@team-agent/installer 0.5.77 → 0.5.80

package/crates/team-agent/src/lifecycle/tests/cursor_mcp_overlay.rs

@@ -1,6 +1,7 @@
 //! purpose: cursor 席位必须把身份写进它实际会读的 mcp.json env
-//! contract: overlay 后 provider-config/<id>/cursor/.cursor/mcp.json 含 team_orchestrator.env.TEAM_AGENT_ID
-//!   （不是改 HOME，也不是靠 pane env 继承）
+//! contract: 隔离默认开时 overlay 写 per-seat 工程根 `.cursor/mcp.json`（`--workspace` /
+//!   enable cwd 同一根）；关隔离时写 `<workspace>/.cursor/mcp.json`。不是
+//!   `.team/runtime/mcp/*.json`，也不是靠 pane env 继承。
 //! boundary: 只覆盖 cursor launch 产物；不改 claude/codex/copilot/grok 路径
 //!
 //! 生产侧判据，未经血统审计。
@@ -16,34 +17,22 @@ use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use serial_test::serial;
-use sha2::{Digest, Sha256};
 use team_agent::lifecycle::quick_start_with_transport_in_workspace;
 use team_agent::lifecycle::{
     apply_cursor_mcp_overlay, apply_cursor_spawn_workspace_pointers,
     apply_cursor_subscription_proxy_env, apply_cursor_workspace_physical_path,
-    cursor_mcp_enable_argv, cursor_mcp_json_path, cursor_mcp_project_dir, physical_workspace_path,
-    refuse_second_cursor_occupant, LifecycleError,
+    cursor_mcp_enable_argv, cursor_mcp_enable_working_dir, cursor_mcp_json_path,
+    cursor_mcp_project_dir, physical_workspace_path, prepare_cursor_seat_mcp, LifecycleError,
 };
 use team_agent::provider::McpConfig;
 use team_agent::transport::test_support::OfflineTransport;
 
 #[test]
-#[serial(cursor_mcp_isolation)]
 fn cursor_overlay_writes_identity_into_mcp_json_env() {
     let ws = tmp_dir("cursor-mcp-id");
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("seat-a", &ws.to_string_lossy()))
         .expect("overlay write");
-    let path = cursor_mcp_json_path(&ws, "seat-a").unwrap();
-    let rendered = path.to_string_lossy();
-    assert!(
-        rendered.contains("provider-config") && rendered.contains("/cursor/"),
-        "identity must land under provider-config/<id>/cursor, not a HOME fork: {rendered}"
-    );
-    assert!(
-        !rendered.contains("/.team/runtime/cursor-mcp/"),
-        "must not use the rejected COPILOT_HOME-style cursor-mcp tree: {rendered}"
-    );
-    let text = std::fs::read_to_string(&path).unwrap();
+    let text = std::fs::read_to_string(ws.join(".cursor/mcp.json")).unwrap();
     assert!(
         text.contains("\"team_orchestrator\""),
         "cursor overlay must use the canonical server name"
@@ -71,7 +60,6 @@ fn cursor_overlay_writes_identity_into_mcp_json_env() {
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
 fn cursor_overlay_refuses_missing_identity() {
     let ws = tmp_dir("cursor-mcp-missing-id");
     let cfg = McpConfig {
@@ -96,7 +84,6 @@ fn cursor_overlay_refuses_missing_identity() {
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
 fn cursor_overlay_keeps_unrelated_servers_and_replaces_orchestrator() {
     let ws = tmp_dir("cursor-mcp-merge");
     let dir = ws.join(".cursor");
@@ -114,63 +101,38 @@ fn cursor_overlay_keeps_unrelated_servers_and_replaces_orchestrator() {
     .unwrap();
 
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("seat-b", "/ws-b")).expect("overlay merge");
-    let project = std::fs::read_to_string(dir.join("mcp.json")).unwrap();
+    let text = std::fs::read_to_string(dir.join("mcp.json")).unwrap();
     assert!(
-        project.contains("keep-me"),
-        "unrelated project MCP servers must survive in workspace mcp.json"
+        text.contains("keep-me"),
+        "unrelated project MCP servers must survive"
     );
     assert!(
-        !project.contains("/old/team-agent") && !project.contains("/stale"),
-        "stale orchestrator/legacy names must be scrubbed from the shared project file"
+        !text.contains("/old/team-agent") && !text.contains("/stale"),
+        "stale orchestrator/legacy names must be replaced"
     );
-    let isolated = std::fs::read_to_string(cursor_mcp_json_path(&ws, "seat-b").unwrap()).unwrap();
     assert!(
-        isolated.contains("seat-b") && isolated.contains("/ws-b"),
-        "new identity must land in the per-seat mcp.json"
+        text.contains("seat-b") && text.contains("/ws-b"),
+        "new identity must land"
     );
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
-fn cursor_second_seat_keeps_both_identities_when_isolated() {
+fn cursor_second_seat_overwrites_json_identity_without_exclusive_gate() {
     let ws = tmp_dir("cursor-mcp-two");
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("first", "/ws")).expect("first");
     apply_cursor_mcp_overlay(&ws, &sample_mcp_config("second", "/ws")).expect("second");
-    let first = std::fs::read_to_string(cursor_mcp_json_path(&ws, "first").unwrap()).unwrap();
-    let second = std::fs::read_to_string(cursor_mcp_json_path(&ws, "second").unwrap()).unwrap();
-    assert!(
-        first.contains("\"first\"") && !first.contains("\"second\""),
-        "seat first must keep its TEAM_AGENT_ID"
-    );
-    assert!(
-        second.contains("\"second\"") && !second.contains("\"first\""),
-        "seat second must keep its TEAM_AGENT_ID"
-    );
-}
-
-#[test]
-#[serial(cursor_mcp_isolation)]
-#[serial(env)]
-fn cursor_shared_overlay_last_writer_is_the_destruction_tooth() {
-    let previous = std::env::var("TEAM_AGENT_CURSOR_MCP_ISOLATION").ok();
-    std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", "0");
-    let ws = tmp_dir("cursor-mcp-shared-red");
-    apply_cursor_mcp_overlay(&ws, &sample_mcp_config("first", "/ws")).expect("first");
-    apply_cursor_mcp_overlay(&ws, &sample_mcp_config("second", "/ws")).expect("second");
     let text = std::fs::read_to_string(ws.join(".cursor/mcp.json")).unwrap();
-    restore_isolation_env(previous);
     assert!(
         text.contains("second"),
-        "destruction: shared mcp.json last writer is second"
+        "last writer wins on a shared --workspace; no grok-style exclusive gate"
     );
     assert!(
         !text.contains("\"first\""),
-        "destruction: criterion 2 goes red — first identity is gone"
+        "previous seat identity must not remain in the single json file"
     );
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
 fn cursor_enable_argv_is_documented_subcommand_without_workspace_flag() {
     let argv = cursor_mcp_enable_argv();
     assert_eq!(
@@ -185,72 +147,6 @@ fn cursor_enable_argv_is_documented_subcommand_without_workspace_flag() {
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
-fn cursor_enable_failure_preserves_cwd_config_identity_and_redacted_stderr() {
-    let ws = tmp_dir("cursor-enable-diagnostic");
-    apply_cursor_mcp_overlay(
-        &ws,
-        &sample_mcp_config("diagnostic-seat", &ws.to_string_lossy()),
-    )
-    .expect("write fake cursor overlay");
-    let cwd = physical_workspace_path(&cursor_mcp_project_dir(&ws, "diagnostic-seat").unwrap());
-    let config_path = cwd.join(".cursor/mcp.json");
-    let config_body = std::fs::read(&config_path).expect("read fake overlay identity");
-    let config_metadata = std::fs::metadata(&config_path).expect("fake overlay metadata");
-    let expected_hash = format!("{:x}", Sha256::digest(&config_body));
-    let benign = format!("benign first-enable diagnostic {}", "x".repeat(700));
-    let secret_value = "must-not-leak-secret-value";
-    let stderr =
-        format!("Authorization: Bearer sk-{secret_value} token={secret_value}\n{benign}\n");
-    let argv = cursor_mcp_enable_argv();
-    let error = LifecycleError::cursor_mcp_enable_failure(
-        &argv,
-        &cwd,
-        Some(23),
-        b"out",
-        stderr.as_bytes(),
-        None,
-    );
-    let LifecycleError::RequirementUnmet(report) = error else {
-        panic!("expected RequirementUnmet diagnostic")
-    };
-
-    assert!(report.contains("argv: agent mcp enable team_orchestrator"));
-    assert!(report.contains(&format!("cwd: {}", cwd.display())));
-    assert!(report.contains(&format!("config_path: {}", config_path.display())));
-    assert!(report.contains("config_exists: true"));
-    assert!(report.contains(&format!("config_size: {}", config_body.len())));
-    assert!(report.contains(&format!("config_sha256: {expected_hash}")));
-    assert!(report.contains("stdout_len: 3"));
-    assert!(report.contains(&format!("stderr_len: {}", stderr.len())));
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::PermissionsExt;
-        assert!(report.contains(&format!(
-            "config_mode: 0o{:o}",
-            config_metadata.permissions().mode()
-        )));
-    }
-    #[cfg(not(unix))]
-    assert!(report.contains("config_mode: unavailable_non_unix"));
-
-    let safe = report
-        .lines()
-        .find_map(|line| line.strip_prefix("stderr_first_safe: "))
-        .expect("bounded benign stderr must be retained");
-    assert!(safe.starts_with("benign first-enable diagnostic"));
-    assert_eq!(safe.len(), 512, "safe stderr must be capped at 512 bytes");
-    assert!(!report.contains("Authorization"));
-    assert!(!report.contains("Bearer"));
-    assert!(!report.contains(secret_value));
-    assert!(
-        !report.contains("TEAM_AGENT_AUTH_MODE"),
-        "diagnostic must not include overlay JSON contents"
-    );
-}
-
-#[test]
-#[serial(cursor_mcp_isolation)]
 fn cursor_workspace_flag_is_rewritten_to_physical_path() {
     let ws = tmp_dir("cursor-phys");
     let mut argv = vec![
@@ -264,29 +160,6 @@ fn cursor_workspace_flag_is_rewritten_to_physical_path() {
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
-fn cursor_spawn_pointers_use_per_seat_workspace_and_add_dir() {
-    let ws = tmp_dir("cursor-pointers");
-    apply_cursor_mcp_overlay(&ws, &sample_mcp_config("seat-p", &ws.to_string_lossy()))
-        .expect("overlay");
-    let mut argv = vec![
-        "agent".to_string(),
-        "--workspace".to_string(),
-        ws.to_string_lossy().into_owned(),
-    ];
-    apply_cursor_spawn_workspace_pointers(&mut argv, &ws, "seat-p").expect("pointers");
-    let project = physical_workspace_path(&cursor_mcp_project_dir(&ws, "seat-p").unwrap());
-    let team = physical_workspace_path(&ws);
-    assert_eq!(argv[2], project.to_string_lossy().as_ref());
-    assert!(
-        argv.windows(2)
-            .any(|pair| pair[0] == "--add-dir" && pair[1] == team.to_string_lossy().as_ref()),
-        "true workspace must be added with documented --add-dir: {argv:?}"
-    );
-}
-
-#[test]
-#[serial(cursor_mcp_isolation)]
 #[serial(env)]
 fn cursor_subscription_proxy_copies_keys_without_requiring_profile() {
     let prev = std::env::var("HTTPS_PROXY").ok();
@@ -312,14 +185,119 @@ fn cursor_subscription_proxy_copies_keys_without_requiring_profile() {
 }
 
 #[test]
-#[serial(cursor_mcp_isolation)]
+fn cursor_subscription_direct_profile_unsets_only_proxy_url_keys() {
+    let ws = tmp_dir("cursor-profile-direct");
+    let profiles = ws.join(".team/current/profiles");
+    std::fs::create_dir_all(&profiles).unwrap();
+    std::fs::write(
+        profiles.join("cursor.env"),
+        "AUTH_MODE=subscription\nPROFILE_NAME=cursor\nPROXY_MODE=direct\n",
+    )
+    .unwrap();
+
+    let launch = crate::lifecycle::profile_launch::prepare_provider_profile_launch_from_json(
+        &ws,
+        "cursor",
+        &serde_json::json!({
+            "id": "cursor",
+            "provider": "cursor_agent",
+            "auth_mode": "subscription",
+            "profile": "cursor"
+        }),
+        None,
+    )
+    .expect("direct Cursor profile should prepare");
+    for key in [
+        "HTTPS_PROXY",
+        "HTTP_PROXY",
+        "ALL_PROXY",
+        "https_proxy",
+        "http_proxy",
+        "all_proxy",
+        "GLOBAL_AGENT_HTTPS_PROXY",
+        "GLOBAL_AGENT_HTTP_PROXY",
+    ] {
+        assert!(launch.env_unset.contains(key), "direct must unset {key}");
+    }
+    assert!(!launch.env_unset.contains("NO_PROXY"));
+    assert!(!launch.env_unset.contains("no_proxy"));
+}
+
+#[test]
+fn cursor_mcp_enable_child_env_applies_direct_profile_unsets() {
+    let ws = tmp_dir("cursor-profile-enable-env");
+    let profiles = ws.join(".team/current/profiles");
+    std::fs::create_dir_all(&profiles).unwrap();
+    std::fs::write(
+        profiles.join("cursor.env"),
+        "AUTH_MODE=subscription\nPROFILE_NAME=cursor\nPROXY_MODE=direct\n",
+    )
+    .unwrap();
+    let launch = crate::lifecycle::profile_launch::prepare_provider_profile_launch_from_json(
+        &ws,
+        "cursor",
+        &serde_json::json!({
+            "id": "cursor",
+            "provider": "cursor_agent",
+            "auth_mode": "subscription",
+            "profile": "cursor"
+        }),
+        None,
+    )
+    .expect("direct Cursor profile should prepare");
+
+    let mut command = std::process::Command::new("/usr/bin/env");
+    command.env_clear();
+    for key in [
+        "HTTPS_PROXY",
+        "HTTP_PROXY",
+        "ALL_PROXY",
+        "https_proxy",
+        "http_proxy",
+        "all_proxy",
+        "GLOBAL_AGENT_HTTPS_PROXY",
+        "GLOBAL_AGENT_HTTP_PROXY",
+    ] {
+        command.env(key, "fixture");
+    }
+    command.env("NO_PROXY", "fixture");
+    command.env("no_proxy", "fixture");
+    crate::lifecycle::launch::apply_cursor_mcp_enable_profile_env(
+        &mut command,
+        Some(&launch),
+    );
+    let output = command.output().expect("env child should run");
+    assert!(output.status.success());
+    let text = String::from_utf8(output.stdout).unwrap();
+    for key in [
+        "HTTPS_PROXY",
+        "HTTP_PROXY",
+        "ALL_PROXY",
+        "https_proxy",
+        "http_proxy",
+        "all_proxy",
+        "GLOBAL_AGENT_HTTPS_PROXY",
+        "GLOBAL_AGENT_HTTP_PROXY",
+    ] {
+        assert!(
+            !text.lines().any(|line| line.starts_with(&format!("{key}="))),
+            "direct MCP child must omit {key}"
+        );
+    }
+    assert!(text.lines().any(|line| line == "NO_PROXY=fixture"));
+    assert!(text.lines().any(|line| line == "no_proxy=fixture"));
+}
+
+#[test]
+#[serial(env)]
 fn cursor_spawn_writes_identity_into_project_mcp_json() {
+    let _hermetic = hermetic_guard::HermeticTestEnv::enter("cursor-mcp-spawn");
     let ws = tmp_dir("cursor-mcp-spawn");
     let team = write_cursor_team(&ws, "cursortm", "cursor_writer");
-    let config_path = cursor_mcp_json_path(&ws, "cursor_writer").expect("iso path");
+    let selected = cursor_mcp_json_path(&ws, "cursor_writer").unwrap();
     assert!(
-        !config_path.exists(),
-        "precondition: project cursor mcp.json must be absent before spawn"
+        !selected.exists() && !ws.join(".cursor/mcp.json").exists(),
+        "precondition: selected project and workspace overlay must be absent before spawn"
     );
 
     quick_start_with_transport_in_workspace(
@@ -332,13 +310,66 @@ fn cursor_spawn_writes_identity_into_project_mcp_json() {
     )
     .expect("cursor quick-start through offline transport should spawn");
 
+    let text = std::fs::read_to_string(&selected).unwrap_or_else(|err| {
+        panic!(
+            "cursor spawn must materialize {}; isolation default reads this per-seat file: {err}",
+            selected.display()
+        )
+    });
+    assert_cursor_identity_overlay(&text, "cursor_writer", &ws);
+    assert!(
+        !ws.join(".cursor/mcp.json").exists(),
+        "default isolation must not dual-write the team workspace overlay"
+    );
+    let project = cursor_mcp_project_dir(&ws, "cursor_writer").unwrap();
+    let enable_cwd = cursor_mcp_enable_working_dir(&ws, Some(&project));
+    assert_eq!(enable_cwd, physical_workspace_path(&project));
+    let argv_workspace = spawn_argv_workspace_flag(&ws).expect("spawn argv --workspace");
+    assert_eq!(argv_workspace, physical_workspace_path(&project).to_string_lossy());
+}
+
+#[test]
+#[serial(env)]
+fn cursor_spawn_isolation_off_writes_workspace_mcp_json() {
+    let _hermetic = hermetic_guard::HermeticTestEnv::enter("cursor-mcp-spawn-legacy");
+    let key = "TEAM_AGENT_CURSOR_MCP_ISOLATION";
+    let prev = std::env::var(key).ok();
+    std::env::set_var(key, "0");
+    let ws = tmp_dir("cursor-mcp-spawn-legacy");
+    let team = write_cursor_team(&ws, "cursortm", "cursor_writer");
+    let result = quick_start_with_transport_in_workspace(
+        &ws,
+        &team,
+        None,
+        true,
+        Some("cursortm"),
+        &OfflineTransport::new(),
+    );
+    match prev {
+        Some(value) => std::env::set_var(key, value),
+        None => std::env::remove_var(key),
+    }
+    result.expect("legacy isolation-off cursor spawn");
+    let config_path = ws.join(".cursor").join("mcp.json");
     let text = std::fs::read_to_string(&config_path).unwrap_or_else(|err| {
         panic!(
-            "cursor spawn must materialize per-seat {}; cursor reads --workspace/.cursor/mcp.json: {err}",
+            "isolation-off spawn must write {}; cursor --workspace is the team root: {err}",
             config_path.display()
         )
     });
-    let workspace = ws.to_string_lossy();
+    assert_cursor_identity_overlay(&text, "cursor_writer", &ws);
+    assert!(
+        !cursor_mcp_json_path(&ws, "cursor_writer")
+            .unwrap()
+            .exists(),
+        "isolation-off must not materialize the per-seat project overlay"
+    );
+    let argv_workspace = spawn_argv_workspace_flag(&ws).expect("spawn argv --workspace");
+    assert_eq!(argv_workspace, physical_workspace_path(&ws).to_string_lossy());
+}
+
+fn assert_cursor_identity_overlay(text: &str, agent_id: &str, workspace: &Path) {
+    let workspace = workspace.to_string_lossy();
     assert!(
         text.contains("\"team_orchestrator\""),
         "spawned overlay must declare team_orchestrator"
@@ -349,10 +380,10 @@ fn cursor_spawn_writes_identity_into_project_mcp_json() {
     );
     assert!(
         text.contains(workspace.as_ref()),
-        "workspace must be the real path, not a placeholder"
+        "TEAM_AGENT_WORKSPACE / mcp args must be the real team path, not a placeholder"
     );
     assert!(
-        text.contains("\"TEAM_AGENT_ID\"") && text.contains("cursor_writer"),
+        text.contains("\"TEAM_AGENT_ID\"") && text.contains(agent_id),
         "identity must be in json env"
     );
     assert!(
@@ -363,6 +394,27 @@ fn cursor_spawn_writes_identity_into_project_mcp_json() {
     );
 }
 
+fn spawn_argv_workspace_flag(workspace: &Path) -> Option<String> {
+    let log = workspace.join(".team").join("logs").join("events.jsonl");
+    let text = std::fs::read_to_string(log).ok()?;
+    for line in text.lines().rev() {
+        let value: serde_json::Value = serde_json::from_str(line).ok()?;
+        if value.get("event").and_then(serde_json::Value::as_str)
+            != Some("provider.worker.spawn_argv")
+        {
+            continue;
+        }
+        let argv = value.get("argv")?.as_array()?;
+        let mut items = argv.iter().filter_map(serde_json::Value::as_str);
+        while let Some(item) = items.next() {
+            if item == "--workspace" {
+                return items.next().map(str::to_string);
+            }
+        }
+    }
+    None
+}
+
 fn write_cursor_team(ws: &Path, team_key: &str, agent_id: &str) -> PathBuf {
     let team = ws.join(team_key);
     std::fs::create_dir_all(team.join("agents")).unwrap();
@@ -400,6 +452,68 @@ fn sample_mcp_config(agent_id: &str, workspace: &str) -> McpConfig {
     }
 }
 
+#[test]
+#[serial(env)]
+fn isolated_cursor_prepare_materializes_per_seat_project_not_workspace_overlay() {
+    let ws = tmp_dir("cursor-iso-clean");
+    let project = prepare_cursor_seat_mcp(&ws, "seat-iso", &sample_mcp_config("seat-iso", &ws.to_string_lossy()))
+        .expect("prepare isolated cursor")
+        .expect("isolation defaults on");
+    assert!(
+        project.ends_with("provider-config/seat-iso/cursor"),
+        "per-seat project must be materialized: {}",
+        project.display()
+    );
+    assert!(project.join(".cursor").is_dir());
+    let overlay = std::fs::read_to_string(cursor_mcp_json_path(&ws, "seat-iso").unwrap()).unwrap();
+    assert!(
+        overlay.contains("seat-iso") && overlay.contains("team_orchestrator"),
+        "overlay must land in the per-seat mcp.json"
+    );
+    assert!(
+        !ws.join(".cursor/mcp.json").exists(),
+        "clean workspace overlay must not be written when isolation is on"
+    );
+    let enable_cwd = cursor_mcp_enable_working_dir(&ws, Some(&project));
+    assert_eq!(enable_cwd, physical_workspace_path(&project));
+    let mut argv = vec![
+        "agent".to_string(),
+        "--workspace".to_string(),
+        ws.to_string_lossy().into_owned(),
+    ];
+    apply_cursor_spawn_workspace_pointers(&mut argv, &ws, "seat-iso").unwrap();
+    let workspace_flag = argv
+        .windows(2)
+        .find(|pair| pair[0] == "--workspace")
+        .map(|pair| pair[1].as_str())
+        .unwrap();
+    assert_eq!(workspace_flag, physical_workspace_path(&project).to_string_lossy());
+    assert_eq!(
+        include_str!("../launch/spawn.rs").contains("prepare_cursor_seat_mcp("),
+        true,
+        "fresh spawn must call the shared materializer, not only compute the path"
+    );
+    assert!(
+        include_str!("../restart/common.rs").contains("prepare_cursor_seat_mcp("),
+        "restart spawn_agent_window must use the same materializer"
+    );
+}
+
+#[test]
+fn cursor_enable_working_dir_does_not_depend_on_cfg_test_skip() {
+    let ws = tmp_dir("cursor-enable-cwd");
+    let project = ws.join(".team/runtime/provider-config/seat/cursor");
+    std::fs::create_dir_all(&project).unwrap();
+    assert_eq!(
+        cursor_mcp_enable_working_dir(&ws, Some(&project)),
+        physical_workspace_path(&project)
+    );
+    assert_eq!(
+        cursor_mcp_enable_working_dir(&ws, None),
+        physical_workspace_path(&ws)
+    );
+}
+
 fn tmp_dir(tag: &str) -> PathBuf {
     static N: AtomicU64 = AtomicU64::new(0);
     // 见 gate_fixtures::scratch_dir：⛔ 不硬编码绝对路径，默认标准临时目录。
@@ -415,50 +529,3 @@ fn tmp_dir(tag: &str) -> PathBuf {
     std::fs::create_dir_all(&dir).unwrap();
     std::fs::canonicalize(dir).unwrap()
 }
-
-fn restore_isolation_env(previous: Option<String>) {
-    match previous {
-        Some(value) => std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", value),
-        None => std::env::remove_var("TEAM_AGENT_CURSOR_MCP_ISOLATION"),
-    }
-}
-
-#[test]
-#[serial(cursor_mcp_isolation)]
-fn refuse_second_allows_when_isolation_on() {
-    let ws = tmp_dir("cursor-refuse-iso-on");
-    let spec = team_agent::model::yaml::loads(
-        "agents:\n  - id: a\n    provider: cursor_agent\n  - id: b\n    provider: cursor_agent\n",
-    )
-    .expect("spec");
-    refuse_second_cursor_occupant(&ws, "b", Some(&spec)).expect("isolation on allows second");
-}
-
-#[test]
-#[serial(cursor_mcp_isolation)]
-#[serial(env)]
-fn refuse_second_still_blocks_when_isolation_disabled() {
-    let previous = std::env::var("TEAM_AGENT_CURSOR_MCP_ISOLATION").ok();
-    std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", "0");
-    let ws = tmp_dir("cursor-refuse-iso-off");
-    let spec = team_agent::model::yaml::loads(
-        "agents:\n  - id: a\n    provider: cursor_agent\n  - id: b\n    provider: cursor_agent\n",
-    )
-    .expect("spec");
-    let err = refuse_second_cursor_occupant(&ws, "b", Some(&spec));
-    restore_isolation_env(previous);
-    let err = err.expect_err("isolation off must fail-closed");
-    match err {
-        LifecycleError::RequirementUnmet(text) => {
-            assert!(
-                text.contains("cursor_agent seat already occupies this workspace"),
-                "fail-closed text must stay: {text}"
-            );
-            assert!(
-                text.contains("last-writer"),
-                "reason must still name last-writer: {text}"
-            );
-        }
-        other => panic!("expected RequirementUnmet, got {other:?}"),
-    }
-}

package/crates/team-agent/src/lifecycle/tests/cursor_require_explicit_model_red.rs

@@ -8,8 +8,8 @@
 //!       what: 写了 model 则该值进入 `--model <值>`
 //!     - name: cursor-effort-refuses-compile
 //!       what: 角色写 effort 则失败，不得丢掉后仍起席
-//!     - name: cursor-second-seat-isolated-identity
-//!       what: 默认 per-seat MCP 隔离时同 workspace 两个 CursorAgent 都启动且身份各自保留
+//!     - name: cursor-second-seat-refuses
+//!       what: 同 workspace 第二 CursorAgent 拒绝，文案含 TEAM_AGENT_ID/mcp.json
 //! boundary:
 //!   - 只钉 Provider::CursorAgent；不改 grok/claude 路径
 //! maturity: wired
@@ -26,7 +26,6 @@ use std::path::{Path, PathBuf};
 use std::sync::atomic::{AtomicU64, Ordering};
 
 use serial_test::serial;
-use team_agent::lifecycle::cursor_mcp_json_path;
 use team_agent::lifecycle::quick_start_with_transport_in_workspace;
 use team_agent::transport::test_support::OfflineTransport;
 
@@ -67,6 +66,7 @@ fn cursor_role_missing_model_refuses_to_start() {
 #[test]
 #[serial(env)]
 fn cursor_role_explicit_model_reaches_argv() {
+    let _hermetic = hermetic_guard::HermeticTestEnv::enter("cursor-with-model");
     let ws = tmp_dir("cursor-with-model");
     let team = write_role_team(
         &ws,
@@ -127,9 +127,8 @@ fn cursor_role_with_effort_refuses_to_start() {
 
 #[test]
 #[serial(env)]
-fn cursor_second_seat_in_same_workspace_uses_isolated_identity() {
-    let previous_isolation = std::env::var("TEAM_AGENT_CURSOR_MCP_ISOLATION").ok();
-    std::env::remove_var("TEAM_AGENT_CURSOR_MCP_ISOLATION");
+fn cursor_second_seat_in_same_workspace_is_refused() {
+    let _hermetic = hermetic_guard::HermeticTestEnv::enter("cursor-two");
     let ws = tmp_dir("cursor-two");
     let team = ws.join("cursortm");
     std::fs::create_dir_all(team.join("agents")).unwrap();
@@ -156,36 +155,21 @@ fn cursor_second_seat_in_same_workspace_uses_isolated_identity() {
         Some("cursortm"),
         &transport,
     );
-    restore_isolation_env(previous_isolation);
-    result.expect("default per-seat MCP isolation must allow both Cursor seats");
-    let records = transport.spawn_records();
-    assert_eq!(
-        records.len(),
-        2,
-        "both Cursor seats must spawn; records={records:?}"
-    );
-
-    let first = std::fs::read_to_string(cursor_mcp_json_path(&ws, "cursor_a").unwrap())
-        .expect("first seat MCP config");
-    let second = std::fs::read_to_string(cursor_mcp_json_path(&ws, "cursor_b").unwrap())
-        .expect("second seat MCP config");
+    let err = match result {
+        Ok(report) => panic!("second cursor seat must refuse; report={report:?}"),
+        Err(error) => error.to_string(),
+    };
     assert!(
-        first.contains("\"cursor_a\"") && !first.contains("\"cursor_b\""),
-        "first seat must retain its own TEAM_AGENT_ID"
+        err.contains("TEAM_AGENT_ID") && err.contains("mcp.json"),
+        "error must name the last-writer identity file; err={err}"
     );
     assert!(
-        second.contains("\"cursor_b\"") && !second.contains("\"cursor_a\""),
-        "second seat must retain its own TEAM_AGENT_ID"
+        transport.spawn_records().is_empty(),
+        "must refuse before any cursor spawn; records={:?}",
+        transport.spawn_records()
     );
 }
 
-fn restore_isolation_env(previous: Option<String>) {
-    match previous {
-        Some(value) => std::env::set_var("TEAM_AGENT_CURSOR_MCP_ISOLATION", value),
-        None => std::env::remove_var("TEAM_AGENT_CURSOR_MCP_ISOLATION"),
-    }
-}
-
 fn first_spawn_argv(transport: &OfflineTransport) -> Vec<String> {
     let records = transport.spawn_records();
     assert!(