@team-agent/installer 0.5.64 → 0.5.66

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.64"
+version = "0.5.66"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.64"
+version = "0.5.66"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/Cargo.toml

@@ -57,5 +57,10 @@ serial_test = { version = "3", features = ["file_locks"] }
 name = "e2e"
 path = "tests/e2e/main.rs"
 
+# 0.5.66 bypass 单源:E2E 验证角色字段 → 运行面 → drift 挡板 → force fresh spawn。
+[[test]]
+name = "e2e_bypass_single_source"
+path = "tests/e2e_bypass_single_source.rs"
+
 [lints]
 workspace = true

package/crates/team-agent/src/cli/adapters.rs

@@ -75,7 +75,7 @@ pub fn cmd_init(args: &InitArgs) -> Result<CmdResult, CliError> {
     if args.force || !default_agent_path.exists() {
         std::fs::write(
             &default_agent_path,
-            "---\nname: worker\nrole: Worker\nprovider: fake\ntools:\n  - mcp_team\n---\n\nWait for instructions.\n",
+            "---\nname: worker\nrole: Worker\nprovider: fake\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWait for instructions.\n",
         )?;
     }
     if args.force || !state_path.exists() {
@@ -523,6 +523,11 @@ pub fn cmd_results(args: &ResultsArgs) -> Result<CmdResult, CliError> {
     })
 }
 
+pub fn cmd_wait(args: &WaitArgs) -> Result<CmdResult, CliError> {
+    let result = messaging::wait_for_result(&args.workspace, &args.task_id)?;
+    Ok(CmdResult::from_json(result.to_json(), args.json))
+}
+
 /// `cmd_allow_peer_talk`(`parser.py allow-peer-talk`).
 pub fn cmd_allow_peer_talk(args: &AllowPeerTalkArgs) -> Result<CmdResult, CliError> {
     if args.team.is_some() {

package/crates/team-agent/src/cli/emit.rs

@@ -196,6 +196,7 @@ fn dispatch(command: &str, args: &[String], cwd: &Path) -> Result<ExitCode, CliE
                 .map(emit_result)
         }
         "results" => cmd_results(&results_args(args, cwd)?).map(emit_result),
+        "wait" => cmd_wait(&wait_args(args, cwd)?).map(emit_result),
         "diagnose" => cmd_diagnose(&diagnose_args(args, cwd)).map(emit_result),
         "preflight" => cmd_preflight(&preflight_args(args, cwd)).map(emit_result),
         "wait-ready" => cmd_wait_ready(&wait_ready_args(args, cwd)).map(emit_result),
@@ -243,6 +244,7 @@ const DISPATCH_COMMANDS: &[&str] = &[
     "profile",
     "collect",
     "results",
+    "wait",
     "diagnose",
     "preflight",
     "wait-ready",
@@ -403,6 +405,7 @@ fn command_help(command: Option<&str>) -> String {
         Some("profile") => "usage: team-agent profile COMMAND NAME [--workspace WORKSPACE] [--team TEAM] [--auth-mode MODE] [--json]".to_string(),
         Some("collect") => "usage: team-agent collect [--workspace WORKSPACE] [--team TEAM] [--result-file FILE] [--json]".to_string(),
         Some("results") => "usage: team-agent results --case CASE_ID [--workspace WORKSPACE] [--team TEAM] [--json]".to_string(),
+        Some("wait") => "usage: team-agent wait --task TASK [--workspace WORKSPACE] [--json]".to_string(),
         Some("diagnose") => "usage: team-agent diagnose [--workspace WORKSPACE] [--team TEAM] [--json]".to_string(),
         Some("preflight") => "usage: team-agent preflight [TEAMDIR] [--json]".to_string(),
         Some("wait-ready") => "usage: team-agent wait-ready [--workspace WORKSPACE] [--team TEAM] [--timeout SECONDS] [--json]".to_string(),
@@ -1319,6 +1322,18 @@ fn watch_args(args: &[String], cwd: &Path) -> WatchArgs {
     }
 }
 
+fn wait_args(args: &[String], cwd: &Path) -> Result<WaitArgs, CliError> {
+    let parsed = parse_args(args);
+    let workspace = workspace(&parsed, cwd);
+    Ok(WaitArgs {
+        task_id: parsed
+            .task
+            .ok_or_else(|| CliError::Usage("wait requires --task <id>".to_string()))?,
+        workspace,
+        json: parsed.json,
+    })
+}
+
 fn approvals_args(args: &[String], cwd: &Path) -> ApprovalsArgs {
     let parsed = parse_args(args);
     ApprovalsArgs {

package/crates/team-agent/src/cli/mod.rs

@@ -2245,14 +2245,15 @@ pub mod lifecycle_port {
     /// runs, where the leader is never in the invoker's ancestry.
     ///
     /// 0.4.x (CR R3): leader shell wrapper interaction. The leader pane's
-    /// controlling process is the `sh -lc "...; exec ${SHELL} -l"` that
-    /// runs Claude as a CHILD. When Claude exits and the shell wrapper falls
-    /// back via `exec ${SHELL} -l`, the controlling PID is REPLACED in-place
-    /// by the interactive shell (same pane_pid). Because this function
-    /// protects by `pane.pane_pid` (Source 1 & 2), the fallback interactive
-    /// shell is already covered by the same protection set — shutdown will
-    /// NOT treat the fallback shell as a stray process. Verified by the
-    /// `leader_fallback_shell_protected_when_provider_exited` test.
+    /// controlling process is the `sh -lc` wrapper that runs Claude as a
+    /// CHILD. When Claude exits, the wrapper records the marker and replaces
+    /// its command with the inert `/bin/sh -c` tail (which ignores INT/QUIT
+    /// and does not read pane stdin). Because this function protects by
+    /// `pane.pane_pid` (Source 1 & 2), that tail is covered by the same
+    /// protection set — shutdown will NOT treat it as a stray process.
+    /// This protection is currently untested; the former claim that
+    /// `leader_fallback_shell_protected_when_provider_exited` verified it
+    /// referred to a test absent from this repository (A-46).
     ///
     /// Two leader-pane sources(N39 双来源,真机 grounded):
     /// 1. **Session prefix**: tmux session starts with `team-agent-leader-`(契约 grounded;

package/crates/team-agent/src/cli/send/presentation.rs

@@ -108,6 +108,7 @@ pub(super) fn delivery_outcome_json(
         "sender": opts.sender,
         "message_id": outcome.message_id,
         "message_status": outcome.message_status.0,
+        "ack_forced_off": outcome.ack_forced_off,
         "verification": outcome.verification,
         "stage": outcome.stage.map(delivery_stage_wire),
         "reason": outcome.reason.map(delivery_refusal_wire),

package/crates/team-agent/src/cli/spec.rs

@@ -78,6 +78,7 @@ pub(crate) enum DispatchKind {
     Profile,
     Collect,
     Results,
+    Wait,
     Diagnose,
     Preflight,
     WaitReady,
@@ -123,6 +124,7 @@ pub(crate) const ALL_DISPATCH_KINDS: &[DispatchKind] = &[
     DispatchKind::Profile,
     DispatchKind::Collect,
     DispatchKind::Results,
+    DispatchKind::Wait,
     DispatchKind::Diagnose,
     DispatchKind::Preflight,
     DispatchKind::WaitReady,
@@ -162,6 +164,7 @@ pub(crate) const COMMAND_SPECS: &[CommandSpec] = &[
     CommandSpec { name: "status", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Status), summary: "show current team status", usage: "usage: team-agent status [AGENT] [--workspace WORKSPACE] [--team TEAM] [--summary|--json] [--detail]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "collect", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Collect), summary: "collect reported results", usage: "usage: team-agent collect [--workspace WORKSPACE] [--team TEAM] [--result-file FILE] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "results", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Results), summary: "read reported results for a case", usage: "usage: team-agent results --case CASE_ID [--workspace WORKSPACE] [--team TEAM] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
+    CommandSpec { name: "wait", tier: CommandTier::Core, category: CommandCategory::Daily, kind: CommandKind::Dispatch(DispatchKind::Wait), summary: "block until a task result is stored", usage: "usage: team-agent wait --task TASK [--workspace WORKSPACE] [--json]", default_help: false, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "restart", tier: CommandTier::Core, category: CommandCategory::TeamLifecycle, kind: CommandKind::Dispatch(DispatchKind::Restart), summary: "restart the selected team", usage: "usage: team-agent restart [WORKSPACE] [--team TEAM] [--allow-fresh] [--session-converge-deadline SECONDS] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::Conditional, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "shutdown", tier: CommandTier::Core, category: CommandCategory::TeamLifecycle, kind: CommandKind::Dispatch(DispatchKind::Shutdown), summary: "stop the selected team", usage: "usage: team-agent shutdown [--workspace WORKSPACE] [--team TEAM] [--keep-logs] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::No, alias_of: None, sunset: None, action: None, governance: None },
     CommandSpec { name: "add-agent", tier: CommandTier::Core, category: CommandCategory::WorkerLifecycle, kind: CommandKind::Dispatch(DispatchKind::AddAgent), summary: "add or force-recreate a worker", usage: "usage: team-agent add-agent AGENT --role-file FILE [--force] [--workspace WORKSPACE] [--team TEAM] [--no-display] [--json]", default_help: true, command_help: true, suggestion_index: true, token_usage: TokenUsage::Conditional, alias_of: None, sunset: None, action: None, governance: None },

package/crates/team-agent/src/cli/tests/compile.rs

@@ -10,7 +10,7 @@ fn compile_team_dir(tag: &str) -> std::path::PathBuf {
     .unwrap();
     std::fs::write(
         team.join("agents").join("worker.md"),
-        "---\nname: worker\nrole: Worker\nprovider: fake\nmodel: fake\ntools:\n  - mcp_team\n---\n\nWorker role.\n",
+        "---\nname: worker\nrole: Worker\nprovider: fake\nmodel: fake\ntools:\n  - mcp_team\ndangerously_skip_permissions: false\n---\n\nWorker role.\n",
     )
     .unwrap();
     team

package/crates/team-agent/src/cli/tests/mod.rs

@@ -42,8 +42,39 @@ fn seed_status_workspace() -> std::path::PathBuf {
     dir
 }
 
-const DELEG_VALID_ROLE: &str = "---\nname: implementer\nrole: Implementation Engineer\nprovider: fake\nmodel: fake\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nImplement bounded tasks.\n";
-const DELEG_INVALID_ROLE: &str = "---\nname: broken\nrole: Broken Worker\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nNo provider field.\n";
+fn seed_send_workspace() -> std::path::PathBuf {
+    let dir = std::env::temp_dir().join(format!(
+        "ta-cli-send-{}-{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    let team = dir.join(".team");
+    std::fs::create_dir_all(team.join("runtime")).unwrap();
+    let state = json!({
+        "active_team_key": "teamA",
+        "teams": {
+            "teamA": {
+                "agents": {
+                    "alice": {"provider": "codex"},
+                    "drifted": {"provider": "codex", "status": "session_drift"}
+                },
+                "tasks": [{"id": "t-1"}]
+            }
+        }
+    });
+    std::fs::write(
+        team.join("runtime").join("state.json"),
+        serde_json::to_vec_pretty(&state).unwrap(),
+    )
+    .unwrap();
+    dir
+}
+
+const DELEG_VALID_ROLE: &str = "---\nname: implementer\nrole: Implementation Engineer\nprovider: fake\nmodel: fake\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nImplement bounded tasks.\n";
+const DELEG_INVALID_ROLE: &str = "---\nname: broken\nrole: Broken Worker\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nNo provider field.\n";
 const DELEG_TEAM_MD: &str =
     "---\nname: clidelegteam\nobjective: Delegation probe.\nprovider: fake\n---\n\nteam.\n";
 

package/crates/team-agent/src/cli/tests/run_delegation.rs

@@ -182,7 +182,7 @@ fn run_dispatches_quick_start_compiles_spec() {
     .unwrap();
     std::fs::write(
             dir.join("agents").join("implementer.md"),
-            "---\nname: implementer\nrole: Impl\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nImpl.\n",
+            "---\nname: implementer\nrole: Impl\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nImpl.\n",
         )
         .unwrap();
     let argv = vec![

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -453,11 +453,13 @@ fn status_port_status_detail_full_keeps_uncompacted_events() {
 // =========================================================================
 
 fn send_args_fixture() -> SendArgs {
+    let workspace = seed_send_workspace();
+    let _ = crate::message_store::MessageStore::open(&workspace).unwrap();
     SendArgs {
         target: Some("alice".into()),
         message: vec!["hello".into(), "world".into(), "foo".into()],
         targets: None,
-        workspace: PathBuf::from("."),
+        workspace,
         team: Some("teamA".into()),
         task: Some("t-1".into()),
         sender: TrustedSender::leader(),
@@ -565,9 +567,17 @@ fn cmd_send_joins_message_with_single_space() {
         CmdOutput::Json(ref v) => {
             assert!(v.get("ok").is_some(), "send result Json must carry `ok`");
             if v.get("ok").and_then(|ok| ok.as_bool()) == Some(true) {
+                let delivered = v.get("delivered").and_then(|x| x.as_bool()) == Some(true);
+                // hermetic tier 假设：此 fixture 无法产生真实 tmux Delivered。
+                // 若 delivered=true 命中说明 tier 前提变了（例如 seed 开了 Delivered 通路），
+                // 应立即失败以强制重新审视，而不是悄悄跑一条从未验过的分支。
+                assert!(
+                    !delivered,
+                    "hermetic seed 不应产生 delivered=true；tier 假设变了"
+                );
                 assert_eq!(
                     v.get("reminder").and_then(|reminder| reminder.as_str()),
-                    Some(crate::cli::SEND_REMINDER)
+                    Some("Message queued; coordinator will notify when the worker receives it. Do not poll the worker terminal with capture-pane.")
                 );
             }
         }
@@ -689,7 +699,7 @@ fn cmd_send_failed_outcome_yields_error_exit() {
     // DeliveryOutcome ok=false (e.g. refused) -> from_json -> ExitCode::Error (parser.py:507).
     // A failed send to a target must propagate non-zero exit reporting through CmdResult.
     let args = SendArgs {
-        target: Some("nonexistent".into()),
+        target: Some("drifted".into()),
         no_ack: false,
         no_wait: false,
         watch_result: false,

package/crates/team-agent/src/cli/tests/verb_validate.rs

@@ -36,7 +36,7 @@ agents:
       - "git_diff"
       - "mcp_team"
       - "provider_builtin"
-    permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "implementation"
     avoid_for: []

package/crates/team-agent/src/cli/types.rs

@@ -677,6 +677,13 @@ pub struct ResultsArgs {
     pub json: bool,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct WaitArgs {
+    pub task_id: String,
+    pub workspace: PathBuf,
+    pub json: bool,
+}
+
 /// `diagnose`(`parser.py:298`) runtime health report, distinct from `doctor`.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct DiagnoseArgs {

package/crates/team-agent/src/compiler/tests.rs

@@ -105,6 +105,7 @@ role: Implementation Engineer
 provider: codex
 model: gpt-5.5
 auth_mode: subscription
+dangerously_skip_permissions: false
 tools:
   - fs_read
   - fs_write
@@ -189,7 +190,7 @@ fn front_matter_non_object_errors() {
 // separators=(",",":"))` with the workspace path templated to __WS__.
 // (team-agent-public v0.2.11, /tmp/probe_compiler.py.)
 
-const BASE_NOPROFILE_JSON: &str = r#"{"version":1,"team":{"name":"doc-team","mode":"supervisor_worker","objective":"Compile role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":"gpt-5.5","tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"implementer","role":"Implementation Engineer","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Implement bounded tasks and report result_envelope_v1.","file":null},"tools":["fs_read","fs_write","execute_bash","mcp_team"],"permission_mode":"restricted","communication_mode":"leader_centric","preferred_for":["implementer","Implementation Engineer"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"implementer","rules":[{"id":"route-implementer","match":{"assignee":["implementer"]},"assign_to":"implementer","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"adaptive","session_name":"team-doc-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["implementer"],"dangerous_auto_approve":false,"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"implementer","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
+const BASE_NOPROFILE_JSON: &str = r#"{"version":1,"team":{"name":"doc-team","mode":"supervisor_worker","objective":"Compile role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":"gpt-5.5","tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"implementer","role":"Implementation Engineer","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Implement bounded tasks and report result_envelope_v1.","file":null},"tools":["fs_read","fs_write","execute_bash","mcp_team"],"dangerously_skip_permissions":false,"communication_mode":"leader_centric","preferred_for":["implementer","Implementation Engineer"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"implementer","rules":[{"id":"route-implementer","match":{"assignee":["implementer"]},"assign_to":"implementer","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"adaptive","session_name":"team-doc-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["implementer"],"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"implementer","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
 
 #[test]
 fn compile_base_noprofile_matches_python_dict_order_and_values() {
@@ -254,12 +255,13 @@ provider: codex
 tools:
   - fs_read
   - mcp_team
+dangerously_skip_permissions: false
 ---
 
 Implement bounded tasks.
 ";
 
-const RUNTIME_DEFAULTS_JSON: &str = r#"{"version":1,"team":{"name":"doc-team","mode":"supervisor_worker","objective":"Compile role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":null,"tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"implementer","role":"Implementation Engineer","provider":"codex","model":"gpt-5.4","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Implement bounded tasks.","file":null},"tools":["fs_read","mcp_team"],"permission_mode":"restricted","communication_mode":"leader_centric","preferred_for":["implementer","Implementation Engineer"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"implementer","rules":[{"id":"route-implementer","match":{"assignee":["implementer"]},"assign_to":"implementer","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"ghostty_window","session_name":"team-doc-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["implementer"],"dangerous_auto_approve":true,"fast":true,"tick_interval_sec":1,"push_min_interval_sec":3,"stuck_timeout_sec":5},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"implementer","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
+const RUNTIME_DEFAULTS_JSON: &str = r#"{"version":1,"team":{"name":"doc-team","mode":"supervisor_worker","objective":"Compile role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":null,"tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"implementer","role":"Implementation Engineer","provider":"codex","model":"gpt-5.4","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Implement bounded tasks.","file":null},"tools":["fs_read","mcp_team"],"dangerously_skip_permissions":false,"communication_mode":"leader_centric","preferred_for":["implementer","Implementation Engineer"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"implementer","rules":[{"id":"route-implementer","match":{"assignee":["implementer"]},"assign_to":"implementer","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"ghostty_window","session_name":"team-doc-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["implementer"],"fast":true,"tick_interval_sec":1,"push_min_interval_sec":3,"stuck_timeout_sec":5},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"implementer","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
 
 #[test]
 fn compile_runtime_front_matter_defaults_match_python() {
@@ -294,12 +296,13 @@ role: Editor and Defender
 provider: claude_code
 tools:
   - mcp_team
+dangerously_skip_permissions: false
 ---
 
 Edit and defend the argument.
 ";
 
-const ALIAS_JSON: &str = r#"{"version":1,"team":{"name":"debate-team","mode":"supervisor_worker","objective":"Compile thin role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":null,"tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"editor","role":"Editor and Defender","provider":"claude_code","model":"claude-sonnet-4-6","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Edit and defend the argument.","file":null},"tools":["mcp_team"],"permission_mode":"restricted","communication_mode":"leader_centric","preferred_for":["editor","Editor and Defender"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"editor","rules":[{"id":"route-editor","match":{"assignee":["editor"]},"assign_to":"editor","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"none","session_name":"team-debate-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["editor"],"dangerous_auto_approve":false,"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"editor","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
+const ALIAS_JSON: &str = r#"{"version":1,"team":{"name":"debate-team","mode":"supervisor_worker","objective":"Compile thin role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":null,"tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"editor","role":"Editor and Defender","provider":"claude_code","model":"claude-sonnet-4-6","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Edit and defend the argument.","file":null},"tools":["mcp_team"],"dangerously_skip_permissions":false,"communication_mode":"leader_centric","preferred_for":["editor","Editor and Defender"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"editor","rules":[{"id":"route-editor","match":{"assignee":["editor"]},"assign_to":"editor","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"none","session_name":"team-debate-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["editor"],"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"editor","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
 
 #[test]
 fn compile_provider_models_claude_code_falls_back_to_claude_alias() {
@@ -325,6 +328,7 @@ name: implementer
 role: Implementation Engineer
 provider: codex
 auth_mode: subscription
+dangerously_skip_permissions: false
 tools:
   - mcp_team
 ---
@@ -332,7 +336,7 @@ tools:
 Implement bounded tasks.
 ";
 
-const BUILTIN_JSON: &str = r#"{"version":1,"team":{"name":"default-model-team","mode":"supervisor_worker","objective":"Compile role docs without model fields.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":null,"tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"implementer","role":"Implementation Engineer","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Implement bounded tasks.","file":null},"tools":["mcp_team"],"permission_mode":"restricted","communication_mode":"leader_centric","preferred_for":["implementer","Implementation Engineer"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"implementer","rules":[{"id":"route-implementer","match":{"assignee":["implementer"]},"assign_to":"implementer","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"none","session_name":"team-default-model-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["implementer"],"dangerous_auto_approve":false,"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"implementer","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
+const BUILTIN_JSON: &str = r#"{"version":1,"team":{"name":"default-model-team","mode":"supervisor_worker","objective":"Compile role docs without model fields.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":null,"tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"implementer","role":"Implementation Engineer","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Implement bounded tasks.","file":null},"tools":["mcp_team"],"dangerously_skip_permissions":false,"communication_mode":"leader_centric","preferred_for":["implementer","Implementation Engineer"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"implementer","rules":[{"id":"route-implementer","match":{"assignee":["implementer"]},"assign_to":"implementer","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"none","session_name":"team-default-model-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":1,"startup_order":["implementer"],"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"implementer","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
 
 #[test]
 fn compile_subscription_without_model_uses_builtin_provider_default() {
@@ -351,6 +355,7 @@ role: Alpha Worker
 provider: codex
 model: gpt-5.5
 auth_mode: subscription
+dangerously_skip_permissions: false
 tools:
   - mcp_team
 ---
@@ -365,6 +370,7 @@ role: Bravo Worker
 provider: codex
 model: gpt-5.5
 auth_mode: subscription
+dangerously_skip_permissions: false
 tools:
   - mcp_team
 ---
@@ -372,7 +378,7 @@ tools:
 Bravo body.
 ";
 
-const TWO_AGENTS_JSON: &str = r#"{"version":1,"team":{"name":"doc-team","mode":"supervisor_worker","objective":"Compile role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":"gpt-5.5","tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"alpha","role":"Alpha Worker","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Alpha body.","file":null},"tools":["mcp_team"],"permission_mode":"restricted","communication_mode":"leader_centric","preferred_for":["alpha","Alpha Worker"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}},{"id":"bravo","role":"Bravo Worker","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Bravo body.","file":null},"tools":["mcp_team"],"permission_mode":"restricted","communication_mode":"leader_centric","preferred_for":["bravo","Bravo Worker"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"alpha","rules":[{"id":"route-alpha","match":{"assignee":["alpha"]},"assign_to":"alpha","priority":10},{"id":"route-bravo","match":{"assignee":["bravo"]},"assign_to":"bravo","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"adaptive","session_name":"team-doc-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":2,"startup_order":["alpha","bravo"],"dangerous_auto_approve":false,"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"alpha","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
+const TWO_AGENTS_JSON: &str = r#"{"version":1,"team":{"name":"doc-team","mode":"supervisor_worker","objective":"Compile role docs.","workspace":"__WS__"},"leader":{"id":"leader","role":"leader","provider":"codex","model":"gpt-5.5","tools":["fs_read","fs_list","mcp_team"],"context_policy":{"keep_user_thread":true,"receive_worker_outputs":"business_messages_and_short_summaries","max_worker_result_tokens":2000}},"agents":[{"id":"alpha","role":"Alpha Worker","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Alpha body.","file":null},"tools":["mcp_team"],"dangerously_skip_permissions":false,"communication_mode":"leader_centric","preferred_for":["alpha","Alpha Worker"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}},{"id":"bravo","role":"Bravo Worker","provider":"codex","model":"gpt-5.5","auth_mode":"subscription","working_directory":"__WS__","system_prompt":{"inline":"Bravo body.","file":null},"tools":["mcp_team"],"dangerously_skip_permissions":false,"communication_mode":"leader_centric","preferred_for":["bravo","Bravo Worker"],"avoid_for":[],"output_contract":{"format":"result_envelope_v1","required_fields":["task_id","status","summary","artifacts"]}}],"routing":{"default_assignee":"alpha","rules":[{"id":"route-alpha","match":{"assignee":["alpha"]},"assign_to":"alpha","priority":10},{"id":"route-bravo","match":{"assignee":["bravo"]},"assign_to":"bravo","priority":10}]},"communication":{"protocol":"mcp_inbox","topology":"leader_centered","worker_to_worker":true,"ack_timeout_sec":60,"result_format":"result_envelope_v1","message_store":{"sqlite":".team/runtime/team.db","mirror_files":".team/messages"}},"runtime":{"backend":"tmux","display_backend":"adaptive","session_name":"team-doc-team","auto_launch":true,"require_user_approval_before_launch":true,"max_active_agents":2,"startup_order":["alpha","bravo"],"fast":false,"tick_interval_sec":2,"push_min_interval_sec":60,"stuck_timeout_sec":300},"context":{"state_file":"team_state.md","artifact_dir":".team/artifacts","log_dir":".team/logs","summarization":{"worker_full_logs":"retain_outside_leader_context","state_update":"after_each_result"}},"tasks":[{"id":"task_initial","title":"Initial document-driven team task","type":"implementation","assignee":"alpha","deps":[],"acceptance":["Worker reports valid result_envelope_v1"],"status":"pending","requires_tools":["mcp_team"],"files":[],"risk":"low"}]}"#;
 
 #[test]
 fn compile_two_agents_sorted_by_filename_with_routing_and_startup_order() {
@@ -394,6 +400,7 @@ name: implementer
 role: Implementation Engineer
 model: gpt-5.5
 auth_mode: subscription
+dangerously_skip_permissions: false
 tools:
   - mcp_team
 ---
@@ -419,6 +426,7 @@ role: Implementation Engineer
 provider: codex
 model: gpt-5.5
 auth_mode: compatible_api
+dangerously_skip_permissions: false
 tools:
   - mcp_team
 ---
@@ -448,7 +456,7 @@ fn compile_compatible_api_without_profile_errors() {
 const TM_CODEX: &str = "---\nname: T\nprovider: codex\n---\nx\n";
 
 fn role_nomodel(provider: &str) -> String {
-    format!("---\nname: w\nrole: R\nprovider: {provider}\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nbody\n")
+    format!("---\nname: w\nrole: R\nprovider: {provider}\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nbody\n")
 }
 
 fn agent0(spec: &Value) -> &Value {
@@ -626,7 +634,7 @@ fn fix_a5_session_name_override_wins() {
 
 #[test]
 fn fix_a6_tools_shell_maps_to_execute_bash() {
-    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: subscription\ntools:\n  - shell\n  - mcp_team\n---\nb\n";
+    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - shell\n  - mcp_team\n---\nb\n";
     let team = build_team(TM_CODEX, &[("w.md", role)], &[]);
     let spec = compile_team(&team).expect("shell must normalize to execute_bash and compile");
     assert_eq!(
@@ -637,7 +645,7 @@ fn fix_a6_tools_shell_maps_to_execute_bash() {
 
 #[test]
 fn fix_a6_missing_tools_errors() {
-    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: subscription\n---\nb\n";
+    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: subscription\ndangerously_skip_permissions: false\n---\nb\n";
     let team = build_team(TM_CODEX, &[("w.md", role)], &[]);
     let err = compile_team(&team).unwrap_err();
     assert!(
@@ -648,7 +656,7 @@ fn fix_a6_missing_tools_errors() {
 
 #[test]
 fn fix_a6_tools_not_a_list_errors() {
-    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: subscription\ntools: justastring\n---\nb\n";
+    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools: justastring\n---\nb\n";
     let team = build_team(TM_CODEX, &[("w.md", role)], &[]);
     let err = compile_team(&team).unwrap_err();
     assert!(
@@ -661,7 +669,7 @@ fn fix_a6_tools_not_a_list_errors() {
 
 #[test]
 fn fix_a7_empty_body_inline_falls_back_to_role() {
-    let role = "---\nname: w\nrole: Reviewer Role\nprovider: codex\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n";
+    let role = "---\nname: w\nrole: Reviewer Role\nprovider: codex\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n";
     let team = build_team(TM_CODEX, &[("w.md", role)], &[]);
     let spec = compile_team(&team).unwrap();
     assert_eq!(
@@ -675,7 +683,7 @@ fn fix_a7_empty_body_inline_falls_back_to_role() {
 #[test]
 fn fix_a8_official_api_without_profile_errors() {
     // official_api (any non-subscription) without profile MUST NOT silently compile.
-    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: official_api\ntools:\n  - mcp_team\n---\nb\n";
+    let role = "---\nname: w\nrole: R\nprovider: codex\nauth_mode: official_api\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\nb\n";
     let team = build_team(TM_CODEX, &[("w.md", role)], &[]);
     let err = compile_team(&team).unwrap_err();
     assert!(
@@ -706,14 +714,9 @@ fn fix_a8_compatible_api_error_names_the_auth_mode() {
 #[test]
 fn fix_a9_bool_coercion_yes_and_one_are_true() {
     for v in ["yes", "1"] {
-        let tm = format!("---\nname: T\nprovider: codex\ndangerous_auto_approve: {v}\nworker_to_worker: {v}\n---\nx\n");
+        let tm = format!("---\nname: T\nprovider: codex\nworker_to_worker: {v}\n---\nx\n");
         let team = build_team(&tm, &[("w.md", &role_nomodel("codex"))], &[]);
         let spec = compile_team(&team).unwrap();
-        assert_eq!(
-            get_path(&spec, &["runtime", "dangerous_auto_approve"]),
-            Some(&Value::Bool(true)),
-            "value {v}"
-        );
         assert_eq!(
             get_path(&spec, &["communication", "worker_to_worker"]),
             Some(&Value::Bool(true)),
@@ -726,11 +729,11 @@ fn fix_a9_bool_coercion_yes_and_one_are_true() {
 fn fix_a9_bool_coercion_no_is_python_truthy() {
     // FLAG: Python bool("no") is TRUE (only 0/false/False are falsy). The contract
     // note said "no->false" but Python golden is no->true; we lock Python.
-    let tm = "---\nname: T\nprovider: codex\ndangerous_auto_approve: no\n---\nx\n";
+    let tm = "---\nname: T\nprovider: codex\nworker_to_worker: no\n---\nx\n";
     let team = build_team(tm, &[("w.md", &role_nomodel("codex"))], &[]);
     let spec = compile_team(&team).unwrap();
     assert_eq!(
-        get_path(&spec, &["runtime", "dangerous_auto_approve"]),
+        get_path(&spec, &["communication", "worker_to_worker"]),
         Some(&Value::Bool(true))
     );
 }
@@ -753,7 +756,7 @@ fn fix_a9_int_coercion_of_quoted_string() {
 fn fix_a10_crlf_role_doc_front_matter_is_parsed() {
     // Windows-authored \r\n doc: read_text universal-newlines normalizes before
     // the "---\n" check, so the front matter parses (current keeps \r\n → no FM).
-    let crlf_role = "---\r\nname: crlfworker\r\nrole: R\r\nprovider: codex\r\nauth_mode: subscription\r\ntools:\r\n  - mcp_team\r\n---\r\n\r\nbody\r\n";
+    let crlf_role = "---\r\nname: crlfworker\r\nrole: R\r\nprovider: codex\r\nauth_mode: subscription\r\ndangerously_skip_permissions: false\r\ntools:\r\n  - mcp_team\r\n---\r\n\r\nbody\r\n";
     let team = build_team(TM_CODEX, &[("w.md", crlf_role)], &[]);
     let spec = compile_team(&team).expect("CRLF role doc must parse its front matter");
     assert_eq!(

package/crates/team-agent/src/compiler.rs

@@ -299,10 +299,6 @@ pub fn compile_team(team_dir: &Path) -> Result<Value, ModelError> {
                     Value::Int(max_active_agents(agent_ids.len())),
                 ),
                 ("startup_order", list_str(agent_ids)),
-                (
-                    "dangerous_auto_approve",
-                    bool_field(&team_meta, "dangerous_auto_approve", false),
-                ),
                 ("fast", bool_field(&team_meta, "fast", false)),
                 (
                     "tick_interval_sec",
@@ -421,7 +417,12 @@ fn compile_role_agent_with_mode(
             ]),
         ),
         ("tools", list_str(tools)),
-        ("permission_mode", Value::Str("restricted".to_string())),
+        // 0.5.66 bypass 单源:compiler 透传角色 md 的 `dangerously_skip_permissions`
+        // (必填 bool,spec 校验保证存在)。取代旧"恒发 permission_mode: restricted"。
+        (
+            "dangerously_skip_permissions",
+            Value::Bool(required_dangerously_skip_permissions(&meta, role_path)?),
+        ),
         (
             "communication_mode",
             Value::Str(communication_mode.as_str().to_string()),
@@ -549,6 +550,25 @@ fn required_string(meta: &Value, path: &Path, key: &str) -> Result<String, Model
     })
 }
 
+/// 0.5.66 bypass 单源:角色 md 的 `dangerously_skip_permissions` 必填 bool。
+/// 缺 = 编译失败(消息含硬串);非 bool = 同 fail-loud。
+fn required_dangerously_skip_permissions(
+    meta: &Value,
+    path: &Path,
+) -> Result<bool, ModelError> {
+    match meta.get("dangerously_skip_permissions") {
+        Some(Value::Bool(value)) => Ok(*value),
+        Some(_) => Err(ModelError::Validation(format!(
+            "{}: front matter field dangerously_skip_permissions must be a boolean. This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed.",
+            path.display()
+        ))),
+        None => Err(ModelError::Validation(format!(
+            "{}: missing front matter field dangerously_skip_permissions. This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed.",
+            path.display()
+        ))),
+    }
+}
+
 fn optional_string_value(meta: &Value, key: &str) -> Value {
     match string_field(meta, key) {
         Some(s) => Value::Str(s),

package/crates/team-agent/src/conpty/backend.rs

@@ -644,6 +644,22 @@ impl Transport for ConPtyBackend {
         Ok(SetEnvOutcome::InternalizedAtSpawn)
     }
 
+    fn set_window_option(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _option: &str,
+        _value: &str,
+    ) -> Result<(), TransportError> {
+        // Design §Transport Boundary: window options are tmux concepts; ConPTY
+        // has no per-window option registry, so this is a typed capability
+        // refusal. Callers must `let _ =` this (A-55 lockdown is best-effort).
+        Err(TransportError::MuxUnavailable {
+            backend: BackendKind::ConPty,
+            detail: "set-window-option is tmux-only".to_string(),
+        })
+    }
+
     fn has_pane(&self, pane: &PaneId) -> Result<Option<bool>, TransportError> {
         let resp = self.dispatch(Op::HasPane, serde_json::json!({"pane_id": pane.as_str()}))?;
         Ok(Some(resp.result["present"].as_bool().unwrap_or(false)))