@team-agent/installer 0.5.120 → 0.5.122

package/crates/team-agent/src/lifecycle/launch/cursor_mcp_iso.rs

@@ -1,120 +1,282 @@
-//! ---
-//! purpose: cursor 的目录作用域 mcp.json 改成 per-seat provider-config 工程根（对齐 grok overlay / claude CLAUDE_CONFIG_DIR）
-//! contract:
-//!   provides:
-//!     - name: materialize_cursor_mcp_project
-//!       what: 在 provider-config/<id>/cursor 建 .cursor/，失败不写共用 mcp.json
-//!     - name: cursor_mcp_isolation_enabled
-//!       what: 默认开；TEAM_AGENT_CURSOR_MCP_ISOLATION=0 时关（只给破坏齿/回归旧闸）
-//!     - name: cursor_mcp_project_dir
-//!       what: 该席位作为 cursor --workspace 的工程根（未建盘）
-//! boundary:
-//!   - 隔离失败 = RequirementUnmet，⛔ 不降级写 <workspace>/.cursor/mcp.json
-//!   - 不改 HOME（不是 copilot COPILOT_HOME / 会话库分叉）
-//!   - 不削弱 refuse_second：隔离关闭时仍拒第二席
-//! maturity: wired
-//! ---
+//! Cursor's native MCP project root must be an owned primary outside Git ancestry.
+//! Keep the real project as --add-dir; never overwrite its shared MCP config or
+//! silently relocate an existing native session. The persisted directory receipt
+//! is transport ownership, not a canonical Provider/native-session identity.
 
+use std::io::{Read, Write};
+use std::os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt};
 use std::path::{Path, PathBuf};
 
+use serde::{Deserialize, Serialize};
+use team_agent_contract::contract::types::{
+    Generation, InstanceId, InstanceIdentity, ScopeId, SeatId,
+};
+use team_agent_contract::host::files::{DirectoryReceipt, ScopedDirectory};
+use team_agent_contract::host::{digest, digest_hex};
+
 use crate::lifecycle::LifecycleError;
 
 const ISOLATION_ENV: &str = "TEAM_AGENT_CURSOR_MCP_ISOLATION";
 
-/// ---
-/// purpose: 默认开启 per-seat provider-config 工程根；显式 0/false/off 才关
-/// ---
+#[derive(Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ProjectRecord {
+    workspace: PathBuf,
+    agent_id: String,
+    owner_team_id: String,
+    directory: DirectoryReceipt,
+}
+
 pub fn cursor_mcp_isolation_enabled() -> bool {
     match std::env::var(ISOLATION_ENV) {
-        Ok(value) => {
-            let trimmed = value.trim();
-            !matches!(
-                trimmed,
-                "0" | "false" | "FALSE" | "off" | "OFF" | "no" | "NO"
-            )
-        }
+        Ok(value) => !matches!(
+            value.trim(),
+            "0" | "false" | "FALSE" | "off" | "OFF" | "no" | "NO"
+        ),
         Err(_) => true,
     }
 }
 
-/// ---
-/// purpose: 算出该席位 cursor --workspace 工程根，不建盘
-/// ---
+fn failure(reason: impl std::fmt::Display) -> LifecycleError {
+    LifecycleError::RequirementUnmet(format!(
+        "cursor MCP private project refused: {reason}; do not overwrite shared .cursor/mcp.json or move an existing session"
+    ))
+}
+
+fn record_path(workspace: &Path, agent_id: &str) -> PathBuf {
+    workspace
+        .join(".team/runtime/provider-config")
+        .join(agent_id)
+        .join("cursor-project.json")
+}
+
+fn project_key(workspace: &Path, agent_id: &str) -> String {
+    digest_hex(digest(
+        format!("{}\0{agent_id}", workspace.display()).as_bytes(),
+    ))
+}
+
+fn planned_project(workspace: &Path, agent_id: &str) -> Result<PathBuf, LifecycleError> {
+    // Do not assume TMPDIR is outside Git, or use an unchecked symlink alias.
+    let parent = std::env::temp_dir().canonicalize().map_err(failure)?;
+    validate_cursor_mcp_project_root(&parent)?;
+    Ok(parent.join(format!(
+        "ta-cursor-{}",
+        &project_key(workspace, agent_id)[..32]
+    )))
+}
+
+/// Computes a new path without creating it; existing allocations must reopen
+/// their captured receipt, never adopt a replacement directory or a new TMPDIR.
 pub fn cursor_mcp_project_dir(workspace: &Path, agent_id: &str) -> Result<PathBuf, LifecycleError> {
     validate_agent_id(agent_id)?;
-    Ok(workspace
-        .join(".team")
-        .join("runtime")
-        .join("provider-config")
-        .join(agent_id)
-        .join("cursor"))
+    let workspace = workspace.canonicalize().map_err(failure)?;
+    match read_record(&workspace, agent_id)? {
+        Some(record) => Ok(reopen(&record)?.path().to_path_buf()),
+        None => planned_project(&workspace, agent_id),
+    }
 }
 
-/// ---
-/// purpose: 该席位 cursor 实际会读的项目 mcp.json
-/// ---
 pub fn cursor_mcp_json_path(workspace: &Path, agent_id: &str) -> Result<PathBuf, LifecycleError> {
-    Ok(cursor_mcp_project_dir(workspace, agent_id)?
-        .join(".cursor")
-        .join("mcp.json"))
+    Ok(cursor_mcp_project_dir(workspace, agent_id)?.join(".cursor/mcp.json"))
+}
+
+/// Read-only scope proof for CLI planning. An external pathname or a matching
+/// directory name is not ownership: the existing selected-team record must pin
+/// this exact physical cwd. Never materialize or repair during preflight.
+pub(crate) fn cursor_mcp_primary_matches_scope(
+    workspace: &Path,
+    owner_team_id: &str,
+    agent_id: &str,
+    declared_cwd: &Path,
+) -> Result<bool, LifecycleError> {
+    validate_agent_id(agent_id)?;
+    let workspace = workspace.canonicalize().map_err(failure)?;
+    let Some(record) = read_record(&workspace, agent_id)? else {
+        return Ok(false);
+    };
+    if record.owner_team_id != owner_team_id || record.directory.path != declared_cwd {
+        return Ok(false);
+    }
+    Ok(reopen(&record)?.path() == declared_cwd)
+}
+
+/// Metadata-only mirror of the measured native project-root boundary. A .git
+/// directory OR worktree file on any ancestor would redirect native MCP loading.
+pub(super) fn validate_cursor_mcp_project_root(project: &Path) -> Result<(), LifecycleError> {
+    if project.canonicalize().map_err(failure)? != project {
+        return Err(failure("project path is not physical"));
+    }
+    for ancestor in project.ancestors() {
+        match std::fs::symlink_metadata(ancestor.join(".git")) {
+            Ok(_) => {
+                return Err(failure(
+                    "Git ancestor would redirect native MCP projectRoot",
+                ))
+            }
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(failure(e)),
+        }
+    }
+    Ok(())
 }
 
-/// ---
-/// purpose: 建 per-seat 工程根，并把团队 rules 链进该根（不链 mcp.json）
-/// returns: 工程根
-/// errors: agent_id 非法或建盘失败 → RequirementUnmet（不写共用 mcp.json）
-/// ---
 pub fn materialize_cursor_mcp_project(
     workspace: &Path,
     agent_id: &str,
+    owner_team_id: &str,
 ) -> Result<PathBuf, LifecycleError> {
-    let project = cursor_mcp_project_dir(workspace, agent_id)?;
-    let cursor_dir = project.join(".cursor");
-    std::fs::create_dir_all(&cursor_dir).map_err(|e| {
-        LifecycleError::RequirementUnmet(format!(
-            "error: cannot materialize cursor per-seat MCP project\n\
-             reason: {e}\n\
-             path: {}\n\
-             action: fix workspace permissions; do not fall back to <workspace>/.cursor/mcp.json",
-            cursor_dir.display()
-        ))
-    })?;
-    link_workspace_rules(workspace, &cursor_dir)?;
-    Ok(project)
+    validate_agent_id(agent_id)?;
+    let workspace = workspace.canonicalize().map_err(failure)?;
+    if owner_team_id.trim().is_empty() {
+        return Err(failure("missing owner team"));
+    }
+    if let Some(record) = read_record(&workspace, agent_id)? {
+        if record.owner_team_id != owner_team_id {
+            return Err(failure("record belongs to another owner team"));
+        }
+        return Ok(reopen(&record)?.path().to_path_buf());
+    }
+    let legacy = workspace
+        .join(".team/runtime/provider-config")
+        .join(agent_id)
+        .join("cursor");
+    match std::fs::symlink_metadata(&legacy) {
+        Ok(_) => return Err(failure("unrecorded legacy primary exists; preserve its cwd/SID and explicitly select a fresh seat")),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(failure(e)),
+    }
+    let path = planned_project(&workspace, agent_id)?;
+    let key = project_key(&workspace, agent_id);
+    let mut nonce = [0u8; 32];
+    std::fs::File::open("/dev/urandom")
+        .and_then(|mut f| f.read_exact(&mut nonce))
+        .map_err(failure)?;
+    let owner = InstanceIdentity {
+        scope: ScopeId::new(format!("legacy-cursor-{}", &key[..32])).map_err(failure)?,
+        seat: SeatId::new(format!("seat-{}", &key[32..])).map_err(failure)?,
+        instance: InstanceId::new(format!("cwd-{}", digest_hex(digest(&nonce))))
+            .map_err(failure)?,
+        generation: Generation(1),
+    };
+    let directory = ScopedDirectory::create(&path, owner).map_err(failure)?;
+    std::fs::DirBuilder::new()
+        .mode(0o700)
+        .create(path.join(".cursor"))
+        .map_err(failure)?;
+    link_workspace_rules(&workspace, &path.join(".cursor"))?;
+    let record = ProjectRecord {
+        workspace: workspace.clone(),
+        agent_id: agent_id.into(),
+        owner_team_id: owner_team_id.into(),
+        directory: directory.receipt().clone(),
+    };
+    let record_path = record_path(&workspace, agent_id);
+    let parent = record_path
+        .parent()
+        .ok_or_else(|| failure("missing record parent"))?;
+    std::fs::create_dir_all(parent).map_err(failure)?;
+    if parent.canonicalize().map_err(failure)? != parent {
+        return Err(failure("record parent is a symlink"));
+    }
+    let bytes = serde_json::to_vec(&record).map_err(failure)?;
+    let mut file = std::fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .mode(0o600)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(record_path)
+        .map_err(failure)?;
+    file.write_all(&bytes)
+        .and_then(|()| file.sync_all())
+        .map_err(failure)?;
+    directory.check_live().map_err(failure)?;
+    validate_cursor_mcp_project_root(&path)?;
+    Ok(path)
+}
+
+fn read_record(workspace: &Path, agent_id: &str) -> Result<Option<ProjectRecord>, LifecycleError> {
+    let path = record_path(workspace, agent_id);
+    let metadata = match std::fs::symlink_metadata(&path) {
+        Ok(metadata) => metadata,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(e) => return Err(failure(e)),
+    };
+    if !metadata.is_file()
+        || metadata.file_type().is_symlink()
+        || metadata.nlink() != 1
+        || metadata.uid() != unsafe { libc::geteuid() }
+        || metadata.mode() & 0o077 != 0
+        || path.parent().and_then(|p| p.canonicalize().ok()).as_deref() != path.parent()
+    {
+        return Err(failure("unowned or aliased project record"));
+    }
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC)
+        .open(&path)
+        .map_err(failure)?;
+    let opened = file.metadata().map_err(failure)?;
+    if opened.dev() != metadata.dev() || opened.ino() != metadata.ino() {
+        return Err(failure("project record replaced"));
+    }
+    let mut bytes = Vec::new();
+    file.take(65537).read_to_end(&mut bytes).map_err(failure)?;
+    if bytes.len() > 65536 {
+        return Err(failure("oversized project record"));
+    }
+    let record: ProjectRecord = serde_json::from_slice(&bytes).map_err(failure)?;
+    if record.workspace != workspace
+        || record.agent_id != agent_id
+        || record.owner_team_id.trim().is_empty()
+    {
+        return Err(failure("project record identity mismatch"));
+    }
+    Ok(Some(record))
+}
+
+fn reopen(record: &ProjectRecord) -> Result<ScopedDirectory, LifecycleError> {
+    let key = project_key(&record.workspace, &record.agent_id);
+    if record.directory.path.file_name().and_then(|n| n.to_str())
+        != Some(format!("ta-cursor-{}", &key[..32]).as_str())
+        || record.directory.owner.scope.as_str() != format!("legacy-cursor-{}", &key[..32])
+        || record.directory.owner.seat.as_str() != format!("seat-{}", &key[32..])
+        || record.directory.owner.generation != Generation(1)
+    {
+        return Err(failure("directory receipt identity mismatch"));
+    }
+    let directory = ScopedDirectory::reopen(record.directory.clone()).map_err(failure)?;
+    validate_cursor_mcp_project_root(directory.path())?;
+    let cursor = directory.path().join(".cursor");
+    let metadata = std::fs::symlink_metadata(&cursor).map_err(failure)?;
+    if !metadata.is_dir()
+        || metadata.file_type().is_symlink()
+        || metadata.uid() != unsafe { libc::geteuid() }
+        || metadata.mode() & 0o077 != 0
+    {
+        return Err(failure("unowned .cursor directory"));
+    }
+    Ok(directory)
 }
 
 fn validate_agent_id(agent_id: &str) -> Result<(), LifecycleError> {
     if agent_id.is_empty()
-        || agent_id.contains('/')
-        || agent_id.contains('\\')
         || agent_id.contains("..")
         || !agent_id
             .chars()
-            .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '_' || c == '-')
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '.' | '_' | '-'))
     {
-        return Err(LifecycleError::RequirementUnmet(format!(
-            "error: cursor per-seat MCP project cannot use agent id {agent_id:?}\n\
-             reason: id must be a single path segment [A-Za-z0-9._-]+\n\
-             action: rename the seat; do not share <workspace>/.cursor/mcp.json"
-        )));
+        return Err(failure(
+            "agent id must be a single path segment [A-Za-z0-9._-]+",
+        ));
     }
     Ok(())
 }
 
 fn link_workspace_rules(workspace: &Path, dest_cursor: &Path) -> Result<(), LifecycleError> {
-    let source = workspace.join(".cursor").join("rules");
-    if !source.exists() {
-        return Ok(());
-    }
-    let dest = dest_cursor.join("rules");
-    if dest.exists() {
-        return Ok(());
-    }
-    std::os::unix::fs::symlink(&source, &dest).map_err(|e| {
-        LifecycleError::RequirementUnmet(format!(
-            "error: cannot link workspace cursor rules into per-seat project\n\
-             reason: {e}\n\
-             action: do not fall back to <workspace>/.cursor/mcp.json"
-        ))
-    })
+    let source = workspace.join(".cursor/rules");
+    if source.exists() {
+        std::os::unix::fs::symlink(source, dest_cursor.join("rules")).map_err(failure)?;
+    }
+    Ok(())
 }

package/crates/team-agent/src/lifecycle/launch.rs

@@ -375,6 +375,7 @@ pub(crate) fn run_pi_catalog_preflight(
 }
 
 mod cursor_mcp_iso;
+pub(crate) use cursor_mcp_iso::cursor_mcp_primary_matches_scope;
 pub use cursor_mcp_iso::{
     cursor_mcp_isolation_enabled, cursor_mcp_json_path, cursor_mcp_project_dir,
     materialize_cursor_mcp_project,

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -1410,6 +1410,9 @@ pub(super) fn mark_agent_started(
         "spawn_cwd".to_string(),
         serde_json::json!(spawn.spawn_cwd.to_string_lossy().to_string()),
     );
+    if let Some(path) = &spawn.mcp_config_path {
+        agent.insert("mcp_config".to_string(), serde_json::json!(path));
+    }
     // 0.4.6 Stage 1+2: ensure spawn_epoch is present after every start.
     // reset_agent_at_paths bumps it before start; non-reset starts
     // initialise to 1 (or preserve existing) so capture/event paths can

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -45,6 +45,8 @@ pub(super) struct SpawnedAgentWindow {
     pub profile_launch: crate::provider::ProviderProfileLaunch,
     pub layout_placement: Option<crate::lifecycle::launch::LayoutPlacement>,
     pub spawn_cwd: std::path::PathBuf,
+    /// Actual configuration generated for this spawn, not inferred from old state.
+    pub mcp_config_path: Option<std::path::PathBuf>,
     /// Issue 2 (Round 3b gate review §6): the resolved `owner_team_id` used
     /// for this spawn's MCP env / command. Callers (`mark_agent_respawned`,
     /// `mark_agent_started`) must persist this back into the agent row so
@@ -462,6 +464,9 @@ pub(super) fn spawn_agent_window(
             &mut env,
         )?;
     }
+    // Keep provider/native cwd distinct from the real Team workspace. Cursor
+    // changes cwd to --workspace before writing its cwd-keyed session archive.
+    let mut native_spawn_cwd = spawn_cwd.to_path_buf();
     // 0.5.67 Cursor 方案 1 变体: role 经 workspace rules 文件注入 (不 argv)。
     if provider == crate::provider::Provider::CursorAgent {
         crate::lifecycle::launch::refuse_second_cursor_occupant(
@@ -479,6 +484,9 @@ pub(super) fn spawn_agent_window(
             agent_id.as_str(),
             &mcp_config,
         )?;
+        if let Some(primary) = project.as_ref() {
+            native_spawn_cwd = primary.clone();
+        }
         crate::lifecycle::launch::enable_cursor_workspace_mcp_with_profile(
             workspace,
             project.as_deref(),
@@ -694,7 +702,8 @@ pub(super) fn spawn_agent_window(
         plan,
         profile_launch,
         layout_placement: layout_placement.cloned(),
-        spawn_cwd: spawn_cwd.to_path_buf(),
+        spawn_cwd: native_spawn_cwd,
+        mcp_config_path,
         owner_team_id: team_id,
     })
 }

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -2480,6 +2480,9 @@ fn mark_agent_respawned(
         "spawn_cwd".to_string(),
         serde_json::json!(spawn.spawn_cwd.to_string_lossy().to_string()),
     );
+    if let Some(path) = &spawn.mcp_config_path {
+        agent.insert("mcp_config".to_string(), serde_json::json!(path));
+    }
     // 0.5.38 (`.team/artifacts/startup-latency-locate.md` §7): every
     // multi-worker restart respawn is a fresh process cohort. The
     // pre-0.5.38 code only wrote `spawned_at` here and left `spawn_epoch`
@@ -2968,6 +2971,7 @@ impl Clone for ParallelSpawnResult {
                 profile_launch: self.spawn.profile_launch.clone(),
                 layout_placement: self.spawn.layout_placement.clone(),
                 spawn_cwd: self.spawn.spawn_cwd.clone(),
+                mcp_config_path: self.spawn.mcp_config_path.clone(),
                 owner_team_id: self.spawn.owner_team_id.clone(),
             },
             spawn_start: self.spawn_start,
@@ -4232,6 +4236,7 @@ tasks:
             profile_launch: crate::provider::ProviderProfileLaunch::default(),
             layout_placement: None,
             spawn_cwd: std::path::PathBuf::from("/tmp/team-epoch"),
+            mcp_config_path: None,
             owner_team_id: None,
         };
         mark_agent_respawned(

package/crates/team-agent/src/lifecycle/tests/acceptance_b_batch_red.rs

@@ -59,6 +59,14 @@ fn b4_monitor_step_failure_does_not_block_deliver_pending() {
     let _g = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("b4-monitor");
     seed_copilot_team_state(&ws, "cp1", true);
+    let mut state = team_agent::state::persist::load_runtime_state(&ws).unwrap();
+    #[cfg(unix)]
+    let targets = vec![crate::mcp_server::readiness::test_ready_worker(
+        &ws, &mut state, "team-b4", "cp1", "%41",
+    )];
+    #[cfg(not(unix))]
+    let targets = Vec::new();
+    save_runtime_state(&ws, &state).unwrap();
     let store = MessageStore::open(&ws).unwrap();
     store
         .create_message(
@@ -68,14 +76,17 @@ fn b4_monitor_step_failure_does_not_block_deliver_pending() {
             "do the thing",
             None,
             false,
-            None,
+            Some("team-b4"),
         )
         .unwrap();
 
     let coord = Coordinator::new(
         WorkspacePath::new(ws.clone()),
         Box::new(RealRegistry),
-        Box::new(MonitorFailTransport::new()),
+        Box::new(MonitorFailTransport {
+            targets,
+            ..MonitorFailTransport::new()
+        }),
     );
     let report = coord.tick();
 
@@ -603,11 +614,13 @@ fn attach_socket_path(command: &str) -> Option<PathBuf> {
 /// (B-4). Sessions/windows present so the tick proceeds to the monitor steps.
 struct MonitorFailTransport {
     session: Mutex<bool>,
+    targets: Vec<PaneInfo>,
 }
 impl MonitorFailTransport {
     fn new() -> Self {
         Self {
             session: Mutex::new(true),
+            targets: Vec::new(),
         }
     }
 }
@@ -688,7 +701,7 @@ impl Transport for MonitorFailTransport {
         }
     }
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
-        Ok(Vec::new())
+        Ok(self.targets.clone())
     }
     fn list_windows(&self, _s: &SessionName) -> Result<Vec<WindowName>, TransportError> {
         Ok(vec![WindowName::new("cp1")])

package/crates/team-agent/src/lifecycle/tests/cursor_mcp_overlay.rs

@@ -262,10 +262,7 @@ fn cursor_mcp_enable_child_env_applies_direct_profile_unsets() {
     }
     command.env("NO_PROXY", "fixture");
     command.env("no_proxy", "fixture");
-    crate::lifecycle::launch::apply_cursor_mcp_enable_profile_env(
-        &mut command,
-        Some(&launch),
-    );
+    crate::lifecycle::launch::apply_cursor_mcp_enable_profile_env(&mut command, Some(&launch));
     let output = command.output().expect("env child should run");
     assert!(output.status.success());
     let text = String::from_utf8(output.stdout).unwrap();
@@ -280,7 +277,9 @@ fn cursor_mcp_enable_child_env_applies_direct_profile_unsets() {
         "GLOBAL_AGENT_HTTP_PROXY",
     ] {
         assert!(
-            !text.lines().any(|line| line.starts_with(&format!("{key}="))),
+            !text
+                .lines()
+                .any(|line| line.starts_with(&format!("{key}="))),
             "direct MCP child must omit {key}"
         );
     }
@@ -326,7 +325,38 @@ fn cursor_spawn_writes_identity_into_project_mcp_json() {
     let enable_cwd = cursor_mcp_enable_working_dir(&ws, Some(&project));
     assert_eq!(enable_cwd, physical_workspace_path(&project));
     let argv_workspace = spawn_argv_workspace_flag(&ws).expect("spawn argv --workspace");
-    assert_eq!(argv_workspace, physical_workspace_path(&project).to_string_lossy());
+    assert_eq!(
+        argv_workspace,
+        physical_workspace_path(&project).to_string_lossy()
+    );
+    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    let row = state.pointer("/agents/cursor_writer").unwrap();
+    assert_eq!(row["spawn_cwd"], project.to_string_lossy().as_ref());
+    assert_eq!(row["session_id"], serde_json::Value::Null);
+
+    // Measured native layout: the store bucket uses --workspace primary, not
+    // --add-dir. A decoy in the real project's bucket must never be selected.
+    let sid = "d298b261-23bb-42bb-bbeb-b2ec08d81ca3";
+    for (cwd, id) in [(&project, sid), (&ws, "foreign-project-session")] {
+        let bucket = format!("{:x}", md5::compute(cwd.to_string_lossy().as_bytes()));
+        let archive = _hermetic.home().join(".cursor/chats").join(bucket).join(id);
+        std::fs::create_dir_all(&archive).unwrap();
+        std::fs::write(archive.join("meta.json"), b"{}").unwrap();
+    }
+    let mut capture = serde_json::json!({"agents": {"cursor_writer": row.clone()}});
+    let report = crate::provider::session::capture::capture_missing_provider_sessions_once(
+        &mut capture,
+        &mut crate::provider::get_adapter,
+        false,
+        0,
+    )
+    .unwrap();
+    assert_eq!(report.assigned, vec!["cursor_writer"]);
+    assert_eq!(capture["agents"]["cursor_writer"]["session_id"], sid);
+    assert_eq!(
+        capture["agents"]["cursor_writer"]["spawn_cwd"],
+        project.to_string_lossy().as_ref()
+    );
 }
 
 #[test]
@@ -361,13 +391,14 @@ fn cursor_spawn_isolation_off_writes_workspace_mcp_json() {
     });
     assert_cursor_identity_overlay(&text, "cursor_writer", &ws);
     assert!(
-        !cursor_mcp_json_path(&ws, "cursor_writer")
-            .unwrap()
-            .exists(),
+        !cursor_mcp_json_path(&ws, "cursor_writer").unwrap().exists(),
         "isolation-off must not materialize the per-seat project overlay"
     );
     let argv_workspace = spawn_argv_workspace_flag(&ws).expect("spawn argv --workspace");
-    assert_eq!(argv_workspace, physical_workspace_path(&ws).to_string_lossy());
+    assert_eq!(
+        argv_workspace,
+        physical_workspace_path(&ws).to_string_lossy()
+    );
 }
 
 fn assert_cursor_identity_overlay(text: &str, agent_id: &str, workspace: &Path) {
@@ -441,7 +472,7 @@ fn sample_mcp_config(agent_id: &str, workspace: &str) -> McpConfig {
     McpConfig {
         raw: serde_json::json!({
             "team_orchestrator": {
-                "command": "/bin/team-agent-test",
+                "command": std::env::current_exe().unwrap(),
                 "args": ["mcp-server", "--workspace", workspace],
                 "env": {
                     "TEAM_AGENT_ID": agent_id,
@@ -458,12 +489,21 @@ fn sample_mcp_config(agent_id: &str, workspace: &str) -> McpConfig {
 #[serial(env)]
 fn isolated_cursor_prepare_materializes_per_seat_project_not_workspace_overlay() {
     let ws = tmp_dir("cursor-iso-clean");
-    let project = prepare_cursor_seat_mcp(&ws, "seat-iso", &sample_mcp_config("seat-iso", &ws.to_string_lossy()))
-        .expect("prepare isolated cursor")
-        .expect("isolation defaults on");
+    let project = prepare_cursor_seat_mcp(
+        &ws,
+        "seat-iso",
+        &sample_mcp_config("seat-iso", &ws.to_string_lossy()),
+    )
+    .expect("prepare isolated cursor")
+    .expect("isolation defaults on");
     assert!(
-        project.ends_with("provider-config/seat-iso/cursor"),
-        "per-seat project must be materialized: {}",
+        !project.starts_with(&ws)
+            && project
+                .file_name()
+                .unwrap()
+                .to_string_lossy()
+                .starts_with("ta-cursor-"),
+        "per-seat native project must be outside workspace Git ancestry: {}",
         project.display()
     );
     assert!(project.join(".cursor").is_dir());
@@ -489,7 +529,10 @@ fn isolated_cursor_prepare_materializes_per_seat_project_not_workspace_overlay()
         .find(|pair| pair[0] == "--workspace")
         .map(|pair| pair[1].as_str())
         .unwrap();
-    assert_eq!(workspace_flag, physical_workspace_path(&project).to_string_lossy());
+    assert_eq!(
+        workspace_flag,
+        physical_workspace_path(&project).to_string_lossy()
+    );
     assert_eq!(
         include_str!("../launch/spawn.rs").contains("prepare_cursor_seat_mcp("),
         true,