@team-agent/installer 0.5.82 → 0.5.84

package/crates/team-agent/src/mcp_server/tools.rs

@@ -82,6 +82,107 @@ impl TeamOrchestratorTools {
         }
     }
 
+    /// Validate an identity supplied by an MCP request against the identity captured
+    /// when this worker server started. Missing request fields are intentionally valid;
+    /// the captured identity is the only fallback. Present values must be non-empty and
+    /// equal to that capture, otherwise reject before routing or persistence.
+    pub(crate) fn validate_identity_argument(
+        &self,
+        tool: &str,
+        value: Option<&Value>,
+    ) -> Result<(), ToolError> {
+        let expected = self.require_captured_identity(tool)?;
+        let Some(value) = value else {
+            return Ok(());
+        };
+        let Some(provided) = value.as_str().and_then(non_empty_string) else {
+            return Err(self.identity_mismatch(tool, expected.as_str(), None));
+        };
+        if provided != expected.as_str() {
+            return Err(self.identity_mismatch(tool, expected.as_str(), Some(provided)));
+        }
+        Ok(())
+    }
+
+    /// Report requests can carry identity in both the top-level argument and the
+    /// envelope. Validate both independently so an envelope cannot overwrite the
+    /// framework-bound sender after the top-level check.
+    pub(crate) fn validate_report_identity_request(
+        &self,
+        envelope: Option<&Value>,
+        explicit_agent_id: Option<&Value>,
+    ) -> Result<(), ToolError> {
+        self.validate_identity_argument("report_result", explicit_agent_id)?;
+        if let Some(value) = envelope
+            .and_then(Value::as_object)
+            .and_then(|obj| obj.get("agent_id"))
+        {
+            self.validate_identity_argument("report_result", Some(value))?;
+        }
+        Ok(())
+    }
+
+    fn require_captured_identity(&self, tool: &str) -> Result<&AgentId, ToolError> {
+        self.agent_id
+            .as_ref()
+            .filter(|agent| non_empty_string(agent.as_str()).is_some())
+            .ok_or_else(|| self.identity_mismatch(tool, "<missing>", None))
+    }
+
+    fn validate_report_identity_text(
+        &self,
+        envelope: Option<&Value>,
+        explicit_agent_id: Option<&str>,
+    ) -> Result<(), ToolError> {
+        let expected = self.require_captured_identity("report_result")?;
+        if let Some(provided) = explicit_agent_id.and_then(non_empty_string) {
+            if provided != expected.as_str() {
+                return Err(self.identity_mismatch(
+                    "report_result",
+                    expected.as_str(),
+                    Some(provided),
+                ));
+            }
+        } else if explicit_agent_id.is_some() {
+            return Err(self.identity_mismatch("report_result", expected.as_str(), None));
+        }
+        if let Some(value) = envelope
+            .and_then(Value::as_object)
+            .and_then(|obj| obj.get("agent_id"))
+        {
+            self.validate_identity_argument("report_result", Some(value))?;
+        }
+        Ok(())
+    }
+
+    fn identity_mismatch(&self, tool: &str, expected: &str, provided: Option<&str>) -> ToolError {
+        let mut error = ToolError::new(
+            ToolErrorReason::McpScopeRefused,
+            format!(
+                "identity_mismatch: {tool} agent_id must match framework-injected TEAM_AGENT_ID"
+            ),
+            "IdentityError",
+        );
+        error
+            .extra
+            .insert("status".to_string(), Value::String("refused".to_string()));
+        error
+            .extra
+            .insert("identity_mismatch".to_string(), Value::Bool(true));
+        error
+            .extra
+            .insert("tool".to_string(), Value::String(tool.to_string()));
+        error.extra.insert(
+            "expected_agent_id".to_string(),
+            Value::String(expected.to_string()),
+        );
+        error.extra.insert(
+            "provided_agent_id".to_string(),
+            provided.map_or(Value::Null, |value| Value::String(value.to_string())),
+        );
+        error
+    }
+
     /// `assign_task` (`tools.py:84-133`): C8 Family-B task-view reconcile then deliver.
     /// Resolves team key from owner-team env (or `active_team_key`), appends or
     /// field-updates the task in state, then delegates delivery to
@@ -214,6 +315,8 @@ impl TeamOrchestratorTools {
         mailbox: Option<&Value>,
         presentation: Option<&Value>,
     ) -> Result<SendOutcome, ToolError> {
+        // A worker without a spawn-time identity cannot safely emit a message.
+        self.require_captured_identity("send_message")?;
         let normalized =
             crate::messaging::presentation::normalize_send_presentation(mailbox, presentation)
                 .map_err(|error| {
@@ -430,6 +533,8 @@ impl TeamOrchestratorTools {
         agent_id: Option<&str>,
         presentation: Option<&Value>,
     ) -> ToolResult {
+        // Validate before scope reads, envelope normalization, or result persistence.
+        self.validate_report_identity_text(envelope, agent_id)?;
         if let Some(envelope) = envelope {
             self.validate_rpc_scope_args("report_result", envelope)?;
         }
@@ -538,17 +643,14 @@ impl TeamOrchestratorTools {
                         .or_insert(Value::String(source.to_string()));
                 }
             }
-            if !obj.contains_key("agent_id") {
-                let resolved = agent_id
-                    .map(ToString::to_string)
-                    .or_else(|| {
-                        self.agent_id
-                            .as_ref()
-                            .map(|env_agent| env_agent.as_str().to_string())
-                    })
-                    .unwrap_or_else(|| "unknown".to_string());
-                obj.insert("agent_id".to_string(), Value::String(resolved));
-            }
+            // The framework capture is authoritative even when a matching request
+            // value was supplied; this also canonicalizes surrounding whitespace.
+            let resolved = self
+                .agent_id
+                .as_ref()
+                .map(|env_agent| env_agent.as_str().to_string())
+                .unwrap_or_else(|| "unknown".to_string());
+            obj.insert("agent_id".to_string(), Value::String(resolved));
             if !obj.contains_key("changes") {
                 obj.insert(
                     "changes".to_string(),

package/crates/team-agent/src/mcp_server/wire.rs

@@ -496,7 +496,9 @@ fn tool_properties(tool: McpTool) -> serde_json::Map<String, Value> {
             insert_property(
                 &mut properties,
                 "agent_id",
-                string_property("Optional reporting agent id override."),
+                string_property(
+                    "Optional reporting agent id; must match framework-injected TEAM_AGENT_ID.",
+                ),
             );
             insert_property(
                 &mut properties,
@@ -671,6 +673,23 @@ pub(crate) fn dispatch_tool(
     tool: McpTool,
     args: &Value,
 ) -> ToolResult {
+    // Check framework-bound identity before scope resolution or any tool side effect.
+    match tool {
+        McpTool::SendMessage => {
+            tools.validate_identity_argument("send_message", args.get("agent_id"))?;
+            if let Some(value) = args
+                .get("envelope")
+                .and_then(Value::as_object)
+                .and_then(|object| object.get("agent_id"))
+            {
+                tools.validate_identity_argument("send_message", Some(value))?;
+            }
+        }
+        McpTool::ReportResult => {
+            tools.validate_report_identity_request(args.get("envelope"), args.get("agent_id"))?
+        }
+        _ => {}
+    }
     if scope_ceiling_tool(tool) {
         tools.validate_rpc_scope_args(tool.wire_name(), args)?;
     }

package/crates/team-agent/src/state/persist.rs

@@ -1706,12 +1706,35 @@ pub(crate) fn load_runtime_state_without_migrations(workspace: &Path) -> Result<
     Ok(state)
 }
 
+/// Run a read-only callback while holding the canonical `state-save` lock.
+/// Unlike `load_runtime_state`, this helper performs no migration, cache
+/// update, or write. A missing state file is represented as `None` so callers
+/// can conservatively retain derived indexes during workspace unavailability.
+pub(crate) fn with_runtime_state_lock_without_migrations<T>(
+    workspace: &Path,
+    callback: impl FnOnce(Option<Value>) -> T,
+) -> Result<T, StateError> {
+    let path = runtime_state_path(workspace);
+    if !path.exists() {
+        return Ok(callback(None));
+    }
+    let _lock = RuntimeLock::acquire(workspace, "state-save", 2.0)?;
+    let state = match std::fs::read_to_string(&path) {
+        Ok(text) => Some(serde_json::from_str::<Value>(&text)?),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => None,
+        Err(error) => return Err(error.into()),
+    };
+    Ok(callback(state))
+}
+
 pub(crate) fn save_runtime_state_without_migrations(
     workspace: &Path,
     state: &Value,
 ) -> Result<(), StateError> {
     let path = runtime_state_path(workspace);
-    let _lock = RuntimeLock::acquire(workspace, "state-save-raw", 2.0)?;
+    // Raw writers share the canonical lock so readers/pruners cannot race
+    // a restore write through a parallel lock namespace.
+    let _lock = RuntimeLock::acquire(workspace, "state-save", 2.0)?;
     if let Some(parent) = path.parent() {
         std::fs::create_dir_all(parent)?;
     }
@@ -3546,4 +3569,30 @@ mod tests {
             2,
         );
     }
+
+    #[test]
+    fn state_save_lock_serializes_raw_writer_and_prune_reader() {
+        let ws = temp_ws();
+        save_runtime_state(&ws, &json!({"teams": {"fresh": {}}})).unwrap();
+        let lock = RuntimeLock::acquire(&ws, "state-save", 2.0).unwrap();
+
+        let writer_ws = ws.clone();
+        let writer = std::thread::spawn(move || {
+            save_runtime_state_without_migrations(&writer_ws, &json!({"teams": {"fresh": {}}}))
+        });
+        std::thread::sleep(Duration::from_millis(100));
+        assert!(!writer.is_finished(), "raw writer must share state-save lock");
+        drop(lock);
+        writer.join().unwrap().unwrap();
+
+        let lock = RuntimeLock::acquire(&ws, "state-save", 2.0).unwrap();
+        let reader_ws = ws.clone();
+        let reader = std::thread::spawn(move || {
+            with_runtime_state_lock_without_migrations(&reader_ws, |state| state.is_some())
+        });
+        std::thread::sleep(Duration::from_millis(100));
+        assert!(!reader.is_finished(), "prune reader must use state-save lock");
+        drop(lock);
+        assert!(reader.join().unwrap().unwrap());
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.82",
+  "version": "0.5.84",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.82",
-    "@team-agent/cli-darwin-x64": "0.5.82",
-    "@team-agent/cli-linux-x64": "0.5.82"
+    "@team-agent/cli-darwin-arm64": "0.5.84",
+    "@team-agent/cli-darwin-x64": "0.5.84",
+    "@team-agent/cli-linux-x64": "0.5.84"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",