@team-agent/installer 0.5.66 → 0.5.69

package/crates/team-agent/src/provider/adapters/cursor_agent.rs

@@ -0,0 +1,89 @@
+//! ---
+//! purpose: Cursor agent CLI argv；role 走 .cursor/rules，MCP 走 mcp.json overlay
+//! contract:
+//!   provides:
+//!     - name: cursor_agent_base_command
+//!       what: 只组已实测文档化 flag；mcp_config 不入 argv，由 launch overlay 写盘
+//! boundary:
+//!   - 不调未文档化 flag（--system-prompt / --allowed-tools）
+//!   - 不写 grok 那种 cwd 独占闸
+//!   - 不打印代理值
+//! maturity: wired
+//! ---
+//!
+//! Cursor `agent` CLI（与 `cursor-agent` 同二进制）。主路径与
+//! `.team/scripts/cursor_seat.sh` 实测一致：
+//!   `--trust --sandbox disabled --workspace <物理路径> [--force] [--model]`
+//! Role 不入 argv，写 `<workspace>/.cursor/rules/*.mdc` + `alwaysApply: true`。
+//! MCP 无 `--mcp-config`；身份必须写进 per-seat
+//! `provider-config/<id>/cursor/.cursor/mcp.json` 的 env 表
+//! （cursor 不把父进程 TEAM_AGENT_* 传给 MCP 子进程）。
+//! spawn 把 `--workspace` 指到该工程根，并用 `--add-dir` 挂上真 workspace。
+//!
+//! 隐藏 flag `--system-prompt` / `--allowed-tools` 实测存在但 help 未列，
+//! 随时可能消失。可以在注释里记录，代码里不许调。
+//! `--allowed-tools` 正反行为未验证，不写「支持工具白名单」。
+
+use crate::model::enums::AuthMode;
+use crate::provider::adapter::BasicProviderAdapter;
+use crate::provider::{McpConfig, ProviderError};
+
+pub(crate) fn cursor_agent_launch_command(
+    adapter: &BasicProviderAdapter,
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Result<Vec<String>, ProviderError> {
+    cursor_agent_base_command(
+        adapter,
+        auth_mode,
+        mcp_config,
+        system_prompt,
+        model,
+        tools,
+        false,
+        None,
+    )
+}
+
+pub(crate) fn cursor_agent_base_command(
+    adapter: &BasicProviderAdapter,
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+    managed_mcp_config: bool,
+    effort: Option<crate::model::enums::ProviderEffort>,
+) -> Result<Vec<String>, ProviderError> {
+    let mut argv = vec!["agent".to_string()];
+    // --trust 跳过 Workspace Trust 闸（已实测）。无此 flag 会停在 Do you trust。
+    argv.push("--trust".to_string());
+    if cursor_agent_dangerous_auto_approve(tools) {
+        argv.push("--force".to_string());
+    }
+    // 与 cursor_seat.sh 主路径一致。沙箱实际隔离面未再拆，但 flag 本身已实测。
+    argv.push("--sandbox".to_string());
+    argv.push("disabled".to_string());
+    if let Some(model) = model {
+        argv.push("--model".to_string());
+        argv.push(model.to_string());
+    }
+    // Cursor `--effort` flag 不存在；框架在调用方丢掉 effort。绝不发明 flag。
+    let _ = effort;
+    // system_prompt 不入 argv（help 无 --rules / --append-system-prompt）。
+    // launch 写 `<workspace>/.cursor/rules/team-agent-role-<agent_id>.mdc`。
+    // mcp_config 也不入 argv（无 --mcp-config）。launch 写
+    // `.team/runtime/provider-config/<id>/cursor/.cursor/mcp.json`
+    // 并 `agent mcp enable team_orchestrator`。这里收下以免静默丢弃。
+    let _ = (adapter, auth_mode, mcp_config, managed_mcp_config, system_prompt);
+    argv.push("--workspace".to_string());
+    argv.push("{workspace}".to_string());
+    Ok(argv)
+}
+
+pub(crate) fn cursor_agent_dangerous_auto_approve(tools: &[&str]) -> bool {
+    tools.contains(&"dangerous_auto_approve")
+}

package/crates/team-agent/src/provider/adapters/grok.rs

@@ -0,0 +1,157 @@
+//!
+//! purpose: Grok CLI argv + permission deny 映射；MCP 不走 CLI flag
+//! contract: launch 写 `<cwd>/.grok/config.toml`；未登录 / 目录未信任必须拒绝启动。
+//!   角色缺 model 必须拒绝启动（禁止内建 / team / CLI 任何隐式默认）。
+//!   未知工具映射记成 Unsupported，不发明 deny 名
+//! mcp_injection: dir_scoped —— 每席必须独立工作目录；同 cwd 多席会静默串台，故拒绝。
+//!   对照 claude/codex 是 argv 作用域（`--mcp-config`），同目录多席没有这个问题。
+//!   本版 exclusive 检查不读 per-agent cwd，一个 workspace 只支持一个 grok 席。
+//!   这是 Provider::Grok 的能力边界，不是框架对所有 provider 的限制。
+//! boundary: 只服务 Provider::Grok。不改 claude/codex/copilot 路径
+//!
+//! Grok CLI provider-local command builders + permission helpers.
+//!
+//! Mirrors `adapters/claude.rs` (0.5.67 provider-adapter step). Pure
+//! flag-name adaptation over the claude skeleton — no new abstraction
+//! layers, no public-API changes outside the provider dispatch.
+//!
+//! Grok CLI flag map (亲核 attest 0.5.67 + grok-full-help.txt):
+//!   bypass  → `--always-approve`  ("Auto-approve all tool executions")
+//!   system  → `--rules <RULES>`   ("Extra rules to append to the system prompt")
+//!   model   → `-m, --model <MODEL>`
+//!   session → `-s, --session-id <SESSION_ID>` (fresh spawn)
+//!   resume  → `-r, --resume [<ID_OR_TITLE>]` / `-c, --continue`
+//!   fork    → `--fork-session` (with --resume)
+//!   effort  → `--effort <level>` (alias of `--reasoning-effort`)
+//!             grok accepts low|medium|high|xhigh; CLI rejects `max`
+//!   deny    → `--disallowed-tools` (compat alias `--disallowedTools`)
+//!   cwd     → `--cwd <CWD>` / `-w, --worktree [<WORKTREE>]`
+//!
+//! No native `--mcp-config` flag on the Grok CLI (`grok mcp` is a subcommand)
+//! → `native_mcp_config: false`; MCP reaches the worker via launch-path
+//! `<cwd>/.grok/config.toml` (`apply_grok_mcp_overlay`).
+
+use crate::model::enums::AuthMode;
+use crate::provider::adapter::{next_session_token, BasicProviderAdapter};
+use crate::provider::{McpConfig, ProviderError};
+
+pub(crate) fn grok_launch_command(
+    adapter: &BasicProviderAdapter,
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+) -> Result<Vec<String>, ProviderError> {
+    let mut argv = grok_base_command(
+        adapter,
+        auth_mode,
+        mcp_config,
+        system_prompt,
+        model,
+        tools,
+        false,
+        None,
+    )?;
+    argv.push("--session-id".to_string());
+    argv.push(next_session_token());
+    Ok(argv)
+}
+
+pub(crate) fn grok_base_command(
+    adapter: &BasicProviderAdapter,
+    auth_mode: AuthMode,
+    mcp_config: Option<&McpConfig>,
+    system_prompt: Option<&str>,
+    model: Option<&str>,
+    tools: &[&str],
+    managed_mcp_config: bool,
+    effort: Option<crate::model::enums::ProviderEffort>,
+) -> Result<Vec<String>, ProviderError> {
+    let mut argv = vec!["grok".to_string()];
+    if grok_dangerous_auto_approve(tools) {
+        argv.push("--always-approve".to_string());
+    }
+    let model = match model.map(str::trim).filter(|value| !value.is_empty()) {
+        Some(model) => model,
+        None => {
+            return Err(ProviderError::Command(
+                "grok launch requires an explicit model. \
+Without an explicit model the framework fills a built-in default (grok-4 for grok), \
+so the seat silently gets a model and context window that are not in the role file, \
+while argv still looks normal. The role file must name the model itself; \
+built-in defaults, team-level defaults, and the Grok CLI global default are all implicit sources. \
+Set the role front-matter field, for example:\n\
+model: grok-4.6"
+                    .to_string(),
+            ));
+        }
+    };
+    argv.push("--model".to_string());
+    argv.push(model.to_string());
+    if let Some(effort) = effort {
+        // Grok accepts `--effort` as alias for `--reasoning-effort`.
+        argv.push("--effort".to_string());
+        argv.push(effort.as_str().to_string());
+    }
+    if let Some(prompt) = system_prompt {
+        argv.push("--rules".to_string());
+        argv.push(prompt.to_string());
+    }
+    // Grok CLI has no `--mcp-config` flag — the claude inline-MCP block is
+    // intentionally absent. Launch writes `<cwd>/.grok/config.toml`.
+    let _ = (adapter, auth_mode, mcp_config, managed_mcp_config);
+    for tool in grok_disallowed_tools(tools) {
+        argv.push("--disallowedTools".to_string());
+        argv.push(tool.to_string());
+    }
+    Ok(argv)
+}
+
+pub(crate) fn grok_dangerous_auto_approve(tools: &[&str]) -> bool {
+    tools.contains(&"dangerous_auto_approve")
+}
+
+pub(crate) fn grok_disallowed_tools(tools: &[&str]) -> Vec<&'static str> {
+    let mut disallowed = Vec::new();
+    for tool in [
+        "execute_bash",
+        "fs_read",
+        "fs_write",
+        "fs_list",
+        "network",
+        "git_diff",
+        "mcp_team",
+        "provider_builtin",
+    ] {
+        if tools.contains(&tool) {
+            continue;
+        }
+        match grok_tool_mapping(tool) {
+            GrokToolMapping::Deny(names) => disallowed.extend(names),
+            GrokToolMapping::Unsupported | GrokToolMapping::Bypass => {}
+        }
+    }
+    disallowed
+}
+
+/// Canonical tool → grok CLI deny names. Unknown tools stay Unsupported
+/// (no invented `--disallowedTools` token).
+pub(crate) fn grok_tool_mapping(tool: &str) -> GrokToolMapping {
+    match tool {
+        "execute_bash" => GrokToolMapping::Deny(&["Bash"]),
+        "fs_read" => GrokToolMapping::Deny(&["Read"]),
+        "fs_write" => GrokToolMapping::Deny(&["Edit", "Write", "MultiEdit", "NotebookEdit"]),
+        "fs_list" => GrokToolMapping::Deny(&["Glob", "Grep"]),
+        "dangerous_auto_approve" => GrokToolMapping::Bypass,
+        "network" | "git_diff" | "mcp_team" | "provider_builtin" => GrokToolMapping::Unsupported,
+        _ => GrokToolMapping::Unsupported,
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum GrokToolMapping {
+    Deny(&'static [&'static str]),
+    Bypass,
+    Unsupported,
+}

package/crates/team-agent/src/provider/adapters/mod.rs

@@ -28,3 +28,6 @@ pub(crate) mod codex;
 pub(crate) mod copilot;
 pub(crate) mod copilot_fork;
 pub(crate) mod fake;
+pub(crate) mod grok;
+pub(crate) mod cursor_agent;
+pub(crate) mod pi;

package/crates/team-agent/src/provider/adapters/pi.rs

@@ -0,0 +1,152 @@
+//! ---
+//! purpose: Pi CLI 的纯工具映射与 fresh/resume argv 构造
+//! contract:
+//!   provides:
+//!     - name: build_pi_command_argv
+//!       what: 仅从已验证输入构造隔离的 regular-TUI Pi argv
+//! boundary:
+//!   - 不发现 executable、catalog、adapter 或 MCP 配置
+//!   - 除 resume exact backing 存在性外不读文件；不写文件、不启动进程
+//! maturity: wired
+//! ---
+
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use crate::model::enums::ProviderEffort;
+use crate::provider::ProviderError;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum PiToolMapping {
+    Mcp,
+    Builtin(&'static [&'static str]),
+    Unsupported,
+}
+
+/// ---
+/// purpose: 把 Team tool category 映射为 exact Pi builtin/proxy names
+/// returns: 单个或多个 builtin、MCP proxy 或 Unsupported
+/// ---
+pub(crate) fn pi_tool_mapping(category: &str) -> PiToolMapping {
+    match category {
+        "mcp_team" => PiToolMapping::Mcp,
+        "fs_read" => PiToolMapping::Builtin(&["read"]),
+        "fs_list" => PiToolMapping::Builtin(&["grep", "find", "ls"]),
+        "fs_write" => PiToolMapping::Builtin(&["edit", "write"]),
+        "execute_bash" => PiToolMapping::Builtin(&["bash"]),
+        _ => PiToolMapping::Unsupported,
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub(crate) enum PiSessionSelector<'a> {
+    Fresh { session_id: &'a str },
+    Resume { path: &'a Path },
+}
+
+pub(crate) struct PiCommandRequest<'a> {
+    pub executable: &'a Path,
+    pub extension: &'a Path,
+    pub model: &'a str,
+    pub effort: ProviderEffort,
+    pub system_prompt: &'a str,
+    pub tool_categories: &'a [&'a str],
+    pub session_dir: &'a Path,
+    pub session: PiSessionSelector<'a>,
+    pub agent_id: &'a str,
+}
+
+/// ---
+/// purpose: 从已验证 semantic request 构造无 ambient flag 的 Pi argv
+/// returns: exact ordered fresh/resume argv
+/// errors: 必需字段、mcp_team 或工具 category 非法时返回 ProviderError
+/// ---
+pub(crate) fn build_pi_command_argv(
+    request: PiCommandRequest<'_>,
+) -> Result<Vec<String>, ProviderError> {
+    if request.executable.as_os_str().is_empty()
+        || request.extension.as_os_str().is_empty()
+        || request.session_dir.as_os_str().is_empty()
+        || request.model.trim().is_empty()
+        || request.system_prompt.trim().is_empty()
+        || request.agent_id.trim().is_empty()
+    {
+        return Err(ProviderError::Command(
+            "Pi command requires executable, extension, model, prompt, session directory, and agent id"
+                .to_string(),
+        ));
+    }
+
+    let mut tools = BTreeSet::new();
+    for category in request.tool_categories {
+        match pi_tool_mapping(category) {
+            PiToolMapping::Mcp => {
+                tools.insert("mcp");
+            }
+            PiToolMapping::Builtin(names) => tools.extend(names.iter().copied()),
+            PiToolMapping::Unsupported => {
+                return Err(ProviderError::Command(format!(
+                    "Pi does not support Team Agent tool category {category:?}"
+                )));
+            }
+        }
+    }
+    if !tools.contains("mcp") {
+        return Err(ProviderError::Command(
+            "Pi command requires mcp_team".to_string(),
+        ));
+    }
+
+    let mut argv = vec![
+        request.executable.to_string_lossy().into_owned(),
+        "--no-extensions".to_string(),
+        "-e".to_string(),
+        request.extension.to_string_lossy().into_owned(),
+        "--no-approve".to_string(),
+        "--no-context-files".to_string(),
+        "--no-skills".to_string(),
+        "--no-prompt-templates".to_string(),
+        "--tui-mode".to_string(),
+        "regular".to_string(),
+        "--model".to_string(),
+        request.model.to_string(),
+        "--thinking".to_string(),
+        request.effort.as_str().to_string(),
+        "--system-prompt".to_string(),
+        request.system_prompt.to_string(),
+        "--tools".to_string(),
+        tools.into_iter().collect::<Vec<_>>().join(","),
+        "--session-dir".to_string(),
+        request.session_dir.to_string_lossy().into_owned(),
+    ];
+    // The shared lifecycle materializer always revalidates resume root/path/header.
+    // Keep the pure argv builder usable before a fixture root is materialized, while
+    // refusing a missing exact file once the recorded path's parent exists.
+    match request.session {
+        PiSessionSelector::Fresh { session_id } if !session_id.trim().is_empty() => {
+            argv.push("--session-id".to_string());
+            argv.push(session_id.to_string());
+        }
+        PiSessionSelector::Resume { path }
+            if !path.as_os_str().is_empty()
+                && (!path.parent().is_some_and(Path::is_dir) || path.is_file()) =>
+        {
+            argv.push("--session".to_string());
+            argv.push(path.to_string_lossy().into_owned());
+        }
+        PiSessionSelector::Resume { path } if !path.as_os_str().is_empty() => {
+            return Err(ProviderError::ResumeUnavailable(format!(
+                "Pi exact session backing is missing: {}",
+                path.display()
+            )));
+        }
+        _ => {
+            return Err(ProviderError::Command(
+                "Pi command requires a non-empty session selector".to_string(),
+            ));
+        }
+    }
+    argv.push("--name".to_string());
+    argv.push(request.agent_id.to_string());
+    Ok(argv)
+}

package/crates/team-agent/src/provider/bypass_flags.rs

@@ -8,6 +8,8 @@
 //!   - claude/claude_code → `--dangerously-skip-permissions`
 //!   - codex → `--dangerously-bypass-approvals-and-sandbox`
 //!   - copilot → `--allow-all`(0.3.27 P1 E54 symptom 2 起)
+//!   - grok → `--always-approve`
+//!   - cursor_agent → `--force`
 //!
 //! 未定义(返回 None)的 provider:调用侧必须 fail-loud(见
 //! `resolved_tool_strings_for_command`),不得静默 fallback。
@@ -20,14 +22,24 @@ pub(crate) fn provider_bypass_flag(provider: Provider) -> Option<&'static str> {
         Provider::Claude | Provider::ClaudeCode => Some("--dangerously-skip-permissions"),
         Provider::Codex => Some("--dangerously-bypass-approvals-and-sandbox"),
         Provider::Copilot => Some("--allow-all"),
+        Provider::Grok => Some("--always-approve"),
+        Provider::CursorAgent => Some("--force"),
+        Provider::Pi => None,
         // TODO: 查 gemini_cli 的等价 bypass 参数;未定义前 fail-loud。
         Provider::GeminiCli => None,
         Provider::Fake => None,
     }
 }
 
-/// 0.5.66 §3.2 跨 workspace 兼容警示用:扫 argv tokens 找已知 bypass flag。
-/// **只做检测,不做行为决策**(0.6.0 删)。
+/// 0.5.66 §3.2 跨 workspace 兼容警示用:扫 **team-agent 进程自己的** argv tokens
+/// 找已知 bypass flag。**只做检测,不做行为决策**(0.6.0 删)。
+///
+/// 不认 `--force`:那是 team-agent 自己的 CLI 旗(`init --force` /
+/// `remove-agent --confirm --force` / `restart --force`),与 cursor worker
+/// 的 `--force` 撞名。本函数看不到「当前在看哪个 provider 的 argv」,
+/// 认 `--force` 会把既有非 grok/cursor 路径误判成 bypass。
+/// cursor worker 的 bypass 仍走 [`provider_bypass_flag`],不走这条检测面。
+/// `--always-approve` 可以认:team-agent 自己没有这个旗。
 ///
 /// TODO(0.6.0): remove
 pub(crate) fn detect_bypass_flag_in_argv(argv_tokens: &[String]) -> Option<&'static str> {
@@ -43,6 +55,9 @@ pub(crate) fn detect_bypass_flag_in_argv(argv_tokens: &[String]) -> Option<&'sta
         if token == "--allow-all" || token == "--yolo" {
             return Some("--allow-all");
         }
+        if token == "--always-approve" {
+            return Some("--always-approve");
+        }
     }
     None
 }
@@ -77,4 +92,34 @@ mod tests {
         assert_eq!(provider_bypass_flag(Provider::GeminiCli), None);
         assert_eq!(provider_bypass_flag(Provider::Fake), None);
     }
+
+    #[test]
+    fn grok_and_cursor_bypass_flags() {
+        assert_eq!(
+            provider_bypass_flag(Provider::Grok),
+            Some("--always-approve")
+        );
+        assert_eq!(
+            provider_bypass_flag(Provider::CursorAgent),
+            Some("--force")
+        );
+    }
+
+    #[test]
+    fn detect_bypass_flag_ignores_team_agent_force() {
+        let argv = [
+            "team-agent".to_string(),
+            "remove-agent".to_string(),
+            "x".to_string(),
+            "--confirm".to_string(),
+            "--force".to_string(),
+        ];
+        assert_eq!(
+            detect_bypass_flag_in_argv(&argv),
+            None,
+            "detect_bypass_flag_in_argv scans team-agent process argv, not worker argv; \
+             `remove-agent --force` must not look like a provider bypass flag; got {:?}",
+            detect_bypass_flag_in_argv(&argv)
+        );
+    }
 }

package/crates/team-agent/src/provider/classify.rs

@@ -215,7 +215,8 @@ fn latest_explicit_error_fact_for_record(
         Provider::Claude | Provider::ClaudeCode => claude_latest_explicit_error_fact(record),
         // C-3-5 cr verdict: copilot N35 通知不依赖 turn-state 分类;一期 Unknown,
         // 与 GeminiCli/Fake 同精神。二期接 sqlite turns 表后再回填。
-        Provider::Copilot | Provider::GeminiCli | Provider::Fake => None,
+        Provider::Copilot | Provider::Grok | Provider::CursorAgent | Provider::Pi | Provider::GeminiCli
+        | Provider::Fake => None,
     }
 }
 
@@ -378,7 +379,8 @@ fn extract_lifecycle_facts(
             Provider::Codex => codex_lifecycle_fact(record),
             // C-3-1 cr verdict: copilot lifecycle facts 一期不导出(classify→None,
             // Unknown);二期读 sqlite turns 表(turn_index/assistant_response)。
-            Provider::Copilot | Provider::GeminiCli | Provider::Fake => None,
+            Provider::Copilot | Provider::Grok | Provider::CursorAgent | Provider::Pi | Provider::GeminiCli
+            | Provider::Fake => None,
         })
         .collect()
 }

package/crates/team-agent/src/provider/faults.rs

@@ -46,7 +46,8 @@ fn fault_fact(provider: Provider, record: &serde_json::Value) -> Option<FaultFac
     match provider {
         Provider::Claude | Provider::ClaudeCode => claude_fault_fact(record),
         Provider::Codex => codex_fault_fact(record),
-        Provider::Copilot | Provider::GeminiCli | Provider::Fake => None,
+        Provider::Copilot | Provider::Grok | Provider::CursorAgent | Provider::Pi | Provider::GeminiCli
+        | Provider::Fake => None,
     }
 }
 

package/crates/team-agent/src/provider/mod.rs

@@ -1,3 +1,13 @@
+//! ---
+//! purpose: provider 命令构造与会话观察入口
+//! contract:
+//!   provides:
+//!     - name: adapter
+//!       what: 按 Provider 分发 launch/capability
+//! boundary:
+//!   - 不把 observation 写成 ownership
+//! maturity: wired
+//! ---
 //!
 //! step 8 · provider — type + trait SKELETON (ROUND-0).
 //!
@@ -44,6 +54,7 @@ pub mod faults;
 pub mod session;
 pub mod session_scan;
 pub mod startup_prompt;
+pub mod submit_now;
 pub mod types;
 /// 0.4.x: provider wire-format helpers — single source of truth for
 /// `Provider` ↔ string conversions (replaces 7 hand-rolled match copies).