@team-agent/installer 0.5.64 → 0.5.66

package/crates/team-agent/src/lifecycle/launch/agent_state.rs

@@ -24,7 +24,6 @@ pub(super) fn running_agent_state(
     team_id: &str,
     pane_id: Option<&str>,
     pane_pid: Option<u32>,
-    safety: &DangerousApproval,
     started_agent: Option<&StartedAgent>,
     profile_dir: Option<&Path>,
 ) -> Result<serde_json::Value, LifecycleError> {
@@ -84,7 +83,16 @@ pub(super) fn running_agent_state(
         permissions_json(agent, id, provider)
             .map_err(|e| LifecycleError::Compile(e.to_string()))?,
     );
-    persist_effective_approval_policy(&mut state, safety);
+    // 0.5.66 bypass 单源:policy 从 agent 字段派生,不再用全队 `DangerousApproval`。
+    persist_effective_approval_policy_from_yaml_agent(&mut state, agent, provider);
+    // 0.5.66 bypass 单源 §2.6:fresh spawn 记录运行面 bypass 值(供 restart drift 挡板)。
+    state.insert(
+        "as_launched_dangerously_skip_permissions".to_string(),
+        serde_json::json!(matches!(
+            agent.get("dangerously_skip_permissions"),
+            Some(Value::Bool(true))
+        )),
+    );
     state.insert("session_id".to_string(), serde_json::Value::Null);
     state.insert("rollout_path".to_string(), serde_json::Value::Null);
     state.insert("captured_at".to_string(), serde_json::Value::Null);
@@ -162,3 +170,130 @@ pub(super) fn dangerous_approval_source_str(source: DangerousApprovalSource) ->
         DangerousApprovalSource::Disabled => "disabled",
     }
 }
+
+/// 0.5.66 bypass 单源:从 agent 行 + provider 构造 approval policy JSON
+/// (restart/fork/add 落盘用;取代全队 `DangerousApproval` 派生)。
+pub(crate) fn effective_approval_policy_from_agent(
+    agent: &serde_json::Value,
+    provider: Provider,
+) -> serde_json::Value {
+    let enabled = agent
+        .get("dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false);
+    if !enabled {
+        return serde_json::json!({
+            "enabled": false,
+            "source": "disabled",
+            "inherited": false,
+            "explicit_yes_confirmed": false,
+            "provider": null,
+            "flag": null,
+            "worker_capability_above_leader": false,
+        });
+    }
+    let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+    serde_json::json!({
+        "enabled": true,
+        "source": "runtime_config",
+        "inherited": false,
+        "explicit_yes_confirmed": true,
+        "provider": provider_wire_str(provider),
+        "flag": flag,
+        "worker_capability_above_leader": false,
+    })
+}
+
+fn provider_wire_str(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Fake => "fake",
+    }
+}
+
+/// 0.5.66 bypass 单源:从 agent 行(state Map)+ provider 落盘 approval policy。
+/// 目标与来源是同一 agent 行。
+pub(crate) fn persist_effective_approval_policy_from_agent(
+    agent_state: &mut serde_json::Map<String, serde_json::Value>,
+    provider: Provider,
+) {
+    let agent = serde_json::Value::Object(agent_state.clone());
+    agent_state.insert(
+        "effective_approval_policy".to_string(),
+        effective_approval_policy_from_agent(&agent, provider),
+    );
+}
+
+/// 0.5.66 bypass 单源:yaml spec agent 版(launch/state_projection 用)。
+pub(crate) fn persist_effective_approval_policy_from_yaml_agent(
+    agent_state: &mut serde_json::Map<String, serde_json::Value>,
+    agent: &Value,
+    provider: Provider,
+) {
+    let enabled = matches!(agent.get("dangerously_skip_permissions"), Some(Value::Bool(true)));
+    let policy = if !enabled {
+        serde_json::json!({
+            "enabled": false,
+            "source": "disabled",
+            "inherited": false,
+            "explicit_yes_confirmed": false,
+            "provider": null,
+            "flag": null,
+            "worker_capability_above_leader": false,
+        })
+    } else {
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+        serde_json::json!({
+            "enabled": true,
+            "source": "runtime_config",
+            "inherited": false,
+            "explicit_yes_confirmed": true,
+            "provider": provider_wire_str(provider),
+            "flag": flag,
+            "worker_capability_above_leader": false,
+        })
+    };
+    agent_state.insert("effective_approval_policy".to_string(), policy);
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    fn yaml_agent(bypass: bool) -> Value {
+        crate::model::yaml::loads(&format!(
+            "id: a\nrole: r\nprovider: codex\ndangerously_skip_permissions: {bypass}\n"
+        ))
+        .unwrap()
+    }
+
+    // 0.5.66 bypass 单源 §4.1:true 角色 → policy 落盘为 enabled=true / runtime_config,
+    // 且 running_agent_state 记录 as_launched_dangerously_skip_permissions=true(审计留痕前提)。
+    #[test]
+    fn test_audit_log_written_on_true_spawn() {
+        let mut state = serde_json::Map::new();
+        persist_effective_approval_policy_from_yaml_agent(&mut state, &yaml_agent(true), Provider::Codex);
+        let policy = state.get("effective_approval_policy").unwrap();
+        assert_eq!(policy["enabled"], serde_json::json!(true));
+        assert_eq!(policy["source"], serde_json::json!("runtime_config"));
+        assert_eq!(
+            policy["flag"],
+            serde_json::json!("--dangerously-bypass-approvals-and-sandbox")
+        );
+        // 运行面记录(as-launched)供 restart drift 挡板。
+        let mut run_state = serde_json::Map::new();
+        run_state.insert(
+            "as_launched_dangerously_skip_permissions".to_string(),
+            serde_json::json!(matches!(
+                yaml_agent(true).get("dangerously_skip_permissions"),
+                Some(Value::Bool(true))
+            )),
+        );
+        assert_eq!(run_state["as_launched_dangerously_skip_permissions"], serde_json::json!(true));
+    }
+}

package/crates/team-agent/src/lifecycle/launch/fork_agent.rs

@@ -121,7 +121,7 @@ pub fn fork_agent_with_transport(
         )));
     }
     let model = new_agent.get("model").and_then(Value::as_str);
-    let safety = effective_runtime_config(&new_spec)?;
+    let safety = effective_runtime_config_for_worker_spawn(new_agent, provider)?;
     let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_yaml(
         new_agent,
         Some(as_agent_id.as_str()),
@@ -132,7 +132,6 @@ pub fn fork_agent_with_transport(
     let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
         &command_agent,
         provider,
-        &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     let mcp_config = adapter.mcp_config(auth_mode).map_err(|e| {

package/crates/team-agent/src/lifecycle/launch/fork_finalize.rs

@@ -232,6 +232,11 @@ pub(super) fn finalize_fork_state(
         .and_then(serde_json::Value::as_object_mut)
     {
         persist_effective_approval_policy(agent, input.safety);
+        // 0.5.66 bypass 单源 §2.6:fork fresh spawn 记录运行面 bypass 值。
+        agent.insert(
+            "as_launched_dangerously_skip_permissions".to_string(),
+            serde_json::json!(input.safety.enabled),
+        );
     }
     maybe_fail_fork_after_spawn("save_runtime_state")?;
     crate::state::repository::StateRepository::new(input.workspace)

package/crates/team-agent/src/lifecycle/launch/spawn.rs

@@ -27,7 +27,6 @@ pub(super) fn spawn_agents(
     spec_path: &Path,
     spec: &Value,
     session_name: &SessionName,
-    safety: &DangerousApproval,
     transport: &dyn Transport,
 ) -> Result<Vec<StartedAgent>, LifecycleError> {
     // E5 解耦:team_dir(角色定义 + profiles 所在)≠ spec_path.parent()(spec 已迁出到 .team/runtime)。
@@ -100,9 +99,10 @@ pub(super) fn spawn_agents(
         let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
             &command_agent,
             provider,
-            safety,
         )?;
         let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
+        // 0.5.66 bypass 单源:per-agent safety 只服务 env 注入与审计,不参与 argv 决策。
+        let safety = effective_runtime_config_for_worker_spawn(agent, provider)?;
         let mcp_team_id = runtime_team_key_for_spec(spec_path, spec, session_name);
         let mcp_config = adapter
             .mcp_config(auth_mode)
@@ -283,6 +283,25 @@ pub(super) fn spawn_agents(
                     "spawn_epoch": spawn_epoch,
                 })),
             );
+            // 0.5.66 bypass 单源 §2.7:最终 argv 含 bypass flag → 审计留痕。
+            if matches!(
+                agent.get("dangerously_skip_permissions"),
+                Some(Value::Bool(true))
+            ) {
+                let _ = event_log.write(
+                    "worker.spawn_dangerously_skip_permissions",
+                    serde_json::json!({
+                        "agent_id": agent_id_raw,
+                        "role": agent
+                            .get("role")
+                            .and_then(Value::as_str)
+                            .unwrap_or_default(),
+                        "provider": provider,
+                        "trigger": "launch",
+                        "spec_source_path": agent_id_spec_source_path(workspace, agent_id_raw),
+                    }),
+                );
+            }
         }
         // 0.3.28 Step 4b: replaced the `adaptive_layout_plan` 3-pane tiling
         // with Python-parity 1-window-per-agent placement. Window name =
@@ -381,3 +400,21 @@ pub(super) fn spawn_agents(
     }
     Ok(started)
 }
+
+/// 0.5.66 bypass 单源 §2.7:审计事件里角色 md 的 spec 来源路径(尽力解析,失败空串)。
+pub(crate) fn agent_id_spec_source_path(workspace: &Path, agent_id: &str) -> String {
+    let team_dir = crate::state::persist::load_runtime_state(workspace)
+        .ok()
+        .and_then(|state| {
+            state
+                .get("team_dir")
+                .and_then(serde_json::Value::as_str)
+                .filter(|s| !s.is_empty())
+                .map(PathBuf::from)
+        });
+    team_dir
+        .map(|dir| dir.join("agents").join(format!("{agent_id}.md")))
+        .unwrap_or_else(|| workspace.join(".team/current/agents").join(format!("{agent_id}.md")))
+        .display()
+        .to_string()
+}

package/crates/team-agent/src/lifecycle/launch/spec_state.rs

@@ -33,7 +33,6 @@ use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
 
 use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
 
-use super::approval::detect_dangerous_approval;
 use super::identity::spec_display_backend;
 use super::leader_context::{
     attributed_provider_for_pane_across_tmux_sockets, caller_provider_for_seed_with_lookup,
@@ -387,64 +386,86 @@ pub(super) fn spec_default_assignee(spec: &Value) -> Option<AgentId> {
         .or_else(|| spec_agents(spec).into_iter().next())
 }
 
-pub(crate) fn effective_runtime_config(spec: &Value) -> Result<DangerousApproval, LifecycleError> {
-    let enabled = spec
-        .get("runtime")
-        .and_then(|v| v.get("dangerous_auto_approve"))
-        .is_some_and(Value::is_truthy);
-    if enabled {
-        let leader = detect_dangerous_approval()?;
-        Ok(DangerousApproval {
-            enabled: true,
-            source: DangerousApprovalSource::RuntimeConfig,
+/// 0.5.66 bypass 单源:从**单个 agent**(yaml spec)的 `dangerously_skip_permissions` 构造
+/// `DangerousApproval`(取代旧"runtime config + leader argv"全队一份)。
+/// true → source=RuntimeConfig(角色声明即用户明确同意,coordinator 的
+/// `explicit_yes_confirmed` 自动放行);false → Disabled。
+pub(crate) fn effective_runtime_config_for_worker_spawn(
+    agent: &Value,
+    provider: Provider,
+) -> Result<DangerousApproval, LifecycleError> {
+    let enabled = matches!(
+        agent.get("dangerously_skip_permissions"),
+        Some(Value::Bool(true))
+    );
+    if !enabled {
+        return Ok(DangerousApproval {
+            enabled: false,
+            source: DangerousApprovalSource::Disabled,
             inherited: false,
             provider: None,
             flag: None,
-            worker_capability_above_leader: !leader.enabled,
-            ancestry_binary_name: leader.ancestry_binary_name,
+            worker_capability_above_leader: false,
+            ancestry_binary_name: None,
             unexpected_binary: false,
-        })
-    } else {
-        Ok(detect_dangerous_approval()?)
+        });
     }
+    let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+    Ok(DangerousApproval {
+        enabled: true,
+        source: DangerousApprovalSource::RuntimeConfig,
+        inherited: false,
+        provider: Some(provider_display_str(provider).to_string()),
+        flag: flag.map(str::to_string),
+        worker_capability_above_leader: false,
+        ancestry_binary_name: None,
+        unexpected_binary: false,
+    })
 }
 
-pub(crate) fn effective_runtime_config_for_worker_spawn(
+/// 0.5.66 bypass 单源:restart/state 路径的 serde_json 版(agent 来自 state JSON)。
+pub(crate) fn effective_runtime_config_for_worker_spawn_json(
+    agent: &serde_json::Value,
+    provider: Provider,
 ) -> Result<DangerousApproval, LifecycleError> {
-    detect_dangerous_approval()
+    let enabled = agent
+        .get("dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false);
+    if !enabled {
+        return Ok(DangerousApproval {
+            enabled: false,
+            source: DangerousApprovalSource::Disabled,
+            inherited: false,
+            provider: None,
+            flag: None,
+            worker_capability_above_leader: false,
+            ancestry_binary_name: None,
+            unexpected_binary: false,
+        });
+    }
+    let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+    Ok(DangerousApproval {
+        enabled: true,
+        source: DangerousApprovalSource::RuntimeConfig,
+        inherited: false,
+        provider: Some(provider_display_str(provider).to_string()),
+        flag: flag.map(str::to_string),
+        worker_capability_above_leader: false,
+        ancestry_binary_name: None,
+        unexpected_binary: false,
+    })
 }
 
-pub(super) fn write_launch_permission_audit(
-    workspace: &Path,
-    safety: &DangerousApproval,
-) -> Result<(), LifecycleError> {
-    crate::event_log::EventLog::new(workspace)
-        .write(
-            "launch.permissions_resolved",
-            serde_json::json!({
-                "dangerous_auto_approve": safety.enabled,
-                "dangerous_auto_approve_source": safety.source,
-                "dangerous_auto_approve_inherited": safety.inherited,
-                "dangerous_auto_approve_provider": safety.provider,
-                "dangerous_auto_approve_flag": safety.flag,
-                "worker_capability_above_leader": safety.worker_capability_above_leader,
-                "ancestry_binary_name": safety.ancestry_binary_name,
-            }),
-        )
-        .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
-    if safety.unexpected_binary {
-        crate::event_log::EventLog::new(workspace)
-            .write(
-                "dangerous_flag_in_unexpected_binary",
-                serde_json::json!({
-                    "provider": safety.provider,
-                    "flag": safety.flag,
-                    "ancestry_binary_name": safety.ancestry_binary_name,
-                }),
-            )
-            .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+pub(crate) fn provider_display_str(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Fake => "fake",
     }
-    Ok(())
 }
 
 pub(super) fn team_workspace(team_dir: &Path) -> PathBuf {
@@ -455,3 +476,39 @@ pub(super) fn team_workspace(team_dir: &Path) -> PathBuf {
             .unwrap_or_else(|| team_dir.to_path_buf())
     })
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+    use crate::model::enums::Provider;
+
+    fn yaml_agent(bypass: bool) -> Value {
+        crate::model::yaml::loads(&format!(
+            "id: a\nrole: r\nprovider: codex\ndangerously_skip_permissions: {bypass}\n"
+        ))
+        .unwrap()
+    }
+
+    // 0.5.66 bypass 单源 §4.1:true → enabled + source=runtime_config(角色声明即明确同意)。
+    #[test]
+    fn test_effective_safety_from_true_field() {
+        let safety =
+            effective_runtime_config_for_worker_spawn(&yaml_agent(true), Provider::Codex).unwrap();
+        assert!(safety.enabled);
+        assert_eq!(safety.source, DangerousApprovalSource::RuntimeConfig);
+        assert_eq!(
+            safety.flag.as_deref(),
+            Some("--dangerously-bypass-approvals-and-sandbox")
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:false → Disabled。
+    #[test]
+    fn test_effective_safety_from_false_field() {
+        let safety =
+            effective_runtime_config_for_worker_spawn(&yaml_agent(false), Provider::Codex).unwrap();
+        assert!(!safety.enabled);
+        assert_eq!(safety.source, DangerousApprovalSource::Disabled);
+    }
+}

package/crates/team-agent/src/lifecycle/launch/state_projection.rs

@@ -28,7 +28,6 @@ pub(super) fn persist_spawn_agent_state(
     session_name: &SessionName,
     transport: &dyn Transport,
     started: &[StartedAgent],
-    safety: &DangerousApproval,
 ) -> Result<(), LifecycleError> {
     let state_path = crate::state::persist::runtime_state_path(workspace);
     let mut state = match crate::state::repository::StateRepository::new(workspace)
@@ -134,7 +133,6 @@ pub(super) fn persist_spawn_agent_state(
                 &team_id,
                 Some(agent_id_to_pane_id(started, id)),
                 pane_pid,
-                safety,
                 started_agent,
                 Some(&profile_dir),
             )?,

package/crates/team-agent/src/lifecycle/launch.rs

@@ -70,6 +70,7 @@ pub fn launch_with_transport_in_workspace(
     transport: &dyn Transport,
 ) -> Result<LaunchReport, LifecycleError> {
     let _ = skip_profile_smoke;
+    let _ = auto_approve; // 0.5.66: bypass 单源后无 runtime.dangerous_auto_approve,`--yes` 为 no-op。
     // 0.5.38 (`.team/artifacts/startup-latency-locate.md` §5): launch.phase
     // timer with monotonic `elapsed_ms` for latency triage.
     let phase_timer = crate::lifecycle::restart::RestartPhaseTimer::start();
@@ -82,14 +83,12 @@ pub fn launch_with_transport_in_workspace(
     let text = std::fs::read_to_string(spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
+    // 0.5.66 §3.2 跨 workspace 兼容警示:leader argv 带 bypass flag 但当前团队
+    // 所有角色都未声明 dangerously_skip_permissions=true → 写 warning 事件不阻塞。
+    // TODO(0.6.0): remove(0.6.0 彻底删源头 A 后此警示无意义)。
+    emit_dangerous_flag_no_role_declared_warning(workspace, &spec);
     phase_timer.emit(workspace, "launch.phase", "compile_spec");
     let session_name = spec_session_name(&spec);
-    let safety = effective_runtime_config(&spec)?;
-    if safety.enabled && !safety.inherited && !auto_approve && !dry_run {
-        return Err(LifecycleError::DangerousApprovalRequired(
-            "runtime dangerous_auto_approve is enabled".to_string(),
-        ));
-    }
     if !dry_run && transport_has_session(transport, &session_name) {
         return Err(LifecycleError::SessionConflict(format!(
             "tmux session already exists: {}",
@@ -103,7 +102,6 @@ pub fn launch_with_transport_in_workspace(
             raw: serde_json::json!({"source": "compiled_spec"}),
         })
         .collect::<Vec<_>>();
-    write_launch_permission_audit(workspace, &safety)?;
     let routes = spec_routes(&spec);
     let started = if dry_run {
         Vec::new()
@@ -114,7 +112,6 @@ pub fn launch_with_transport_in_workspace(
             spec_path,
             &spec,
             &session_name,
-            &safety,
             transport,
         )?;
         persist_spawn_agent_state(
@@ -124,7 +121,6 @@ pub fn launch_with_transport_in_workspace(
             &session_name,
             transport,
             &started,
-            &safety,
         )?;
         // 0.5.38: per-worker timing tags (source="launch") so operators can
         // trace which worker's spawn dominates wall time. Zeros for now on
@@ -181,17 +177,55 @@ pub fn launch_with_transport_in_workspace(
         tmux_endpoint: transport.tmux_endpoint(),
         routes,
         permissions,
-        safety,
         leader_receiver_attached: false,
         session_capture_incomplete_agents: Vec::new(),
     })
 }
 
+/// 0.5.66 §3.2 跨 workspace 升级警示(仅警示,不做行为决策)。
+/// leader argv 含 bypass flag、但当前 spec 所有 agent 都未声明
+/// `dangerously_skip_permissions=true` → 写 `dangerously_flag_present_but_no_role_declared`。
+///
+/// TODO(0.6.0): remove(0.6.0 删源头 A 后此警示无意义)。
+fn emit_dangerous_flag_no_role_declared_warning(workspace: &Path, spec: &Value) {
+    let argv: Vec<String> = std::env::args().collect();
+    emit_dangerous_flag_no_role_declared_warning_with_argv(workspace, spec, &argv);
+}
+
+/// 带显式 argv 的可测版。
+fn emit_dangerous_flag_no_role_declared_warning_with_argv(
+    workspace: &Path,
+    spec: &Value,
+    argv: &[String],
+) {
+    if crate::provider::bypass_flags::detect_bypass_flag_in_argv(argv).is_none() {
+        return;
+    }
+    let any_role_declared = spec_agent_values(spec).iter().any(|agent| {
+        matches!(
+            agent.get("dangerously_skip_permissions"),
+            Some(Value::Bool(true))
+        )
+    });
+    if any_role_declared {
+        return;
+    }
+    let _ = crate::event_log::EventLog::new(workspace).write(
+        "dangerously_flag_present_but_no_role_declared",
+        serde_json::json!({
+            "message": "leader process carries a bypass flag but no role in this team declares \
+                       dangerously_skip_permissions=true; bypass no longer inherits to workers \
+                       (0.5.66 single-source). Declare the field per role to opt in.",
+        }),
+    );
+}
+
 mod plan;
 pub(crate) use plan::{handle_report_result, start_plan};
 
 pub mod spawn;
 pub(super) use spawn::*;
+pub(crate) use spawn::agent_id_spec_source_path;
 
 mod layout;
 pub(super) use layout::*;
@@ -221,7 +255,10 @@ pub(crate) use leader_context::{
 
 mod agent_state;
 pub(super) use agent_state::*;
-pub(crate) use agent_state::{effective_approval_policy, persist_effective_approval_policy};
+pub(crate) use agent_state::{
+    effective_approval_policy, persist_effective_approval_policy,
+    persist_effective_approval_policy_from_agent,
+};
 
 mod mcp_config;
 pub(super) use mcp_config::*;
@@ -266,14 +303,6 @@ pub mod readiness;
 pub(crate) use readiness::launched_team_receiver_is_attached;
 pub(super) use readiness::*;
 
-mod approval;
-pub use approval::detect_dangerous_approval;
-use approval::{
-    binary_matches_provider, binary_name, dangerous_leader_flags,
-    detect_dangerous_approval_in_argv, disabled_dangerous_approval, process_ancestry_argv,
-    process_argv_tokens, process_parent_pid,
-};
-
 mod add_agent;
 pub(super) use add_agent::*;
 pub use add_agent::{add_agent, add_agent_force};
@@ -309,14 +338,81 @@ pub(crate) use ownership::{ensure_owner_allowed, ensure_owner_allowed_for_state,
 
 pub mod spec_state;
 pub(crate) use spec_state::{
-    effective_runtime_config, effective_runtime_config_for_worker_spawn,
     override_spec_session_name, override_spec_workspace, spec_agent_id_set, write_spec_atomic,
 };
+pub(crate) use spec_state::{
+    effective_runtime_config_for_worker_spawn, effective_runtime_config_for_worker_spawn_json,
+};
 use spec_state::{
     env_nonempty, has_positive_caller_leader_env, initial_runtime_state,
     override_spec_display_backend, override_spec_runtime_str,
     seed_launched_owner_from_caller_with_provider_lookup, seed_launched_owner_from_env,
     spec_agent_values, spec_agents, spec_default_assignee, spec_routes, spec_session_name,
-    spec_tasks_json, team_workspace, write_launch_permission_audit, yaml_value_to_json,
+    spec_tasks_json, team_workspace, yaml_value_to_json,
 };
 pub use spec_state::worker_session_name_pub;
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    // 0.5.66 §4.1 test_leader_flag_present_but_no_role_true_writes_warning_event:
+    // leader argv 带 bypass flag + 无角色声明 true → 写 warning 事件。
+    #[test]
+    fn test_leader_flag_present_but_no_role_true_writes_warning_event() {
+        let ws = std::env::temp_dir().join(format!(
+            "ta-bypass-warning-test-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&ws);
+        std::fs::create_dir_all(&ws).unwrap();
+        let spec = yaml::loads(
+            "version: 1\nteam: {}\nleader: {}\nagents:\n  - id: a\n    role: r\n    provider: fake\n    dangerously_skip_permissions: false\n",
+        )
+        .unwrap();
+        let argv = vec![
+            "team-agent".to_string(),
+            "--dangerously-skip-permissions".to_string(),
+        ];
+        emit_dangerous_flag_no_role_declared_warning_with_argv(&ws, &spec, &argv);
+        let events = crate::event_log::EventLog::new(&ws).tail(0).unwrap();
+        assert!(
+            events.iter().any(|event| {
+                event.get("event").and_then(serde_json::Value::as_str)
+                    == Some("dangerously_flag_present_but_no_role_declared")
+            }),
+            "leader flag + no role declared must write the warning event; events={events:?}"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    // 0.5.66 §4.1 同测试的反向:有角色声明 true → 不写 warning。
+    #[test]
+    fn test_leader_flag_present_but_role_declared_no_warning() {
+        let ws = std::env::temp_dir().join(format!(
+            "ta-bypass-warning-none-test-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&ws);
+        std::fs::create_dir_all(&ws).unwrap();
+        let spec = yaml::loads(
+            "version: 1\nteam: {}\nleader: {}\nagents:\n  - id: a\n    role: r\n    provider: fake\n    dangerously_skip_permissions: true\n",
+        )
+        .unwrap();
+        let argv = vec![
+            "team-agent".to_string(),
+            "--dangerously-skip-permissions".to_string(),
+        ];
+        emit_dangerous_flag_no_role_declared_warning_with_argv(&ws, &spec, &argv);
+        let events = crate::event_log::EventLog::new(&ws).tail(0).unwrap();
+        assert!(
+            !events.iter().any(|event| {
+                event.get("event").and_then(serde_json::Value::as_str)
+                    == Some("dangerously_flag_present_but_no_role_declared")
+            }),
+            "role declared true must suppress the warning; events={events:?}"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+}