@team-agent/installer 0.5.119 → 0.5.121

package/crates/team-agent/src/lifecycle/launch/agent_state.rs

@@ -129,6 +129,14 @@ pub(super) fn running_agent_state(
     if let Some(started_agent) = started_agent {
         persist_started_agent_plan_state(&mut state, started_agent);
     }
+    // Cursor chdirs to its native --workspace primary. Session archives are
+    // keyed by this directory, not the real project supplied via --add-dir.
+    let cursor_cwd = if provider == Provider::CursorAgent && cursor_mcp_isolation_enabled() {
+        Some(cursor_mcp_project_dir(workspace, id)?)
+    } else {
+        None
+    };
+    let spawn_cwd = cursor_cwd.as_deref().unwrap_or(spawn_cwd);
     state.insert(
         "spawn_cwd".to_string(),
         serde_json::json!(spawn_cwd.to_string_lossy().to_string()),

package/crates/team-agent/src/lifecycle/launch/cursor_mcp.rs

@@ -33,6 +33,7 @@ use crate::provider::Provider;
 
 use super::cursor_mcp_iso::{
     cursor_mcp_isolation_enabled, cursor_mcp_project_dir, materialize_cursor_mcp_project,
+    validate_cursor_mcp_project_root,
 };
 
 /// Keys that must appear in mcp.json env. Cursor strips parent env down to
@@ -280,8 +281,31 @@ pub fn prepare_cursor_seat_mcp(
     mcp_config: &crate::provider::McpConfig,
 ) -> Result<Option<PathBuf>, LifecycleError> {
     if cursor_mcp_isolation_enabled() {
-        let project = materialize_cursor_mcp_project(workspace, agent_id)?;
+        let server = mcp_config
+            .raw
+            .get("team_orchestrator")
+            .or_else(|| mcp_config.raw.get("team-agent"));
+        let env = server.and_then(|s| s.get("env"));
+        let field = |key| {
+            env.and_then(|v| v.get(key))
+                .and_then(serde_json::Value::as_str)
+        };
+        let physical = physical_workspace_path(workspace);
+        if field("TEAM_AGENT_ID") != Some(agent_id)
+            || field("TEAM_AGENT_WORKSPACE") != physical.to_str()
+        {
+            return Err(LifecycleError::RequirementUnmet(
+                "cursor MCP resolved identity does not match the selected workspace/seat".into(),
+            ));
+        }
+        let owner = field("TEAM_AGENT_OWNER_TEAM_ID")
+            .filter(|s| !s.trim().is_empty())
+            .ok_or_else(|| {
+                LifecycleError::RequirementUnmet("cursor MCP missing owner team".into())
+            })?;
+        let project = materialize_cursor_mcp_project(&physical, agent_id, owner)?;
         apply_cursor_mcp_overlay(&project, mcp_config)?;
+        validate_cursor_project_mcp(&physical, &project)?;
         Ok(Some(project))
     } else {
         apply_cursor_mcp_overlay(workspace, mcp_config)?;
@@ -305,14 +329,15 @@ pub fn enable_cursor_workspace_mcp_with_profile(
     profile_launch: Option<&crate::provider::ProviderProfileLaunch>,
 ) -> Result<(), LifecycleError> {
     let physical = cursor_mcp_enable_working_dir(workspace, project_root);
+    if project_root.is_some() {
+        validate_cursor_project_mcp(&physical_workspace_path(workspace), &physical)?;
+    }
     if skip_cursor_mcp_enable() {
         return Ok(());
     }
     let argv = cursor_mcp_enable_argv();
     let mut command = Command::new(&argv[0]);
-    command
-        .args(&argv[1..])
-        .current_dir(&physical);
+    command.args(&argv[1..]).current_dir(&physical);
     apply_cursor_mcp_enable_profile_env(&mut command, profile_launch);
     let output = command.output().map_err(|e| {
         LifecycleError::RequirementUnmet(format!(
@@ -323,6 +348,11 @@ pub fn enable_cursor_workspace_mcp_with_profile(
         ))
     })?;
     if output.status.success() {
+        // Approval is not native tool readiness. Recheck our root/config after
+        // the external command; native loading/calls still need their own proof.
+        if project_root.is_some() {
+            validate_cursor_project_mcp(&physical_workspace_path(workspace), &physical)?;
+        }
         return Ok(());
     }
     let stderr = String::from_utf8_lossy(&output.stderr);
@@ -343,6 +373,83 @@ pub fn enable_cursor_workspace_mcp_with_profile(
     )))
 }
 
+fn validate_cursor_project_mcp(workspace: &Path, project: &Path) -> Result<(), LifecycleError> {
+    use std::io::Read;
+    use std::os::unix::fs::{MetadataExt, OpenOptionsExt};
+    validate_cursor_mcp_project_root(project)?;
+    let refuse = || {
+        LifecycleError::RequirementUnmet(
+        "cursor MCP private config is missing, mismatched, or its server executable is unavailable; native tools are not ready".into(),
+    )
+    };
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(project.join(".cursor/mcp.json"))
+        .map_err(|_| refuse())?;
+    let metadata = file.metadata().map_err(|_| refuse())?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.uid() != unsafe { libc::geteuid() }
+    {
+        return Err(refuse());
+    }
+    let mut bytes = Vec::new();
+    file.take(65537)
+        .read_to_end(&mut bytes)
+        .map_err(|_| refuse())?;
+    if bytes.len() > 65536 {
+        return Err(refuse());
+    }
+    let config: serde_json::Value = serde_json::from_slice(&bytes).map_err(|_| refuse())?;
+    let server = config
+        .get("mcpServers")
+        .and_then(|v| v.get("team_orchestrator"))
+        .ok_or_else(refuse)?;
+    let env = server.get("env").ok_or_else(refuse)?;
+    for key in REQUIRED_IDENTITY_KEYS {
+        if env
+            .get(*key)
+            .and_then(serde_json::Value::as_str)
+            .is_none_or(|s| s.trim().is_empty() || s.contains('{'))
+        {
+            return Err(refuse());
+        }
+    }
+    let seat = env
+        .get("TEAM_AGENT_ID")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(refuse)?;
+    let owner = env
+        .get("TEAM_AGENT_OWNER_TEAM_ID")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(refuse)?;
+    if env
+        .get("TEAM_AGENT_WORKSPACE")
+        .and_then(serde_json::Value::as_str)
+        != workspace.to_str()
+        || cursor_mcp_project_dir(workspace, seat)? != project
+        || materialize_cursor_mcp_project(workspace, seat, owner)? != project
+    {
+        return Err(refuse());
+    }
+    let command = server
+        .get("command")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(refuse)?;
+    let metadata = std::fs::metadata(command).map_err(|_| refuse())?;
+    let current = std::env::current_exe()
+        .and_then(std::fs::canonicalize)
+        .map_err(|_| refuse())?;
+    if !Path::new(command).is_absolute()
+        || !metadata.is_file()
+        || metadata.mode() & 0o111 == 0
+        || std::fs::canonicalize(command).map_err(|_| refuse())? != current
+        || server.get("args") != Some(&serde_json::json!(["mcp-server", "--workspace", workspace]))
+    {
+        return Err(refuse());
+    }
+    Ok(())
+}
+
 pub(crate) fn apply_cursor_mcp_enable_profile_env(
     command: &mut Command,
     profile_launch: Option<&crate::provider::ProviderProfileLaunch>,

package/crates/team-agent/src/lifecycle/launch/cursor_mcp_iso.rs

@@ -1,120 +1,282 @@
-//! ---
-//! purpose: cursor 的目录作用域 mcp.json 改成 per-seat provider-config 工程根（对齐 grok overlay / claude CLAUDE_CONFIG_DIR）
-//! contract:
-//!   provides:
-//!     - name: materialize_cursor_mcp_project
-//!       what: 在 provider-config/<id>/cursor 建 .cursor/，失败不写共用 mcp.json
-//!     - name: cursor_mcp_isolation_enabled
-//!       what: 默认开；TEAM_AGENT_CURSOR_MCP_ISOLATION=0 时关（只给破坏齿/回归旧闸）
-//!     - name: cursor_mcp_project_dir
-//!       what: 该席位作为 cursor --workspace 的工程根（未建盘）
-//! boundary:
-//!   - 隔离失败 = RequirementUnmet，⛔ 不降级写 <workspace>/.cursor/mcp.json
-//!   - 不改 HOME（不是 copilot COPILOT_HOME / 会话库分叉）
-//!   - 不削弱 refuse_second：隔离关闭时仍拒第二席
-//! maturity: wired
-//! ---
+//! Cursor's native MCP project root must be an owned primary outside Git ancestry.
+//! Keep the real project as --add-dir; never overwrite its shared MCP config or
+//! silently relocate an existing native session. The persisted directory receipt
+//! is transport ownership, not a canonical Provider/native-session identity.
 
+use std::io::{Read, Write};
+use std::os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt};
 use std::path::{Path, PathBuf};
 
+use serde::{Deserialize, Serialize};
+use team_agent_contract::contract::types::{
+    Generation, InstanceId, InstanceIdentity, ScopeId, SeatId,
+};
+use team_agent_contract::host::files::{DirectoryReceipt, ScopedDirectory};
+use team_agent_contract::host::{digest, digest_hex};
+
 use crate::lifecycle::LifecycleError;
 
 const ISOLATION_ENV: &str = "TEAM_AGENT_CURSOR_MCP_ISOLATION";
 
-/// ---
-/// purpose: 默认开启 per-seat provider-config 工程根；显式 0/false/off 才关
-/// ---
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ProjectRecord {
+    workspace: PathBuf,
+    agent_id: String,
+    owner_team_id: String,
+    directory: DirectoryReceipt,
+}
+
 pub fn cursor_mcp_isolation_enabled() -> bool {
     match std::env::var(ISOLATION_ENV) {
-        Ok(value) => {
-            let trimmed = value.trim();
-            !matches!(
-                trimmed,
-                "0" | "false" | "FALSE" | "off" | "OFF" | "no" | "NO"
-            )
-        }
+        Ok(value) => !matches!(
+            value.trim(),
+            "0" | "false" | "FALSE" | "off" | "OFF" | "no" | "NO"
+        ),
         Err(_) => true,
     }
 }
 
-/// ---
-/// purpose: 算出该席位 cursor --workspace 工程根，不建盘
-/// ---
+fn failure(reason: impl std::fmt::Display) -> LifecycleError {
+    LifecycleError::RequirementUnmet(format!(
+        "cursor MCP private project refused: {reason}; do not overwrite shared .cursor/mcp.json or move an existing session"
+    ))
+}
+
+fn record_path(workspace: &Path, agent_id: &str) -> PathBuf {
+    workspace
+        .join(".team/runtime/provider-config")
+        .join(agent_id)
+        .join("cursor-project.json")
+}
+
+fn project_key(workspace: &Path, agent_id: &str) -> String {
+    digest_hex(digest(
+        format!("{}\0{agent_id}", workspace.display()).as_bytes(),
+    ))
+}
+
+fn planned_project(workspace: &Path, agent_id: &str) -> Result<PathBuf, LifecycleError> {
+    // Do not assume TMPDIR is outside Git, or use an unchecked symlink alias.
+    let parent = std::env::temp_dir().canonicalize().map_err(failure)?;
+    validate_cursor_mcp_project_root(&parent)?;
+    Ok(parent.join(format!(
+        "ta-cursor-{}",
+        &project_key(workspace, agent_id)[..32]
+    )))
+}
+
+/// Computes a new path without creating it; existing allocations must reopen
+/// their captured receipt, never adopt a replacement directory or a new TMPDIR.
 pub fn cursor_mcp_project_dir(workspace: &Path, agent_id: &str) -> Result<PathBuf, LifecycleError> {
     validate_agent_id(agent_id)?;
-    Ok(workspace
-        .join(".team")
-        .join("runtime")
-        .join("provider-config")
-        .join(agent_id)
-        .join("cursor"))
+    let workspace = workspace.canonicalize().map_err(failure)?;
+    match read_record(&workspace, agent_id)? {
+        Some(record) => Ok(reopen(&record)?.path().to_path_buf()),
+        None => planned_project(&workspace, agent_id),
+    }
 }
 
-/// ---
-/// purpose: 该席位 cursor 实际会读的项目 mcp.json
-/// ---
 pub fn cursor_mcp_json_path(workspace: &Path, agent_id: &str) -> Result<PathBuf, LifecycleError> {
-    Ok(cursor_mcp_project_dir(workspace, agent_id)?
-        .join(".cursor")
-        .join("mcp.json"))
+    Ok(cursor_mcp_project_dir(workspace, agent_id)?.join(".cursor/mcp.json"))
+}
+
+/// Read-only scope proof for CLI planning. An external pathname or a matching
+/// directory name is not ownership: the existing selected-team record must pin
+/// this exact physical cwd. Never materialize or repair during preflight.
+pub(crate) fn cursor_mcp_primary_matches_scope(
+    workspace: &Path,
+    owner_team_id: &str,
+    agent_id: &str,
+    declared_cwd: &Path,
+) -> Result<bool, LifecycleError> {
+    validate_agent_id(agent_id)?;
+    let workspace = workspace.canonicalize().map_err(failure)?;
+    let Some(record) = read_record(&workspace, agent_id)? else {
+        return Ok(false);
+    };
+    if record.owner_team_id != owner_team_id || record.directory.path != declared_cwd {
+        return Ok(false);
+    }
+    Ok(reopen(&record)?.path() == declared_cwd)
+}
+
+/// Metadata-only mirror of the measured native project-root boundary. A .git
+/// directory OR worktree file on any ancestor would redirect native MCP loading.
+pub(super) fn validate_cursor_mcp_project_root(project: &Path) -> Result<(), LifecycleError> {
+    if project.canonicalize().map_err(failure)? != project {
+        return Err(failure("project path is not physical"));
+    }
+    for ancestor in project.ancestors() {
+        match std::fs::symlink_metadata(ancestor.join(".git")) {
+            Ok(_) => {
+                return Err(failure(
+                    "Git ancestor would redirect native MCP projectRoot",
+                ))
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(failure(e)),
+        }
+    }
+    Ok(())
 }
 
-/// ---
-/// purpose: 建 per-seat 工程根，并把团队 rules 链进该根（不链 mcp.json）
-/// returns: 工程根
-/// errors: agent_id 非法或建盘失败 → RequirementUnmet（不写共用 mcp.json）
-/// ---
 pub fn materialize_cursor_mcp_project(
     workspace: &Path,
     agent_id: &str,
+    owner_team_id: &str,
 ) -> Result<PathBuf, LifecycleError> {
-    let project = cursor_mcp_project_dir(workspace, agent_id)?;
-    let cursor_dir = project.join(".cursor");
-    std::fs::create_dir_all(&cursor_dir).map_err(|e| {
-        LifecycleError::RequirementUnmet(format!(
-            "error: cannot materialize cursor per-seat MCP project\n\
-             reason: {e}\n\
-             path: {}\n\
-             action: fix workspace permissions; do not fall back to <workspace>/.cursor/mcp.json",
-            cursor_dir.display()
-        ))
-    })?;
-    link_workspace_rules(workspace, &cursor_dir)?;
-    Ok(project)
+    validate_agent_id(agent_id)?;
+    let workspace = workspace.canonicalize().map_err(failure)?;
+    if owner_team_id.trim().is_empty() {
+        return Err(failure("missing owner team"));
+    }
+    if let Some(record) = read_record(&workspace, agent_id)? {
+        if record.owner_team_id != owner_team_id {
+            return Err(failure("record belongs to another owner team"));
+        }
+        return Ok(reopen(&record)?.path().to_path_buf());
+    }
+    let legacy = workspace
+        .join(".team/runtime/provider-config")
+        .join(agent_id)
+        .join("cursor");
+    match std::fs::symlink_metadata(&legacy) {
+        Ok(_) => return Err(failure("unrecorded legacy primary exists; preserve its cwd/SID and explicitly select a fresh seat")),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(failure(e)),
+    }
+    let path = planned_project(&workspace, agent_id)?;
+    let key = project_key(&workspace, agent_id);
+    let mut nonce = [0u8; 32];
+    std::fs::File::open("/dev/urandom")
+        .and_then(|mut f| f.read_exact(&mut nonce))
+        .map_err(failure)?;
+    let owner = InstanceIdentity {
+        scope: ScopeId::new(format!("legacy-cursor-{}", &key[..32])).map_err(failure)?,
+        seat: SeatId::new(format!("seat-{}", &key[32..])).map_err(failure)?,
+        instance: InstanceId::new(format!("cwd-{}", digest_hex(digest(&nonce))))
+            .map_err(failure)?,
+        generation: Generation(1),
+    };
+    let directory = ScopedDirectory::create(&path, owner).map_err(failure)?;
+    std::fs::DirBuilder::new()
+        .mode(0o700)
+        .create(path.join(".cursor"))
+        .map_err(failure)?;
+    link_workspace_rules(&workspace, &path.join(".cursor"))?;
+    let record = ProjectRecord {
+        workspace: workspace.clone(),
+        agent_id: agent_id.into(),
+        owner_team_id: owner_team_id.into(),
+        directory: directory.receipt().clone(),
+    };
+    let record_path = record_path(&workspace, agent_id);
+    let parent = record_path
+        .parent()
+        .ok_or_else(|| failure("missing record parent"))?;
+    std::fs::create_dir_all(parent).map_err(failure)?;
+    if parent.canonicalize().map_err(failure)? != parent {
+        return Err(failure("record parent is a symlink"));
+    }
+    let bytes = serde_json::to_vec(&record).map_err(failure)?;
+    let mut file = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(record_path)
+        .map_err(failure)?;
+    file.write_all(&bytes)
+        .and_then(|()| file.sync_all())
+        .map_err(failure)?;
+    directory.check_live().map_err(failure)?;
+    validate_cursor_mcp_project_root(&path)?;
+    Ok(path)
+}
+
+fn read_record(workspace: &Path, agent_id: &str) -> Result<Option<ProjectRecord>, LifecycleError> {
+    let path = record_path(workspace, agent_id);
+    let metadata = match std::fs::symlink_metadata(&path) {
+        Ok(metadata) => metadata,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(e) => return Err(failure(e)),
+    };
+    if !metadata.is_file()
+        || metadata.file_type().is_symlink()
+        || metadata.nlink() != 1
+        || metadata.uid() != unsafe { libc::geteuid() }
+        || metadata.mode() & 0o077 != 0
+        || path.parent().and_then(|p| p.canonicalize().ok()).as_deref() != path.parent()
+    {
+        return Err(failure("unowned or aliased project record"));
+    }
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(&path)
+        .map_err(failure)?;
+    let opened = file.metadata().map_err(failure)?;
+    if opened.dev() != metadata.dev() || opened.ino() != metadata.ino() {
+        return Err(failure("project record replaced"));
+    }
+    let mut bytes = Vec::new();
+    file.take(65537).read_to_end(&mut bytes).map_err(failure)?;
+    if bytes.len() > 65536 {
+        return Err(failure("oversized project record"));
+    }
+    let record: ProjectRecord = serde_json::from_slice(&bytes).map_err(failure)?;
+    if record.workspace != workspace
+        || record.agent_id != agent_id
+        || record.owner_team_id.trim().is_empty()
+    {
+        return Err(failure("project record identity mismatch"));
+    }
+    Ok(Some(record))
+}
+
+fn reopen(record: &ProjectRecord) -> Result<ScopedDirectory, LifecycleError> {
+    let key = project_key(&record.workspace, &record.agent_id);
+    if record.directory.path.file_name().and_then(|n| n.to_str())
+        != Some(format!("ta-cursor-{}", &key[..32]).as_str())
+        || record.directory.owner.scope.as_str() != format!("legacy-cursor-{}", &key[..32])
+        || record.directory.owner.seat.as_str() != format!("seat-{}", &key[32..])
+        || record.directory.owner.generation != Generation(1)
+    {
+        return Err(failure("directory receipt identity mismatch"));
+    }
+    let directory = ScopedDirectory::reopen(record.directory.clone()).map_err(failure)?;
+    validate_cursor_mcp_project_root(directory.path())?;
+    let cursor = directory.path().join(".cursor");
+    let metadata = std::fs::symlink_metadata(&cursor).map_err(failure)?;
+    if !metadata.is_dir()
+        || metadata.file_type().is_symlink()
+        || metadata.uid() != unsafe { libc::geteuid() }
+        || metadata.mode() & 0o077 != 0
+    {
+        return Err(failure("unowned .cursor directory"));
+    }
+    Ok(directory)
 }
 
 fn validate_agent_id(agent_id: &str) -> Result<(), LifecycleError> {
     if agent_id.is_empty()
-        || agent_id.contains('/')
-        || agent_id.contains('\\')
         || agent_id.contains("..")
         || !agent_id
             .chars()
-            .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '_' || c == '-')
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-'))
     {
-        return Err(LifecycleError::RequirementUnmet(format!(
-            "error: cursor per-seat MCP project cannot use agent id {agent_id:?}\n\
-             reason: id must be a single path segment [A-Za-z0-9._-]+\n\
-             action: rename the seat; do not share <workspace>/.cursor/mcp.json"
-        )));
+        return Err(failure(
+            "agent id must be a single path segment [A-Za-z0-9._-]+",
+        ));
     }
     Ok(())
 }
 
 fn link_workspace_rules(workspace: &Path, dest_cursor: &Path) -> Result<(), LifecycleError> {
-    let source = workspace.join(".cursor").join("rules");
-    if !source.exists() {
-        return Ok(());
-    }
-    let dest = dest_cursor.join("rules");
-    if dest.exists() {
-        return Ok(());
-    }
-    std::os::unix::fs::symlink(&source, &dest).map_err(|e| {
-        LifecycleError::RequirementUnmet(format!(
-            "error: cannot link workspace cursor rules into per-seat project\n\
-             reason: {e}\n\
-             action: do not fall back to <workspace>/.cursor/mcp.json"
-        ))
-    })
+    let source = workspace.join(".cursor/rules");
+    if source.exists() {
+        std::os::unix::fs::symlink(source, dest_cursor.join("rules")).map_err(failure)?;
+    }
+    Ok(())
 }