}
 pub(crate) use identity::{
     extend_worker_env_unset_for_effort, provider_effort_event_if_dropped,
     provider_effort_event_if_dropped_json, provider_effort_event_payload,

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -405,6 +405,14 @@ fn restart_with_selected_team_and_transport(
     let spec =
         rebuild_runtime_spec_from_roles(&selected.run_workspace, &selected.team_key, &state)?;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::CompileSpec);
+    // All native H2/model/session/cwd gates run before any legacy teardown.
+    // Their private sockets and Node images must not enter legacy selection.
+    #[cfg(unix)]
+    let native_restart = if crate::contract_runtime::framework::has_contract(&state) {
+        crate::contract_runtime::backend::prepare_restart(
+            &selected.run_workspace, &selected.team_key, &selected.team_dir, &state,
+        ).map_err(|error| LifecycleError::Provider(error.to_string()))?
+    } else { Vec::new() };
     // 重建后 spec_workspace 恒为 runtime spec 的父目录(.team/runtime/<team_key>/)。
     let runtime_spec =
         crate::model::paths::runtime_spec_path(&selected.run_workspace, &selected.team_key);
@@ -1354,6 +1362,20 @@ fn restart_with_selected_team_and_transport(
             attach_commands,
         });
     }
+    let legacy_successful_agents = successful_agents.clone();
+    #[cfg(unix)]
+    for result in crate::contract_runtime::commands::restart_prepared(
+        &selected.run_workspace, &selected.team_key, &mut state, native_restart,
+    ) {
+        let decision = RestartedAgent {
+            agent_id: AgentId::new(result.agent_id), restart_mode: StartMode::Resumed,
+            decision: ResumeDecision::Resume, session_id: result.session_id.map(SessionId::new),
+        };
+        match result.outcome {
+            Ok(()) => successful_agents.push(decision),
+            Err(error) => failed_agents.push(restart_failed_agent(&decision, "native_resume", error)),
+        }
+    }
     drop(lifecycle_lock);
     let coordinator =
         start_coordinator_for_workspace(&selected.run_workspace, Some(&selected.team_key))?;
@@ -1368,7 +1390,7 @@ fn restart_with_selected_team_and_transport(
         &selected.run_workspace,
         &state,
         &session_name,
-        &successful_agents,
+        &legacy_successful_agents,
         transport,
         restart_readiness_deadline(readiness_deadline_ms),
         restart_readiness_poll_interval(),