@team-agent/installer 0.5.77 → 0.5.80

package/crates/team-agent/src/lifecycle/launch/cursor_mcp.rs

@@ -3,21 +3,21 @@
 //! contract:
 //!   provides:
 //!     - name: apply_cursor_mcp_overlay
-//!       what: 默认写 provider-config/<id>/cursor/.cursor/mcp.json；隔离关闭时写 workspace 文件
-//!     - name: apply_cursor_spawn_workspace_pointers
-//!       what: 隔离开时 --workspace 指 per-seat 工程根，--add-dir 指真 workspace
+//!       what: 写 <workspace>/.cursor/mcp.json，env 必须带 TEAM_AGENT_ID
 //!     - name: cursor_mcp_enable_argv
 //!       what: 组 `agent mcp enable team_orchestrator`（不认 --workspace）
 //!     - name: enable_cursor_workspace_mcp
-//!       what: 在工程根跑 enable；测试隔离下跳过以免写 ~/.cursor
+//!       what: 在工程根（可选）或物理工作目录跑 enable；测试隔离下跳过以免写 ~/.cursor
+//!     - name: apply_cursor_spawn_workspace_pointers
+//!       what: 隔离开时 --workspace 指 per-seat 工程根，--add-dir 指真 workspace
 //!     - name: physical_workspace_path
 //!       what: pwd -P 等价路径；mcp enable 按 getcwd 分片
 //!     - name: refuse_second_cursor_occupant
-//!       what: 隔离不可用时拒绝第二席；隔离可用时放行
+//!       what: 同一物理 workspace 第二 CursorAgent 拒绝（mcp.json last-writer）
 //! boundary:
-//!   - 隔离开启时同 workspace 允许多 CursorAgent；隔离关闭/失败仍 fail-closed
+//!   - 同 workspace 第二 CursorAgent 拒绝；U-07 过前不装「已支持多席」
 //!   - 不把身份从 json env 删掉（cursor 不继承父进程 TEAM_AGENT_*）
-//!   - 不改 HOME，不写 ~/.cursor/mcp.json 全局文件
+//!   - 不写 ~/.cursor/mcp.json 全局文件
 //!   - 不调 --approve-mcps（未验证能代替 enable）
 //! maturity: wired
 //! ---
@@ -26,8 +26,6 @@ use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use sha2::{Digest, Sha256};
-
 use crate::lifecycle::LifecycleError;
 use crate::model::yaml::Value as YamlValue;
 use crate::provider::wire::command_name;
@@ -46,123 +44,6 @@ const REQUIRED_IDENTITY_KEYS: &[&str] = &[
     "TEAM_AGENT_AUTH_MODE",
 ];
 
-const CURSOR_ENABLE_STDERR_MAX_BYTES: usize = 512;
-const CURSOR_ENABLE_SECRET_INDICATORS: &[&str] = &[
-    "authorization",
-    "bearer",
-    "api_key",
-    "cookie",
-    "password",
-    "token=",
-    "sk-",
-];
-
-impl LifecycleError {
-    pub(crate) fn cursor_mcp_enable_failure(
-        argv: &[String],
-        physical_cwd: &Path,
-        exit_code: Option<i32>,
-        stdout: &[u8],
-        stderr: &[u8],
-        spawn_error: Option<&str>,
-    ) -> Self {
-        let config_path = physical_cwd.join(".cursor").join("mcp.json");
-        let metadata = std::fs::metadata(&config_path).ok();
-        let config_exists = metadata.is_some();
-        let config_size = metadata
-            .as_ref()
-            .map(|value| value.len().to_string())
-            .unwrap_or_else(|| "unavailable".to_string());
-        #[cfg(unix)]
-        let config_mode = {
-            use std::os::unix::fs::PermissionsExt;
-            metadata
-                .as_ref()
-                .map(|value| format!("0o{:o}", value.permissions().mode()))
-                .unwrap_or_else(|| "unavailable".to_string())
-        };
-        #[cfg(not(unix))]
-        let config_mode = "unavailable_non_unix".to_string();
-        let config_sha256 = std::fs::read(&config_path)
-            .ok()
-            .map(|body| format!("{:x}", Sha256::digest(body)))
-            .unwrap_or_else(|| "unavailable".to_string());
-        let stderr_fact = bounded_safe_cursor_stderr(stderr)
-            .map(|safe| format!("stderr_first_safe: {safe}"))
-            .unwrap_or_else(|| "stderr_redacted".to_string());
-        let (reason, action) = match spawn_error {
-            Some(error) => (
-                format!("cannot run cursor MCP enable: {error}"),
-                format!(
-                    "install cursor-agent on PATH (same binary as `{}`) and retry",
-                    argv[0]
-                ),
-            ),
-            None => (
-                "without enable, cursor keeps MCP as not loaded (needs approval)".to_string(),
-                format!(
-                    "from that directory run `{} mcp enable team_orchestrator`",
-                    argv[0]
-                ),
-            ),
-        };
-        LifecycleError::RequirementUnmet(format!(
-            "error: `{}` failed (exit {})\n\
-             reason: {reason}\n\
-             argv: {}\n\
-             cwd: {}\n\
-             config_path: {}\n\
-             config_exists: {config_exists}\n\
-             config_mode: {config_mode}\n\
-             config_size: {config_size}\n\
-             config_sha256: {config_sha256}\n\
-             stdout_len: {}\n\
-             stderr_len: {}\n\
-             {stderr_fact}\n\
-             action: {action}",
-            argv.join(" "),
-            exit_code
-                .map(|code| code.to_string())
-                .unwrap_or_else(|| "unavailable".to_string()),
-            argv.join(" "),
-            physical_cwd.display(),
-            config_path.display(),
-            stdout.len(),
-            stderr.len(),
-        ))
-    }
-}
-
-fn bounded_safe_cursor_stderr(stderr: &[u8]) -> Option<String> {
-    let stderr = String::from_utf8_lossy(stderr);
-    let mut safe = String::new();
-    'lines: for line in stderr.lines() {
-        let lower = line.to_ascii_lowercase();
-        if CURSOR_ENABLE_SECRET_INDICATORS
-            .iter()
-            .any(|indicator| lower.contains(indicator))
-        {
-            continue;
-        }
-        if line.trim().is_empty() {
-            continue;
-        }
-        if !safe.is_empty() {
-            if safe.len() == CURSOR_ENABLE_STDERR_MAX_BYTES {
-                break;
-            }
-            safe.push('\n');
-        }
-        for character in line.chars() {
-            if safe.len() + character.len_utf8() > CURSOR_ENABLE_STDERR_MAX_BYTES {
-                break 'lines;
-            }
-            safe.push(character);
-        }
-    }
-    (!safe.is_empty()).then_some(safe)
-}
-
 /// ---
 /// purpose: 给出 workspace 的物理路径
 /// returns: 能 canonicalize 就用它，否则原样返回
@@ -186,18 +67,17 @@ fn agent_is_cursor(provider: Option<&str>) -> bool {
 }
 
 /// ---
-/// purpose: 同一物理 workspace 的第二 CursorAgent：隔离可用则放行，否则 fail-closed
+/// purpose: 同一物理 workspace 拒绝第二 CursorAgent
 /// params:
 ///   workspace: 物理工作目录
 ///   incoming_id: 正要起的席位 id
 ///   spec: 可选 yaml spec，用来在 state 尚未写入时看见第二席
-/// returns: 隔离关闭且已有其它 CursorAgent 则 RequirementUnmet
+/// returns: 已有其它 CursorAgent 则 RequirementUnmet，文案含 TEAM_AGENT_ID 与 mcp.json
 /// contract:
 ///   provides:
 ///     - name: refuse_second_cursor_occupant
-///       what: 共用 mcp.json last-writer 闸；隔离落地后不再挡第二席
+///       what: mcp.json last-writer 闸；U-07 过前不装多席
 /// boundary:
-///   - 隔离失败/关闭时不改文案语义（仍点名 mcp.json last-writer）
 ///   - 不改 grok 独占实现
 /// ---
 pub fn refuse_second_cursor_occupant(
@@ -249,9 +129,6 @@ pub fn refuse_second_cursor_occupant(
     if others.is_empty() {
         return Ok(());
     }
-    if cursor_mcp_isolation_enabled() {
-        return Ok(());
-    }
     Err(LifecycleError::RequirementUnmet(format!(
         "error: cursor_agent seat already occupies this workspace\n\
          incoming: {incoming_id}\n\
@@ -269,41 +146,16 @@ fn agent_is_paused_yaml(agent: &YamlValue) -> bool {
 }
 
 /// ---
-/// purpose: 写 cursor 会读的 mcp.json；默认进 provider-config 工程根，关闭隔离时才写 workspace 文件
+/// purpose: 写 workspace 下 cursor 会读的 mcp.json，env 里必须带席位身份键
 /// params:
 ///   mcp_config: 已解析的 MCP 配置，须含 team_orchestrator 与 command
 /// returns: 写出的文件路径
-/// errors: 缺条目或缺 command 时返回 StatePersist；隔离建盘失败返回 RequirementUnmet
+/// errors: 缺条目或缺 command 时返回 StatePersist，写盘失败也返回 StatePersist
 /// ---
 pub fn apply_cursor_mcp_overlay(
     workspace: &Path,
     mcp_config: &crate::provider::McpConfig,
 ) -> Result<PathBuf, LifecycleError> {
-    let (command, args, env) = parse_orchestrator_env(mcp_config)?;
-    let agent_id = env
-        .get("TEAM_AGENT_ID")
-        .map(String::as_str)
-        .filter(|value| !value.trim().is_empty())
-        .ok_or_else(|| {
-            LifecycleError::StatePersist(
-                "cursor MCP overlay missing resolved TEAM_AGENT_ID in json env \
-(cursor does not inherit parent TEAM_AGENT_* into the MCP child)"
-                    .to_string(),
-            )
-        })?;
-    let cursor_dir = if cursor_mcp_isolation_enabled() {
-        let project = materialize_cursor_mcp_project(workspace, agent_id)?;
-        scrub_workspace_orchestrator_mcp(workspace)?;
-        project.join(".cursor")
-    } else {
-        workspace.join(".cursor")
-    };
-    write_cursor_mcp_json_at(&cursor_dir, command, args, env)
-}
-
-fn parse_orchestrator_env(
-    mcp_config: &crate::provider::McpConfig,
-) -> Result<(String, Vec<String>, BTreeMap<String, String>), LifecycleError> {
     let server = mcp_config
         .raw
         .get("team_orchestrator")
@@ -319,8 +171,7 @@ fn parse_orchestrator_env(
         .filter(|value| !value.is_empty())
         .ok_or_else(|| {
             LifecycleError::StatePersist("cursor MCP overlay missing command".to_string())
-        })?
-        .to_string();
+        })?;
     let args = server
         .get("args")
         .and_then(serde_json::Value::as_array)
@@ -354,16 +205,9 @@ fn parse_orchestrator_env(
             }
         }
     }
-    Ok((command, args, env))
-}
 
-fn write_cursor_mcp_json_at(
-    dir: &Path,
-    command: String,
-    args: Vec<String>,
-    env: BTreeMap<String, String>,
-) -> Result<PathBuf, LifecycleError> {
-    std::fs::create_dir_all(dir)
+    let dir = workspace.join(".cursor");
+    std::fs::create_dir_all(&dir)
         .map_err(|e| LifecycleError::StatePersist(format!("{}: {e}", dir.display())))?;
     let path = dir.join("mcp.json");
     let mut root = read_existing_mcp_json(&path);
@@ -405,28 +249,6 @@ fn write_cursor_mcp_json_at(
     Ok(path)
 }
 
-fn scrub_workspace_orchestrator_mcp(workspace: &Path) -> Result<(), LifecycleError> {
-    let path = workspace.join(".cursor").join("mcp.json");
-    if !path.is_file() {
-        return Ok(());
-    }
-    let mut root = read_existing_mcp_json(&path);
-    let Some(servers) = root
-        .as_object_mut()
-        .and_then(|obj| obj.get_mut("mcpServers"))
-        .and_then(serde_json::Value::as_object_mut)
-    else {
-        return Ok(());
-    };
-    servers.remove("team_orchestrator");
-    servers.remove("team-agent");
-    let body = serde_json::to_string_pretty(&root)
-        .map_err(|e| LifecycleError::StatePersist(format!("serialize cursor mcp.json: {e}")))?;
-    std::fs::write(&path, body.as_bytes())
-        .map_err(|e| LifecycleError::StatePersist(format!("{}: {e}", path.display())))?;
-    Ok(())
-}
-
 /// ---
 /// purpose: 组出启用 team_orchestrator 的 cursor 命令行
 /// returns: 不带 workspace 参数的 argv，该命令按进程工作目录分片
@@ -441,49 +263,99 @@ pub fn cursor_mcp_enable_argv() -> Vec<String> {
 }
 
 /// ---
-/// purpose: 在工程根下执行 cursor 的 MCP 启用命令（getcwd 分片，不改 HOME）
+/// purpose: 在物理工作目录下执行 cursor 的 MCP 启用命令
 /// returns: 测试隔离环境或显式跳过标志下直接成功，避免写用户全局配置
-/// errors: 命令跑不起来或退出码非零时返回 RequirementUnmet，附带有界脱敏诊断但不读出 json 内容
+/// errors: 命令跑不起来或退出码非零时返回 RequirementUnmet，错误里只记输出长度不记内容
 /// ---
+pub fn cursor_mcp_enable_working_dir(workspace: &Path, project_root: Option<&Path>) -> PathBuf {
+    match project_root {
+        Some(root) => physical_workspace_path(root),
+        None => physical_workspace_path(workspace),
+    }
+}
+
+pub fn prepare_cursor_seat_mcp(
+    workspace: &Path,
+    agent_id: &str,
+    mcp_config: &crate::provider::McpConfig,
+) -> Result<Option<PathBuf>, LifecycleError> {
+    if cursor_mcp_isolation_enabled() {
+        let project = materialize_cursor_mcp_project(workspace, agent_id)?;
+        apply_cursor_mcp_overlay(&project, mcp_config)?;
+        Ok(Some(project))
+    } else {
+        apply_cursor_mcp_overlay(workspace, mcp_config)?;
+        Ok(None)
+    }
+}
+
 pub fn enable_cursor_workspace_mcp(
     workspace: &Path,
     project_root: Option<&Path>,
 ) -> Result<(), LifecycleError> {
+    enable_cursor_workspace_mcp_with_profile(workspace, project_root, None)
+}
+
+/// Run Cursor's MCP enable command with the same profile-local environment
+/// policy as the worker spawn. In particular, subscription direct mode must
+/// not reintroduce proxy URL keys during this preparatory command.
+pub fn enable_cursor_workspace_mcp_with_profile(
+    workspace: &Path,
+    project_root: Option<&Path>,
+    profile_launch: Option<&crate::provider::ProviderProfileLaunch>,
+) -> Result<(), LifecycleError> {
+    let physical = cursor_mcp_enable_working_dir(workspace, project_root);
     if skip_cursor_mcp_enable() {
         return Ok(());
     }
-    let physical = match project_root {
-        Some(root) => physical_workspace_path(root),
-        None => physical_workspace_path(workspace),
-    };
     let argv = cursor_mcp_enable_argv();
-    let mut cmd = Command::new(&argv[0]);
-    cmd.args(&argv[1..]).current_dir(&physical);
-    let output = match cmd.output() {
-        Ok(output) => output,
-        Err(error) => {
-            let error = error.to_string();
-            return Err(LifecycleError::cursor_mcp_enable_failure(
-                &argv,
-                &physical,
-                None,
-                &[],
-                &[],
-                Some(&error),
-            ));
-        }
-    };
+    let mut command = Command::new(&argv[0]);
+    command
+        .args(&argv[1..])
+        .current_dir(&physical);
+    apply_cursor_mcp_enable_profile_env(&mut command, profile_launch);
+    let output = command.output().map_err(|e| {
+        LifecycleError::RequirementUnmet(format!(
+            "error: cannot run `{} mcp enable team_orchestrator`\n\
+             reason: {e}\n\
+             action: install cursor-agent on PATH (same binary as `agent`) and retry",
+            argv[0]
+        ))
+    })?;
     if output.status.success() {
         return Ok(());
     }
-    Err(LifecycleError::cursor_mcp_enable_failure(
-        &argv,
-        &physical,
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    Err(LifecycleError::RequirementUnmet(format!(
+        "error: `{} mcp enable team_orchestrator` failed (exit {:?})\n\
+         reason: without enable, cursor keeps MCP as not loaded (needs approval)\n\
+         cwd: {}\n\
+         stdout_len: {}\n\
+         stderr_len: {}\n\
+         action: from that directory run `{} mcp enable team_orchestrator`",
+        argv[0],
         output.status.code(),
-        &output.stdout,
-        &output.stderr,
-        None,
-    ))
+        physical.display(),
+        stdout.len(),
+        stderr.len(),
+        argv[0]
+    )))
+}
+
+pub(crate) fn apply_cursor_mcp_enable_profile_env(
+    command: &mut Command,
+    profile_launch: Option<&crate::provider::ProviderProfileLaunch>,
+) {
+    let Some(profile_launch) = profile_launch else {
+        return;
+    };
+    for key in &profile_launch.env_unset {
+        command.env_remove(key);
+    }
+    for (key, value) in &profile_launch.env_overlay {
+        command.env(key, value);
+    }
 }
 
 /// ---
@@ -503,11 +375,6 @@ pub fn apply_cursor_workspace_physical_path(argv: &mut [String], workspace: &Pat
 
 /// ---
 /// purpose: 隔离开时把 cursor --workspace 指到 per-seat 工程根，并用 --add-dir 挂上真 workspace
-/// params:
-///   argv: 就地改写（可能追加 --add-dir）
-///   workspace: 团队工作目录
-///   agent_id: 席位 id
-/// errors: 工程根路径非法时返回 RequirementUnmet
 /// ---
 pub fn apply_cursor_spawn_workspace_pointers(
     argv: &mut Vec<String>,

package/crates/team-agent/src/lifecycle/launch/mcp_config.rs

@@ -11,7 +11,7 @@
 //!     - name: reconcile_grok_toml_per_seat_keys
 //!       what: 起 grok 席前清掉共享 toml 里遗留的 per-seat 键并留审计事件
 //!     - name: ensure_grok_login_and_folder_trust
-//!       what: grok 未登录时拒绝起席；目录信任与用户同意由可见 Grok TUI 负责
+//!       what: grok 未登录或目录未信任时拒绝起席
 //!     - name: point_native_mcp_config_at_file
 //!       what: 把 argv 里的 MCP 配置参数改指到已落盘的文件
 //!   depends:
@@ -29,6 +29,7 @@
 //! ---
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
+use std::process::Command;
 
 use crate::lifecycle::*;
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
@@ -380,19 +381,20 @@ fn grok_occupied_cwd_error(
 }
 
 /// ---
-/// purpose: 起 grok 席前确认已登录；目录信任与用户同意交给可见 Grok TUI
+/// purpose: 起 grok 席前确认已登录且该目录已被信任
 /// params:
-///   _cwd: 席位的工作目录；保留参数以维持现有调用契约
-/// returns: 登录态存在时返回空值
-/// errors: HOME 未设、登录态文件缺失或为空时返回 RequirementUnmet
+///   cwd: 席位的工作目录，用于判断目录信任
+/// returns: 通过返回空值；关闭 folder-trust 的环境变量下跳过信任检查
+/// errors: HOME 未设、登录态文件缺失或为空、目录未被信任时返回 RequirementUnmet
 /// ---
-/// 未登录时不许起出「能收信、没有手」的 grok 席。登录态只看
-/// `$HOME/.grok/auth.json`；Team Agent 不判断或改变目录信任，Grok TUI
-/// 如需用户同意会在可见 pane 内自行询问。
-pub(crate) fn ensure_grok_login_and_folder_trust(_cwd: &Path) -> Result<(), LifecycleError> {
+/// 未登录 / 目录未信任时不许起出「能收信、没有手」的 grok 席。
+/// 登录态看 `$HOME/.grok/auth.json`；目录信任看 `$HOME/.grok/trusted_folders.toml`
+/// （与 grok `--trust` / `/hooks-trust` 同一份；未信任则项目作用域 MCP 不生效）。
+/// `GROK_FOLDER_TRUST=0` 时 grok 自己关掉 folder-trust，本检查跟着放行。
+pub(crate) fn ensure_grok_login_and_folder_trust(cwd: &Path) -> Result<(), LifecycleError> {
     let home = std::env::var_os("HOME").map(PathBuf::from).ok_or_else(|| {
         LifecycleError::RequirementUnmet(
-            "error: HOME is unset; cannot verify grok login\n\
+            "error: HOME is unset; cannot verify grok login or folder trust\n\
                  action: export HOME and retry"
                 .to_string(),
         )
@@ -405,6 +407,15 @@ pub(crate) fn ensure_grok_login_and_folder_trust(_cwd: &Path) -> Result<(), Life
             grok_home.join("auth.json").display()
         )));
     }
+    if folder_trust_required() && !grok_folder_is_trusted(&grok_home, cwd) {
+        return Err(LifecycleError::RequirementUnmet(format!(
+            "error: grok folder is not trusted; project-scope MCP at {}/.grok/config.toml will not load\n\
+             cwd: {}\n\
+             action: from that directory run `grok --trust` (or `/hooks-trust` in a grok session), then retry",
+            cwd.display(),
+            cwd.display()
+        )));
+    }
     Ok(())
 }
 
@@ -419,6 +430,44 @@ fn grok_auth_present(grok_home: &Path) -> bool {
     value.as_object().is_some_and(|map| !map.is_empty())
 }
 
+fn folder_trust_required() -> bool {
+    !matches!(
+        std::env::var("GROK_FOLDER_TRUST").ok().as_deref(),
+        Some("0") | Some("false") | Some("off")
+    )
+}
+
+fn grok_folder_is_trusted(grok_home: &Path, cwd: &Path) -> bool {
+    let text = std::fs::read_to_string(grok_home.join("trusted_folders.toml")).unwrap_or_default();
+    let cwd = std::fs::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf());
+    grok_trusted_folders(&text).into_iter().any(|trusted| {
+        let trusted = std::fs::canonicalize(&trusted).unwrap_or(trusted);
+        cwd == trusted || cwd.starts_with(&trusted)
+    })
+}
+
+fn grok_trusted_folders(text: &str) -> Vec<PathBuf> {
+    let mut current = None;
+    let mut out = Vec::new();
+    for line in text.lines() {
+        let trimmed = line.trim();
+        if let Some(rest) = trimmed.strip_prefix("[folders.\"") {
+            current = rest.strip_suffix("\"]").map(str::to_string);
+            continue;
+        }
+        if trimmed.starts_with('[') {
+            current = None;
+            continue;
+        }
+        if trimmed == "trusted = true" {
+            if let Some(path) = current.take() {
+                out.push(PathBuf::from(path));
+            }
+        }
+    }
+    out
+}
+
 /// ---
 /// purpose: 写 workspace 下 grok 的项目作用域 MCP 配置，服务名固定为 team_orchestrator
 /// params:

package/crates/team-agent/src/lifecycle/launch/pi_mcp.rs

@@ -151,14 +151,30 @@ pub(crate) fn parse_pi_list_models_table(bytes: &[u8]) -> Result<Vec<String>, Pr
         if line.trim().is_empty() {
             continue;
         }
-        let columns = line.split_whitespace().collect::<Vec<_>>();
-        if columns.len() < 2 || columns[0].is_empty() || columns[1].is_empty() {
-            return Err(ProviderError::Command(format!(
+        let malformed = || {
+            ProviderError::Command(format!(
                 "Pi model catalog row {} is malformed",
                 index + 2
-            )));
+            ))
+        };
+        let (provider, model) = line
+            .trim()
+            .split_once(char::is_whitespace)
+            .ok_or_else(malformed)?;
+        let mut model = model.trim();
+        // Pi prints the raw model id, which may contain spaces. Only the
+        // capability columns following it are single whitespace-free values.
+        for _ in 2..header_columns.len() {
+            model = model
+                .rsplit_once(char::is_whitespace)
+                .ok_or_else(malformed)?
+                .0
+                .trim_end();
+        }
+        if model.is_empty() {
+            return Err(malformed());
         }
-        let exact = format!("{}/{}", columns[0], columns[1]);
+        let exact = format!("{provider}/{model}");
         if !seen.insert(exact.clone()) {
             return Err(ProviderError::Command(format!(
                 "Pi model catalog contains duplicate exact id {exact:?}"
@@ -642,6 +658,64 @@ fn observe_pi_catalog_test(f: impl FnOnce(&mut PiCatalogTestContext)) {
     });
 }
 
+fn spawn_catalog_reader(
+    stdout: std::process::ChildStdout,
+    max_bytes: u64,
+) -> mpsc::Receiver<(std::io::Result<usize>, Vec<u8>)> {
+    let (sender, receiver) = mpsc::channel();
+    std::thread::spawn(move || {
+        let mut bytes = Vec::new();
+        let result = stdout.take(max_bytes + 1).read_to_end(&mut bytes);
+        let _ = sender.send((result, bytes));
+    });
+    receiver
+}
+
+fn finish_catalog_reader(
+    receiver: mpsc::Receiver<(std::io::Result<usize>, Vec<u8>)>,
+    status: std::process::ExitStatus,
+    timeout: Duration,
+    max_bytes: u64,
+) -> Result<Vec<u8>, String> {
+    let (result, bytes) = match receiver.recv_timeout(timeout) {
+        Ok(value) => value,
+        Err(_) => {
+            #[cfg(test)]
+            observe_pi_catalog_test(|context| context.observation.reader_timeout = true);
+            return Err("Pi model catalog command timed out".to_string());
+        }
+    };
+    if !status.success() {
+        return Err("Pi model catalog command failed".into());
+    }
+    result.map_err(|_| "Pi model catalog could not be read".to_string())?;
+    if bytes.len() as u64 > max_bytes {
+        return Err("Pi model catalog exceeds the bounded output limit".into());
+    }
+    Ok(bytes)
+}
+
+#[cfg(test)]
+pub(crate) fn run_pi_catalog_after_parent_exit_for_test(
+    stdout: std::process::ChildStdout,
+    parent_pid: u32,
+    status: std::process::ExitStatus,
+    timeout: Duration,
+    max_bytes: u64,
+) -> Result<Vec<u8>, String> {
+    observe_pi_catalog_test(|context| {
+        context.observation.parent_pid = Some(parent_pid);
+        context.observation.parent_exit_success = Some(status.success());
+        context.observation.parent_exit_code = status.code();
+    });
+    finish_catalog_reader(
+        spawn_catalog_reader(stdout, max_bytes),
+        status,
+        timeout,
+        max_bytes,
+    )
+}
+
 /// Discover candidates with one PATH-first catalog observation. This deliberately
 /// does not resolve adapters or scan wrapper chains; callers use it only for
 /// rejecting an unqualified role model before lifecycle mutation.
@@ -685,12 +759,7 @@ pub(crate) fn run_pi_catalog(
         let _ = child.wait();
         "Pi model catalog output unavailable".to_string()
     })?;
-    let (sender, receiver) = mpsc::channel();
-    std::thread::spawn(move || {
-        let mut bytes = Vec::new();
-        let result = stdout.take(max_bytes + 1).read_to_end(&mut bytes);
-        let _ = sender.send((result, bytes));
-    });
+    let receiver = spawn_catalog_reader(stdout, max_bytes);
     let start = Instant::now();
     loop {
         match child.try_wait() {
@@ -700,18 +769,12 @@ pub(crate) fn run_pi_catalog(
                     context.observation.parent_exit_success = Some(status.success());
                     context.observation.parent_exit_code = status.code();
                 });
-                let (result, bytes) = match receiver.recv_timeout(timeout.saturating_sub(start.elapsed())) {
-                    Ok(value) => value,
-                    Err(_) => {
-                        #[cfg(test)]
-                        observe_pi_catalog_test(|context| context.observation.reader_timeout = true);
-                        return Err("Pi model catalog command timed out".to_string());
-                    }
-                };
-                if !status.success() { return Err("Pi model catalog command failed".into()); }
-                result.map_err(|_| "Pi model catalog could not be read".to_string())?;
-                if bytes.len() as u64 > max_bytes { return Err("Pi model catalog exceeds the bounded output limit".into()); }
-                return Ok(bytes);
+                return finish_catalog_reader(
+                    receiver,
+                    status,
+                    timeout.saturating_sub(start.elapsed()),
+                    max_bytes,
+                );
             }
             Ok(None) if start.elapsed() < timeout => std::thread::sleep(Duration::from_millis(20)),
             Ok(None) => {