@team-agent/installer 0.5.64 → 0.5.66

package/crates/team-agent/src/coordinator/health.rs

@@ -1064,6 +1064,23 @@ pub fn render_event_line(event: &Value) -> Option<String> {
             clean_field(event, &["provider"], "-"),
             clean_field(event, &["matched_pattern_snippet", "snippet"], "-")
         )),
+        "result_wake.registered" => Some(format!(
+            "result_wake.registered: task={} watcher={}",
+            clean_field(event, &["task_id"], "-"),
+            clean_field(event, &["watcher_id"], "-")
+        )),
+        "result_wake.notified" => Some(format!(
+            "result_wake.notified: task={} result={} watcher={}",
+            clean_field(event, &["task_id"], "-"),
+            clean_field(event, &["result_id"], "-"),
+            clean_field(event, &["watcher_id"], "-")
+        )),
+        "result_wake.notify_failed" => Some(format!(
+            "result_wake.notify_failed: task={} watcher={} reason={}",
+            clean_field(event, &["task_id"], "-"),
+            clean_field(event, &["watcher_id"], "-"),
+            clean_field(event, &["reason", "error"], "-")
+        )),
         _ => None,
     }
 }

package/crates/team-agent/src/coordinator/steps/abnormal.rs

@@ -578,7 +578,7 @@ fn agent_process_liveness(
     // pane for POSITIVE provider evidence via current-command + worker
     // exit marker. Under the 0.5.39 wrapper, `state.status=running` is
     // administrative spawn accounting, not runtime truth — a provider
-    // may have exited into the shell fallback while state still reads
+    // may have exited into the inert shell tail while state still reads
     // running. The marker probe positively proves that case; when it
     // fires we return Dead here instead of the false Alive further
     // down.
@@ -795,9 +795,29 @@ fn worker_provider_exit_marker_check(
         .capture(&target, crate::transport::CaptureRange::Tail(200))
         .ok()?;
     if cap.text.contains(&marker) {
+        // The wrapper writes its exit code immediately after this marker.  A
+        // truncated capture can leave the marker without a complete token;
+        // keep that case explicit rather than guessing success (or zero).
+        // Scope: this detail only covers exits that execute the wrapper's
+        // marker printf. SIGKILL, direct pane termination, and host power loss
+        // produce no marker; that absence is silent, not `rc=unknown`.
+        let rc = cap
+            .text
+            .split_once(&marker)
+            .and_then(|(_, tail)| {
+                let token = tail.split_whitespace().next()?;
+                let end = tail.find(token)? + token.len();
+                tail.as_bytes()
+                    .get(end)
+                    .is_some_and(u8::is_ascii_whitespace)
+                    .then_some(token)
+            })
+            .and_then(|token| token.parse::<i32>().ok())
+            .map(|value| value.to_string())
+            .unwrap_or_else(|| "unknown".to_string());
         Some(process_check(
             ProcessLiveness::Dead,
-            format!("worker_provider_exited:{pane_id_str}"),
+            format!("worker_provider_exited:{pane_id_str}:rc={rc}"),
         ))
     } else {
         None
@@ -1816,6 +1836,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn worker_exit_marker_detail_includes_exit_code() {
+        let pane_id = crate::transport::PaneId::new("%marker-rc");
+        let marker = crate::tmux_backend::worker_provider_exit_marker("codex");
+        let transport = crate::transport::test_support::OfflineTransport::new()
+            .with_capture_for_pane(pane_id.as_str(), format!("\n{marker} 23\n"));
+        let mut agent = test_abnormal_agent("/tmp/rollout.jsonl", Some(1), None);
+        agent.pane_id = Some(pane_id.as_str().to_string());
+
+        let check = worker_provider_exit_marker_check(&agent, &transport).expect("marker hit");
+
+        assert_eq!(check.state, ProcessLiveness::Dead);
+        assert_eq!(check.detail, "worker_provider_exited:%marker-rc:rc=23");
+    }
+
+    #[test]
+    fn worker_exit_marker_detail_uses_unknown_for_truncated_exit_code() {
+        let pane_id = crate::transport::PaneId::new("%marker-truncated");
+        let marker = crate::tmux_backend::worker_provider_exit_marker("codex");
+        let transport = crate::transport::test_support::OfflineTransport::new()
+            .with_capture_for_pane(pane_id.as_str(), format!("\n{marker} "));
+        let mut agent = test_abnormal_agent("/tmp/rollout.jsonl", Some(1), None);
+        agent.pane_id = Some(pane_id.as_str().to_string());
+
+        let check = worker_provider_exit_marker_check(&agent, &transport).expect("marker hit");
+
+        assert_eq!(check.state, ProcessLiveness::Dead);
+        assert_eq!(
+            check.detail,
+            "worker_provider_exited:%marker-truncated:rc=unknown"
+        );
+    }
+
     #[test]
     fn abnormal_dead_fresh_error_event_reports_actual_dead_booleans() {
         let dir = temp_abnormal_dir("dead-fresh");

package/crates/team-agent/src/db/migration.rs

@@ -98,6 +98,7 @@ pub const MANAGED_TABLE_LAYOUTS: &[(&str, &[&str])] = &[
             "agent_id",
             "message_id",
             "leader_id",
+            "recipient",
             "status",
             "created_at",
             "completed_at",
@@ -129,7 +130,7 @@ const CREATE_TABLE_TEMPLATES: &[(&str, &str)] = &[
     ("delivery_tokens", "create table if not exists __TABLE__ (\n          message_id text primary key,\n          unique_token text not null,\n          injected_at text not null,\n          visible_at text,\n          consumed_at text,\n          failed_at text,\n          failure_reason text\n        )"),
     ("agent_health", "create table if not exists __TABLE__ (\n          owner_team_id text,\n          agent_id text not null,\n          status text not null,\n          last_output_at text,\n          context_usage_pct integer,\n          current_task_id text,\n          updated_at text not null,\n          unique(owner_team_id, agent_id)\n        )"),
     ("peer_allowlist", "create table if not exists __TABLE__ (\n          a text not null,\n          b text not null,\n          created_at text not null,\n          primary key (a, b)\n        )"),
-    ("result_watchers", "create table if not exists __TABLE__ (\n          watcher_id text primary key,\n          owner_team_id text,\n          task_id text,\n          agent_id text,\n          message_id text,\n          leader_id text not null,\n          status text not null,\n          created_at text not null,\n          completed_at text,\n          result_id text,\n          notified_message_id text,\n          error text\n        )"),
+    ("result_watchers", "create table if not exists __TABLE__ (\n          watcher_id text primary key,\n          owner_team_id text,\n          task_id text,\n          agent_id text,\n          message_id text,\n          leader_id text not null,\n          recipient text,\n          status text not null,\n          created_at text not null,\n          completed_at text,\n          result_id text,\n          notified_message_id text,\n          error text\n        )"),
     ("leader_notification_log", "create table if not exists __TABLE__ (\n          result_id text not null,\n          owner_team_id text not null default '',\n          owner_epoch integer not null default 0,\n          leader_session_uuid text,\n          notified_message_id text not null,\n          notified_at text not null,\n          leader_pane_id_at_notify text,\n          envelope_content_hash text,\n          primary key (result_id, owner_team_id, owner_epoch)\n        )"),
 ];
 

package/crates/team-agent/src/db/schema.rs

@@ -13,7 +13,7 @@ use rusqlite::Connection;
 use crate::db::DbError;
 
 /// `schema.py:90`。
-pub const SCHEMA_VERSION: i64 = 4;
+pub const SCHEMA_VERSION: i64 = 5;
 
 /// 8 张表的 DDL(逐字照搬 `schema.py:initialize_schema` 的内联建表;含 `if not exists`)。
 /// 顺序与 Python 一致(leader_notification_log 在 ensure 块后创建)。
@@ -23,7 +23,7 @@ const CREATE_SCHEDULED_EVENTS: &str = "create table if not exists scheduled_even
 const CREATE_DELIVERY_TOKENS: &str = "create table if not exists delivery_tokens (\n              message_id text primary key,\n              unique_token text not null,\n              injected_at text not null,\n              visible_at text,\n              consumed_at text,\n              failed_at text,\n              failure_reason text\n            )";
 const CREATE_AGENT_HEALTH: &str = "create table if not exists agent_health (\n              owner_team_id text,\n              agent_id text not null,\n              status text not null,\n              last_output_at text,\n              context_usage_pct integer,\n              current_task_id text,\n              updated_at text not null,\n              unique(owner_team_id, agent_id)\n            )";
 const CREATE_PEER_ALLOWLIST: &str = "create table if not exists peer_allowlist (\n              a text not null,\n              b text not null,\n              created_at text not null,\n              primary key (a, b)\n            )";
-const CREATE_RESULT_WATCHERS: &str = "create table if not exists result_watchers (\n              watcher_id text primary key,\n              owner_team_id text,\n              task_id text,\n              agent_id text,\n              message_id text,\n              leader_id text not null,\n              status text not null,\n              created_at text not null,\n              completed_at text,\n              result_id text,\n              notified_message_id text,\n              error text\n            )";
+const CREATE_RESULT_WATCHERS: &str = "create table if not exists result_watchers (\n              watcher_id text primary key,\n              owner_team_id text,\n              task_id text,\n              agent_id text,\n              message_id text,\n              leader_id text not null,\n              recipient text,\n              status text not null,\n              created_at text not null,\n              completed_at text,\n              result_id text,\n              notified_message_id text,\n              error text\n            )";
 const CREATE_LEADER_NOTIFICATION_LOG: &str = "create table if not exists leader_notification_log (\n              result_id text not null,\n              owner_team_id text not null default '',\n              owner_epoch integer not null default 0,\n              leader_session_uuid text,\n              notified_message_id text not null,\n              notified_at text not null,\n              leader_pane_id_at_notify text,\n              envelope_content_hash text,\n              primary key (result_id, owner_team_id, owner_epoch)\n            )";
 const CREATE_AGENT_HEALTH_NEW: &str = "create table agent_health_new (\n              owner_team_id text,\n              agent_id text not null,\n              status text not null,\n              last_output_at text,\n              context_usage_pct integer,\n              current_task_id text,\n              updated_at text not null,\n              unique(owner_team_id, agent_id)\n            )";
 
@@ -104,6 +104,7 @@ const RESULT_WATCHER_COLUMNS: &[&str] = &[
     "agent_id",
     "message_id",
     "leader_id",
+    "recipient",
     "status",
     "created_at",
     "completed_at",
@@ -297,10 +298,16 @@ pub fn initialize_schema(
         &tx,
         "result_watchers",
         RESULT_WATCHER_COLUMNS,
-        &[(
-            "owner_team_id",
-            "alter table result_watchers add column owner_team_id text",
-        )],
+        &[
+            (
+                "owner_team_id",
+                "alter table result_watchers add column owner_team_id text",
+            ),
+            (
+                "recipient",
+                "alter table result_watchers add column recipient text",
+            ),
+        ],
     )?;
     tx.execute(CREATE_LEADER_NOTIFICATION_LOG, [])?;
     ensure_table_columns(
@@ -360,13 +367,13 @@ mod tests {
     }
 
     #[test]
-    fn user_version_is_four() {
+    fn user_version_is_five() {
         let conn = fresh();
         let v: i64 = conn
             .query_row("pragma user_version", [], |r| r.get(0))
             .unwrap();
         assert_eq!(v, SCHEMA_VERSION);
-        assert_eq!(v, 4);
+        assert_eq!(v, 5);
     }
 
     #[test]
@@ -513,6 +520,7 @@ mod tests {
                     ("agent_id", "TEXT", 0, None, 0),
                     ("message_id", "TEXT", 0, None, 0),
                     ("leader_id", "TEXT", 1, None, 0),
+                    ("recipient", "TEXT", 0, None, 0),
                     ("status", "TEXT", 1, None, 0),
                     ("created_at", "TEXT", 1, None, 0),
                     ("completed_at", "TEXT", 0, None, 0),

package/crates/team-agent/src/leader/lease.rs

@@ -505,7 +505,6 @@ pub fn claim_leader(
     team: Option<&str>,
     confirm: bool,
 ) -> Result<LeaseResult, LeaderError> {
-    let _ = confirm;
     let caller = std::env::var("TMUX_PANE")
         .ok()
         .filter(|pane| !pane.is_empty())
@@ -598,7 +597,7 @@ pub fn claim_leader(
         Some(team_id.as_str()),
         &team_id,
         &PaneId::new(caller),
-        true,
+        confirm,
         &event_log,
         &liveness,
         caller_target.as_ref(),

package/crates/team-agent/src/leader/start.rs

@@ -1059,6 +1059,16 @@ fn execute_managed_leader_plan_attempt(
         workspace,
         session_existed_before,
     )?;
+    // A-55 (window rename race): tmux defaults `allow-rename` + `automatic-rename`
+    // ON, so the pane's shell wrapper can print an OSC title-set escape during
+    // init (zshrc/starship/PROMPT_COMMAND) and rename the window away from WINDOW
+    // between spawn-poll and attach — making `attach-session -t SESSION:WINDOW`
+    // fail with "can't find window: WINDOW". Lock both off right after spawn,
+    // before run_leader_argv. Best-effort: a failure must NOT abort the launcher
+    // (old tmux may lack the option), but it is audited below.
+    let (rename_result, rename_stderr) =
+        lock_down_window_rename(&transport, session, &spawned.window);
+    write_window_rename_lockdown_event(workspace, &rename_result, &rename_stderr);
     if let Err(error) = persist_managed_leader_binding(plan, workspace, &spawned) {
         cleanup_managed_leader_resources(
             &transport,
@@ -1269,12 +1279,12 @@ fn ensure_managed_provider_live_after_attach(
 /// 0.4.x (CR C-3 P0): leader provider health reconciliation. The default
 /// `liveness()` check only proves the pane is ADDRESSABLE via tmux — it
 /// returns `Live` even when the provider has exited and the wrapper shell
-/// fell back to an interactive shell. This function distinguishes
+/// remains at its inert tail. This function distinguishes
 /// `provider_alive` from `provider_exited` by:
 ///   1. Reading `pane_current_command` (tmux `#{pane_current_command}`).
 ///   2. If the current command matches the expected provider binary (or
 ///      one of its known aliases), report `Alive`.
-///   3. If the current command is an interactive shell AND the pane
+///   3. If the current command is a shell tail process AND the pane
 ///      content contains the exit marker `[team-agent] <provider> exited`
 ///      (emitted by `leader_shell_wrapper_command`), report
 ///      `ProviderExited`.
@@ -1282,7 +1292,7 @@ fn ensure_managed_provider_live_after_attach(
 ///      conservative default — avoid false-positive exit alarms.
 ///
 /// Note: when the leader shell wrapper is used (CR C-2), a provider exit
-/// leaves the pane as `<SHELL:-/bin/zsh>` with the exit marker in
+/// leaves the pane as an inert `/bin/sh -c` tail with the exit marker in
 /// scrollback. Pre-wrapper code that hit `exec claude` would have left the
 /// pane as `[exited]` and `liveness()` would have returned `Dead`. The new
 /// failure mode requires this richer health check to surface
@@ -1340,16 +1350,16 @@ pub enum LeaderProviderHealth {
     Unreachable,
 }
 
-/// 0.4.x (CR R6 + R3): single-source interactive-shell detection.
+/// 0.4.x (CR R6 + R3): single-source shell-tail detection.
 /// Used by:
-///   - `leader_provider_health` to decide "pane fell back to shell"
-///   - shutdown logic to recognise a leader pane in fallback-shell mode
+///   - `leader_provider_health` to decide "pane is at the shell tail"
+///   - shutdown logic to recognise a leader pane in shell-tail mode
 ///     as still owned by the leader (not stray).
 ///
 /// Matches by basename (case-insensitive) — `pane_current_command` returns
 /// the basename of the running binary. Conservative whitelist of POSIX +
-/// common interactive shells; missing entries here are false negatives
-/// (shell looks like provider absent → health says Alive) which is the
+/// common shell processes; missing entries here are false negatives
+/// (shell tail looks like provider absent → health says Alive) which is the
 /// safe default per the CR R6 conservative-Alive rule.
 fn is_interactive_shell_basename(name: &str) -> bool {
     let trimmed = name.trim().to_ascii_lowercase();
@@ -2246,6 +2256,44 @@ fn write_leader_startup_prompt_event(workspace: &Path, event: &str, fields: serd
     let _ = crate::event_log::EventLog::new(workspace).write(event, fields);
 }
 
+/// A-55 (window rename race): lock the freshly-spawned leader window against
+/// rename — `allow-rename off` (refuse pane-internal OSC title-set renames)
+/// AND `automatic-rename off` (refuse tmux's own command-driven rename). Both
+/// must be set; tmux treats them as independent. Best-effort: a failure must
+/// NOT abort the launcher (old tmux may lack the option) — return the outcome
+/// for audit instead of propagating an error. Returns (result, tmux_stderr).
+fn lock_down_window_rename(
+    transport: &dyn Transport,
+    session: &SessionName,
+    window: &WindowName,
+) -> (String, String) {
+    let allow_rename = transport.set_window_option(session, window, "allow-rename", "off");
+    let automatic_rename = transport.set_window_option(session, window, "automatic-rename", "off");
+    let (result, stderr) = match (&allow_rename, &automatic_rename) {
+        (Ok(()), Ok(())) => ("ok".to_string(), String::new()),
+        (Ok(()), Err(error)) => ("failed".to_string(), error.to_string()),
+        (Err(error), Ok(())) => ("failed".to_string(), error.to_string()),
+        (Err(a), Err(b)) => (
+            "failed".to_string(),
+            format!("allow-rename: {a}; automatic-rename: {b}"),
+        ),
+    };
+    (result, stderr)
+}
+
+/// A-55: audit the rename-lockdown outcome to the event log. Failure does not
+/// abort the launcher; record ok/failed + tmux stderr for regression triage.
+fn write_window_rename_lockdown_event(workspace: &Path, result: &str, stderr: &str) {
+    write_leader_startup_prompt_event(
+        workspace,
+        "leader.launcher.window_rename_lockdown",
+        serde_json::json!({
+            "result": result,
+            "tmux_stderr": stderr,
+        }),
+    );
+}
+
 fn ensure_tmux_installed() -> Result<(), LeaderError> {
     match Command::new("tmux").arg("-V").output() {
         Ok(output) if output.status.success() => Ok(()),
@@ -2350,8 +2398,8 @@ mod tests {
     use super::{
         ensure_managed_provider_live_after_attach, execute_leader_plan_after_ambient_authority,
         format_launcher_failure, handle_exec_provider_startup_prompts,
-        is_interactive_shell_basename, push_bounded_stderr, shlex_quote,
-        VerifiedAmbientPaneAuthority, LEADER_STDERR_LIMIT,
+        is_interactive_shell_basename, lock_down_window_rename, push_bounded_stderr, shlex_quote,
+        write_window_rename_lockdown_event, VerifiedAmbientPaneAuthority, LEADER_STDERR_LIMIT,
     };
 
     struct ScriptedTransport {
@@ -2359,6 +2407,8 @@ mod tests {
         sent: Mutex<Vec<(Target, Vec<Key>)>>,
         liveness: PaneLiveness,
         targets: Vec<PaneInfo>,
+        window_options: Mutex<Vec<(String, String)>>,
+        window_option_error: Mutex<Option<String>>,
     }
 
     impl ScriptedTransport {
@@ -2368,6 +2418,8 @@ mod tests {
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
                 targets: Vec::new(),
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(None),
             }
         }
 
@@ -2377,6 +2429,8 @@ mod tests {
                 sent: Mutex::new(Vec::new()),
                 liveness,
                 targets: Vec::new(),
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(None),
             }
         }
 
@@ -2386,6 +2440,21 @@ mod tests {
                 sent: Mutex::new(Vec::new()),
                 liveness,
                 targets,
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(None),
+            }
+        }
+
+        /// A-55: a ScriptedTransport whose `set_window_option` always fails with
+        /// the given tmux stderr — proves the lockdown never aborts the launcher.
+        fn with_window_option_error(error: &str) -> Self {
+            Self {
+                screens: Mutex::new(Vec::new()),
+                sent: Mutex::new(Vec::new()),
+                liveness: PaneLiveness::Unknown,
+                targets: Vec::new(),
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(Some(error.to_string())),
             }
         }
 
@@ -2395,6 +2464,14 @@ mod tests {
                 Err(poisoned) => poisoned.into_inner().clone(),
             }
         }
+
+        /// All `set-window-option option value` pairs, in call order.
+        fn window_options(&self) -> Vec<(String, String)> {
+            match self.window_options.lock() {
+                Ok(guard) => guard.clone(),
+                Err(poisoned) => poisoned.into_inner().clone(),
+            }
+        }
     }
 
     impl Transport for ScriptedTransport {
@@ -2511,6 +2588,34 @@ mod tests {
             Ok(SetEnvOutcome::Applied)
         }
 
+        fn set_window_option(
+            &self,
+            _session: &SessionName,
+            _window: &WindowName,
+            option: &str,
+            value: &str,
+        ) -> Result<(), TransportError> {
+            if let Some(stderr) = self
+                .window_option_error
+                .lock()
+                .ok()
+                .and_then(|guard| guard.clone())
+            {
+                return Err(TransportError::Subprocess {
+                    argv: vec!["tmux".to_string(), "set-window-option".to_string()],
+                    code: Some(1),
+                    stderr,
+                });
+            }
+            match self.window_options.lock() {
+                Ok(mut guard) => guard.push((option.to_string(), value.to_string())),
+                Err(poisoned) => poisoned
+                    .into_inner()
+                    .push((option.to_string(), value.to_string())),
+            }
+            Ok(())
+        }
+
         fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
             Ok(())
         }
@@ -2988,4 +3093,64 @@ mod tests {
         assert_eq!(captured.len(), LEADER_STDERR_LIMIT);
         assert!(captured.ends_with(b"XYZ"));
     }
+
+    #[test]
+    fn managed_leader_launch_disables_window_rename() {
+        let transport = ScriptedTransport::with_liveness(PaneLiveness::Live);
+        let session = SessionName::new("team-agent-leader-claude_code-demo");
+        let window = WindowName::new("claude_code");
+
+        let (result, stderr) = lock_down_window_rename(&transport, &session, &window);
+
+        assert_eq!(result, "ok", "both set-window-option calls must succeed");
+        assert!(stderr.is_empty());
+        let options = transport.window_options();
+        assert_eq!(
+            options,
+            vec![
+                ("allow-rename".to_string(), "off".to_string()),
+                ("automatic-rename".to_string(), "off".to_string()),
+            ],
+            "both rename lockdown options must be issued, in order"
+        );
+    }
+
+    #[test]
+    fn launcher_survives_set_window_option_failure() {
+        let workspace =
+            std::env::temp_dir().join(format!("ta-rename-lockdown-fail-{}", std::process::id()));
+        std::fs::create_dir_all(&workspace).unwrap();
+        let transport = ScriptedTransport::with_window_option_error(
+            "set-window-option: unknown option: allow-rename",
+        );
+        let session = SessionName::new("team-agent-leader-claude_code-demo");
+        let window = WindowName::new("claude_code");
+
+        // Lockdown must NOT abort the launcher: it returns a failed outcome
+        // (recorded for audit) instead of propagating an error.
+        let (result, stderr) = lock_down_window_rename(&transport, &session, &window);
+
+        assert_eq!(result, "failed", "a set-window-option failure is audited, not fatal");
+        assert!(
+            stderr.contains("unknown option"),
+            "tmux stderr must surface in the audit payload: {stderr}"
+        );
+
+        // The audit event lands in the workspace event log with result=failed.
+        write_window_rename_lockdown_event(&workspace, &result, &stderr);
+        let events = crate::event_log::EventLog::new(&workspace).tail(0).unwrap();
+        let lockdown = events
+            .iter()
+            .find(|event| {
+                event["event"] == "leader.launcher.window_rename_lockdown"
+            })
+            .expect("rename_lockdown event must be written even on failure");
+        assert_eq!(lockdown["result"], "failed");
+        assert!(
+            lockdown["tmux_stderr"].as_str().unwrap_or_default().contains("unknown option"),
+            "event must carry tmux stderr for regression triage: {lockdown}"
+        );
+
+        std::fs::remove_dir_all(&workspace).ok();
+    }
 }

package/crates/team-agent/src/leader/tests/team_in_team_state_scope_red.rs

@@ -1054,7 +1054,7 @@ fn team_dir(root: &Path, name: &str, agents: &[(&str, &str)]) -> PathBuf {
 
 fn role_doc(name: &str, role: &str) -> String {
     format!(
-        "---\nname: {name}\nrole: {role}\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{role}.\n"
+        "---\nname: {name}\nrole: {role}\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{role}.\n"
     )
 }
 

package/crates/team-agent/src/lifecycle/launch/add_agent.rs

@@ -337,7 +337,6 @@ pub(super) fn add_agent_with_transport_at_paths(
         )));
     }
     inject_agent_into_spec(&mut spec, compiled.agent, &compiled.id)?;
-    let safety = effective_runtime_config(&spec)?;
     // E5 spec 迁移:重编译的 spec 原子写到 .team/runtime/<team_key>/(不落用户目录 team_dir)。
     let spec_path = crate::model::paths::runtime_spec_path(run_workspace, &canonical_team_key);
     // E42 (0.3.24 P0): capture pre-write bytes for atomic rollback. If anything
@@ -362,7 +361,6 @@ pub(super) fn add_agent_with_transport_at_paths(
         agent_id,
         &meta,
         role_file_path,
-        &safety,
     ) {
         rollback_add_agent_atomic(
             run_workspace,

package/crates/team-agent/src/lifecycle/launch/add_agent_state.rs

@@ -116,7 +116,6 @@ pub(super) fn upsert_agent_state_from_role(
     agent_id: &AgentId,
     meta: &Value,
     dynamic_role_file: &Path,
-    safety: &DangerousApproval,
 ) -> Result<(), LifecycleError> {
     let mut state =
         crate::state::projection::select_runtime_state(workspace, Some(canonical_team_key))
@@ -195,7 +194,13 @@ pub(super) fn upsert_agent_state_from_role(
         }
     }
     if let Some(obj) = entry.as_object_mut() {
-        persist_effective_approval_policy(obj, safety);
+        // 0.5.66 bypass 单源:policy 从 role 文档字段派生,不再用全队 `DangerousApproval`。
+        let meta_provider = meta
+            .get("provider")
+            .and_then(Value::as_str)
+            .and_then(crate::provider::wire::parse_provider)
+            .unwrap_or(Provider::Codex);
+        persist_effective_approval_policy_from_yaml_agent(obj, meta, meta_provider);
     }
     agent_map.insert(agent_id.as_str().to_string(), entry);
     crate::lifecycle::restart::remove::clear_agent_retirement_in_state(&mut state, agent_id);