@team-agent/installer 0.5.68 → 0.5.70

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -37,6 +37,7 @@
 //! maturity: wired
 //! ---
 use super::*;
+use crate::transport::Transport;
 
 pub(super) struct SpawnedAgentWindow {
     pub spawn: crate::transport::SpawnResult,
@@ -340,11 +341,15 @@ pub(super) fn spawn_agent_window(
         agent_id.as_str(),
         team_id.as_deref().unwrap_or(""),
     );
-    let mcp_config_path = crate::lifecycle::launch::write_worker_mcp_config(
-        workspace,
-        agent_id.as_str(),
-        &mcp_config,
-    )?;
+    let mcp_config_path = if provider == Provider::Pi {
+        None
+    } else {
+        Some(crate::lifecycle::launch::write_worker_mcp_config(
+            workspace,
+            agent_id.as_str(),
+            &mcp_config,
+        )?)
+    };
     let profile_launch =
         crate::lifecycle::profile_launch::prepare_provider_profile_launch_from_json(
             workspace,
@@ -374,20 +379,65 @@ pub(super) fn spawn_agent_window(
         agent_id_hint: Some(agent_id.as_str()),
         effort: restart_effort,
     };
-    let mut plan = match resume_session_id {
-        Some(session_id) => adapter
-            .build_resume_command_plan(Some(session_id), context)
-            .map_err(|e| LifecycleError::Provider(e.to_string()))?,
-        None => adapter
-            .build_command_plan(context)
-            .map_err(|e| LifecycleError::Provider(e.to_string()))?,
+    let pi_spawn_cwd = (provider == Provider::Pi)
+        .then(|| {
+            agent
+                .get("spawn_cwd")
+                .and_then(serde_json::Value::as_str)
+                .filter(|value| !value.is_empty())
+                .map(PathBuf::from)
+        })
+        .flatten();
+    let spawn_cwd = spawn_cwd_override
+        .or(pi_spawn_cwd.as_deref())
+        .unwrap_or(workspace);
+    let mut plan = if provider == Provider::Pi {
+        let request = crate::lifecycle::launch::pi_mcp::PiMaterializeRequest {
+            workspace,
+            team_id: team_id.as_deref().unwrap_or(""),
+            agent_id: agent_id.as_str(),
+            model: command_model,
+            effort: restart_effort,
+            system_prompt: &system_prompt,
+            tool_categories: &resolved_tool_refs,
+            team_mcp_tools: &["send_message", "report_result"],
+            mcp_config: &mcp_config,
+        };
+        match resume_session_id {
+            Some(session_id) => {
+                let rollout_path = agent_rollout_path(agent).ok_or_else(|| {
+                    LifecycleError::RequirementUnmet(
+                        "Pi resume requires the persisted exact session path".to_string(),
+                    )
+                })?;
+                crate::lifecycle::launch::pi_mcp::materialize_pi_resume_plan(
+                    request,
+                    session_id,
+                    rollout_path.as_path(),
+                    spawn_cwd,
+                )
+            }
+            None => crate::lifecycle::launch::pi_mcp::materialize_pi_plan(request),
+        }
+        .map_err(|e| LifecycleError::Provider(e.to_string()))?
+    } else {
+        match resume_session_id {
+            Some(session_id) => adapter
+                .build_resume_command_plan(Some(session_id), context)
+                .map_err(|e| LifecycleError::Provider(e.to_string()))?,
+            None => adapter
+                .build_command_plan(context)
+                .map_err(|e| LifecycleError::Provider(e.to_string()))?,
+        }
     };
     if !plan.managed_mcp_config && !profile_launch.managed_mcp_config {
-        crate::lifecycle::launch::point_native_mcp_config_at_file(
-            &mut plan.argv,
-            provider,
-            &mcp_config_path,
-        );
+        if let Some(mcp_config_path) = mcp_config_path.as_ref() {
+            crate::lifecycle::launch::point_native_mcp_config_at_file(
+                &mut plan.argv,
+                provider,
+                mcp_config_path,
+            );
+        }
     }
     crate::lifecycle::launch::fill_spawn_placeholders_full(
         &mut plan.argv,
@@ -427,8 +477,20 @@ pub(super) fn spawn_agent_window(
             &system_prompt,
         )?;
         crate::lifecycle::launch::apply_cursor_mcp_overlay(workspace, &mcp_config)?;
-        crate::lifecycle::launch::enable_cursor_workspace_mcp(workspace)?;
-        crate::lifecycle::launch::apply_cursor_workspace_physical_path(&mut plan.argv, workspace);
+        let project = if crate::lifecycle::launch::cursor_mcp_isolation_enabled() {
+            Some(crate::lifecycle::launch::cursor_mcp_project_dir(
+                workspace,
+                agent_id.as_str(),
+            )?)
+        } else {
+            None
+        };
+        crate::lifecycle::launch::enable_cursor_workspace_mcp(workspace, project.as_deref())?;
+        crate::lifecycle::launch::apply_cursor_spawn_workspace_pointers(
+            &mut plan.argv,
+            workspace,
+            agent_id.as_str(),
+        )?;
         crate::lifecycle::launch::apply_cursor_subscription_proxy_env(&mut env);
     }
     if provider == crate::provider::Provider::Grok {
@@ -446,8 +508,9 @@ pub(super) fn spawn_agent_window(
     //
     // NOTE: Step 4 will thread the YAML spec down to here so we can honour
     // a per-agent YAML `spawn_cwd` field if one is set. Until then, override
-    // > workspace; state-based override is silently dropped.
-    let spawn_cwd = spawn_cwd_override.unwrap_or(workspace);
+    // > workspace; state-based override is silently dropped for existing
+    // providers. Pi is the narrow exception because exact header/path resume
+    // must preserve the captured cwd or refuse.
     // 0.4.x provider effort MVP step 9: scrub CLAUDE_EFFORT for Claude
     // worker spawn so a parent shell env cannot silently override the
     // framework's effort decision.
@@ -912,6 +975,14 @@ pub(super) fn lifecycle_worker_tmux_backend_selection_for_state(
             )));
         }
     }
+    if let Some((endpoint, source)) = crate::tmux_backend::owning_tmux_endpoint_from_state(state) {
+        let backend = crate::tmux_backend::TmuxBackend::for_tmux_endpoint(endpoint);
+        return Ok(crate::tmux_backend::RuntimeTmuxBackendSelection {
+            tmux_endpoint_used: backend.tmux_endpoint(),
+            backend,
+            tmux_endpoint_source: source,
+        });
+    }
     Ok(
         crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(
             run_workspace,
@@ -928,6 +999,9 @@ pub(super) fn lifecycle_worker_tmux_backend_for_state(
     run_workspace: &Path,
     state: &serde_json::Value,
 ) -> crate::tmux_backend::TmuxBackend {
+    if let Some((endpoint, _source)) = crate::tmux_backend::owning_tmux_endpoint_from_state(state) {
+        return crate::tmux_backend::TmuxBackend::for_tmux_endpoint(endpoint);
+    }
     crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(run_workspace, Some(state))
         .backend
 }
@@ -1091,12 +1165,34 @@ fn json_team_identity_matches(existing: &serde_json::Value, compact: &serde_json
 /// returns: 非空的 session_name，缺失时退到默认名
 /// ---
 pub(super) fn state_session_name(state: &serde_json::Value) -> SessionName {
+    worker_session_name_from_state(state)
+        .map(SessionName::new)
+        .unwrap_or_else(|| SessionName::new("team-agent"))
+}
+
+fn worker_session_name_from_state(state: &serde_json::Value) -> Option<&str> {
     state
         .get("session_name")
         .and_then(|v| v.as_str())
         .filter(|s| !s.is_empty())
-        .map(SessionName::new)
-        .unwrap_or_else(|| SessionName::new("team-agent"))
+        .or_else(|| {
+            let team_key = state
+                .get("active_team_key")
+                .and_then(serde_json::Value::as_str)
+                .filter(|team_key| !team_key.is_empty())?;
+            state
+                .get("teams")?
+                .get(team_key)?
+                .pointer("/leader_receiver/session_name")?
+                .as_str()
+                .filter(|session| !session.is_empty())
+        })
+        .or_else(|| {
+            state
+                .pointer("/leader_receiver/session_name")
+                .and_then(serde_json::Value::as_str)
+                .filter(|session| !session.is_empty())
+        })
 }
 
 /// ---
@@ -1104,11 +1200,7 @@ pub(super) fn state_session_name(state: &serde_json::Value) -> SessionName {
 /// returns: 记了则 true
 /// ---
 pub(super) fn session_name_present(state: &serde_json::Value) -> bool {
-    state
-        .get("session_name")
-        .and_then(|v| v.as_str())
-        .map(|s| !s.is_empty())
-        .unwrap_or(false)
+    worker_session_name_from_state(state).is_some()
 }
 
 /// ---
@@ -1349,6 +1441,22 @@ pub(super) fn resume_backing_probe_for_agent(
                     crate::provider::session_scan::cursor::cursor_session_archive_present(dir)
                 })
         }
+        Provider::Pi => {
+            let spawn_cwd = agent
+                .get("spawn_cwd")
+                .and_then(serde_json::Value::as_str)
+                .filter(|value| !value.is_empty())
+                .map(PathBuf::from)
+                .unwrap_or_else(|| workspace.to_path_buf());
+            rollout_path.is_some_and(|path| {
+                crate::provider::session_scan::pi::validate_exact_backing(
+                    path.as_path(),
+                    session_id,
+                    &spawn_cwd,
+                )
+                .is_ok()
+            })
+        }
         Provider::GeminiCli | Provider::Fake => false,
     };
 

package/crates/team-agent/src/lifecycle/restart/remove.rs

@@ -539,6 +539,22 @@ fn remove_agent_at_paths(
             }
         });
     }
+    let pi_cleanup_paths = preflight
+        .seat
+        .state
+        .get("agents")
+        .and_then(|agents| agents.get(agent_id.as_str()))
+        .and_then(|agent| agent.get("provider"))
+        .and_then(serde_json::Value::as_str)
+        .and_then(crate::provider::wire::parse_provider)
+        .filter(|provider| *provider == Provider::Pi)
+        .map(|_| {
+            crate::lifecycle::launch::pi_mcp::pi_seat_paths(
+                workspace,
+                &preflight.seat.team_key,
+                agent_id.as_str(),
+            )
+        });
     let paths = LifecyclePathRefs {
         run_workspace: workspace,
         spec_workspace,
@@ -574,7 +590,27 @@ fn remove_agent_at_paths(
         Ok(success)
     });
     match result {
-        Ok(success) => {
+        Ok(mut success) => {
+            if let Some(pi_paths) = pi_cleanup_paths.as_ref() {
+                let cleanup = crate::lifecycle::launch::pi_mcp::pi_cleanup_plan(
+                    crate::lifecycle::launch::pi_mcp::PiCleanupAction::Remove,
+                    pi_paths,
+                );
+                for path in cleanup.delete_paths {
+                    match std::fs::remove_file(&path) {
+                        Ok(()) => success
+                            .cleared_locations
+                            .push(serde_json::json!(path.to_string_lossy().to_string())),
+                        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+                        Err(error) => {
+                            return Err(LifecycleError::StatePersist(format!(
+                                "remove-agent completed logical removal for {agent_id}, but exact Pi wrapper cleanup failed at {}: {error}",
+                                path.display()
+                            )));
+                        }
+                    }
+                }
+            }
             // Foundation-0 F0-2: the historical dual-write to the legacy
             // per-session snapshot has been retired
             // (`.team/artifacts/foundation-0-slice-design.md` §§4-5).

package/crates/team-agent/src/lifecycle/tests/claude_profile_launch_red.rs

@@ -133,19 +133,40 @@ fn launch_restart_start_add_and_fork_all_delegate_to_the_profile_launch_resolver
         ("launch quick-start", &launch, "spawn_agents"),
         ("add-agent", &launch, "add_agent_with_transport"),
         ("fork-agent", &launch, "fork_agent_with_transport"),
-        ("restart", &restart_common, "restart_with_transport"),
-        ("start-agent", &restart_agent, "start_agent_at_paths"),
+        (
+            "restart/start shared spawn",
+            &restart_common,
+            "pub(super) fn spawn_agent_window(",
+        ),
     ];
     for (surface, source, entry) in surfaces {
         let section = source
             .find(entry)
             .map(|idx| &source[idx..])
-            .unwrap_or(source.as_str());
+            .unwrap_or_else(|| panic!("{surface} entry missing: {entry}"));
         assert!(
             section.contains("prepare_provider_profile_launch"),
             "{surface} must call the single profile resolver before building/spawning provider argv; entry={entry}"
         );
     }
+
+    let start_agent = restart_agent
+        .find("pub(crate) fn start_agent_at_paths(")
+        .map(|idx| &restart_agent[idx..])
+        .unwrap_or_else(|| panic!("start-agent entry missing: start_agent_at_paths"));
+    assert!(
+        start_agent.contains("spawn_agent_window("),
+        "start-agent must delegate provider argv construction to the shared restart/start spawn path"
+    );
+
+    let spawn_agent_window = restart_common
+        .find("pub(super) fn spawn_agent_window(")
+        .map(|idx| &restart_common[idx..])
+        .unwrap_or_else(|| panic!("restart/start shared spawn entry missing"));
+    assert!(
+        spawn_agent_window.contains("prepare_provider_profile_launch_from_json("),
+        "shared restart/start spawn must call the JSON profile launch resolver"
+    );
 }
 
 #[test]

package/crates/team-agent/src/lifecycle/tests/cursor_mcp_overlay.rs

@@ -1,6 +1,6 @@
 //! purpose: cursor 席位必须把身份写进它实际会读的 mcp.json env
-//! contract: overlay 后 `<workspace>/.cursor/mcp.json` 含 team_orchestrator.env.TEAM_AGENT_ID
-//!   （不是 `.team/runtime/mcp/*.json`，也不是靠 pane env 继承）
+//! contract: overlay 后 provider-config/<id>/cursor/.cursor/mcp.json 含 team_orchestrator.env.TEAM_AGENT_ID
+//!   （不是改 HOME，也不是靠 pane env 继承）
 //! boundary: 只覆盖 cursor launch 产物；不改 claude/codex/copilot/grok 路径
 //!
 //! 生产侧判据，未经血统审计。
@@ -16,21 +16,34 @@ use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use serial_test::serial;
+use sha2::{Digest, Sha256};
 use team_agent::lifecycle::quick_start_with_transport_in_workspace;
 use team_agent::lifecycle::{
-    apply_cursor_mcp_overlay, apply_cursor_subscription_proxy_env,
-    apply_cursor_workspace_physical_path, cursor_mcp_enable_argv, physical_workspace_path,
-    LifecycleError,
+    apply_cursor_mcp_overlay, apply_cursor_spawn_workspace_pointers,
+    apply_cursor_subscription_proxy_env, apply_cursor_workspace_physical_path,
+    cursor_mcp_enable_argv, cursor_mcp_json_path, cursor_mcp_project_dir, physical_workspace_path,
+    refuse_second_cursor_occupant, LifecycleError,
 };
 use team_agent::provider::McpConfig;
 use team_agent::transport::test_support::OfflineTransport;
 
 #[test]
+#[serial(cursor_mcp_isolation)]
 fn cursor_overlay_writes_identity_into_mcp_json_env() {
     let ws = tmp_dir("cursor-mcp-id");
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("seat-a", &ws.to_string_lossy()))
         .expect("overlay write");
-    let text = std::fs::read_to_string(ws.join(".cursor/mcp.json")).unwrap();
+    let path = cursor_mcp_json_path(&ws, "seat-a").unwrap();
+    let rendered = path.to_string_lossy();
+    assert!(
+        rendered.contains("provider-config") && rendered.contains("/cursor/"),
+        "identity must land under provider-config/<id>/cursor, not a HOME fork: {rendered}"
+    );
+    assert!(
+        !rendered.contains("/.team/runtime/cursor-mcp/"),
+        "must not use the rejected COPILOT_HOME-style cursor-mcp tree: {rendered}"
+    );
+    let text = std::fs::read_to_string(&path).unwrap();
     assert!(
         text.contains("\"team_orchestrator\""),
         "cursor overlay must use the canonical server name"
@@ -58,6 +71,7 @@ fn cursor_overlay_writes_identity_into_mcp_json_env() {
 }
 
 #[test]
+#[serial(cursor_mcp_isolation)]
 fn cursor_overlay_refuses_missing_identity() {
     let ws = tmp_dir("cursor-mcp-missing-id");
     let cfg = McpConfig {
@@ -82,6 +96,7 @@ fn cursor_overlay_refuses_missing_identity() {
 }
 
 #[test]
+#[serial(cursor_mcp_isolation)]
 fn cursor_overlay_keeps_unrelated_servers_and_replaces_orchestrator() {
     let ws = tmp_dir("cursor-mcp-merge");
     let dir = ws.join(".cursor");
@@ -99,38 +114,63 @@ fn cursor_overlay_keeps_unrelated_servers_and_replaces_orchestrator() {
     .unwrap();
 
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("seat-b", "/ws-b")).expect("overlay merge");
-    let text = std::fs::read_to_string(dir.join("mcp.json")).unwrap();
+    let project = std::fs::read_to_string(dir.join("mcp.json")).unwrap();
     assert!(
-        text.contains("keep-me"),
-        "unrelated project MCP servers must survive"
+        project.contains("keep-me"),
+        "unrelated project MCP servers must survive in workspace mcp.json"
     );
     assert!(
-        !text.contains("/old/team-agent") && !text.contains("/stale"),
-        "stale orchestrator/legacy names must be replaced"
+        !project.contains("/old/team-agent") && !project.contains("/stale"),
+        "stale orchestrator/legacy names must be scrubbed from the shared project file"
     );
+    let isolated = std::fs::read_to_string(cursor_mcp_json_path(&ws, "seat-b").unwrap()).unwrap();
     assert!(
-        text.contains("seat-b") && text.contains("/ws-b"),
-        "new identity must land"
+        isolated.contains("seat-b") && isolated.contains("/ws-b"),
+        "new identity must land in the per-seat mcp.json"
     );
 }
 
 #[test]
-fn cursor_second_seat_overwrites_json_identity_without_exclusive_gate() {
+#[serial(cursor_mcp_isolation)]
+fn cursor_second_seat_keeps_both_identities_when_isolated() {
     let ws = tmp_dir("cursor-mcp-two");
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("first", "/ws")).expect("first");
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("second", "/ws")).expect("second");
+    let first = std::fs::read_to_string(cursor_mcp_json_path(&ws, "first").unwrap()).unwrap();
+    let second = std::fs::read_to_string(cursor_mcp_json_path(&ws, "second").unwrap()).unwrap();
+    assert!(
+        first.contains("\"first\"") && !first.contains("\"second\""),
+        "seat first must keep its TEAM_AGENT_ID"
+    );
+    assert!(
+        second.contains("\"second\"") && !second.contains("\"first\""),
+        "seat second must keep its TEAM_AGENT_ID"
+    );
+}
+
+#[test]
+#[serial(cursor_mcp_isolation)]
+#[serial(env)]
+fn cursor_shared_overlay_last_writer_is_the_destruction_tooth() {
+    let previous = std::env::var("TEAM_AGENT_CURSOR_MCP_ISOLATION").ok();
+    std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", "0");
+    let ws = tmp_dir("cursor-mcp-shared-red");
+    apply_cursor_mcp_overlay(&ws, &sample_mcp_config("first", "/ws")).expect("first");
+    apply_cursor_mcp_overlay(&ws, &sample_mcp_config("second", "/ws")).expect("second");
     let text = std::fs::read_to_string(ws.join(".cursor/mcp.json")).unwrap();
+    restore_isolation_env(previous);
     assert!(
         text.contains("second"),
-        "last writer wins on a shared --workspace; no grok-style exclusive gate"
+        "destruction: shared mcp.json last writer is second"
     );
     assert!(
         !text.contains("\"first\""),
-        "previous seat identity must not remain in the single json file"
+        "destruction: criterion 2 goes red — first identity is gone"
     );
 }
 
 #[test]
+#[serial(cursor_mcp_isolation)]
 fn cursor_enable_argv_is_documented_subcommand_without_workspace_flag() {
     let argv = cursor_mcp_enable_argv();
     assert_eq!(
@@ -145,6 +185,72 @@ fn cursor_enable_argv_is_documented_subcommand_without_workspace_flag() {
 }
 
 #[test]
+#[serial(cursor_mcp_isolation)]
+fn cursor_enable_failure_preserves_cwd_config_identity_and_redacted_stderr() {
+    let ws = tmp_dir("cursor-enable-diagnostic");
+    apply_cursor_mcp_overlay(
+        &ws,
+        &sample_mcp_config("diagnostic-seat", &ws.to_string_lossy()),
+    )
+    .expect("write fake cursor overlay");
+    let cwd = physical_workspace_path(&cursor_mcp_project_dir(&ws, "diagnostic-seat").unwrap());
+    let config_path = cwd.join(".cursor/mcp.json");
+    let config_body = std::fs::read(&config_path).expect("read fake overlay identity");
+    let config_metadata = std::fs::metadata(&config_path).expect("fake overlay metadata");
+    let expected_hash = format!("{:x}", Sha256::digest(&config_body));
+    let benign = format!("benign first-enable diagnostic {}", "x".repeat(700));
+    let secret_value = "must-not-leak-secret-value";
+    let stderr =
+        format!("Authorization: Bearer sk-{secret_value} token={secret_value}\n{benign}\n");
+    let argv = cursor_mcp_enable_argv();
+    let error = LifecycleError::cursor_mcp_enable_failure(
+        &argv,
+        &cwd,
+        Some(23),
+        b"out",
+        stderr.as_bytes(),
+        None,
+    );
+    let LifecycleError::RequirementUnmet(report) = error else {
+        panic!("expected RequirementUnmet diagnostic")
+    };
+
+    assert!(report.contains("argv: agent mcp enable team_orchestrator"));
+    assert!(report.contains(&format!("cwd: {}", cwd.display())));
+    assert!(report.contains(&format!("config_path: {}", config_path.display())));
+    assert!(report.contains("config_exists: true"));
+    assert!(report.contains(&format!("config_size: {}", config_body.len())));
+    assert!(report.contains(&format!("config_sha256: {expected_hash}")));
+    assert!(report.contains("stdout_len: 3"));
+    assert!(report.contains(&format!("stderr_len: {}", stderr.len())));
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        assert!(report.contains(&format!(
+            "config_mode: 0o{:o}",
+            config_metadata.permissions().mode()
+        )));
+    }
+    #[cfg(not(unix))]
+    assert!(report.contains("config_mode: unavailable_non_unix"));
+
+    let safe = report
+        .lines()
+        .find_map(|line| line.strip_prefix("stderr_first_safe: "))
+        .expect("bounded benign stderr must be retained");
+    assert!(safe.starts_with("benign first-enable diagnostic"));
+    assert_eq!(safe.len(), 512, "safe stderr must be capped at 512 bytes");
+    assert!(!report.contains("Authorization"));
+    assert!(!report.contains("Bearer"));
+    assert!(!report.contains(secret_value));
+    assert!(
+        !report.contains("TEAM_AGENT_AUTH_MODE"),
+        "diagnostic must not include overlay JSON contents"
+    );
+}
+
+#[test]
+#[serial(cursor_mcp_isolation)]
 fn cursor_workspace_flag_is_rewritten_to_physical_path() {
     let ws = tmp_dir("cursor-phys");
     let mut argv = vec![
@@ -158,6 +264,29 @@ fn cursor_workspace_flag_is_rewritten_to_physical_path() {
 }
 
 #[test]
+#[serial(cursor_mcp_isolation)]
+fn cursor_spawn_pointers_use_per_seat_workspace_and_add_dir() {
+    let ws = tmp_dir("cursor-pointers");
+    apply_cursor_mcp_overlay(&ws, &sample_mcp_config("seat-p", &ws.to_string_lossy()))
+        .expect("overlay");
+    let mut argv = vec![
+        "agent".to_string(),
+        "--workspace".to_string(),
+        ws.to_string_lossy().into_owned(),
+    ];
+    apply_cursor_spawn_workspace_pointers(&mut argv, &ws, "seat-p").expect("pointers");
+    let project = physical_workspace_path(&cursor_mcp_project_dir(&ws, "seat-p").unwrap());
+    let team = physical_workspace_path(&ws);
+    assert_eq!(argv[2], project.to_string_lossy().as_ref());
+    assert!(
+        argv.windows(2)
+            .any(|pair| pair[0] == "--add-dir" && pair[1] == team.to_string_lossy().as_ref()),
+        "true workspace must be added with documented --add-dir: {argv:?}"
+    );
+}
+
+#[test]
+#[serial(cursor_mcp_isolation)]
 #[serial(env)]
 fn cursor_subscription_proxy_copies_keys_without_requiring_profile() {
     let prev = std::env::var("HTTPS_PROXY").ok();
@@ -183,10 +312,11 @@ fn cursor_subscription_proxy_copies_keys_without_requiring_profile() {
 }
 
 #[test]
+#[serial(cursor_mcp_isolation)]
 fn cursor_spawn_writes_identity_into_project_mcp_json() {
     let ws = tmp_dir("cursor-mcp-spawn");
     let team = write_cursor_team(&ws, "cursortm", "cursor_writer");
-    let config_path = ws.join(".cursor").join("mcp.json");
+    let config_path = cursor_mcp_json_path(&ws, "cursor_writer").expect("iso path");
     assert!(
         !config_path.exists(),
         "precondition: project cursor mcp.json must be absent before spawn"
@@ -204,7 +334,7 @@ fn cursor_spawn_writes_identity_into_project_mcp_json() {
 
     let text = std::fs::read_to_string(&config_path).unwrap_or_else(|err| {
         panic!(
-            "cursor spawn must materialize {}; cursor only reads this workspace file: {err}",
+            "cursor spawn must materialize per-seat {}; cursor reads --workspace/.cursor/mcp.json: {err}",
             config_path.display()
         )
     });
@@ -285,3 +415,50 @@ fn tmp_dir(tag: &str) -> PathBuf {
     std::fs::create_dir_all(&dir).unwrap();
     std::fs::canonicalize(dir).unwrap()
 }
+
+fn restore_isolation_env(previous: Option<String>) {
+    match previous {
+        Some(value) => std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", value),
+        None => std::env::remove_var("TEAM_AGENT_CURSOR_MCP_ISOLATION"),
+    }
+}
+
+#[test]
+#[serial(cursor_mcp_isolation)]
+fn refuse_second_allows_when_isolation_on() {
+    let ws = tmp_dir("cursor-refuse-iso-on");
+    let spec = team_agent::model::yaml::loads(
+        "agents:\n  - id: a\n    provider: cursor_agent\n  - id: b\n    provider: cursor_agent\n",
+    )
+    .expect("spec");
+    refuse_second_cursor_occupant(&ws, "b", Some(&spec)).expect("isolation on allows second");
+}
+
+#[test]
+#[serial(cursor_mcp_isolation)]
+#[serial(env)]
+fn refuse_second_still_blocks_when_isolation_disabled() {
+    let previous = std::env::var("TEAM_AGENT_CURSOR_MCP_ISOLATION").ok();
+    std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", "0");
+    let ws = tmp_dir("cursor-refuse-iso-off");
+    let spec = team_agent::model::yaml::loads(
+        "agents:\n  - id: a\n    provider: cursor_agent\n  - id: b\n    provider: cursor_agent\n",
+    )
+    .expect("spec");
+    let err = refuse_second_cursor_occupant(&ws, "b", Some(&spec));
+    restore_isolation_env(previous);
+    let err = err.expect_err("isolation off must fail-closed");
+    match err {
+        LifecycleError::RequirementUnmet(text) => {
+            assert!(
+                text.contains("cursor_agent seat already occupies this workspace"),
+                "fail-closed text must stay: {text}"
+            );
+            assert!(
+                text.contains("last-writer"),
+                "reason must still name last-writer: {text}"
+            );
+        }
+        other => panic!("expected RequirementUnmet, got {other:?}"),
+    }
+}