@team-agent/installer 0.5.117 → 0.5.118

package/Cargo.lock

@@ -727,7 +727,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.117"
+version = "0.5.118"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -11,7 +11,7 @@ exclude = ["crates/team-agent-contract"]
 
 [workspace.package]
 edition = "2021"
-version = "0.5.117"
+version = "0.5.118"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/mod.rs

@@ -424,6 +424,26 @@ pub mod lifecycle_port {
         });
         if let Some(object) = value.as_object_mut() {
             object.extend(facts);
+            // Only a plain Pi entry can be retried verbatim with this command.
+            // Never drop explicit attach/external intent or provider arguments,
+            // clear the caller's environment, or adopt the unverified pane.
+            if cfg!(unix)
+                && provider == Provider::Pi
+                && attach == &LeaderLauncherArgs::default()
+            {
+                let command = "env -u TMUX -u TMUX_PANE team-agent pi";
+                object.insert("recovery_command".to_string(), json!(command));
+                object.insert(
+                    ACTION_FIELD.to_string(),
+                    json!(format!(
+                        "The inherited TMUX/TMUX_PANE could not be authorized for \
+                         requested_workspace; this is not an empty-directory error. \
+                         To explicitly retry from requested_workspace, run `{command}`. \
+                         This removes the inherited variables only for the new process \
+                         and does not detach or modify your current tmux pane. {action}"
+                    )),
+                );
+            }
         }
         value
     }

package/crates/team-agent/src/leader/start.rs

@@ -48,9 +48,6 @@ enum ManagedClientAttachMode {
     SwitchClient,
 }
 
-const DIFFERENT_TMUX_SERVER_PREFIX: &str =
-    "managed launcher refuses a different ambient tmux server";
-
 impl PreparedLeaderStart {
     pub(crate) fn plan(&self) -> &LeaderStartPlan {
         &self.plan
@@ -141,8 +138,6 @@ pub(crate) fn prepare_leader_start_with_nested_attach(
     let (ambient_authority, managed_client_attach_mode, managed_exec_provider) =
         if explicit_external_path || state_external_path {
             (ambient_pane_authority_preflight(workspace)?, None, false)
-        } else if workspace_state_is_managed_provider_reentry(workspace) {
-            (ambient_pane_authority_preflight(workspace)?, None, true)
         } else {
             managed_launcher_ambient_route(
                 provider,
@@ -159,7 +154,7 @@ pub(crate) fn prepare_leader_start_with_nested_attach(
         confirm_attach,
         attach_session,
         external_leader,
-        std::env::var_os("TMUX").is_some(),
+        ambient_authority.is_some(),
         managed_client_attach_mode,
         managed_exec_provider,
         allow_nested_attach,
@@ -613,64 +608,49 @@ fn managed_launcher_ambient_route(
     ),
     PrepareLeaderStartError,
 > {
-    let Some(tmux) = std::env::var_os("TMUX") else {
-        return Ok((
-            None,
-            Some(ManagedClientAttachMode::AttachSession),
-            false,
-        ));
+    let isolated = || (None, Some(ManagedClientAttachMode::AttachSession), false);
+    let authority = match ambient_pane_authority_preflight(workspace) {
+        Ok(Some(authority)) => authority,
+        Ok(None) => return Ok(isolated()),
+        Err(PrepareLeaderStartError::PaneAuthorityRefused(_)) if !allow_nested_attach => {
+            // An inherited tuple cannot authorize adoption, but an ordinary
+            // managed launch can still create its own workspace pane. Keep
+            // explicit external/attach and nested-attach intent fail-closed.
+            return Ok(isolated());
+        }
+        Err(error) => return Err(error),
     };
-    let tmux = tmux.into_string().map_err(|_| {
-        PrepareLeaderStartError::PaneAuthorityRefused(ambient_tmux_endpoint_refusal(
-            workspace,
-            pane_refusal::AmbientTmuxEndpointUnavailableCause::TmuxValueNotUnicode,
-        ))
-    })?;
-    let observed_endpoint = validated_ambient_tmux_endpoint(workspace, &tmux)
-        .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
-    if provider == Provider::Pi && provider_args.is_empty() && !allow_nested_attach {
-        // Pi's zero-argument managed entry already owns this verified pane as its
-        // user-facing terminal. Replacing the current process is safe on either
-        // the workspace server or another server; switching/attaching would move
-        // the user away from the positively verified workspace pane.
-        let authority = verified_ambient_pane_authority(workspace, &tmux)
-            .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
+    if workspace_state_is_managed_provider_reentry(workspace)
+        || (provider == Provider::Pi && provider_args.is_empty() && !allow_nested_attach)
+    {
+        // Only verified current-pane authority permits replacing the caller.
         return Ok((Some(authority), None, true));
     }
-    let target_socket_name = TmuxBackend::for_workspace(workspace)
-        .tmux_endpoint()
-        .ok_or_else(|| LeaderError::Start("workspace tmux endpoint missing".to_string()))?;
     let target_endpoint = crate::tmux_backend::socket_path_for_workspace(workspace);
     let same_server = target_endpoint.as_ref().is_some_and(|target| {
-        let observed = Path::new(&observed_endpoint)
+        let observed = Path::new(&authority.endpoint)
             .canonicalize()
-            .unwrap_or_else(|_| PathBuf::from(&observed_endpoint));
+            .unwrap_or_else(|_| PathBuf::from(&authority.endpoint));
         let target = target.canonicalize().unwrap_or_else(|_| target.clone());
         observed == target
     });
     if same_server {
-        let authority = verified_ambient_pane_authority(workspace, &tmux)
-            .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
         return Ok((
             Some(authority),
             Some(ManagedClientAttachMode::SwitchClient),
             false,
         ));
     }
-    if !allow_nested_attach {
-        return Err(LeaderError::Validation(format!(
-            "{DIFFERENT_TMUX_SERVER_PREFIX}: observed_endpoint={observed_endpoint}; \
-             requested_workspace_socket={target_socket_name}"
-        ))
-        .into());
+    if allow_nested_attach {
+        return Ok((
+            Some(authority),
+            Some(ManagedClientAttachMode::AttachSession),
+            false,
+        ));
     }
-    let authority = verified_ambient_pane_authority(workspace, &tmux)
-        .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
-    Ok((
-        Some(authority),
-        Some(ManagedClientAttachMode::AttachSession),
-        false,
-    ))
+    // Do not switch/adopt the unrelated server. The existing managed attach
+    // child clears TMUX/TMUX_PANE without changing the caller's environment.
+    Ok(isolated())
 }
 
 fn validated_ambient_tmux_endpoint(

package/crates/team-agent/src/lifecycle/tests/pi_session_delivery_red.rs

@@ -4,7 +4,7 @@ use std::time::Duration;
 
 use crate::lifecycle::launch::pi_mcp::pi_seat_paths;
 use crate::messaging::delivery::{
-    paste_to_submit_floor_for_recipient, recipient_allows_explicit_queue_flush, recipient_is_busy,
+    paste_to_submit_floor_for_recipient, recipient_allows_explicit_queue_flush,
     recipient_requires_single_enter,
 };
 use crate::model::enums::{Provider, ProviderEffort};
@@ -186,17 +186,12 @@ fn pi_delivery_submits_one_enter_and_never_flushes_or_retries() {
         paste_to_submit_floor_for_recipient(&idle, "worker-a"),
         Duration::ZERO
     );
-    assert!(!recipient_is_busy(&idle, "worker-a"));
-
     let busy = serde_json::json!({
         "agents": {
             "worker-a": {"provider": "pi", "status": "busy"}
         }
     });
-    assert!(
-        recipient_is_busy(&busy, "worker-a"),
-        "known busy must take the existing send.deferred_busy path before paste"
-    );
+    // Working native CLIs queue the same single-Enter input; no idle admission.
     assert!(recipient_requires_single_enter(&busy, "worker-a"));
     assert!(!recipient_allows_explicit_queue_flush(&busy, "worker-a"));
 }

package/crates/team-agent/src/messaging/delivery.rs

@@ -299,34 +299,6 @@ fn prepare_message_state(
             }
         }
     }
-    if batch
-        && recipient_is_busy(
-            prepared.scoped.as_ref().unwrap_or(state),
-            &message.recipient,
-        )
-    {
-        event_log.write(
-            "send.deferred_busy",
-            serde_json::json!({
-                "message_id": message_id,
-                "sender": message.sender,
-                "recipient": message.recipient,
-                "reason": "recipient_busy",
-            }),
-        )?;
-        return Ok(Err(DeliveryOutcome {
-            ok: false,
-            status: DeliveryStatus::Queued,
-            message_status: MessageStatusShadow(message.status.clone()),
-            message_id: Some(message_id.to_string()),
-            verification: None,
-            stage: None,
-            reason: None,
-            channel: None,
-            ack_forced_off: false,
-            turn_verification: None,
-        }));
-    }
     Ok(Ok(prepared))
 }
 
@@ -682,34 +654,33 @@ fn deliver_prepared_message(
         canonical_owner_team_id.as_deref(),
         resolved.metadata.as_ref(),
     );
-    let recipient_cursor = recipient_is_cursor_agent(state, &message.recipient);
-    let native_request = recipient_provider(state, &message.recipient)
-        .filter(|provider| matches!(provider, Provider::Pi | Provider::CursorAgent))
-        .filter(|_| message.recipient != "leader" && transport.supports_owned_native_input())
-        .map(|provider| crate::transport::native_input::NativeInputRequest {
-            message_id: message_id.to_string(),
-            owner_team_id: canonical_owner_team_id.clone().unwrap_or_default(),
-            recipient: message.recipient.clone(), provider,
-            pane_id: resolved.metadata.as_ref().map(|meta| meta.target_pane_id.clone()).unwrap_or_default(),
-            pane_pid: resolved.metadata.as_ref().and_then(|meta| meta.target_pane_pid).unwrap_or_default(),
-            session: resolved.metadata.as_ref().map(|meta| meta.target_session.clone()).unwrap_or_default(),
-            window: resolved.metadata.as_ref().map(|meta| meta.target_window.clone()).unwrap_or_default(),
-        });
-    let guarded_native = native_request.is_some();
-    let (inject_attempt, native_evidence) = crate::transport::native_input::with_native_input(native_request, || {
-        crate::tmux_backend::with_paste_to_submit_floor(
-            paste_to_submit_floor_for_recipient(state, &message.recipient),
-            || crate::tmux_backend::with_cursor_single_enter(recipient_cursor, || {
-                transport.inject_with_submit_observer(&target, &payload, Key::Enter, true, Some(&submit_observer))
-            }),
-        )
-    });
+    // v0.5.113 delivery: address/owner and pane serialization are authoritative;
+    // composer appearance is not admission. Native CLIs buffer/queue input.
+    let inject_attempt = crate::tmux_backend::with_paste_to_submit_floor(
+        paste_to_submit_floor_for_recipient(state, &message.recipient),
+        || {
+            crate::tmux_backend::with_cursor_single_enter(
+                recipient_requires_single_enter(state, &message.recipient),
+                || {
+                    transport.inject_with_submit_observer(
+                        &target,
+                        &payload,
+                        Key::Enter,
+                        true,
+                        Some(&submit_observer),
+                    )
+                },
+            )
+        },
+    );
     let inject_report = match inject_attempt {
         Ok(report) => {
             // grok 忙时第一次回车只入显式队列。默认 send-now：只重按回车顶出去。
             // 无 `Enter:send now` 时零次额外按键，claude/codex 行为不变。
             // cursor：第二下 Enter 打断进行中回合，不走 flush。
-            if !guarded_native && !crate::provider::submit_now::keep_provider_queue_requested() && !recipient_cursor {
+            if !crate::provider::submit_now::keep_provider_queue_requested()
+                && recipient_allows_explicit_queue_flush(state, &message.recipient)
+            {
                 match crate::provider::submit_now::flush_explicit_queue(transport, &target) {
                     Ok(flush) if flush.extra_enters > 0 => {
                         let _ = event_log.write(
@@ -739,28 +710,6 @@ fn deliver_prepared_message(
         }
         Err(error) => {
             let reason = format!("inject_failed:{error}");
-            if guarded_native {
-                let pasted = native_evidence.as_ref().filter(|evidence|
-                    evidence.phase >= crate::transport::native_input::NativeInputPhase::MayHavePasted);
-                let status = if let Some(evidence) = pasted {
-                    super::enter_rescue::park(store, evidence, attempt, &reason, event_log)?;
-                    "submitted_unverified"
-                } else {
-                    super::enter_rescue::release_no_effect(store, message_id, attempt)?;
-                    "target_resolved"
-                };
-                event_log.write("native_input.deferred", serde_json::json!({
-                    "message_id": message_id, "reason": reason, "status": status,
-                    "may_have_pasted": pasted.is_some(),
-                }))?;
-                return Ok(DeliveryOutcome {
-                    ok: false, status: DeliveryStatus::Queued,
-                    message_status: MessageStatusShadow(status.to_string()),
-                    message_id: Some(message_id.to_string()), verification: Some(reason),
-                    stage: Some(DeliveryStage::Inject), reason: None, channel: None,
-                    ack_forced_off: false, turn_verification: None,
-                });
-            }
             if message.recipient == "leader" {
                 store.mark(message_id, "failed", Some("leader_not_attached"))?;
                 event_log.write(
@@ -926,11 +875,7 @@ fn deliver_prepared_message(
                 turn_verification: Some(turn_verification),
             });
         }
-        if let Some(evidence) = native_evidence.as_ref() {
-            super::enter_rescue::park(store, evidence, attempt, &reason, event_log)?;
-        } else {
-            store.mark(message_id, "submitted_unverified", Some(&reason))?;
-        }
+        store.mark(message_id, "submitted_unverified", Some(&reason))?;
         return Ok(DeliveryOutcome {
             ok: false,
             status: DeliveryStatus::Failed,
@@ -2305,8 +2250,8 @@ fn only_team_entry(state: &serde_json::Value) -> Option<&serde_json::Value> {
     }
 }
 
-/// `_deliver_pending_messages` (`delivery.py:484`):扫 pending 队列逐条投递;busy 收件人写
-/// `send.deferred_busy` 跳过 (**不丢**,card §131)。返回投递的 message_id 列表。
+/// Deliver pending rows without activity/composer admission; native CLIs queue input.
+/// Returns the message IDs whose post-submit evidence verified delivery.
 pub fn deliver_pending_messages(
     workspace: &Path,
     state: &serde_json::Value,
@@ -2500,13 +2445,6 @@ fn recipient_provider(state: &serde_json::Value, recipient: &str) -> Option<Prov
         .and_then(parse_canonical_provider)
 }
 
-fn recipient_is_cursor_agent(state: &serde_json::Value, recipient: &str) -> bool {
-    matches!(
-        recipient_provider(state, recipient),
-        Some(Provider::CursorAgent)
-    )
-}
-
 /// ---
 /// purpose: paste→Enter 地板按收件人 provider 选择
 /// contract: CursorAgent 与 Grok 为 1s；其余（含 claude）为 ZERO
@@ -2549,16 +2487,6 @@ pub(crate) fn recipient_allows_explicit_queue_flush(
     )
 }
 
-pub(crate) fn recipient_is_busy(state: &serde_json::Value, recipient: &str) -> bool {
-    state
-        .get("agents")
-        .and_then(serde_json::Value::as_object)
-        .and_then(|agents| agents.get(recipient))
-        .and_then(|agent| agent.get("status"))
-        .and_then(serde_json::Value::as_str)
-        == Some("busy")
-}
-
 fn leader_rollout_path(state: &serde_json::Value) -> Option<std::path::PathBuf> {
     if let Some(receiver) = leader_receiver_value(state).filter(|receiver| {
         receiver.get("provider").and_then(serde_json::Value::as_str) == Some("pi")

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -735,7 +735,7 @@ fn resource188_batch_and_public_single_prepare_once_and_keep_fresh_leader_load()
 }
 
 #[test]
-fn resource188_busy_and_refused_candidates_prepare_once_without_claiming() {
+fn resource188_busy_reaches_claim_but_owner_refusal_does_not() {
     use crate::messaging::delivery::preparation_probe::COUNTS;
     let mut case = Case::new("188-busy");
     case.state["agents"] = serde_json::json!({"worker": {"agent_id": "worker", "status": "busy"}});
@@ -767,14 +767,15 @@ fn resource188_busy_and_refused_candidates_prepare_once_without_claiming() {
             Some("missing-team"),
         )
         .unwrap();
-    let before = case.message_status(&busy);
     COUNTS.with(|counts| counts.set((0, 0, 0)));
     deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log).unwrap();
-    assert_eq!(COUNTS.with(|counts| counts.get()), (2, 2, 0));
-    assert_eq!(case.message_status(&busy), before);
+    assert_eq!(COUNTS.with(|counts| counts.get()), (2, 2, 1));
+    assert_ne!(case.message_status(&busy), "accepted");
     assert_ne!(case.message_status(&refused), "delivered");
+    // This leader-only transport has no worker target. Removing idle admission
+    // must not also remove target binding: the claimed row still cannot inject.
     assert_eq!(transport.inject_count(), 0);
-    assert!(case.events().contains("send.deferred_busy"));
+    assert!(!case.events().contains("send.deferred_busy"));
     assert!(case.events().contains("delivery.projection_refused"));
 }
 

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -174,6 +174,9 @@ impl Transport for DeliverOkTransport {
     fn kind(&self) -> BackendKind {
         BackendKind::Tmux
     }
+    fn supports_owned_native_input(&self) -> bool {
+        true
+    }
     fn spawn_first(
         &self,
         _s: &SessionName,
@@ -201,6 +204,8 @@ impl Transport for DeliverOkTransport {
         _s: Key,
         _b: bool,
     ) -> Result<InjectReport, TransportError> {
+        assert!(crate::transport::native_input::current_request().is_none(),
+            "ordinary sends must use v0.5.113 direct input, not pre-paste idle admission");
         Ok(InjectReport {
             stage_reached: crate::transport::InjectStage::Submit,
             inject_verification: crate::transport::InjectVerification::CaptureContainsToken,
@@ -344,13 +349,10 @@ fn spine_delivery_skips_queued_statuses() {
     );
 }
 
-// #2 (CONTRACT, corrected) — busy recipient = LIFECYCLE status=="busy" → emit ONE send.deferred_busy
-// {recipient,reason:"recipient_busy"} and do NOT deliver (row stays 'accepted'). golden delivery.py:491
-// gates on `state.agents[recipient].status == "busy"`, NOT on turn-level agent_health=WORKING.
-// (The prior version of this test seeded agent_health=WORKING + status="running" and asserted deferral,
-//  misreading golden — that stale lock is the root of the deferred_busy regression; corrected here.)
+// Input is unconditional: native CLIs queue messages while working. Activity
+// metadata must not prevent a pending message from reaching paste + Enter.
 #[test]
-fn spine_delivery_busy_recipient_defers_with_event() {
+fn spine_delivery_busy_recipient_is_injected_without_idle_deferral() {
     let ws = tmp_ws("deliver-busy");
     let store = store_for(&ws);
     let log = EventLog::new(&ws);
@@ -361,33 +363,30 @@ fn spine_delivery_busy_recipient_defers_with_event() {
 
     let delivered = deliver_pending_messages(&ws, &state, &DeliverOkTransport, &log).unwrap();
 
-    assert!(
-        !delivered.contains(&mid),
-        "a busy recipient's message must NOT be delivered"
-    );
-    assert_eq!(
-        message_status_of(&store, &mid),
-        "accepted",
-        "the row must stay 'accepted' (no-drop, left for a later tick)"
-    );
+    assert!(delivered.contains(&mid));
+    assert_eq!(message_status_of(&store, &mid), "delivered");
     let events = read_event_log(&ws);
     let deferred: Vec<_> = events
         .iter()
         .filter(|e| e.get("event").and_then(|v| v.as_str()) == Some("send.deferred_busy"))
         .collect();
-    assert_eq!(
-        deferred.len(),
-        1,
-        "exactly one send.deferred_busy event expected; got {events:?}"
-    );
-    assert_eq!(
-        deferred[0].get("recipient").and_then(|v| v.as_str()),
-        Some("w1")
-    );
-    assert_eq!(
-        deferred[0].get("reason").and_then(|v| v.as_str()),
-        Some("recipient_busy")
-    );
+    assert!(deferred.is_empty());
+}
+
+#[test]
+fn spine_delivery_pi_cursor_uses_v113_direct_input_without_idle_scope() {
+    for provider in ["pi", "cursor_agent"] {
+        let ws = tmp_ws(&format!("direct-input-{provider}"));
+        let store = store_for(&ws);
+        let log = EventLog::new(&ws);
+        let mid = store
+            .create_message(Some("t"), "leader", "w1", "hi", None, true, None)
+            .unwrap();
+        let state = serde_json::json!({"agents": {"w1": {"provider": provider, "status": "running"}}});
+        let delivered = deliver_pending_messages(&ws, &state, &DeliverOkTransport, &log).unwrap();
+        assert!(delivered.contains(&mid), "{provider}");
+        assert_eq!(message_status_of(&store, &mid), "delivered");
+    }
 }
 
 // CONTRACT (shared-root, real-machine-driven; golden = correct-behavior baseline): an ALIVE worker

package/crates/team-agent/src/tmux_backend/native_input_tests.rs

@@ -20,6 +20,12 @@ enum Mode {
     R6IdleNotice,
     PiFolded,
     PiFoldedUnstable,
+    CursorFollowup,
+    CursorHeaderEvicted,
+    CursorHistoryOnly,
+    CursorLongHistory,
+    CursorExpanded,
+    CursorExpandedDirty,
 }
 struct State {
     mode: Mode,
@@ -53,7 +59,13 @@ impl CommandRunner for Runner {
             };
             let height = if matches!(
                 state.mode,
-                Mode::R6IdleNotice | Mode::PiFolded | Mode::PiFoldedUnstable
+                Mode::R6IdleNotice
+                    | Mode::PiFolded
+                    | Mode::PiFoldedUnstable
+                    | Mode::CursorHistoryOnly
+                    | Mode::CursorLongHistory
+                    | Mode::CursorExpanded
+                    | Mode::CursorExpandedDirty
             ) {
                 24
             } else {
@@ -168,14 +180,58 @@ impl CommandRunner for Runner {
         let stdout = if state.provider == Provider::CursorAgent
             && argv.iter().any(|arg| arg == "capture-pane")
         {
+            let followup = matches!(
+                state.mode,
+                Mode::CursorFollowup
+                    | Mode::CursorHeaderEvicted
+                    | Mode::CursorHistoryOnly
+                    | Mode::CursorLongHistory
+                    | Mode::CursorExpanded
+                    | Mode::CursorExpandedDirty
+            );
+            let placeholder = if followup {
+                "Add a follow-up"
+            } else {
+                "Plan, search, build anything"
+            };
+            let header = if matches!(state.mode, Mode::CursorFollowup)
+                || (matches!(state.mode, Mode::CursorHeaderEvicted) && state.pasted > 0)
+            {
+                ""
+            } else {
+                "Cursor Agent\nv2026.10.01-e373342\n"
+            };
             let (composer, history) = if state.entered > 0 {
-                ("Plan, search, build anything", "[Pasted text #2 +25 lines]")
+                (placeholder, "[Pasted text #2 +25 lines]")
             } else if state.pasted > 0 {
                 ("[Pasted text #2 +25 lines]", "[Pasted text #1 +25 lines]")
             } else {
-                ("Plan, search, build anything", "[Pasted text #1 +25 lines]")
+                (placeholder, "[Pasted text #1 +25 lines]")
+            };
+            let padding = if matches!(state.mode, Mode::CursorLongHistory) {
+                "historical transcript row\n".repeat(70)
+            } else {
+                String::new()
             };
-            format!("Cursor Agent\nv2026.10.01-e373342\n{history}\n→ {composer}\nGrok 4.7 High Run Everything\n/owned/project\n")
+            let frame = format!(
+                "{header}{history}\n{padding}→ {composer}\nGrok 4.7 High Run Everything\n/owned/project\n"
+            );
+            if matches!(state.mode, Mode::CursorExpanded | Mode::CursorExpandedDirty) {
+                let expanded = include_str!("../../tests/fixtures/cursor-followup-expanded.txt");
+                if matches!(state.mode, Mode::CursorExpandedDirty)
+                    || state.pasted > 0 && state.entered == 0
+                {
+                    format!("[Pasted text #1 +30 lines]\n{expanded}")
+                } else if state.entered > 0 {
+                    format!("{marker}\n→ Add a follow-up\nGrok 4.7 256K High · 8.6% Run Everything\n/owned/project\n")
+                } else {
+                    "[Pasted text #1 +30 lines]\n→ Add a follow-up\nGrok 4.7 256K High · 8.6% Run Everything\n/owned/project\n".into()
+                }
+            } else if matches!(state.mode, Mode::CursorHistoryOnly) {
+                format!("{frame}{}", "unknown current row\n".repeat(24))
+            } else {
+                frame
+            }
         } else {
             stdout
         };
@@ -703,6 +759,87 @@ fn native_input_cursor_owned_new_capsule_transfers_to_transcript_without_token_c
     assert_eq!(state.entered, 1);
 }
 
+#[test]
+fn native_input_cursor_clean_followup_uses_one_paste_one_enter_across_banner_eviction() {
+    for mode in [
+        Mode::CursorFollowup,
+        Mode::CursorHeaderEvicted,
+        Mode::CursorLongHistory,
+    ] {
+        let f = Fixture::new(mode);
+        f.state.lock().unwrap().provider = Provider::CursorAgent;
+        let (report, evidence) = f.inject();
+        let report = report.unwrap();
+        assert_eq!(
+            report.submit_verification,
+            SubmitVerification::EnterSentWithoutPlaceholderCheck
+        );
+        let evidence = evidence.unwrap();
+        assert_eq!(evidence.phase, NativeInputPhase::Accepted);
+        assert_eq!(
+            evidence.capsule.as_deref(),
+            Some("[Pasted text #2 +25 lines]")
+        );
+        let state = f.state.lock().unwrap();
+        assert_eq!((state.pasted, state.entered), (1, 1));
+    }
+}
+
+#[test]
+fn native_input_cursor_expanded_followup_reaches_seen_then_one_enter() {
+    let f = Fixture::new(Mode::CursorExpanded);
+    f.state.lock().unwrap().provider = Provider::CursorAgent;
+    let text = "For a harmless terminal-scroll fixture, reply with exactly 240 numbered lines, one per line, from 001 through 240, each formatted `NNN: amber`; do not use tools or change any files. Then wait.\n\n[team-agent-token:msg_one]";
+    let (report, evidence) = with_native_input(Some(f.request()), || {
+        f.backend.inject(
+            &Target::Pane(PaneId::new("%1")),
+            &InjectPayload::Text(text.into()),
+            Key::Enter,
+            true,
+        )
+    });
+    let report = report.unwrap();
+    assert_eq!(
+        report.submit_verification,
+        SubmitVerification::EnterSentWithoutPlaceholderCheck
+    );
+    assert_eq!(
+        report.inject_verification,
+        InjectVerification::CaptureContainsToken
+    );
+    let evidence = evidence.unwrap();
+    assert_eq!(evidence.phase, NativeInputPhase::Accepted);
+    assert!(evidence.capsule.is_none());
+    assert_eq!(evidence.baseline_capsules, ["[Pasted text #1 +30 lines]"]);
+    let state = f.state.lock().unwrap();
+    assert_eq!((state.pasted, state.entered), (1, 1));
+    assert!(state.stage_captures[1] >= 2);
+}
+
+#[test]
+fn native_input_cursor_foreign_expanded_followup_is_zero_effect() {
+    let f = Fixture::new(Mode::CursorExpandedDirty);
+    f.state.lock().unwrap().provider = Provider::CursorAgent;
+    let (report, _) = f.inject();
+    assert!(report.is_err());
+    let state = f.state.lock().unwrap();
+    assert_eq!((state.pasted, state.entered), (0, 0));
+}
+
+#[test]
+fn native_input_cursor_history_only_composer_cannot_authorize_paste_or_enter() {
+    let f = Fixture::new(Mode::CursorHistoryOnly);
+    f.state.lock().unwrap().provider = Provider::CursorAgent;
+    let (result, _) = f.inject();
+    let state = f.state.lock().unwrap();
+    assert_eq!(
+        (state.pasted, state.entered),
+        (0, 0),
+        "old history is not current composer authority"
+    );
+    assert!(result.is_err());
+}
+
 #[test]
 fn native_input_buffer_uses_authoritative_message_not_first_quoted_marker() {
     let f = Fixture::new(Mode::Normal);

package/crates/team-agent/src/transport/native_input.rs

@@ -202,16 +202,27 @@ pub(crate) fn inspect_input(
 ) -> Option<InputFrame> {
     match provider {
         Provider::Pi => pi_input(text, pane_height),
-        Provider::CursorAgent => cursor_input(text),
+        Provider::CursorAgent => cursor_input(text, pane_height),
         _ => None,
     }
 }
 
-fn cursor_input(text: &str) -> Option<InputFrame> {
+fn cursor_input(text: &str, pane_height: u32) -> Option<InputFrame> {
     use team_agent_contract::contract::delivery::InputSurface;
+    if pane_height == 0 {
+        return None;
+    }
+    let text_rows: Vec<_> = text.lines().collect();
+    // Only the current viewport authorizes input; retain full history below
+    // solely for same-message transcript correlation.
+    let viewport_start = text_rows.len().saturating_sub(pane_height as usize);
+    let viewport = text_rows[viewport_start..].join("\n");
     let (surface, rows, capsule, busy) =
-        team_agent_contract::providers::cursor::interaction::inspect_composer(text)?;
-    let first = rows.first()?.strip_prefix("→ ")?;
+        team_agent_contract::providers::cursor::interaction::inspect_legacy_composer(&viewport)?;
+    let first = match *rows.first()? {
+        "→" => "",
+        row => row.strip_prefix("→ ")?,
+    };
     let footer = rows.iter().rposition(|row| {
         row.strip_suffix("Run Everything").is_some_and(|prefix| {
             !prefix.trim().is_empty() && !prefix.trim_start().starts_with("→ ")
@@ -228,9 +239,13 @@ fn cursor_input(text: &str) -> Option<InputFrame> {
     if tail.is_empty() {
         return None;
     }
-    let header: Vec<_> = text.lines().map(str::trim).collect();
-    let version = header.windows(2).find(|pair| pair[0] == "Cursor Agent")?[1];
-    let identity = format!("{version}:{}", input_digest(&tail.join("\n")));
+    // Startup history can leave Tail(200) between Ready/Pasted/Accepted. The
+    // immutable carrier birth/nonce remains in NativeInputBinding; this UI
+    // context is the current native cwd/footer tail, not a version attestation.
+    let identity = format!(
+        "cursor-current-composer-v1:{}",
+        input_digest(&tail.join("\n"))
+    );
     let footer_row = rows[footer]
         .split_whitespace()
         .collect::<Vec<_>>()
@@ -247,10 +262,9 @@ fn cursor_input(text: &str) -> Option<InputFrame> {
             .collect::<Vec<_>>()
             .join("\n")
     };
-    let text_rows: Vec<_> = text.lines().collect();
     let arrow = text_rows
         .iter()
-        .rposition(|line| line.trim().starts_with("→ "))?;
+        .rposition(|line| line.trim() == "→" || line.trim().starts_with("→ "))?;
     Some(InputFrame {
         composer,
         transcript: text.lines().take(arrow).collect::<Vec<_>>().join("\n"),
@@ -544,6 +558,114 @@ mod tests {
         }
     }
 
+    // Native Issue #328 current-composer rows; transcript removed and private
+    // cwd replaced with /owned/project. Startup banner is genuinely absent
+    // from the owned pane's Tail(200), not a fabricated invalid version.
+    const CURSOR_FOLLOWUP: &str =
+        include_str!("../../tests/fixtures/cursor-followup-headerless.txt");
+
+    #[test]
+    fn native_input_cursor_clean_followup_does_not_require_scrolled_startup_banner() {
+        let ready = inspect_input(Provider::CursorAgent, CURSOR_FOLLOWUP).unwrap();
+        assert!(ready.empty());
+        assert!(!ready.busy);
+        assert!(ready.capsule.is_none());
+        let header = format!("Cursor Agent\nv2026.10.14-0f9edde\n{CURSOR_FOLLOWUP}");
+        let with_header = inspect_input(Provider::CursorAgent, &header).unwrap();
+        assert!(with_header.empty() && !with_header.busy);
+        assert_eq!(ready.footer, with_header.footer);
+        assert_eq!(
+            ready.identity, with_header.identity,
+            "startup history is not a new UI identity"
+        );
+    }
+
+    #[test]
+    fn native_input_cursor_headerless_followup_retains_draft_busy_and_footer_fences() {
+        let label = "[Pasted text #2 +25 lines]";
+        let folded = CURSOR_FOLLOWUP.replace("Add a follow-up", label);
+        let draft = inspect_input(Provider::CursorAgent, &folded).unwrap();
+        assert!(!draft.empty());
+        assert_eq!(draft.capsule.as_deref(), Some(label));
+        let dirty = CURSOR_FOLLOWUP.replace("Add a follow-up", "Add a follow-up draft");
+        assert!(!inspect_input(Provider::CursorAgent, &dirty)
+            .unwrap()
+            .empty());
+        for dirty in [
+            CURSOR_FOLLOWUP.replace("Add a follow-up", "Add a follow-up\nforeign draft"),
+            CURSOR_FOLLOWUP.replace("Add a follow-up", &format!("{label}\nforeign draft")),
+        ] {
+            assert!(inspect_input(Provider::CursorAgent, &dirty).is_none());
+        }
+        let busy = CURSOR_FOLLOWUP.replace("Add a follow-up", "Add a follow-up ctrl+c to stop");
+        assert!(inspect_input(Provider::CursorAgent, &busy).unwrap().busy);
+        let working = format!("⠘⠆ Working\n{CURSOR_FOLLOWUP}");
+        assert!(inspect_input(Provider::CursorAgent, &working).unwrap().busy);
+        for unknown in [
+            "→ Add a follow-up\n".to_string(),
+            CURSOR_FOLLOWUP.replace("Run Everything", "unknown footer"),
+            CURSOR_FOLLOWUP.replace("  /owned/project\n", ""),
+        ] {
+            assert!(inspect_input(Provider::CursorAgent, &unknown).is_none());
+        }
+    }
+
+    #[test]
+    fn native_input_cursor_real_expanded_followup_is_nonempty_current_marker_not_capsule() {
+        let expanded = include_str!("../../tests/fixtures/cursor-followup-expanded.txt");
+        let marker = "[team-agent-token:msg_one]";
+        for prefix in [
+            "".to_string(),
+            format!("Cursor Agent\nv2026.10.14-0f9edde\n{CURSOR_FOLLOWUP}"),
+        ] {
+            let text = format!("{prefix}{expanded}");
+            let frame = inspect_input(Provider::CursorAgent, &text).unwrap();
+            assert!(!frame.empty() && !frame.busy);
+            assert!(frame.has_marker(marker));
+            assert!(frame.capsule.is_none());
+            assert!(!frame.transcript.contains(marker));
+            let changed = text.replace("/owned/project", "/different/project");
+            assert_ne!(
+                frame.identity,
+                inspect_input(Provider::CursorAgent, &changed)
+                    .unwrap()
+                    .identity
+            );
+        }
+        let duplicate = expanded.replace(marker, &format!("{marker}\n{marker}"));
+        assert!(!inspect_input(Provider::CursorAgent, &duplicate)
+            .unwrap()
+            .has_marker(marker));
+        let busy = expanded.replace("  →", "⠘⠆ Working\n  →");
+        assert!(inspect_input(Provider::CursorAgent, &busy).unwrap().busy);
+        for unknown in [
+            "→\nGrok 4.7 High Run Everything\n/owned/project\n".to_string(),
+            "→\nforeign draft\n→ Add a follow-up\nGrok 4.7 High Run Everything\n/owned/project\n"
+                .to_string(),
+            expanded.replace("Run Everything", "unknown footer"),
+            expanded.replace("  /owned/project\n", ""),
+            format!("{expanded}{}", "unknown current row\n".repeat(24)),
+        ] {
+            assert!(super::inspect_input(Provider::CursorAgent, &unknown, 24).is_none());
+        }
+    }
+
+    #[test]
+    fn native_input_cursor_requires_composer_in_current_viewport_not_old_history() {
+        for header in ["", "Cursor Agent\nv2026.10.14-0f9edde\n"] {
+            let hidden = format!(
+                "{header}{CURSOR_FOLLOWUP}{}",
+                "unknown current row\n".repeat(24)
+            );
+            assert!(super::inspect_input(Provider::CursorAgent, &hidden, 24).is_none());
+        }
+        assert!(super::inspect_input(Provider::CursorAgent, CURSOR_FOLLOWUP, 0).is_none());
+        let current = super::inspect_input(Provider::CursorAgent, CURSOR_FOLLOWUP, 24).unwrap();
+        let changed = CURSOR_FOLLOWUP.replace("/owned/project", "/different/project");
+        let changed = super::inspect_input(Provider::CursorAgent, &changed, 24).unwrap();
+        assert_ne!(current.identity, changed.identity);
+    }
+
     #[test]
     fn native_input_cursor_separates_folded_draft_from_history_and_busy() {
         let capsule = "[Pasted text #1 +25 lines]";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.117",
+  "version": "0.5.118",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.117",
-    "@team-agent/cli-darwin-x64": "0.5.117",
-    "@team-agent/cli-linux-x64": "0.5.117"
+    "@team-agent/cli-darwin-arm64": "0.5.118",
+    "@team-agent/cli-darwin-x64": "0.5.118",
+    "@team-agent/cli-linux-x64": "0.5.118"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",