@team-agent/installer 0.5.64 → 0.5.66

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -181,6 +181,31 @@ pub(crate) fn start_agent_at_paths(
         );
     }
     let agent_live = agent_live && (!has_collision || noop_pane.is_some());
+    // 0.5.66 bypass 单源 §2.6 — dangerously_skip_permissions drift 挡板:
+    // Noop 路径不 spawn,若声明面(角色 md / spec)与运行面(as-launched)不一致,
+    // 拒 Noop 报明,防"改了 md 却以为生效、进程仍带旧 bypass 跑着"的暗门。
+    let file_bypass = agent
+        .get("dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool);
+    let launched_bypass = raw_agent
+        .get("as_launched_dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool);
+    if !force && agent_live && check_bypass_drift(file_bypass, launched_bypass) {
+        // 0.5.66 bypass 单源 §2.7:Noop drift 拒也写审计事件。
+        let _ = crate::event_log::EventLog::new(workspace).write(
+            "worker.spawn_dangerously_skip_permissions_drift_denied",
+            serde_json::json!({
+                "agent_id": agent_id.as_str(),
+                "file_value": file_bypass,
+                "launched_value": launched_bypass,
+                "action": "noop_denied_require_remove_add_or_force",
+            }),
+        );
+        return Err(LifecycleError::RequirementUnmet(format!(
+            "dangerously_skip_permissions drift for agent {agent_id}: file={file_bypass:?} but running process launched with {launched_bypass:?}. \
+             Run `remove-agent {agent_id}` then `add-agent {agent_id}` to apply, or `restart --force {agent_id}` to accept fresh spawn."
+        )));
+    }
     if !force && agent_live {
         let old_binding = pane_binding_snapshot(&raw_agent);
         let refreshed_binding = noop_pane.as_ref().map(pane_binding_from_live);
@@ -257,7 +282,10 @@ pub(crate) fn start_agent_at_paths(
     };
     let into_existing_session =
         session_live_or_default(transport, &session_name, session_name_present(&state));
-    let safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn()?;
+    let safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn_json(
+        &agent,
+        provider,
+    )?;
     let layout_placement = if adaptive_layout {
         crate::lifecycle::launch::adaptive_existing_placement_for_agent(
             &state,
@@ -323,6 +351,30 @@ pub(crate) fn start_agent_at_paths(
         &safety,
         start_mode,
     )?;
+    // 0.5.66 bypass 单源 §2.7:启动即带 bypass → 审计留痕。
+    if safety.enabled {
+        let state_agent = state
+            .get("agents")
+            .and_then(|v| v.get(agent_id.as_str()));
+        let _ = crate::event_log::EventLog::new(workspace).write(
+            "worker.spawn_dangerously_skip_permissions",
+            serde_json::json!({
+                "agent_id": agent_id.as_str(),
+                "role": state_agent
+                    .and_then(|a| a.get("role"))
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or_default(),
+                "provider": state_agent
+                    .and_then(|a| a.get("provider"))
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or_default(),
+                "trigger": "start-agent",
+                "spec_source_path": crate::lifecycle::launch::agent_id_spec_source_path(
+                    workspace, agent_id.as_str(),
+                ),
+            }),
+        );
+    }
     // **0.3.24 add-agent socket drift fix**: keep `state.tmux_endpoint` /
     // `state.tmux_socket` synchronized with the transport actually used for the
     // spawn. Without this, add-agent / fork-agent could spawn to a socket that
@@ -1078,6 +1130,12 @@ fn mark_agent_started(
     // lifecycle/topology fields so absence == UNKNOWN until the next
     // coordinator tick or pane fallback produces a post-spawn observation.
     clear_agent_runtime_activity_observation(agent);
+    // 0.5.66 bypass 单源 §2.6:fresh spawn 那一刻记录运行面 bypass 值,
+    // 供下一次 restart 的 Noop drift 挡板比较。
+    agent.insert(
+        "as_launched_dangerously_skip_permissions".to_string(),
+        serde_json::json!(safety.enabled),
+    );
     // S1-CAPTURE-001 (0.4.8, CR M3 provider-agnostic): on a Fresh /
     // FreshAfterMissingRollout start, the prior session's authoritative
     // capture tuple MUST be cleared before persist_command_plan_state
@@ -1609,7 +1667,6 @@ fn write_start_agent_start_event(
     let adapter = crate::provider::get_adapter(provider);
     // Contract C / F6.4: event log must record the same context-aware argv that the
     // actual spawn used — so the role/tools/MCP context appears in `start_agent.agent_start`.
-    let safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn()?;
     let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_json(
         agent,
         Some(agent_id.as_str()),
@@ -1620,7 +1677,6 @@ fn write_start_agent_start_event(
     let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
         &command_agent,
         provider,
-        &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     let mcp_config = adapter
@@ -1831,6 +1887,17 @@ fn write_reset_complete_event(
     Ok(())
 }
 
+/// 0.5.66 bypass 单源 §2.6:声明面(file)与运行面(as-launched)是否 drift。
+/// 缺 as-launched(从未 spawn)= 视为未启动,不 drift(首次 Noop 无进程可比)。
+fn check_bypass_drift(file: Option<bool>, launched: Option<bool>) -> bool {
+    match (file, launched) {
+        (Some(file), Some(launched)) => file != launched,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1907,4 +1974,23 @@ mod tests {
             "other-agent collision checks must also include tmux_socket"
         );
     }
+
+    // 0.5.66 bypass 单源 §4.1:Noop drift 检测——声明面与运行面不一致 → drift。
+    #[test]
+    fn test_restart_noop_denied_on_drift() {
+        // file=true, launched=false → drift(改了 md 升 bypass 但进程没带)。
+        assert!(check_bypass_drift(Some(true), Some(false)));
+        // file=false, launched=true → drift(改了 md 撤 bypass 但进程还带着)。
+        assert!(check_bypass_drift(Some(false), Some(true)));
+    }
+
+    // 0.5.66 bypass 单源 §4.1:无 drift 或从未 spawn(as-launched 缺)→ 不拒。
+    #[test]
+    fn test_restart_fresh_spawn_after_drift_uses_file_value() {
+        assert!(!check_bypass_drift(Some(true), Some(true)));
+        assert!(!check_bypass_drift(Some(false), Some(false)));
+        // 从未 spawn:as-launched 缺失 → 不 drift(首次 Noop 无进程可比)。
+        assert!(!check_bypass_drift(Some(true), None));
+        assert!(!check_bypass_drift(None, None));
+    }
 }

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -213,7 +213,10 @@ pub(super) fn spawn_agent_window(
     let safety = if let Some(safety) = safety {
         safety
     } else {
-        detected_safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn()?;
+        detected_safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn_json(
+            agent,
+            provider,
+        )?;
         &detected_safety
     };
     let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_json(
@@ -226,7 +229,6 @@ pub(super) fn spawn_agent_window(
     let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
         &command_agent,
         provider,
-        safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     // owner_team_id resolution priority (Issue 2 fix):
@@ -405,9 +407,9 @@ pub(super) fn spawn_agent_window(
 
     // 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): route the
     // primary worker spawn through the worker shell wrapper so provider
-    // exit leaves the pane at an interactive shell with an explicit exit
-    // marker instead of collapsing the pane into `[exited]`. This mirrors
-    // the leader wrapper's manual-tmux equivalence. The split path stays
+    // exit leaves the pane at an inert sh tail with an explicit exit marker
+    // instead of collapsing the pane into `[exited]`. The inert tail does
+    // not read pane stdin. The split path stays
     // on plain spawn_split — split panes are display overlays, not the
     // primary worker process.
     let provider_label = crate::provider::wire::command_name(provider);
@@ -591,6 +593,8 @@ fn merge_command_context_fields(
         "effort",
         "profile",
         "permission_mode",
+        // 0.5.66 bypass 单源:rehydrate 同步合入,restart 的 safety 构造读到新值。
+        "dangerously_skip_permissions",
     ] {
         if let Some(value) = spec_agent.get(field).and_then(yaml_value_to_json) {
             obj.insert(field.to_string(), value);
@@ -799,13 +803,6 @@ pub(super) fn lifecycle_worker_tmux_backend_for_state(
         .backend
 }
 
-pub(super) fn persist_effective_approval_policy_for_restart(
-    agent: &mut serde_json::Map<String, serde_json::Value>,
-    safety: &DangerousApproval,
-) {
-    crate::lifecycle::launch::persist_effective_approval_policy(agent, safety);
-}
-
 pub(super) fn save_restart_projected_state(
     workspace: &Path,
     state: &mut serde_json::Value,

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -270,7 +270,6 @@ fn restart_with_selected_team_and_transport(
     let spec_workspace = runtime_spec.parent().ok_or_else(|| {
         LifecycleError::TeamSelect("active team spec workspace not found".to_string())
     })?;
-    let safety = crate::lifecycle::launch::effective_runtime_config(&spec)?;
     // Bug 1 (0.4.2 P0): the rebuilt spec is the single source of truth for the
     // active roster. Any agent in state.agents that is NOT in the rebuilt
     // spec is a stale leftover (role doc was deleted between sessions) and
@@ -526,7 +525,6 @@ fn restart_with_selected_team_and_transport(
             &selected.team_key,
             &session_name,
             transport,
-            &safety,
             tmux_endpoint_source,
             &state,
         )
@@ -551,12 +549,25 @@ fn restart_with_selected_team_and_transport(
         if let Some(parallel_result) = parallel_result {
             match parallel_result {
                 Ok(pspawn) => {
+                    let raw_agent = state
+                        .get("agents")
+                        .and_then(|v| v.get(decision.agent_id.as_str()))
+                        .cloned()
+                        .unwrap_or(serde_json::Value::Null);
+                    let rehydrated = rehydrate_agent_command_context_from_spec(
+                        spec_workspace,
+                        &decision.agent_id,
+                        &raw_agent,
+                    );
+                    let launched_bypass = matches!(
+                        rehydrated.get("dangerously_skip_permissions"),
+                        Some(serde_json::Value::Bool(true))
+                    );
                     apply_marked_respawn(
                         &selected.run_workspace,
                         &selected.team_key,
                         &mut state,
                         transport,
-                        &safety,
                         &phase_timer,
                         decision,
                         &pspawn.spawn,
@@ -565,6 +576,7 @@ fn restart_with_selected_team_and_transport(
                         &mut successful_agents,
                         &mut failed_agents,
                         &mut fatal_resume_failure,
+                        launched_bypass,
                     );
                 }
                 Err(error) => {
@@ -709,7 +721,7 @@ fn restart_with_selected_team_and_transport(
             session_id,
             session_live,
             transport,
-            Some(&safety),
+            None,
             layout_placement.as_ref(),
             None,
             tmux_endpoint_source,
@@ -737,6 +749,10 @@ fn restart_with_selected_team_and_transport(
             }
         };
         let verify_start = std::time::Instant::now();
+        let launched_bypass = matches!(
+            agent.get("dangerously_skip_permissions"),
+            Some(serde_json::Value::Bool(true))
+        );
         if let Err(error) = verify_spawned_agent_live(&decision.agent_id, &spawn, transport)
             .and_then(|_| {
                 mark_agent_respawned(
@@ -745,7 +761,7 @@ fn restart_with_selected_team_and_transport(
                     decision.restart_mode,
                     &spawn,
                     transport,
-                    &safety,
+                    launched_bypass,
                 )
             })
         {
@@ -787,7 +803,16 @@ fn restart_with_selected_team_and_transport(
             .and_then(|agents| agents.get_mut(decision.agent_id.as_str()))
             .and_then(serde_json::Value::as_object_mut)
         {
-            persist_effective_approval_policy_for_restart(agent, &safety);
+            // 0.5.66 bypass 单源:policy 从 agent 行字段派生。
+            let agent_provider = agent
+                .get("provider")
+                .and_then(serde_json::Value::as_str)
+                .and_then(crate::provider::wire::parse_canonical_provider)
+                .unwrap_or(crate::model::enums::Provider::Codex);
+            crate::lifecycle::launch::persist_effective_approval_policy_from_agent(
+                agent,
+                agent_provider,
+            );
         }
         // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
         // pair the state-side activity clear with a DB `agent_health` clear so
@@ -1958,7 +1983,7 @@ fn mark_agent_respawned(
     restart_mode: StartMode,
     spawn: &SpawnedAgentWindow,
     transport: &dyn crate::transport::Transport,
-    safety: &DangerousApproval,
+    launched_bypass: bool,
 ) -> Result<(), LifecycleError> {
     let Some(agent) = state
         .get_mut("agents")
@@ -2081,7 +2106,18 @@ fn mark_agent_respawned(
         }
     }
     crate::lifecycle::launch::persist_command_plan_state(agent, &spawn.plan, &spawn.profile_launch);
-    persist_effective_approval_policy_for_restart(agent, safety);
+    // 0.5.66 bypass 单源:policy 从 agent 行字段派生,不再用全队 `DangerousApproval`。
+    let agent_provider = agent
+        .get("provider")
+        .and_then(serde_json::Value::as_str)
+        .and_then(crate::provider::wire::parse_canonical_provider)
+        .unwrap_or(crate::model::enums::Provider::Codex);
+    crate::lifecycle::launch::persist_effective_approval_policy_from_agent(agent, agent_provider);
+    // 0.5.66 bypass 单源 §2.6:fresh spawn(restart)记录运行面 bypass 值。
+    agent.insert(
+        "as_launched_dangerously_skip_permissions".to_string(),
+        serde_json::json!(launched_bypass),
+    );
     if let Some(placement) = spawn.layout_placement.as_ref() {
         agent.insert(
             "layout_window".to_string(),
@@ -2510,7 +2546,6 @@ fn run_bounded_parallel_worker_spawns(
     team_key: &str,
     session_name: &SessionName,
     transport: &(dyn crate::transport::Transport),
-    safety: &DangerousApproval,
     tmux_endpoint_source: Option<&str>,
     state: &serde_json::Value,
 ) -> Vec<Option<Result<ParallelSpawnResult, String>>> {
@@ -2589,7 +2624,7 @@ fn run_bounded_parallel_worker_spawns(
         first_input.session_id.as_ref(),
         first_session_live,
         transport,
-        Some(safety),
+        None,
         first_input.layout_placement.as_ref(),
         None,
         tmux_endpoint_source,
@@ -2673,7 +2708,7 @@ fn run_bounded_parallel_worker_spawns(
                     input.session_id.as_ref(),
                     /* into_existing_session */ true,
                     transport,
-                    Some(safety),
+                    None,
                     input.layout_placement.as_ref(),
                     None,
                     tmux_endpoint_source,
@@ -2716,7 +2751,6 @@ fn apply_marked_respawn(
     team_key: &str,
     state: &mut serde_json::Value,
     transport: &(dyn crate::transport::Transport),
-    safety: &DangerousApproval,
     phase_timer: &RestartPhaseTimer,
     decision: &RestartedAgent,
     spawn: &SpawnedAgentWindow,
@@ -2725,6 +2759,7 @@ fn apply_marked_respawn(
     successful_agents: &mut Vec<RestartedAgent>,
     failed_agents: &mut Vec<RestartFailedAgent>,
     fatal_resume_failure: &mut bool,
+    launched_bypass: bool,
 ) {
     let verify_start = std::time::Instant::now();
     if let Err(error) =
@@ -2735,7 +2770,7 @@ fn apply_marked_respawn(
                 decision.restart_mode,
                 spawn,
                 transport,
-                safety,
+                launched_bypass,
             )
         })
     {
@@ -2776,7 +2811,16 @@ fn apply_marked_respawn(
         .and_then(|agents| agents.get_mut(decision.agent_id.as_str()))
         .and_then(serde_json::Value::as_object_mut)
     {
-        persist_effective_approval_policy_for_restart(agent, safety);
+        // 0.5.66 bypass 单源:policy 从 agent 行字段派生。
+        let agent_provider = agent
+            .get("provider")
+            .and_then(serde_json::Value::as_str)
+            .and_then(crate::provider::wire::parse_canonical_provider)
+            .unwrap_or(crate::model::enums::Provider::Codex);
+        crate::lifecycle::launch::persist_effective_approval_policy_from_agent(
+            agent,
+            agent_provider,
+        );
     }
     let _ = crate::db::agent_health_capture::clear_agent_health_observation(
         run_workspace,
@@ -3728,7 +3772,7 @@ tasks:
             StartMode::Resumed,
             &spawn,
             &RespawnEpochTransport,
-            &disabled_safety(),
+            false,
         )
         .expect("mark respawned");
 

package/crates/team-agent/src/lifecycle/tests/acceptance_b_batch_red.rs

@@ -393,7 +393,7 @@ fn write_min_team(ws: &Path, name: &str) -> PathBuf {
     .unwrap();
     std::fs::write(
         team.join("agents/worker_a.md"),
-        "---\nname: worker_a\nrole: Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker.\n",
+        "---\nname: worker_a\nrole: Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker.\n",
     )
     .unwrap();
     team

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -330,7 +330,7 @@ fn add_agent_joins_w2_into_running_roster_and_existing_session() {
     let role_file = team_dir.join("w2-role.md");
     std::fs::write(
         &role_file,
-        "---\nname: w2\nrole: Worker Two\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker two.\n",
+        "---\nname: w2\nrole: Worker Two\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker two.\n",
     )
     .unwrap();
     let transport = OfflineTransport::new().with_session_present(true);
@@ -518,9 +518,9 @@ if [ "$track" != 1 ]; then
 fi
 # 0.5.39 Slice 2: worker spawn now goes through the worker shell
 # wrapper (tmux-server-death-locate §7 Slice 2), which embeds a
-# printf format literal containing "\n" bytes so the pane returns to
-# an interactive shell with an explicit exit marker instead of
-# collapsing to `[exited]`. Those embedded newlines land inside the
+# printf format literal containing "\n" bytes so the pane retains an
+# inert sh tail with an explicit exit marker instead of collapsing to
+# `[exited]`. Those embedded newlines land inside the
 # tmux argv payload, so a naive `printf '%s\n' "$*"` writes multiple
 # lines per tmux invocation and downstream `raw.lines()` scans see
 # fake "argv" lines that carry only the marker text. Escape newlines

package/crates/team-agent/src/lifecycle/tests/behavioral_diff_264_red.rs

@@ -528,7 +528,7 @@ fn write_team(workspace: &Path, fixture: &TeamFixture<'_>) -> PathBuf {
         std::fs::write(
             team.join("agents").join(format!("{}.md", agent.id)),
             format!(
-                "---\nname: {}\nrole: {}\nprovider: {}\n{model}auth_mode: {}\n{profile}tools:\n{tools}---\n\n{}\n",
+                "---\nname: {}\nrole: {}\nprovider: {}\n{model}auth_mode: {}\n{profile}dangerously_skip_permissions: false\ntools:\n{tools}---\n\n{}\n",
                 agent.id, agent.role, agent.provider, agent.auth_mode, agent.body
             ),
         )

package/crates/team-agent/src/lifecycle/tests/claude_compatible_config_red.rs

@@ -152,14 +152,14 @@ fn write_claude_profile_team(ws: &Path, team_key: &str, agent_id: &str) -> PathB
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {team_key}\nobjective: Claude compatible config contract.\nprovider: claude\nauth_mode: compatible_api\n---\n\nTeam.\n"
+            "---\nname: {team_key}\nobjective: Claude compatible config contract.\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\n---\n\nTeam.\n"
         ),
     )
     .unwrap();
     std::fs::write(
         team.join("agents").join(format!("{agent_id}.md")),
         format!(
-            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
         ),
     )
     .unwrap();

package/crates/team-agent/src/lifecycle/tests/claude_profile_launch_red.rs

@@ -218,14 +218,14 @@ fn write_claude_profile_team(ws: &Path, team_key: &str, agent_id: &str) -> PathB
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {team_key}\nobjective: Claude compatible profile launch contract.\nprovider: claude\nauth_mode: compatible_api\n---\n\nTeam.\n"
+            "---\nname: {team_key}\nobjective: Claude compatible profile launch contract.\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\n---\n\nTeam.\n"
         ),
     )
     .unwrap();
     std::fs::write(
         team.join("agents").join(format!("{agent_id}.md")),
         format!(
-            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
         ),
     )
     .unwrap();
@@ -247,14 +247,14 @@ fn write_claude_subscription_profile_team(ws: &Path, team_key: &str, agent_id: &
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {team_key}\nobjective: Claude subscription profile launch contract.\nprovider: claude\nauth_mode: subscription\n---\n\nTeam.\n"
+            "---\nname: {team_key}\nobjective: Claude subscription profile launch contract.\nprovider: claude\nauth_mode: subscription\ndangerously_skip_permissions: false\n---\n\nTeam.\n"
         ),
     )
     .unwrap();
     std::fs::write(
         team.join("agents").join(format!("{agent_id}.md")),
         format!(
-            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: subscription\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: subscription\ndangerously_skip_permissions: false\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
         ),
     )
     .unwrap();

package/crates/team-agent/src/lifecycle/tests/clone_fork_copilot_perms_red.rs

@@ -304,7 +304,7 @@ fn write_team_docs(workspace: &Path, provider: &str) {
     std::fs::write(
         workspace.join("agents").join(format!("{SOURCE}.md")),
         format!(
-            "---\nname: {SOURCE}\nrole: {SOURCE}\nprovider: {provider}\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{SOURCE} body.\n"
+            "---\nname: {SOURCE}\nrole: {SOURCE}\nprovider: {provider}\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{SOURCE} body.\n"
         ),
     )
     .expect("write source role doc");
@@ -323,7 +323,7 @@ fn write_copilot_team_docs(workspace: &Path) -> PathBuf {
     std::fs::write(
         team_dir.join("agents").join(format!("{SOURCE}.md")),
         format!(
-            "---\nname: {SOURCE}\nrole: Copilot Worker\nprovider: copilot\nmodel: gpt-5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nCopilot source body.\n"
+            "---\nname: {SOURCE}\nrole: Copilot Worker\nprovider: copilot\nmodel: gpt-5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nCopilot source body.\n"
         ),
     )
     .expect("write source role doc");
@@ -502,20 +502,16 @@ fn r8_copilot_fork_is_no_longer_capability_refused() {
 }
 
 /// R7 permission-clamp GUARDRAIL — a fork's effective approval policy is derived
-/// from the LEADER and never escalates above it (MUST-16). Naturally green at
-/// baseline (the role model forces permission_mode=restricted and inherits
-/// approval from the leader); its teeth engage after implement recompiles the
-/// role via RoleSourceResolver — any raw clone of a compiled permission above the
-/// leader trips it. The true escalation scenario (a source declaring capability
-/// above the leader) is a real-machine concern.
+/// from the LEADER and never escalates above it (MUST-16). 0.5.66 bypass 单源:
+/// fork 的 approval policy 由源角色的 `dangerously_skip_permissions` 派生
+/// (本 fixture = false → `source=disabled`),不再依赖 leader argv 继承。任何
+/// fork 都不得出现 `source=leader_process`(旧模型已删)或 capability 高于源。
 #[test]
 fn r7_fork_effective_permissions_are_clamped_to_leader_guardrail() {
     // Claude source + success-path backing shim so the fork COMPLETES and a NEW
-    // row exists to inspect — no vacuous pass on a refused fork. The dangerous
-    // leader is established by the PINNED ancestry seam (see ANCESTRY_ENV note):
-    // `source=leader_process` is only correct when a dangerous ancestor is
-    // actually detected, so the fixture must supply one instead of borrowing
-    // the host's.
+    // row exists to inspect — no vacuous pass on a refused fork. The source role
+    // declares `dangerously_skip_permissions: false`, so the fork's policy must
+    // resolve to `disabled` (fail-closed) — the new single-source model.
     let case = Case::start("cf-r7");
     let fork = case.fork(NEW);
     assert_eq!(
@@ -538,11 +534,17 @@ fn r7_fork_effective_permissions_are_clamped_to_leader_guardrail() {
     let above = policy
         .get("worker_capability_above_leader")
         .and_then(Value::as_bool);
-    assert_eq!(
+    assert_ne!(
         source,
         Some("leader_process"),
-        "guardrail: a fork's effective approval policy must be derived from the leader \
-         (source=leader_process), not raw-cloned from the source; MUST-16. policy={policy}"
+        "0.5.66: fork policy must never be leader_process (old ancestry model removed); \
+         policy={policy}"
+    );
+    assert_eq!(
+        source,
+        Some("disabled"),
+        "guardrail: a fork's approval policy derives from the role's dangerously_skip_permissions \
+         (false → disabled), never raw-cloned escalation; MUST-16. policy={policy}"
     );
     assert_ne!(
         above,
@@ -552,18 +554,9 @@ fn r7_fork_effective_permissions_are_clamped_to_leader_guardrail() {
     );
 }
 
-/// R7b reverse positive control — with a pinned RESTRICTED leader ancestry the
-/// fork's policy must resolve to `source=disabled` (fail-closed), never
-/// `leader_process`, and still never escalate. This is the CI-truth face of the
-/// clamp (a clean runner == no dangerous ancestor) and proves r7 does not pass
-/// by constant behavior: the same fixture flips leader_process↔disabled purely
-/// on the pinned seam. Mirrors the deterministic product contract
-/// `lifecycle/tests/core.rs` (clean mocked ancestry → Disabled).
-///
-/// NOTE deliberately NOT asserted with the seam UNSET: unpinned, the policy is
-/// a function of the host process tree (the exact non-hermeticity this
-/// revision removes), so an unset-seam assertion would be red on any host
-/// whose own leader runs dangerously.
+/// R7b reverse positive control — same source role (dangerously_skip_permissions:
+/// false) must also resolve to `source=disabled` under any ancestry seam. 0.5.66
+/// 起 policy 与 leader argv 无关:source 恒 `disabled`,fork 恒不升级(MUST-16)。
 #[test]
 fn r7b_fork_policy_under_restricted_leader_ancestry_is_disabled() {
     let case = Case::start_with_ancestry("cf-r7b", RESTRICTED_LEADER_ARGV);
@@ -587,16 +580,15 @@ fn r7b_fork_policy_under_restricted_leader_ancestry_is_disabled() {
     assert_eq!(
         policy.get("source").and_then(Value::as_str),
         Some("disabled"),
-        "reverse control: a restricted/clean leader ancestry must resolve to source=disabled \
-         (fail-closed), never leader_process. policy={policy}"
+        "fail-closed: source role declares dangerously_skip_permissions=false → fork policy must \
+         be disabled; policy={policy}"
     );
     assert_ne!(
         policy
             .get("worker_capability_above_leader")
             .and_then(Value::as_bool),
         Some(true),
-        "reverse control: a restricted leader must never yield a fork above the leader; MUST-16. \
-         policy={policy}"
+        "a fork must never yield a capability above the source; MUST-16. policy={policy}"
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/communication_mode_runtime_contract_red.rs

@@ -246,7 +246,7 @@ fn fixture(tag: &str, team_mode: Option<&str>) -> PathBuf {
         std::fs::write(
             root.join("agents").join(format!("worker_{id}.md")),
             format!(
-                "---\nname: worker_{id}\nrole: Communication Worker\nprovider: claude\ncommunication_mode: {id}\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL {id}\n"
+                "---\nname: worker_{id}\nrole: Communication Worker\nprovider: claude\ndangerously_skip_permissions: false\ncommunication_mode: {id}\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL {id}\n"
             ),
         )
         .unwrap();
@@ -265,7 +265,7 @@ fn default_fixture(tag: &str) -> PathBuf {
     }
     std::fs::write(
         root.join("agents").join("worker_default.md"),
-        "---\nname: worker_default\nrole: Communication Worker\nprovider: claude\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL default\n",
+        "---\nname: worker_default\nrole: Communication Worker\nprovider: claude\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL default\n",
     )
     .unwrap();
     root