@team-agent/installer 0.5.120 → 0.5.122

package/Cargo.lock

@@ -727,7 +727,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.120"
+version = "0.5.122"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -11,7 +11,7 @@ exclude = ["crates/team-agent-contract"]
 
 [workspace.package]
 edition = "2021"
-version = "0.5.120"
+version = "0.5.122"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/intent/runtime.rs

@@ -442,6 +442,37 @@ fn stop_args(plan: &Plan, id: &str) -> StopAgentArgs {
         json: true,
     }
 }
+fn check_incarnation_cwd(
+    selected: &SelectedTeam,
+    id: &str,
+    row: &Value,
+    provider: crate::provider::Provider,
+) -> Result<(), CliError> {
+    if let Some(cwd) = row
+        .get("spawn_cwd")
+        .and_then(Value::as_str)
+        .filter(|cwd| !cwd.is_empty())
+    {
+        let declared_cwd = Path::new(cwd);
+        let cwd = checked(declared_cwd.canonicalize())?;
+        let inside = cwd.starts_with(&selected.run_workspace);
+        #[cfg(unix)]
+        let owned_cursor_primary = !inside
+            && provider == crate::provider::Provider::CursorAgent
+            && checked(crate::lifecycle::launch::cursor_mcp_primary_matches_scope(
+                &selected.run_workspace,
+                &selected.team_key,
+                id,
+                declared_cwd,
+            ))?;
+        #[cfg(not(unix))]
+        let owned_cursor_primary = false;
+        if !cwd.is_dir() || !(inside || owned_cursor_primary) {
+            return Err(refusal("legacy incarnation cwd is outside the selected workspace; no context or scope fallback"));
+        }
+    }
+    Ok(())
+}
 fn preflight_start(
     selected: &SelectedTeam,
     id: &str,
@@ -515,16 +546,7 @@ fn preflight_start(
     {
         return Err(refusal("resume metadata lacks the scoped spawn cwd"));
     }
-    if let Some(cwd) = row
-        .get("spawn_cwd")
-        .and_then(Value::as_str)
-        .filter(|cwd| !cwd.is_empty())
-    {
-        let cwd = checked(Path::new(cwd).canonicalize())?;
-        if !cwd.is_dir() || !cwd.starts_with(&selected.run_workspace) {
-            return Err(refusal("legacy incarnation cwd is outside the selected workspace; no context or scope fallback"));
-        }
-    }
+    check_incarnation_cwd(selected, id, row, provider)?;
     if row
         .get("task_prompt_delivered")
         .is_some_and(|value| !value.is_null() && !value.is_boolean())
@@ -1134,6 +1156,20 @@ pub(super) fn recheck(plan: &Plan, step: &Step, after_stop: bool) -> Result<(),
                 }
             }
         }
+        #[cfg(unix)]
+        if !crate::contract_runtime::framework::is_contract(row)
+            && crate::provider::wire::parse_provider(provider(row))
+                == Some(crate::provider::Provider::CursorAgent)
+            && (matches!(step, Step::StartAgent(_))
+                || (plan.intent.verb == Verb::Restart && matches!(step, Step::StopAgent(_)))
+                || (matches!(step, Step::RestartTeam(_))
+                    && row.get("status").and_then(Value::as_str) == Some("running")
+                    && !crate::state::projection::agent_explicit_stop(row)))
+        {
+            // Reopen the same ownership proof at the existing execution recheck,
+            // before effects; a planning-time receipt is not a filesystem lease.
+            check_incarnation_cwd(&selected, id, row, crate::provider::Provider::CursorAgent)?;
+        }
     }
     Ok(())
 }

package/crates/team-agent/src/cli/intent/runtime_tests.rs

@@ -2,6 +2,10 @@
 use super::super::tests::Sandbox;
 use super::*;
 
+#[cfg(unix)]
+#[path = "../../../tests/support/hermetic.rs"]
+mod hermetic_guard;
+
 fn fixture(ids: &[&str]) -> (Sandbox, Intent) {
     let root = Sandbox::new();
     std::fs::create_dir(root.path().join("agents")).unwrap();
@@ -311,6 +315,116 @@ fn preserve_rejects_known_missing_backing_before_stop_auto_uses_existing_decisio
     }
 }
 
+#[cfg(unix)]
+fn cursor_scope_fixture() -> (
+    hermetic_guard::HermeticTestEnv,
+    Sandbox,
+    SelectedTeam,
+    PathBuf,
+    Value,
+) {
+    let env = hermetic_guard::HermeticTestEnv::enter("cursor-intent-scope");
+    let (root, _) = fixture(&["one"]);
+    install(root.path(), &[("one", "stopped", true)]);
+    let selected =
+        resolve_active_team_readonly(root.path(), Some("fixture"), SelectorMode::RuntimeOnly)
+            .unwrap();
+    let config = crate::provider::McpConfig {
+        raw: json!({"team_orchestrator": {
+            "command": std::env::current_exe().unwrap(),
+            "args": ["mcp-server", "--workspace", root.path()],
+            "env": {"TEAM_AGENT_WORKSPACE": root.path(), "TEAM_AGENT_ID": "one", "TEAM_AGENT_OWNER_TEAM_ID": "fixture", "TEAM_AGENT_AUTH_MODE": "subscription"}
+        }}),
+    };
+    let primary = crate::lifecycle::launch::prepare_cursor_seat_mcp(root.path(), "one", &config)
+        .unwrap()
+        .unwrap();
+    let sid = "af3ce55e-2ee9-4bc5-8dae-b628e7447286";
+    let archive = env
+        .home()
+        .join(".cursor/chats")
+        .join(format!(
+            "{:x}",
+            md5::compute(primary.to_string_lossy().as_bytes())
+        ))
+        .join(sid);
+    std::fs::create_dir_all(&archive).unwrap();
+    std::fs::write(archive.join("meta.json"), b"{}").unwrap();
+    let row = json!({"provider":"cursor_agent","status":"stopped","explicit_stop":true,"session_id":sid,"rollout_path":archive,"spawn_cwd":primary});
+    (env, root, selected, primary, row)
+}
+
+#[test]
+#[cfg(unix)]
+#[serial_test::serial(env)]
+fn issue342_cursor_owned_primary_scope_is_readonly_and_exact() {
+    let (_env, root, selected, primary, row) = cursor_scope_fixture();
+    let state = crate::state::persist::runtime_state_path(root.path());
+    let record = root
+        .path()
+        .join(".team/runtime/provider-config/one/cursor-project.json");
+    let paths = [state, record, primary.join(".cursor/mcp.json")];
+    let before: Vec<_> = paths.iter().map(|p| std::fs::read(p).unwrap()).collect();
+    assert!(!primary.starts_with(root.path()));
+    for policy in [SessionPolicy::Preserve, SessionPolicy::Auto] {
+        assert!(preflight_start(&selected, "one", &row, policy).is_ok());
+    }
+    let after: Vec<_> = paths.iter().map(|p| std::fs::read(p).unwrap()).collect();
+    assert_eq!(
+        before, after,
+        "scope preflight must not write state, record or MCP config"
+    );
+
+    let mut foreign_provider = row.clone();
+    foreign_provider["provider"] = json!("pi");
+    assert!(preflight_start(&selected, "one", &foreign_provider, SessionPolicy::Auto).is_err());
+    let mut other_team = selected.clone();
+    other_team.team_key = "foreign-team".into();
+    assert!(preflight_start(&other_team, "one", &row, SessionPolicy::Preserve).is_err());
+    assert!(preflight_start(&selected, "two", &row, SessionPolicy::Preserve).is_err());
+    let outside = Sandbox::new();
+    let mut other_workspace = selected.clone();
+    other_workspace.run_workspace = outside.path().to_owned();
+    assert!(preflight_start(&other_workspace, "one", &row, SessionPolicy::Preserve).is_err());
+    assert!(!outside.path().join(".team").exists());
+}
+
+#[test]
+#[cfg(unix)]
+#[serial_test::serial(env)]
+fn issue342_cursor_scope_refuses_unrecorded_alias_and_replaced_incarnation() {
+    use std::os::unix::fs::{symlink, DirBuilderExt};
+    let (_env, root, selected, primary, row) = cursor_scope_fixture();
+    let record = root
+        .path()
+        .join(".team/runtime/provider-config/one/cursor-project.json");
+    let bytes = std::fs::read(&record).unwrap();
+    let retained = record.with_extension("retained");
+    std::fs::rename(&record, &retained).unwrap();
+    assert!(preflight_start(&selected, "one", &row, SessionPolicy::Preserve).is_err());
+    assert!(
+        !record.exists(),
+        "a same-named external directory is not authority to create a record"
+    );
+    std::fs::rename(retained, &record).unwrap();
+    let mut forged = row.clone();
+    let arbitrary = Sandbox::new();
+    forged["spawn_cwd"] = json!(arbitrary.path());
+    assert!(preflight_start(&selected, "one", &forged, SessionPolicy::Auto).is_err());
+    let alias = root.path().join("primary-alias");
+    symlink(&primary, &alias).unwrap();
+    forged["spawn_cwd"] = json!(alias);
+    assert!(preflight_start(&selected, "one", &forged, SessionPolicy::Preserve).is_err());
+    let old = primary.with_extension("retained");
+    std::fs::rename(&primary, old).unwrap();
+    std::fs::DirBuilder::new()
+        .mode(0o700)
+        .create(&primary)
+        .unwrap();
+    assert!(preflight_start(&selected, "one", &row, SessionPolicy::Auto).is_err());
+    assert_eq!(std::fs::read(record).unwrap(), bytes);
+}
+
 #[test]
 #[serial_test::serial(env)]
 fn changed_role_and_socket_refuse_in_the_real_readonly_recheck() {

package/crates/team-agent/src/cli/mod.rs

@@ -1724,7 +1724,10 @@ pub mod lifecycle_port {
             let wp = crate::coordinator::WorkspacePath::new(run_workspace.clone());
             let coordinator_pid_before_stop = crate::coordinator::coordinator_health(&wp).pid;
             coordinator_pid_for_report = coordinator_pid_before_stop.map(|pid| pid.get());
-            match stop_coordinator_bounded(wp, std::time::Duration::from_millis(900)) {
+            // Owned termination can use 5s graceful + 5s escalation waits.
+            // Await its result within the existing shutdown deadline, not an
+            // unrelated 900ms cap that abandons a still-finishing stop worker.
+            match stop_coordinator_bounded(wp, deadline.remaining()) {
                 Some(Ok(report)) => Some(report),
                 Some(Err(error)) => {
                     kill_error.get_or_insert(error);

package/crates/team-agent/src/cli/tests/shutdown_kill_plan.rs

@@ -1254,6 +1254,62 @@ fn bounded_coordinator_stop_returns_grace_window_late_success() {
     assert_eq!(report.status, crate::coordinator::StopOutcome::Stopped);
 }
 
+#[test]
+fn bounded_coordinator_stop_retains_completion_beyond_old_1150ms_cap() {
+    let ws = tmp_shutdown_workspace("coordinator-stop-after-old-cap");
+    let cleanup = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let worker_cleanup = cleanup.clone();
+    let report = crate::cli::lifecycle_port::stop_coordinator_bounded_with(
+        crate::coordinator::WorkspacePath::new(ws),
+        std::time::Duration::from_secs(20),
+        move |_workspace| {
+            std::thread::sleep(std::time::Duration::from_millis(1300));
+            worker_cleanup.store(true, std::sync::atomic::Ordering::SeqCst);
+            Ok(crate::coordinator::StopReport {
+                ok: true,
+                status: crate::coordinator::StopOutcome::Stopped,
+                pid: Some(crate::coordinator::Pid::new(12345)),
+            })
+        },
+    )
+    .expect("completion inside the shutdown budget must not be abandoned")
+    .expect("owned stop completed successfully");
+
+    assert!(cleanup.load(std::sync::atomic::Ordering::SeqCst));
+    assert!(report.ok);
+    assert_eq!(report.status, crate::coordinator::StopOutcome::Stopped);
+}
+
+#[test]
+fn bounded_coordinator_stop_does_not_claim_completion_after_budget_exhaustion() {
+    let ws = tmp_shutdown_workspace("coordinator-stop-real-timeout");
+    let (release_tx, release_rx) = std::sync::mpsc::channel();
+    let (completed_tx, completed_rx) = std::sync::mpsc::channel();
+    let report = crate::cli::lifecycle_port::stop_coordinator_bounded_with(
+        crate::coordinator::WorkspacePath::new(ws),
+        std::time::Duration::from_millis(1),
+        move |_workspace| {
+            release_rx.recv().unwrap();
+            completed_tx.send(()).unwrap();
+            Ok(crate::coordinator::StopReport {
+                ok: true,
+                status: crate::coordinator::StopOutcome::Stopped,
+                pid: Some(crate::coordinator::Pid::new(12345)),
+            })
+        },
+    );
+
+    assert!(report.is_none(), "an unfinished stop must remain unknown");
+    assert!(matches!(
+        completed_rx.try_recv(),
+        Err(std::sync::mpsc::TryRecvError::Empty)
+    ));
+    release_tx.send(()).unwrap();
+    completed_rx
+        .recv_timeout(std::time::Duration::from_secs(5))
+        .expect("release the controlled worker without leaving a blocked thread");
+}
+
 #[test]
 fn shutdown_outcome_late_or_postcheck_gone_is_ok_with_lsof_diagnostic() {
     let out = crate::cli::lifecycle_port::classify_shutdown_outcome(

package/crates/team-agent/src/coordinator/tests/health_sync.rs

@@ -15,6 +15,7 @@ use super::*;
 /// agent. `has_session`→true (gate passes); `inject`→Ok (delivery may run); the rest are Ok defaults.
 struct CapturingTransport {
     scrollback: String,
+    targets: Vec<PaneInfo>,
 }
 impl Transport for CapturingTransport {
     fn kind(&self) -> BackendKind {
@@ -73,7 +74,7 @@ impl Transport for CapturingTransport {
         Ok(PaneLiveness::Live)
     }
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
-        Ok(Vec::new())
+        Ok(self.targets.clone())
     }
     fn has_session(&self, _s: &SessionName) -> Result<bool, TransportError> {
         Ok(true)
@@ -106,6 +107,14 @@ impl Transport for CapturingTransport {
 fn seeded_health_coord(
     agents: serde_json::Value,
     scrollback: &str,
+) -> (Coordinator, std::path::PathBuf) {
+    seeded_health_coord_with_readiness(agents, scrollback, false)
+}
+
+fn seeded_health_coord_with_readiness(
+    agents: serde_json::Value,
+    scrollback: &str,
+    ready: bool,
 ) -> (Coordinator, std::path::PathBuf) {
     use std::sync::atomic::{AtomicU64, Ordering};
     static N: AtomicU64 = AtomicU64::new(0);
@@ -115,11 +124,18 @@ fn seeded_health_coord(
         N.fetch_add(1, Ordering::Relaxed)
     ));
     std::fs::create_dir_all(&dir).unwrap();
-    crate::state::persist::save_runtime_state(
-        &dir,
-        &serde_json::json!({ "session_name": "team-health", "agents": agents }),
-    )
-    .unwrap();
+    let mut state = serde_json::json!({ "session_name": "team-health", "agents": agents });
+    #[cfg(unix)]
+    let targets = if ready {
+        vec![crate::mcp_server::readiness::test_ready_worker(
+            &dir, &mut state, "current", "w1", "%1",
+        )]
+    } else {
+        Vec::new()
+    };
+    #[cfg(not(unix))]
+    let targets = { let _ = ready; Vec::new() };
+    crate::state::persist::save_runtime_state(&dir, &state).unwrap();
     let ws = WorkspacePath::new(dir.clone());
     let reg: Box<dyn ProviderRegistry> = Box::new(MockRegistry::new(&[], &[]));
     let coord = Coordinator::for_test(
@@ -127,6 +143,7 @@ fn seeded_health_coord(
         reg,
         Box::new(CapturingTransport {
             scrollback: scrollback.to_string(),
+            targets,
         }),
         None,
         None,
@@ -260,10 +277,12 @@ fn spine2_capture_missing_captures_session_id_for_missing_agent() {
 // activity/agent_health WORKING remains diagnostic turn state.
 #[test]
 fn spine2_sync_health_working_status_delivers_same_tick() {
-    let (coord, dir) = seeded_health_coord(one_agent("codex"), "Working (5s · esc to interrupt)");
+    let (coord, dir) = seeded_health_coord_with_readiness(
+        one_agent("codex"), "Working (5s · esc to interrupt)", true,
+    );
     let store = MessageStore::open(&dir).unwrap();
     let mid = store
-        .create_message(Some("t"), "leader", "w1", "hi", None, true, None)
+        .create_message(Some("t"), "leader", "w1", "hi", None, true, Some("current"))
         .unwrap();
     let conn = crate::db::schema::open_db(store.db_path()).unwrap();
     conn.execute(

package/crates/team-agent/src/db/message_store.rs

@@ -585,6 +585,30 @@ impl MessageStore {
         Ok(rows == 1)
     }
 
+    /// Release only an owned claim that has performed no input. Readiness
+    /// waiting must remain retryable without consuming the input-attempt budget.
+    /// A changed attempt, status, or error means this caller no longer owns it.
+    pub(crate) fn release_delivery_before_input(
+        &self,
+        message_id: &str,
+        attempt: u32,
+        reason: &str,
+    ) -> Result<bool, MessageStoreError> {
+        if attempt == 0 || reason.is_empty() {
+            return Ok(false);
+        }
+        let conn = crate::db::schema::open_db(&self.path)?;
+        let rows = conn.execute(
+            "update messages
+             set delivery_attempts = delivery_attempts - 1,
+                 error = ?3, updated_at = ?4
+             where message_id = ?1 and status = 'target_resolved'
+               and error is null and delivery_attempts = ?2",
+            params![message_id, attempt, reason, now_ts()],
+        )?;
+        Ok(rows == 1)
+    }
+
     /// Read inbox rows through [`Self::inbox`]; recovery transitions below are
     /// separate repository owners and are not claim eligibility.
     pub fn requeue_blocked_leader_messages(
@@ -1168,6 +1192,47 @@ mod tests {
         assert_eq!(col_i64(&read(&s), &mid, "delivery_attempts"), 1);
     }
 
+    #[test]
+    fn release_delivery_before_input_preserves_budget_and_single_winner() {
+        let s = store();
+        let mid = s.create_message(Some("t"), "s", "r", "c", None, true, None).unwrap();
+        assert!(s.claim_for_delivery(&mid).unwrap());
+        assert!(!s.claim_for_delivery(&mid).unwrap());
+        assert!(s.release_delivery_before_input(&mid, 1, "mcp_handshake_missing").unwrap());
+        assert_eq!(col_i64(&read(&s), &mid, "delivery_attempts"), 0);
+        assert_eq!(col_str(&read(&s), &mid, "error").as_deref(), Some("mcp_handshake_missing"));
+        assert!(!s.release_delivery_before_input(&mid, 1, "late").unwrap());
+        assert!(s.claim_for_delivery(&mid).unwrap());
+        assert!(!s.claim_for_delivery(&mid).unwrap());
+        assert_eq!(col_i64(&read(&s), &mid, "delivery_attempts"), 1);
+    }
+
+    #[test]
+    fn release_delivery_before_input_cannot_overwrite_changed_claims() {
+        let s = store();
+        let mid = s.create_message(Some("t"), "s", "r", "c", None, true, None).unwrap();
+        assert!(s.claim_for_delivery(&mid).unwrap());
+        assert!(!s.release_delivery_before_input(&mid, 0, "missing").unwrap());
+        assert!(!s.release_delivery_before_input(&mid, 2, "stale").unwrap());
+        s.mark(&mid, "target_resolved", Some("other_owner")).unwrap();
+        assert!(!s.release_delivery_before_input(&mid, 1, "stale").unwrap());
+        assert_eq!(col_str(&read(&s), &mid, "error").as_deref(), Some("other_owner"));
+        assert!(s.claim_for_delivery(&mid).unwrap());
+        assert!(!s.release_delivery_before_input(&mid, 1, "old_claim").unwrap());
+        assert_eq!(col_i64(&read(&s), &mid, "delivery_attempts"), 2);
+        assert_eq!(col_str(&read(&s), &mid, "error"), None);
+        for status in ["cancelled", "delivered", "submitted_unverified"] {
+            // Each terminal/effect state needs its own row: mark correctly
+            // refuses to downgrade a previously delivered row.
+            let changed = s.create_message(Some("t"), "s", "r", "c", None, true, None).unwrap();
+            assert!(s.claim_for_delivery(&changed).unwrap());
+            s.mark(&changed, status, None).unwrap();
+            assert!(!s.release_delivery_before_input(&changed, 1, "stale").unwrap());
+            assert_eq!(status_of(&read(&s), &changed), status);
+            assert_eq!(col_i64(&read(&s), &changed, "delivery_attempts"), 1);
+        }
+    }
+
     #[test]
     fn claim_for_delivery_never_claims_stored_only_presentation() {
         let s = store();

package/crates/team-agent/src/lifecycle/launch/agent_state.rs

@@ -129,6 +129,14 @@ pub(super) fn running_agent_state(
     if let Some(started_agent) = started_agent {
         persist_started_agent_plan_state(&mut state, started_agent);
     }
+    // Cursor chdirs to its native --workspace primary. Session archives are
+    // keyed by this directory, not the real project supplied via --add-dir.
+    let cursor_cwd = if provider == Provider::CursorAgent && cursor_mcp_isolation_enabled() {
+        Some(cursor_mcp_project_dir(workspace, id)?)
+    } else {
+        None
+    };
+    let spawn_cwd = cursor_cwd.as_deref().unwrap_or(spawn_cwd);
     state.insert(
         "spawn_cwd".to_string(),
         serde_json::json!(spawn_cwd.to_string_lossy().to_string()),

package/crates/team-agent/src/lifecycle/launch/cursor_mcp.rs

@@ -33,6 +33,7 @@ use crate::provider::Provider;
 
 use super::cursor_mcp_iso::{
     cursor_mcp_isolation_enabled, cursor_mcp_project_dir, materialize_cursor_mcp_project,
+    validate_cursor_mcp_project_root,
 };
 
 /// Keys that must appear in mcp.json env. Cursor strips parent env down to
@@ -280,8 +281,31 @@ pub fn prepare_cursor_seat_mcp(
     mcp_config: &crate::provider::McpConfig,
 ) -> Result<Option<PathBuf>, LifecycleError> {
     if cursor_mcp_isolation_enabled() {
-        let project = materialize_cursor_mcp_project(workspace, agent_id)?;
+        let server = mcp_config
+            .raw
+            .get("team_orchestrator")
+            .or_else(|| mcp_config.raw.get("team-agent"));
+        let env = server.and_then(|s| s.get("env"));
+        let field = |key| {
+            env.and_then(|v| v.get(key))
+                .and_then(serde_json::Value::as_str)
+        };
+        let physical = physical_workspace_path(workspace);
+        if field("TEAM_AGENT_ID") != Some(agent_id)
+            || field("TEAM_AGENT_WORKSPACE") != physical.to_str()
+        {
+            return Err(LifecycleError::RequirementUnmet(
+                "cursor MCP resolved identity does not match the selected workspace/seat".into(),
+            ));
+        }
+        let owner = field("TEAM_AGENT_OWNER_TEAM_ID")
+            .filter(|s| !s.trim().is_empty())
+            .ok_or_else(|| {
+                LifecycleError::RequirementUnmet("cursor MCP missing owner team".into())
+            })?;
+        let project = materialize_cursor_mcp_project(&physical, agent_id, owner)?;
         apply_cursor_mcp_overlay(&project, mcp_config)?;
+        validate_cursor_project_mcp(&physical, &project)?;
         Ok(Some(project))
     } else {
         apply_cursor_mcp_overlay(workspace, mcp_config)?;
@@ -305,14 +329,15 @@ pub fn enable_cursor_workspace_mcp_with_profile(
     profile_launch: Option<&crate::provider::ProviderProfileLaunch>,
 ) -> Result<(), LifecycleError> {
     let physical = cursor_mcp_enable_working_dir(workspace, project_root);
+    if project_root.is_some() {
+        validate_cursor_project_mcp(&physical_workspace_path(workspace), &physical)?;
+    }
     if skip_cursor_mcp_enable() {
         return Ok(());
     }
     let argv = cursor_mcp_enable_argv();
     let mut command = Command::new(&argv[0]);
-    command
-        .args(&argv[1..])
-        .current_dir(&physical);
+    command.args(&argv[1..]).current_dir(&physical);
     apply_cursor_mcp_enable_profile_env(&mut command, profile_launch);
     let output = command.output().map_err(|e| {
         LifecycleError::RequirementUnmet(format!(
@@ -323,6 +348,11 @@ pub fn enable_cursor_workspace_mcp_with_profile(
         ))
     })?;
     if output.status.success() {
+        // Approval is not native tool readiness. Recheck our root/config after
+        // the external command; native loading/calls still need their own proof.
+        if project_root.is_some() {
+            validate_cursor_project_mcp(&physical_workspace_path(workspace), &physical)?;
+        }
         return Ok(());
     }
     let stderr = String::from_utf8_lossy(&output.stderr);
@@ -343,6 +373,83 @@ pub fn enable_cursor_workspace_mcp_with_profile(
     )))
 }
 
+fn validate_cursor_project_mcp(workspace: &Path, project: &Path) -> Result<(), LifecycleError> {
+    use std::io::Read;
+    use std::os::unix::fs::{MetadataExt, OpenOptionsExt};
+    validate_cursor_mcp_project_root(project)?;
+    let refuse = || {
+        LifecycleError::RequirementUnmet(
+        "cursor MCP private config is missing, mismatched, or its server executable is unavailable; native tools are not ready".into(),
+    )
+    };
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(project.join(".cursor/mcp.json"))
+        .map_err(|_| refuse())?;
+    let metadata = file.metadata().map_err(|_| refuse())?;
+    if !metadata.is_file() || metadata.nlink() != 1 || metadata.uid() != unsafe { libc::geteuid() }
+    {
+        return Err(refuse());
+    }
+    let mut bytes = Vec::new();
+    file.take(65537)
+        .read_to_end(&mut bytes)
+        .map_err(|_| refuse())?;
+    if bytes.len() > 65536 {
+        return Err(refuse());
+    }
+    let config: serde_json::Value = serde_json::from_slice(&bytes).map_err(|_| refuse())?;
+    let server = config
+        .get("mcpServers")
+        .and_then(|v| v.get("team_orchestrator"))
+        .ok_or_else(refuse)?;
+    let env = server.get("env").ok_or_else(refuse)?;
+    for key in REQUIRED_IDENTITY_KEYS {
+        if env
+            .get(*key)
+            .and_then(serde_json::Value::as_str)
+            .is_none_or(|s| s.trim().is_empty() || s.contains('{'))
+        {
+            return Err(refuse());
+        }
+    }
+    let seat = env
+        .get("TEAM_AGENT_ID")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(refuse)?;
+    let owner = env
+        .get("TEAM_AGENT_OWNER_TEAM_ID")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(refuse)?;
+    if env
+        .get("TEAM_AGENT_WORKSPACE")
+        .and_then(serde_json::Value::as_str)
+        != workspace.to_str()
+        || cursor_mcp_project_dir(workspace, seat)? != project
+        || materialize_cursor_mcp_project(workspace, seat, owner)? != project
+    {
+        return Err(refuse());
+    }
+    let command = server
+        .get("command")
+        .and_then(serde_json::Value::as_str)
+        .ok_or_else(refuse)?;
+    let metadata = std::fs::metadata(command).map_err(|_| refuse())?;
+    let current = std::env::current_exe()
+        .and_then(std::fs::canonicalize)
+        .map_err(|_| refuse())?;
+    if !Path::new(command).is_absolute()
+        || !metadata.is_file()
+        || metadata.mode() & 0o111 == 0
+        || std::fs::canonicalize(command).map_err(|_| refuse())? != current
+        || server.get("args") != Some(&serde_json::json!(["mcp-server", "--workspace", workspace]))
+    {
+        return Err(refuse());
+    }
+    Ok(())
+}
+
 pub(crate) fn apply_cursor_mcp_enable_profile_env(
     command: &mut Command,
     profile_launch: Option<&crate::provider::ProviderProfileLaunch>,