@team-agent/installer 0.5.83 → 0.5.85

package/crates/team-agent/src/lifecycle/tests/copilot_provider_red.rs

@@ -993,6 +993,145 @@ fn copilot_mcp_config_uses_copilot_field_name() {
     );
 }
 
+fn assert_rules_t02_final_mcp(argv: &[String], ws: &Path, agent_id: &str, team: &str) {
+    let argument = flag_value(argv, "--additional-mcp-config").expect("final MCP flag");
+    let path = argument
+        .strip_prefix('@')
+        .expect("final plan references a file");
+    let config: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(path).unwrap()).unwrap();
+    let server = &config["mcpServers"]["team_orchestrator"];
+    assert_eq!(server["transport"], "stdio", "{config}");
+    assert!(server.get("type").is_none(), "{config}");
+    assert!(Path::new(server["command"].as_str().unwrap()).is_absolute());
+    assert_eq!(
+        server["args"],
+        serde_json::json!(["mcp-server", "--workspace", ws])
+    );
+    assert_eq!(
+        server["env"]["TEAM_AGENT_WORKSPACE"],
+        ws.to_string_lossy().as_ref()
+    );
+    assert_eq!(server["env"]["TEAM_AGENT_ID"], agent_id);
+    assert_eq!(server["env"]["TEAM_AGENT_OWNER_TEAM_ID"], team);
+    eprintln!("T02 final MCP: agent={agent_id} team={team} argv={argv:?} config={config}");
+}
+
+#[test]
+#[serial(env)]
+fn rules_t02_final_mcp_across_fresh_start_restart_and_add() {
+    let hermetic = enter_hermetic("rules-t02-final-mcp");
+    let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
+    let ws = hermetic.workspace("mcp");
+    let team_dir = write_copilot_team(&ws, "cp-resume", &["mcp_team"], false);
+    seed_healthy_coordinator(&ws);
+    let health = team_agent::coordinator::coordinator_health(
+        &team_agent::coordinator::WorkspacePath::new(ws.clone()),
+    );
+    assert!(
+        health.ok,
+        "seeded coordinator must prevent daemon spawn: {health:?}"
+    );
+    let fresh = RecordingTransport::new();
+    quick_start_with_transport_in_workspace(&ws, &team_dir, None, true, Some("cpresume"), &fresh)
+        .expect("fresh entry");
+    let argv = fresh.single_spawn().argv;
+    assert_rules_t02_final_mcp(&argv, &ws, "worker_a", "cpresume");
+    assert!(flag_value(&argv, "--session-id").is_some());
+    assert!(flag_value(&argv, "--resume").is_none());
+
+    seed_running_resumable(&ws, "worker_a");
+    seed_copilot_session_store(hermetic.home(), "99999999-aaaa-4bbb-8ccc-dddddddddddd");
+    for single in [true, false] {
+        // A previous file is an output, never the authority for the next spawn.
+        std::fs::write(ws.join(".team/runtime/mcp/worker_a.json"),
+            r#"{"mcpServers":{"team_orchestrator":{"type":"stdio","env":{"TEAM_AGENT_ID":"foreign"}}}}"#,
+        ).unwrap();
+        let transport = RecordingTransport::new();
+        if single {
+            team_agent::lifecycle::start_agent_with_transport(
+                &ws,
+                &team_agent::model::ids::AgentId::new("worker_a"),
+                true,
+                false,
+                false,
+                Some("cpresume"),
+                &transport,
+            )
+            .expect("single start entry");
+        } else {
+            team_agent::lifecycle::restart_with_transport(&ws, true, Some("cpresume"), &transport)
+                .expect("team restart entry");
+        }
+        let argv = transport.single_spawn().argv;
+        assert_rules_t02_final_mcp(&argv, &ws, "worker_a", "cpresume");
+        assert_eq!(
+            flag_value(&argv, "--resume").as_deref(),
+            Some("99999999-aaaa-4bbb-8ccc-dddddddddddd")
+        );
+        assert!(flag_value(&argv, "--session-id").is_none());
+    }
+
+    let role_file = ws.join("worker_b.md");
+    let role = std::fs::read_to_string(team_dir.join("agents/worker_a.md")).unwrap();
+    std::fs::write(&role_file, role.replace("worker_a", "worker_b")).unwrap();
+    let added = RecordingTransport::with_session_present();
+    team_agent::lifecycle::add_agent_with_transport(
+        &team_dir,
+        &team_agent::model::ids::AgentId::new("worker_b"),
+        &role_file,
+        false,
+        Some("cpresume"),
+        &added,
+    )
+    .expect("add entry");
+    assert_rules_t02_final_mcp(&added.single_spawn().argv, &ws, "worker_b", "cpresume");
+}
+
+#[test]
+fn rules_t02_inline_server_map_preserves_unknown_and_non_object_values() {
+    use team_agent::provider::adapters::copilot::copilot_translate_mcp_config;
+    let raw = serde_json::json!({
+        "stdio": {"type": "stdio", "command": "synthetic", "unknown": {"type": "nested"}},
+        "http": {"type": "http", "url": "https://example.invalid"},
+        "opaque": 7,
+    });
+    let translated = copilot_translate_mcp_config(&raw);
+    assert_eq!(
+        translated,
+        serde_json::json!({
+            "stdio": {"transport": "stdio", "command": "synthetic", "unknown": {"type": "nested"}},
+            "http": {"transport": "http", "url": "https://example.invalid"},
+            "opaque": 7,
+        })
+    );
+    assert!(translated.get("mcpServers").is_none());
+    for raw in [serde_json::json!(null), serde_json::json!([1, "opaque"])] {
+        assert_eq!(copilot_translate_mcp_config(&raw), raw);
+    }
+}
+
+#[test]
+#[serial(env)]
+fn rules_t02_non_copilot_writer_keeps_canonical_schema() {
+    let hermetic = enter_hermetic("rules-t02-canonical");
+    let ws = hermetic.workspace("canonical");
+    let config = team_agent::provider::get_adapter(Provider::ClaudeCode)
+        .mcp_config(team_agent::provider::AuthMode::Subscription)
+        .unwrap();
+    let path = team_agent::lifecycle::launch::write_worker_mcp_config_for_provider(
+        &ws,
+        "synthetic",
+        &config,
+        Some(Provider::ClaudeCode),
+    )
+    .unwrap();
+    let written: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(path).unwrap()).unwrap();
+    assert_eq!(written["mcpServers"], config.raw);
+    assert_eq!(written["mcpServers"]["team_orchestrator"]["type"], "stdio");
+}
+
 /// C-7-3 / RC-24: a resume command line must not carry `--session-id` and `--resume`
 /// together (conflicting session semantics). Driven through the real restart path so
 /// the public resume builder is exercised end to end.
@@ -1436,11 +1575,7 @@ fn write_copilot_team(ws: &Path, name: &str, tools: &[&str], dangerous: bool) ->
     let team = ws.join(name);
     std::fs::create_dir_all(team.join("agents")).unwrap();
     // 0.5.66 bypass 单源:bypass 由角色字段驱动,不再是 TEAM.md dangerous_auto_approve。
-    let role_bypass = if dangerous {
-        "true"
-    } else {
-        "false"
-    };
+    let role_bypass = if dangerous { "true" } else { "false" };
     std::fs::write(
         team.join("TEAM.md"),
         format!(
@@ -1637,6 +1772,7 @@ struct RecordedSpawn {
 struct RecordingTransport {
     spawns: Mutex<Vec<RecordedSpawn>>,
     session_present: Mutex<bool>,
+    panes: Mutex<Vec<PaneInfo>>,
 }
 
 impl RecordingTransport {
@@ -1681,8 +1817,22 @@ impl Transport for RecordingTransport {
             window: window.as_str().to_string(),
         });
         *self.session_present.lock().unwrap() = true;
+        let pane_id = PaneId::new(format!("%{}", spawns.len()));
+        self.panes.lock().unwrap().push(PaneInfo {
+            pane_id: pane_id.clone(),
+            session: session.clone(),
+            window_index: None,
+            window_name: Some(window.clone()),
+            pane_index: None,
+            tty: None,
+            current_command: None,
+            current_path: None,
+            active: false,
+            pane_pid: Some(30_000 + spawns.len() as u32),
+            leader_env: BTreeMap::new(),
+        });
         Ok(SpawnResult {
-            pane_id: PaneId::new(format!("%{}", spawns.len())),
+            pane_id,
             session: session.clone(),
             window: window.clone(),
             child_pid: Some(30_000 + spawns.len() as u32),
@@ -1747,7 +1897,7 @@ impl Transport for RecordingTransport {
     }
 
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
-        Ok(Vec::new())
+        Ok(self.panes.lock().unwrap().clone())
     }
 
     fn has_session(&self, _session: &SessionName) -> Result<bool, TransportError> {
@@ -1769,10 +1919,20 @@ impl Transport for RecordingTransport {
 
     fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
         *self.session_present.lock().unwrap() = false;
+        self.panes
+            .lock()
+            .unwrap()
+            .retain(|pane| &pane.session != _session);
         Ok(())
     }
 
-    fn kill_window(&self, _target: &Target) -> Result<(), TransportError> {
+    fn kill_window(&self, target: &Target) -> Result<(), TransportError> {
+        self.panes.lock().unwrap().retain(|pane| match target {
+            Target::Pane(id) => &pane.pane_id != id,
+            Target::SessionWindow { session, window } => {
+                &pane.session != session || pane.window_name.as_ref() != Some(window)
+            }
+        });
         Ok(())
     }
 
@@ -1796,6 +1956,17 @@ fn copilot_empty_mcp_list_shim(tag: &str) -> TempWorkspace {
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
+        // coordinator health needs the seeded test PID's real non-zombie status.
+        // Keep PATH isolated and refuse any broader process inspection.
+        std::fs::write(
+            bin.join("ps"),
+            format!(
+                "#!/bin/sh\nif [ \"$#\" = 4 ] && [ \"$1\" = -p ] && [ \"$2\" = {} ] && [ \"$3\" = -o ] && [ \"$4\" = stat= ]; then\n  exec /bin/ps \"$@\"\nfi\nexit 1\n",
+                std::process::id(),
+            ),
+        )
+        .unwrap();
+        std::fs::set_permissions(bin.join("ps"), std::fs::Permissions::from_mode(0o755)).unwrap();
         std::fs::set_permissions(bin.join("copilot"), std::fs::Permissions::from_mode(0o755))
             .unwrap();
     }

package/crates/team-agent/src/mcp_server/tests/scoped.rs

@@ -163,30 +163,28 @@ fn verify_cleanup_surviving_receipt(
         assert!(!receipt.exists(), "cleanup must remove only the exact receipt path");
     }
 
-    // ── #36 report_result setdefault: populated envelope keys WIN over args ─────
-    // GOLDEN (probe_setdefault.py): envelope {agent_id:env-agent, task_id:env-task,...}
-    // + explicit args agent_id=ARG-agent, task_id=ARG-task → returned dict keeps
-    // env-agent / env-task (setdefault). Rust unconditionally insert-overrides.
+    // ── #36 report_result identity: neither envelope nor args can override capture ─
     #[test]
-    fn report_result_setdefault_envelope_wins_over_args() {
+    fn report_result_rejects_envelope_and_argument_identity_mismatch() {
         let tools = TeamOrchestratorTools::with_identity(
             &unique_ws("report-setdefault"),
             Some(AgentId::new("env-id")),
             None,
         );
-        let ok = tools.report_result(
-            Some(&json!({
-                "agent_id": "env-agent", "task_id": "env-task",
-                "status": "blocked", "summary": "env summary"
-            })),
-            Some("ARG summary"), ResultStatus::Success,
-            None, None, None, None, None,
-            Some("ARG-task"), Some("ARG-agent"),
-        ).expect("report ok");
-        let v = serde_json::to_value(&ok).unwrap();
-        // setdefault: the pre-populated envelope values win.
-        assert_eq!(v.get("agent_id"), Some(&json!("env-agent")), "envelope agent_id wins (setdefault)");
-        assert_eq!(v.get("task_id"), Some(&json!("env-task")), "envelope task_id wins (setdefault)");
+        let error = tools
+            .report_result(
+                Some(&json!({
+                    "agent_id": "env-agent", "task_id": "env-task",
+                    "status": "blocked", "summary": "env summary"
+                })),
+                Some("ARG summary"), ResultStatus::Success,
+                None, None, None, None, None,
+                Some("ARG-task"), Some("ARG-agent"),
+            )
+            .expect_err("envelope and argument identities must be bound to the worker capture");
+        assert_eq!(error.reason, ToolErrorReason::McpScopeRefused);
+        assert!(error.message.contains("identity_mismatch"));
+        assert_eq!(error.extra.get("expected_agent_id"), Some(&json!("env-id")));
     }
 
     // ── #44 report_result task_id inference from state (_latest_task_for_assignee)

package/crates/team-agent/src/mcp_server/tests/tools.rs

@@ -25,31 +25,42 @@
     }
 
     #[test]
-    fn report_result_explicit_agent_overrides_env() {
+    fn report_result_rejects_explicit_agent_mismatch() {
         let tools = TeamOrchestratorTools::with_identity(
-            &unique_ws("report-explicit"),
+            &unique_ws("report-explicit-mismatch"),
             Some(AgentId::new("worker-7")),
             Some(TeamKey::new("teamA")),
         );
-        let ok = tools.report_result(
-            None, Some("done"), ResultStatus::Success,
-            None, None, None, None, None,
-            Some("task-9"), Some("explicit-agent"),
-        ).expect("report ok");
-        let v = serde_json::to_value(&ok).unwrap();
-        // explicit > env: both task_id and agent_id are ok-whitelist keys
-        // (normalize.py:45-46) echoed by runtime.report_result, so present on success.
-        // UNCONDITIONAL asserts — the override must be proven, not silently skipped.
-        assert_eq!(
-            v.get("agent_id"),
-            Some(&json!("explicit-agent")),
-            "explicit agent_id overrides env"
-        );
-        assert_eq!(
-            v.get("task_id"),
-            Some(&json!("task-9")),
-            "explicit task_id flows through"
+        let error = tools
+            .report_result(
+                None, Some("done"), ResultStatus::Success,
+                None, None, None, None, None,
+                Some("task-9"), Some("explicit-agent"),
+            )
+            .expect_err("a request agent_id cannot override the captured identity");
+        assert_eq!(error.reason, ToolErrorReason::McpScopeRefused);
+        assert!(error.message.contains("identity_mismatch"));
+        assert_eq!(error.extra.get("expected_agent_id"), Some(&json!("worker-7")));
+        assert_eq!(error.extra.get("provided_agent_id"), Some(&json!("explicit-agent")));
+    }
+
+    #[test]
+    fn report_result_accepts_explicit_captured_agent() {
+        let tools = TeamOrchestratorTools::with_identity(
+            &unique_ws("report-explicit-match"),
+            Some(AgentId::new("worker-7")),
+            Some(TeamKey::new("teamA")),
         );
+        let ok = tools
+            .report_result(
+                None, Some("done"), ResultStatus::Success,
+                None, None, None, None, None,
+                Some("task-9"), Some("worker-7"),
+            )
+            .expect("matching explicit agent_id remains compatible");
+        let v = serde_json::to_value(&ok).unwrap();
+        assert_eq!(v.get("agent_id"), Some(&json!("worker-7")));
+        assert_eq!(v.get("task_id"), Some(&json!("task-9")));
     }
 
     #[test]

package/crates/team-agent/src/mcp_server/tests/wire.rs

@@ -264,6 +264,36 @@ fn dispatch_unknown_tool_returns_unknown_tool_error() {
     assert_eq!(err.message, "unknown tool 'nope'");
 }
 
+#[test]
+fn worker_identity_is_bound_before_send_or_report_dispatch() {
+    let tools = TeamOrchestratorTools::with_identity(
+        Path::new("/tmp/ws"),
+        Some(AgentId::new("worker-7")),
+        None,
+    );
+    let send = dispatch(
+        &tools,
+        &json!({
+            "tool": "send_message",
+            "arguments": {"to": "leader", "content": "spoof", "agent_id": "in-dev2"}
+        }),
+    )
+    .expect_err("send_message must reject a spoofed request identity");
+    assert!(send.message.contains("identity_mismatch"));
+    assert_eq!(send.extra.get("expected_agent_id"), Some(&json!("worker-7")));
+
+    let report = dispatch(
+        &tools,
+        &json!({
+            "tool": "report_result",
+            "arguments": {"envelope": {"agent_id": "in-dev2", "summary": "spoof"}}
+        }),
+    )
+    .expect_err("report_result envelope must not override captured identity");
+    assert!(report.message.contains("identity_mismatch"));
+    assert_eq!(report.extra.get("provided_agent_id"), Some(&json!("in-dev2")));
+}
+
 // ════════════════════════════════════════════════════════════════════════
 // requires_ack_for_target — leader-only → false (tools.py:16)
 // ════════════════════════════════════════════════════════════════════════

package/crates/team-agent/src/mcp_server/tools.rs

@@ -82,6 +82,107 @@ impl TeamOrchestratorTools {
         }
     }
 
+    /// Validate an identity supplied by an MCP request against the identity captured
+    /// when this worker server started. Missing request fields are intentionally valid;
+    /// the captured identity is the only fallback. Present values must be non-empty and
+    /// equal to that capture, otherwise reject before routing or persistence.
+    pub(crate) fn validate_identity_argument(
+        &self,
+        tool: &str,
+        value: Option<&Value>,
+    ) -> Result<(), ToolError> {
+        let expected = self.require_captured_identity(tool)?;
+        let Some(value) = value else {
+            return Ok(());
+        };
+        let Some(provided) = value.as_str().and_then(non_empty_string) else {
+            return Err(self.identity_mismatch(tool, expected.as_str(), None));
+        };
+        if provided != expected.as_str() {
+            return Err(self.identity_mismatch(tool, expected.as_str(), Some(provided)));
+        }
+        Ok(())
+    }
+
+    /// Report requests can carry identity in both the top-level argument and the
+    /// envelope. Validate both independently so an envelope cannot overwrite the
+    /// framework-bound sender after the top-level check.
+    pub(crate) fn validate_report_identity_request(
+        &self,
+        envelope: Option<&Value>,
+        explicit_agent_id: Option<&Value>,
+    ) -> Result<(), ToolError> {
+        self.validate_identity_argument("report_result", explicit_agent_id)?;
+        if let Some(value) = envelope
+            .and_then(Value::as_object)
+            .and_then(|obj| obj.get("agent_id"))
+        {
+            self.validate_identity_argument("report_result", Some(value))?;
+        }
+        Ok(())
+    }
+
+    fn require_captured_identity(&self, tool: &str) -> Result<&AgentId, ToolError> {
+        self.agent_id
+            .as_ref()
+            .filter(|agent| non_empty_string(agent.as_str()).is_some())
+            .ok_or_else(|| self.identity_mismatch(tool, "<missing>", None))
+    }
+
+    fn validate_report_identity_text(
+        &self,
+        envelope: Option<&Value>,
+        explicit_agent_id: Option<&str>,
+    ) -> Result<(), ToolError> {
+        let expected = self.require_captured_identity("report_result")?;
+        if let Some(provided) = explicit_agent_id.and_then(non_empty_string) {
+            if provided != expected.as_str() {
+                return Err(self.identity_mismatch(
+                    "report_result",
+                    expected.as_str(),
+                    Some(provided),
+                ));
+            }
+        } else if explicit_agent_id.is_some() {
+            return Err(self.identity_mismatch("report_result", expected.as_str(), None));
+        }
+        if let Some(value) = envelope
+            .and_then(Value::as_object)
+            .and_then(|obj| obj.get("agent_id"))
+        {
+            self.validate_identity_argument("report_result", Some(value))?;
+        }
+        Ok(())
+    }
+
+    fn identity_mismatch(&self, tool: &str, expected: &str, provided: Option<&str>) -> ToolError {
+        let mut error = ToolError::new(
+            ToolErrorReason::McpScopeRefused,
+            format!(
+                "identity_mismatch: {tool} agent_id must match framework-injected TEAM_AGENT_ID"
+            ),
+            "IdentityError",
+        );
+        error
+            .extra
+            .insert("status".to_string(), Value::String("refused".to_string()));
+        error
+            .extra
+            .insert("identity_mismatch".to_string(), Value::Bool(true));
+        error
+            .extra
+            .insert("tool".to_string(), Value::String(tool.to_string()));
+        error.extra.insert(
+            "expected_agent_id".to_string(),
+            Value::String(expected.to_string()),
+        );
+        error.extra.insert(
+            "provided_agent_id".to_string(),
+            provided.map_or(Value::Null, |value| Value::String(value.to_string())),
+        );
+        error
+    }
+
     /// `assign_task` (`tools.py:84-133`): C8 Family-B task-view reconcile then deliver.
     /// Resolves team key from owner-team env (or `active_team_key`), appends or
     /// field-updates the task in state, then delegates delivery to
@@ -214,6 +315,8 @@ impl TeamOrchestratorTools {
         mailbox: Option<&Value>,
         presentation: Option<&Value>,
     ) -> Result<SendOutcome, ToolError> {
+        // A worker without a spawn-time identity cannot safely emit a message.
+        self.require_captured_identity("send_message")?;
         let normalized =
             crate::messaging::presentation::normalize_send_presentation(mailbox, presentation)
                 .map_err(|error| {
@@ -430,6 +533,8 @@ impl TeamOrchestratorTools {
         agent_id: Option<&str>,
         presentation: Option<&Value>,
     ) -> ToolResult {
+        // Validate before scope reads, envelope normalization, or result persistence.
+        self.validate_report_identity_text(envelope, agent_id)?;
         if let Some(envelope) = envelope {
             self.validate_rpc_scope_args("report_result", envelope)?;
         }
@@ -538,17 +643,14 @@ impl TeamOrchestratorTools {
                         .or_insert(Value::String(source.to_string()));
                 }
             }
-            if !obj.contains_key("agent_id") {
-                let resolved = agent_id
-                    .map(ToString::to_string)
-                    .or_else(|| {
-                        self.agent_id
-                            .as_ref()
-                            .map(|env_agent| env_agent.as_str().to_string())
-                    })
-                    .unwrap_or_else(|| "unknown".to_string());
-                obj.insert("agent_id".to_string(), Value::String(resolved));
-            }
+            // The framework capture is authoritative even when a matching request
+            // value was supplied; this also canonicalizes surrounding whitespace.
+            let resolved = self
+                .agent_id
+                .as_ref()
+                .map(|env_agent| env_agent.as_str().to_string())
+                .unwrap_or_else(|| "unknown".to_string());
+            obj.insert("agent_id".to_string(), Value::String(resolved));
             if !obj.contains_key("changes") {
                 obj.insert(
                     "changes".to_string(),

package/crates/team-agent/src/mcp_server/wire.rs

@@ -496,7 +496,9 @@ fn tool_properties(tool: McpTool) -> serde_json::Map<String, Value> {
             insert_property(
                 &mut properties,
                 "agent_id",
-                string_property("Optional reporting agent id override."),
+                string_property(
+                    "Optional reporting agent id; must match framework-injected TEAM_AGENT_ID.",
+                ),
             );
             insert_property(
                 &mut properties,
@@ -671,6 +673,23 @@ pub(crate) fn dispatch_tool(
     tool: McpTool,
     args: &Value,
 ) -> ToolResult {
+    // Check framework-bound identity before scope resolution or any tool side effect.
+    match tool {
+        McpTool::SendMessage => {
+            tools.validate_identity_argument("send_message", args.get("agent_id"))?;
+            if let Some(value) = args
+                .get("envelope")
+                .and_then(Value::as_object)
+                .and_then(|object| object.get("agent_id"))
+            {
+                tools.validate_identity_argument("send_message", Some(value))?;
+            }
+        }
+        McpTool::ReportResult => {
+            tools.validate_report_identity_request(args.get("envelope"), args.get("agent_id"))?
+        }
+        _ => {}
+    }
     if scope_ceiling_tool(tool) {
         tools.validate_rpc_scope_args(tool.wire_name(), args)?;
     }