@team-agent/installer 0.5.83 → 0.5.84

package/Cargo.lock

@@ -581,7 +581,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.83"
+version = "0.5.84"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.83"
+version = "0.5.84"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/emit.rs

@@ -418,7 +418,7 @@ fn command_help(command: Option<&str>) -> String {
         .to_string(),
         Some("allow-peer-talk") => "usage: team-agent allow-peer-talk A B [--workspace WORKSPACE] [--json]".to_string(),
         Some("status") => "usage: team-agent status [AGENT] [--workspace WORKSPACE] [--team TEAM] [--summary|--json] [--detail]\n\n输出七字段：name/provider/runtime_status/activity/health/session_name/tmux_command；人读与 --json 使用同一投影。缺少可靠定位或 nodeprobe 证据时显示 unknown；tmux_command 可复制到对应目标。--summary/--detail 仅保留兼容性，不增加诊断字段。".to_string(),
-        Some("models") => "usage: team-agent models --provider pi [--search TEXT] [--json]\n\nPrints models.v1 exact role_model entries; each entry includes current=true|false. Catalog readiness is reported as auth=ok|not_ready with auth_basis=catalog_visibility.".to_string(),
+        Some("models") => "usage: team-agent models [--provider pi|cursor_agent] [QUERY|--search TEXT] [--json]\n\nLists exact provider model ids with case-insensitive multi-word search across provider, vendor, id, and display name. Cursor uses the local `agent --list-models` catalog.".to_string(),
         Some("leaders") => "usage: team-agent leaders [QUERY|--search TEXT] [--all|--stale] [--json] | --prune [--dry-run] [--json]\n\nLists LIVE leaders by default. Use --all to include retained STALE entries, --stale to inspect only STALE entries, QUERY or --search TEXT to match workspace/team/name fields, and --prune to remove only entries proven terminal by canonical state. --dry-run is valid only with --prune.".to_string(),
         Some("stop") => compat_hidden_help("stop", "usage: team-agent stop [--workspace WORKSPACE] [--team TEAM] [--keep-logs] [--json]"),
         Some("shutdown") => "usage: team-agent shutdown [--workspace WORKSPACE] [--team TEAM] [--keep-logs] [--json]".to_string(),
@@ -1007,6 +1007,9 @@ fn parse_args(args: &[String]) -> ParsedArgs {
             other if other.starts_with("--provider=") => {
                 parsed.provider = Some(other.trim_start_matches("--provider=").to_string());
             }
+            other if other.starts_with("--search=") => {
+                parsed.search = Some(other.trim_start_matches("--search=").to_string());
+            }
             other if other.starts_with("--socket=") => {
                 parsed.socket = Some(other.trim_start_matches("--socket=").to_string());
             }
@@ -1106,17 +1109,19 @@ fn quick_start_args(args: &[String], cwd: &Path) -> Result<QuickStartArgs, CliEr
 
 fn models_args(args: &[String]) -> Result<ModelsArgs, CliError> {
     let parsed = parse_args(args);
-    let provider = parsed
-        .provider
-        .ok_or_else(|| CliError::Usage("models requires --provider pi".to_string()))?;
-    if provider != "pi" {
-        return Err(CliError::Usage(format!(
-            "models supports only --provider pi, got {provider:?}"
-        )));
+    let provider = parsed.provider.unwrap_or_else(|| "pi".to_string());
+    if parsed.search.is_some() && !parsed.positionals.is_empty() {
+        return Err(CliError::Usage(
+            "models accepts either QUERY or --search TEXT, not both".to_string(),
+        ));
     }
+    let search = parsed
+        .search
+        .or_else(|| (!parsed.positionals.is_empty()).then(|| parsed.positionals.join(" ")))
+        .filter(|query| !query.trim().is_empty());
     Ok(ModelsArgs {
         provider,
-        search: parsed.search,
+        search,
         json: parsed.json,
     })
 }
@@ -2385,6 +2390,30 @@ mod tests {
         assert!(!help.contains("错误细分走 status --summary"));
     }
 
+    #[test]
+    fn models_defaults_provider_and_accepts_one_query_form() {
+        let defaulted = models_args(&cli_argv(&["gpt", "5.6", "luna"])).unwrap();
+        assert_eq!(defaulted.provider, "pi");
+        assert_eq!(defaulted.search.as_deref(), Some("gpt 5.6 luna"));
+
+        let cursor = models_args(&cli_argv(&[
+            "--provider",
+            "cursor_agent",
+            "--search",
+            "GPT Luna",
+        ]))
+        .unwrap();
+        assert_eq!(cursor.provider, "cursor_agent");
+        assert_eq!(cursor.search.as_deref(), Some("GPT Luna"));
+
+        let both = models_args(&cli_argv(&["luna", "--search", "gpt"])).unwrap_err();
+        assert!(
+            matches!(both, CliError::Usage(message) if message.contains("either QUERY or --search TEXT"))
+        );
+        let blank = models_args(&cli_argv(&["--search", "   "])).unwrap();
+        assert_eq!(blank.search, None);
+    }
+
     #[test]
     fn send_pane_positionals_are_message_not_target() {
         let cwd = tmp_workspace();

package/crates/team-agent/src/cli/models.rs

@@ -1,53 +1,98 @@
-//! Read-only Pi model catalog discovery for `team-agent models`.
+//! Read-only provider model catalog discovery for `team-agent models`.
 use super::{CliError, CmdOutput, CmdResult, ExitCode, ModelsArgs};
 use serde_json::{json, Value};
 #[cfg(test)]
 use std::collections::BTreeMap;
 use std::path::Path;
-use std::process::Command;
 use std::time::Duration;
 const CATALOG_TIMEOUT: Duration = Duration::from_secs(10);
 const MAX_CATALOG_BYTES: u64 = 1024 * 1024;
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum CatalogFormat {
+    Pi,
+    CursorAgent,
+}
+
+#[derive(Clone, Debug)]
+struct ModelRecord {
+    provider: String,
+    vendor: String,
+    id: String,
+    display_name: String,
+    default: Option<bool>,
+}
+
 pub fn cmd_models(args: &ModelsArgs) -> Result<CmdResult, CliError> {
-    cmd_models_with(args, Path::new("pi"), CATALOG_TIMEOUT, MAX_CATALOG_BYTES)
+    let (program, format) = match args.provider.as_str() {
+        "pi" => (Path::new("pi"), CatalogFormat::Pi),
+        "cursor_agent" => (Path::new("agent"), CatalogFormat::CursorAgent),
+        provider => {
+            return Ok(failure(
+                args,
+                &format!("unsupported model provider {provider:?}"),
+            ))
+        }
+    };
+    cmd_models_with_format(args, program, format, CATALOG_TIMEOUT, MAX_CATALOG_BYTES)
 }
 
+/// Existing injectable Pi boundary retained for deterministic command/timeout tests.
 fn cmd_models_with(
     args: &ModelsArgs,
     program: &Path,
     timeout: Duration,
     max_bytes: u64,
+) -> Result<CmdResult, CliError> {
+    cmd_models_with_format(args, program, CatalogFormat::Pi, timeout, max_bytes)
+}
+
+fn cmd_models_with_format(
+    args: &ModelsArgs,
+    program: &Path,
+    format: CatalogFormat,
+    timeout: Duration,
+    max_bytes: u64,
 ) -> Result<CmdResult, CliError> {
     let bytes = match run_catalog(program, timeout, max_bytes) {
         Ok(bytes) => bytes,
-        Err(message) => return Ok(failure(args, &message)),
+        Err(message) => return Ok(failure(args, &catalog_error_prefix(format, message))),
     };
-    let all = match crate::lifecycle::launch::pi_mcp::parse_pi_list_models_table(&bytes) {
+    let all = match parse_catalog(&bytes, format) {
         Ok(models) => models,
-        Err(error) => return Ok(failure(args, &safe_catalog_error(error))),
+        Err(message) => return Ok(failure(args, &message)),
     };
     let visible = args.search.as_deref().map_or_else(
         || all.clone(),
         |search| {
             all.iter()
-                .filter(|model| model.contains(search))
+                .filter(|model| model_matches(model, search))
                 .cloned()
                 .collect::<Vec<_>>()
         },
     );
-    let current = current_role_model(&all);
+    let current = current_model_for(format, &all);
     let entries: Vec<Value> = visible
         .iter()
         .map(|model| {
             json!({
-                "role_model": model,
-                "current": current.as_deref() == Some(model.as_str()),
+                "role_model": model.id,
+                "current": if format == CatalogFormat::Pi {
+                    json!(current.as_deref() == Some(model.id.as_str()))
+                } else {
+                    Value::Null
+                },
+                "provider": model.provider,
+                "vendor": model.vendor,
+                "model_id": model.id,
+                "display_name": model.display_name,
+                "default": model.default,
             })
         })
         .collect();
+    let provider = args.provider.as_str();
     let value = json!({
-        "schema_version": "models.v1", "ok": true, "provider": "pi", "models": entries,
+        "schema_version": "models.v1", "ok": true, "provider": provider, "models": entries,
         "auth": "ok", "auth_basis": "catalog_visibility", "current_role_model": current, "search": args.search,
     });
     if args.json {
@@ -59,11 +104,25 @@ fn cmd_models_with(
             preserve_json_order: true,
         })
     } else {
-        let mut lines = vec!["models.v1 | Pi models (copyable role_model):".to_string()];
+        let mut lines = vec![format!(
+            "models.v1 | {provider} models (copyable model_id):"
+        )];
+        lines.push("PROVIDER VENDOR MODEL_ID DISPLAY_NAME CURRENT DEFAULT".to_string());
         lines.extend(visible.iter().map(|model| {
             format!(
-                "role_model: {model} current={}",
-                current.as_deref() == Some(model.as_str())
+                "{} {} {} {} {} {}",
+                model.provider,
+                model.vendor,
+                model.id,
+                model.display_name,
+                if format == CatalogFormat::Pi {
+                    (current.as_deref() == Some(model.id.as_str())).to_string()
+                } else {
+                    "—".to_string()
+                },
+                model
+                    .default
+                    .map_or_else(|| "—".to_string(), |value| value.to_string()),
             )
         }));
         lines.push(format!(
@@ -71,14 +130,135 @@ fn cmd_models_with(
             visible.len()
         ));
         if visible.is_empty() {
-            lines.push("No models matched --search.".to_string());
+            lines.push("No models matched --search/query.".to_string());
         }
         Ok(CmdResult::human(lines.join("\n")))
     }
 }
 
+fn parse_catalog(bytes: &[u8], format: CatalogFormat) -> Result<Vec<ModelRecord>, String> {
+    match format {
+        CatalogFormat::Pi => crate::lifecycle::launch::pi_mcp::parse_pi_list_models_table(bytes)
+            .map(|models| {
+                models
+                    .into_iter()
+                    .map(|id| {
+                        let vendor = id
+                            .split_once('/')
+                            .map_or_else(|| "pi".to_string(), |(vendor, _)| vendor.to_string());
+                        ModelRecord {
+                            provider: "pi".to_string(),
+                            vendor,
+                            display_name: id.clone(),
+                            id,
+                            default: None,
+                        }
+                    })
+                    .collect()
+            })
+            .map_err(safe_catalog_error),
+        CatalogFormat::CursorAgent => parse_cursor_catalog(bytes),
+    }
+}
+
+fn parse_cursor_catalog(bytes: &[u8]) -> Result<Vec<ModelRecord>, String> {
+    let text = std::str::from_utf8(bytes)
+        .map_err(|_| "Cursor model catalog is not valid UTF-8".to_string())?;
+    let mut models = Vec::new();
+    for line in text.lines() {
+        let line = line.trim();
+        if line.is_empty()
+            || line
+                .trim_end_matches(':')
+                .eq_ignore_ascii_case("available models")
+        {
+            continue;
+        }
+        let Some((id, display)) = line.split_once(" - ") else {
+            return Err("Cursor model catalog contains a malformed row".to_string());
+        };
+        let id = id.trim();
+        if id.is_empty() || id.chars().any(char::is_whitespace) || display.trim().is_empty() {
+            return Err("Cursor model catalog contains a malformed row".to_string());
+        }
+        if models.iter().any(|model: &ModelRecord| model.id == id) {
+            return Err("Cursor model catalog contains duplicate model ids".to_string());
+        }
+        let default = display.trim_end().ends_with("(default)");
+        let display_name = display.trim().strip_suffix("(default)").map_or_else(
+            || display.trim().to_string(),
+            |name| name.trim().to_string(),
+        );
+        let vendor = id
+            .split_once('-')
+            .map_or_else(|| "cursor".to_string(), |(vendor, _)| vendor.to_string());
+        models.push(ModelRecord {
+            provider: "cursor_agent".to_string(),
+            vendor,
+            id: id.to_string(),
+            display_name,
+            default: Some(default),
+        });
+    }
+    if models.is_empty() {
+        return Err("Cursor model catalog is empty".to_string());
+    }
+    Ok(models)
+}
+
+fn model_matches(model: &ModelRecord, search: &str) -> bool {
+    let fields = [
+        model.provider.as_str(),
+        model.vendor.as_str(),
+        model.id.as_str(),
+        model.display_name.as_str(),
+    ];
+    search
+        .split_whitespace()
+        .map(str::to_lowercase)
+        .all(|needle| {
+            fields
+                .iter()
+                .any(|field| field.to_lowercase().contains(needle.as_str()))
+        })
+}
+
+fn current_model_for(format: CatalogFormat, models: &[ModelRecord]) -> Option<String> {
+    match format {
+        CatalogFormat::Pi => current_role_model(
+            &models
+                .iter()
+                .map(|model| model.id.clone())
+                .collect::<Vec<_>>(),
+        ),
+        // Cursor's catalog does not expose the active role model; never mark a
+        // catalog default as current without an explicit runtime identity.
+        CatalogFormat::CursorAgent => None,
+    }
+}
+
+fn catalog_error_prefix(format: CatalogFormat, message: String) -> String {
+    match format {
+        CatalogFormat::Pi => message,
+        CatalogFormat::CursorAgent => message.replace("Pi", "Cursor"),
+    }
+}
+
 fn failure(args: &ModelsArgs, message: &str) -> CmdResult {
-    let value = json!({ "schema_version": "models.v1", "ok": false, "provider": "pi", "auth": "not_ready", "auth_basis": "catalog_visibility", "models": Value::Array(Vec::new()), "current_role_model": Value::Null, "error": message, "action": "install or repair the PATH-first `pi` executable, then retry `team-agent models --provider pi`" });
+    let executable = if args.provider == "cursor_agent" {
+        "agent"
+    } else {
+        "pi"
+    };
+    let action = if message.starts_with("unsupported model provider") {
+        "choose a supported provider: pi or cursor_agent".to_string()
+    } else {
+        format!(
+            "install or repair the PATH-first `{executable}` executable, then retry `team-agent models --provider {}`",
+            args.provider
+        )
+    };
+    let value = json!({ "schema_version": "models.v1", "ok": false, "provider": args.provider, "auth": "not_ready", "auth_basis": "catalog_visibility", "models": Value::Array(Vec::new()), "current_role_model": Value::Null, "error": message, "action": action });
     if args.json {
         let text = serde_json::to_string_pretty(&value)
             .unwrap_or_else(|_| "{\"schema_version\":\"models.v1\",\"ok\":false}".to_string());
@@ -89,7 +269,7 @@ fn failure(args: &ModelsArgs, message: &str) -> CmdResult {
             preserve_json_order: true,
         }
     } else {
-        CmdResult { output: CmdOutput::Human(format!("models.v1 | error: {message}\naction: install or repair the PATH-first `pi` executable, then retry `team-agent models --provider pi`\nauth: not_ready (catalog_visibility)")), exit: ExitCode::Error, as_json: false, preserve_json_order: false }
+        CmdResult { output: CmdOutput::Human(format!("models.v1 | error: {message}\naction: {action}\nauth: not_ready (catalog_visibility)")), exit: ExitCode::Error, as_json: false, preserve_json_order: false }
     }
 }
 
@@ -279,6 +459,38 @@ mod tests {
         assert_eq!(models[1]["role_model"], "team-agent/gpt-5.6-luna");
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn cursor_catalog_parses_copyable_ids_and_multiword_search() {
+        let path = fixture(
+            "printf 'Available models\\ngpt-5.6-luna-high - GPT-5.6 Luna 1M High\\ncursor-grok-4.6-high - Cursor Grok 4.6\\nauto - Auto (default)\\n'",
+        );
+        let result = cmd_models_with_format(
+            &ModelsArgs {
+                provider: "cursor_agent".into(),
+                search: Some("GPT luna".into()),
+                json: true,
+            },
+            &path,
+            CatalogFormat::CursorAgent,
+            Duration::from_secs(1),
+            MAX_CATALOG_BYTES,
+        )
+        .unwrap();
+        let CmdOutput::Human(text) = result.output else {
+            panic!("expected JSON projection")
+        };
+        let value: Value = serde_json::from_str(&text).unwrap();
+        assert_eq!(value["ok"], true);
+        assert_eq!(value["provider"], "cursor_agent");
+        assert_eq!(value["models"].as_array().unwrap().len(), 1);
+        assert_eq!(value["models"][0]["role_model"], "gpt-5.6-luna-high");
+        assert_eq!(value["models"][0]["model_id"], "gpt-5.6-luna-high");
+        assert_eq!(value["models"][0]["display_name"], "GPT-5.6 Luna 1M High");
+        assert_eq!(value["models"][0]["current"], Value::Null);
+        cleanup_fixture(&path);
+    }
+
     #[cfg(unix)]
     fn fixture(body: &str) -> std::path::PathBuf {
         use std::os::unix::fs::PermissionsExt;
@@ -785,12 +997,7 @@ mod tests {
             &["--provider".into(), "codex".into()],
             Path::new("/tmp"),
         );
-        match refusal {
-            Err(CliError::Usage(message)) => {
-                assert_eq!(message, "models supports only --provider pi, got \"codex\"")
-            }
-            other => panic!("expected provider refusal, got {other:?}"),
-        }
+        assert!(matches!(refusal, Ok(ExitCode::Error)));
         cleanup_fixture(&path);
     }
 
@@ -894,7 +1101,7 @@ mod tests {
         );
         assert_eq!(
             crate::cli::spec::command_spec("models").unwrap().usage,
-            "usage: team-agent models --provider pi [--search TEXT] [--json]"
+            "usage: team-agent models [--provider pi|cursor_agent] [QUERY|--search TEXT] [--json]"
         );
     }
 

package/crates/team-agent/src/cli/spec.rs

@@ -169,7 +169,7 @@ pub(crate) const COMMAND_SPECS: &[CommandSpec] = &[
     CommandSpec { name: "quick-start", tier: CommandTier::Core, category: CommandCategory::Start, kind: CommandKind::Dispatch(DispatchKind::QuickStart), summary: "start or attach a team from TEAM.md", usage: "usage: team-agent quick-start [TEAMDIR] [--workspace WORKSPACE] [--name NAME] [--team-id TEAM|--team TEAM] [--yes] [--no-display] [--backend tmux|conpty] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::Conditional, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "send", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Send), summary: "persist a message for an in-team short name or fully-qualified logical recipient", usage: "usage: team-agent send TO MESSAGE... [--workspace WORKSPACE] [--team TEAM] [--mailbox] [--json]\nTO forms are co-equal: an in-team short name (for example `team-agent send reviewer \"Review\"`) or `<workspace>::<team>/<agent>`.", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::Conditional, alias_of: None, sunset: Some("next compatibility release"), action: Some("use positional logical TO and the returned message id"), governance: None },
     CommandSpec { name: "status", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Status), summary: "show current team status", usage: "usage: team-agent status [AGENT] [--workspace WORKSPACE] [--team TEAM] [--summary|--json] [--detail]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
-    CommandSpec { name: "models", tier: CommandTier::Core, category: CommandCategory::Observe, kind: CommandKind::Dispatch(DispatchKind::Models), summary: "list exact provider model ids", usage: "usage: team-agent models --provider pi [--search TEXT] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
+    CommandSpec { name: "models", tier: CommandTier::Core, category: CommandCategory::Observe, kind: CommandKind::Dispatch(DispatchKind::Models), summary: "list exact provider model ids", usage: "usage: team-agent models [--provider pi|cursor_agent] [QUERY|--search TEXT] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "collect", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Collect), summary: "collect reported results", usage: "usage: team-agent collect [--workspace WORKSPACE] [--team TEAM] [--result-file FILE] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "results", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Results), summary: "read reported results for a case", usage: "usage: team-agent results --case CASE_ID [--workspace WORKSPACE] [--team TEAM] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "wait", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Wait), summary: "block until a task result is stored", usage: "usage: team-agent wait --task TASK [--workspace WORKSPACE] [--json]", default_help: false, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },

package/crates/team-agent/src/cli/types.rs

@@ -655,7 +655,7 @@ pub struct LeadersArgs {
     pub json: bool,
 }
 
-/// Read-only Pi model catalog discovery.
+/// Read-only provider model catalog discovery.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ModelsArgs {
     pub provider: String,

package/crates/team-agent/src/mcp_server/tests/scoped.rs

@@ -163,30 +163,28 @@ fn verify_cleanup_surviving_receipt(
         assert!(!receipt.exists(), "cleanup must remove only the exact receipt path");
     }
 
-    // ── #36 report_result setdefault: populated envelope keys WIN over args ─────
-    // GOLDEN (probe_setdefault.py): envelope {agent_id:env-agent, task_id:env-task,...}
-    // + explicit args agent_id=ARG-agent, task_id=ARG-task → returned dict keeps
-    // env-agent / env-task (setdefault). Rust unconditionally insert-overrides.
+    // ── #36 report_result identity: neither envelope nor args can override capture ─
     #[test]
-    fn report_result_setdefault_envelope_wins_over_args() {
+    fn report_result_rejects_envelope_and_argument_identity_mismatch() {
         let tools = TeamOrchestratorTools::with_identity(
             &unique_ws("report-setdefault"),
             Some(AgentId::new("env-id")),
             None,
         );
-        let ok = tools.report_result(
-            Some(&json!({
-                "agent_id": "env-agent", "task_id": "env-task",
-                "status": "blocked", "summary": "env summary"
-            })),
-            Some("ARG summary"), ResultStatus::Success,
-            None, None, None, None, None,
-            Some("ARG-task"), Some("ARG-agent"),
-        ).expect("report ok");
-        let v = serde_json::to_value(&ok).unwrap();
-        // setdefault: the pre-populated envelope values win.
-        assert_eq!(v.get("agent_id"), Some(&json!("env-agent")), "envelope agent_id wins (setdefault)");
-        assert_eq!(v.get("task_id"), Some(&json!("env-task")), "envelope task_id wins (setdefault)");
+        let error = tools
+            .report_result(
+                Some(&json!({
+                    "agent_id": "env-agent", "task_id": "env-task",
+                    "status": "blocked", "summary": "env summary"
+                })),
+                Some("ARG summary"), ResultStatus::Success,
+                None, None, None, None, None,
+                Some("ARG-task"), Some("ARG-agent"),
+            )
+            .expect_err("envelope and argument identities must be bound to the worker capture");
+        assert_eq!(error.reason, ToolErrorReason::McpScopeRefused);
+        assert!(error.message.contains("identity_mismatch"));
+        assert_eq!(error.extra.get("expected_agent_id"), Some(&json!("env-id")));
     }
 
     // ── #44 report_result task_id inference from state (_latest_task_for_assignee)

package/crates/team-agent/src/mcp_server/tests/tools.rs

@@ -25,31 +25,42 @@
     }
 
     #[test]
-    fn report_result_explicit_agent_overrides_env() {
+    fn report_result_rejects_explicit_agent_mismatch() {
         let tools = TeamOrchestratorTools::with_identity(
-            &unique_ws("report-explicit"),
+            &unique_ws("report-explicit-mismatch"),
             Some(AgentId::new("worker-7")),
             Some(TeamKey::new("teamA")),
         );
-        let ok = tools.report_result(
-            None, Some("done"), ResultStatus::Success,
-            None, None, None, None, None,
-            Some("task-9"), Some("explicit-agent"),
-        ).expect("report ok");
-        let v = serde_json::to_value(&ok).unwrap();
-        // explicit > env: both task_id and agent_id are ok-whitelist keys
-        // (normalize.py:45-46) echoed by runtime.report_result, so present on success.
-        // UNCONDITIONAL asserts — the override must be proven, not silently skipped.
-        assert_eq!(
-            v.get("agent_id"),
-            Some(&json!("explicit-agent")),
-            "explicit agent_id overrides env"
-        );
-        assert_eq!(
-            v.get("task_id"),
-            Some(&json!("task-9")),
-            "explicit task_id flows through"
+        let error = tools
+            .report_result(
+                None, Some("done"), ResultStatus::Success,
+                None, None, None, None, None,
+                Some("task-9"), Some("explicit-agent"),
+            )
+            .expect_err("a request agent_id cannot override the captured identity");
+        assert_eq!(error.reason, ToolErrorReason::McpScopeRefused);
+        assert!(error.message.contains("identity_mismatch"));
+        assert_eq!(error.extra.get("expected_agent_id"), Some(&json!("worker-7")));
+        assert_eq!(error.extra.get("provided_agent_id"), Some(&json!("explicit-agent")));
+    }
+
+    #[test]
+    fn report_result_accepts_explicit_captured_agent() {
+        let tools = TeamOrchestratorTools::with_identity(
+            &unique_ws("report-explicit-match"),
+            Some(AgentId::new("worker-7")),
+            Some(TeamKey::new("teamA")),
         );
+        let ok = tools
+            .report_result(
+                None, Some("done"), ResultStatus::Success,
+                None, None, None, None, None,
+                Some("task-9"), Some("worker-7"),
+            )
+            .expect("matching explicit agent_id remains compatible");
+        let v = serde_json::to_value(&ok).unwrap();
+        assert_eq!(v.get("agent_id"), Some(&json!("worker-7")));
+        assert_eq!(v.get("task_id"), Some(&json!("task-9")));
     }
 
     #[test]

package/crates/team-agent/src/mcp_server/tests/wire.rs

@@ -264,6 +264,36 @@ fn dispatch_unknown_tool_returns_unknown_tool_error() {
     assert_eq!(err.message, "unknown tool 'nope'");
 }
 
+#[test]
+fn worker_identity_is_bound_before_send_or_report_dispatch() {
+    let tools = TeamOrchestratorTools::with_identity(
+        Path::new("/tmp/ws"),
+        Some(AgentId::new("worker-7")),
+        None,
+    );
+    let send = dispatch(
+        &tools,
+        &json!({
+            "tool": "send_message",
+            "arguments": {"to": "leader", "content": "spoof", "agent_id": "in-dev2"}
+        }),
+    )
+    .expect_err("send_message must reject a spoofed request identity");
+    assert!(send.message.contains("identity_mismatch"));
+    assert_eq!(send.extra.get("expected_agent_id"), Some(&json!("worker-7")));
+
+    let report = dispatch(
+        &tools,
+        &json!({
+            "tool": "report_result",
+            "arguments": {"envelope": {"agent_id": "in-dev2", "summary": "spoof"}}
+        }),
+    )
+    .expect_err("report_result envelope must not override captured identity");
+    assert!(report.message.contains("identity_mismatch"));
+    assert_eq!(report.extra.get("provided_agent_id"), Some(&json!("in-dev2")));
+}
+
 // ════════════════════════════════════════════════════════════════════════
 // requires_ack_for_target — leader-only → false (tools.py:16)
 // ════════════════════════════════════════════════════════════════════════

package/crates/team-agent/src/mcp_server/tools.rs

@@ -82,6 +82,107 @@ impl TeamOrchestratorTools {
         }
     }
 
+    /// Validate an identity supplied by an MCP request against the identity captured
+    /// when this worker server started. Missing request fields are intentionally valid;
+    /// the captured identity is the only fallback. Present values must be non-empty and
+    /// equal to that capture, otherwise reject before routing or persistence.
+    pub(crate) fn validate_identity_argument(
+        &self,
+        tool: &str,
+        value: Option<&Value>,
+    ) -> Result<(), ToolError> {
+        let expected = self.require_captured_identity(tool)?;
+        let Some(value) = value else {
+            return Ok(());
+        };
+        let Some(provided) = value.as_str().and_then(non_empty_string) else {
+            return Err(self.identity_mismatch(tool, expected.as_str(), None));
+        };
+        if provided != expected.as_str() {
+            return Err(self.identity_mismatch(tool, expected.as_str(), Some(provided)));
+        }
+        Ok(())
+    }
+
+    /// Report requests can carry identity in both the top-level argument and the
+    /// envelope. Validate both independently so an envelope cannot overwrite the
+    /// framework-bound sender after the top-level check.
+    pub(crate) fn validate_report_identity_request(
+        &self,
+        envelope: Option<&Value>,
+        explicit_agent_id: Option<&Value>,
+    ) -> Result<(), ToolError> {
+        self.validate_identity_argument("report_result", explicit_agent_id)?;
+        if let Some(value) = envelope
+            .and_then(Value::as_object)
+            .and_then(|obj| obj.get("agent_id"))
+        {
+            self.validate_identity_argument("report_result", Some(value))?;
+        }
+        Ok(())
+    }
+
+    fn require_captured_identity(&self, tool: &str) -> Result<&AgentId, ToolError> {
+        self.agent_id
+            .as_ref()
+            .filter(|agent| non_empty_string(agent.as_str()).is_some())
+            .ok_or_else(|| self.identity_mismatch(tool, "<missing>", None))
+    }
+
+    fn validate_report_identity_text(
+        &self,
+        envelope: Option<&Value>,
+        explicit_agent_id: Option<&str>,
+    ) -> Result<(), ToolError> {
+        let expected = self.require_captured_identity("report_result")?;
+        if let Some(provided) = explicit_agent_id.and_then(non_empty_string) {
+            if provided != expected.as_str() {
+                return Err(self.identity_mismatch(
+                    "report_result",
+                    expected.as_str(),
+                    Some(provided),
+                ));
+            }
+        } else if explicit_agent_id.is_some() {
+            return Err(self.identity_mismatch("report_result", expected.as_str(), None));
+        }
+        if let Some(value) = envelope
+            .and_then(Value::as_object)
+            .and_then(|obj| obj.get("agent_id"))
+        {
+            self.validate_identity_argument("report_result", Some(value))?;
+        }
+        Ok(())
+    }
+
+    fn identity_mismatch(&self, tool: &str, expected: &str, provided: Option<&str>) -> ToolError {
+        let mut error = ToolError::new(
+            ToolErrorReason::McpScopeRefused,
+            format!(
+                "identity_mismatch: {tool} agent_id must match framework-injected TEAM_AGENT_ID"
+            ),
+            "IdentityError",
+        );
+        error
+            .extra
+            .insert("status".to_string(), Value::String("refused".to_string()));
+        error
+            .extra
+            .insert("identity_mismatch".to_string(), Value::Bool(true));
+        error
+            .extra
+            .insert("tool".to_string(), Value::String(tool.to_string()));
+        error.extra.insert(
+            "expected_agent_id".to_string(),
+            Value::String(expected.to_string()),
+        );
+        error.extra.insert(
+            "provided_agent_id".to_string(),
+            provided.map_or(Value::Null, |value| Value::String(value.to_string())),
+        );
+        error
+    }
+
     /// `assign_task` (`tools.py:84-133`): C8 Family-B task-view reconcile then deliver.
     /// Resolves team key from owner-team env (or `active_team_key`), appends or
     /// field-updates the task in state, then delegates delivery to
@@ -214,6 +315,8 @@ impl TeamOrchestratorTools {
         mailbox: Option<&Value>,
         presentation: Option<&Value>,
     ) -> Result<SendOutcome, ToolError> {
+        // A worker without a spawn-time identity cannot safely emit a message.
+        self.require_captured_identity("send_message")?;
         let normalized =
             crate::messaging::presentation::normalize_send_presentation(mailbox, presentation)
                 .map_err(|error| {
@@ -430,6 +533,8 @@ impl TeamOrchestratorTools {
         agent_id: Option<&str>,
         presentation: Option<&Value>,
     ) -> ToolResult {
+        // Validate before scope reads, envelope normalization, or result persistence.
+        self.validate_report_identity_text(envelope, agent_id)?;
         if let Some(envelope) = envelope {
             self.validate_rpc_scope_args("report_result", envelope)?;
         }
@@ -538,17 +643,14 @@ impl TeamOrchestratorTools {
                         .or_insert(Value::String(source.to_string()));
                 }
             }
-            if !obj.contains_key("agent_id") {
-                let resolved = agent_id
-                    .map(ToString::to_string)
-                    .or_else(|| {
-                        self.agent_id
-                            .as_ref()
-                            .map(|env_agent| env_agent.as_str().to_string())
-                    })
-                    .unwrap_or_else(|| "unknown".to_string());
-                obj.insert("agent_id".to_string(), Value::String(resolved));
-            }
+            // The framework capture is authoritative even when a matching request
+            // value was supplied; this also canonicalizes surrounding whitespace.
+            let resolved = self
+                .agent_id
+                .as_ref()
+                .map(|env_agent| env_agent.as_str().to_string())
+                .unwrap_or_else(|| "unknown".to_string());
+            obj.insert("agent_id".to_string(), Value::String(resolved));
             if !obj.contains_key("changes") {
                 obj.insert(
                     "changes".to_string(),

package/crates/team-agent/src/mcp_server/wire.rs

@@ -496,7 +496,9 @@ fn tool_properties(tool: McpTool) -> serde_json::Map<String, Value> {
             insert_property(
                 &mut properties,
                 "agent_id",
-                string_property("Optional reporting agent id override."),
+                string_property(
+                    "Optional reporting agent id; must match framework-injected TEAM_AGENT_ID.",
+                ),
             );
             insert_property(
                 &mut properties,
@@ -671,6 +673,23 @@ pub(crate) fn dispatch_tool(
     tool: McpTool,
     args: &Value,
 ) -> ToolResult {
+    // Check framework-bound identity before scope resolution or any tool side effect.
+    match tool {
+        McpTool::SendMessage => {
+            tools.validate_identity_argument("send_message", args.get("agent_id"))?;
+            if let Some(value) = args
+                .get("envelope")
+                .and_then(Value::as_object)
+                .and_then(|object| object.get("agent_id"))
+            {
+                tools.validate_identity_argument("send_message", Some(value))?;
+            }
+        }
+        McpTool::ReportResult => {
+            tools.validate_report_identity_request(args.get("envelope"), args.get("agent_id"))?
+        }
+        _ => {}
+    }
     if scope_ceiling_tool(tool) {
         tools.validate_rpc_scope_args(tool.wire_name(), args)?;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.83",
+  "version": "0.5.84",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.83",
-    "@team-agent/cli-darwin-x64": "0.5.83",
-    "@team-agent/cli-linux-x64": "0.5.83"
+    "@team-agent/cli-darwin-arm64": "0.5.84",
+    "@team-agent/cli-darwin-x64": "0.5.84",
+    "@team-agent/cli-linux-x64": "0.5.84"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",