@team-agent/installer 0.5.64 → 0.5.66

package/crates/team-agent/src/model/spec.rs

@@ -354,8 +354,31 @@ fn basic_schema_errors(spec: &Yaml) -> Vec<String> {
     );
     match spec.get("agents") {
         Some(Yaml::List(agents)) if !agents.is_empty() => {
+            // 0.5.66 bypass 单源:收集缺/错 `dangerously_skip_permissions` 的角色清单,
+            // 循环后一次性报出,满足"缺字段错误消息含每个缺字段的角色 id 清单"硬要求。
+            let mut missing_bypass: Vec<String> = Vec::new();
+            let mut bad_type_bypass: Vec<String> = Vec::new();
             for (idx, agent) in agents.iter().enumerate() {
                 check_agent(agent, &format!("/agents/{idx}"), &mut e);
+                match agent.get("dangerously_skip_permissions") {
+                    None => missing_bypass.push(agent_label(agent, idx)),
+                    Some(value) if !matches!(value, Yaml::Bool(_)) => {
+                        bad_type_bypass.push(agent_label(agent, idx))
+                    }
+                    Some(_) => {}
+                }
+            }
+            if !missing_bypass.is_empty() {
+                e.push(format!(
+                    "/agents/dangerously_skip_permissions: missing required field (role id(s): {}). This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed.",
+                    missing_bypass.join(", ")
+                ));
+            }
+            if !bad_type_bypass.is_empty() {
+                e.push(format!(
+                    "/agents/dangerously_skip_permissions: must be a boolean (role id(s): {}). This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed.",
+                    bad_type_bypass.join(", ")
+                ));
             }
         }
         _ => e.push("/agents: must be a non-empty list".to_string()),
@@ -384,7 +407,7 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "working_directory",
         "system_prompt",
         "tools",
-        "permission_mode",
+        "dangerously_skip_permissions",
         "preferred_for",
         "avoid_for",
         "output_contract",
@@ -397,7 +420,7 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "working_directory",
         "system_prompt",
         "tools",
-        "permission_mode",
+        "dangerously_skip_permissions",
         "preferred_for",
         "avoid_for",
         "output_contract",
@@ -407,6 +430,10 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "profile",
         "credential_ref",
         "forked_from",
+        // 存量角色 md 的 `permission_mode` 是历史无效值(compiler 曾恒发 restricted)。
+        // 0.5.66 起不再被 compiler 消费;保留在 allowed 以免存量文件 fail-loud
+        // (§3.1 迁移时顺手删除,0.6.0 可收紧)。
+        "permission_mode",
         // 0.4.x provider effort MVP step 3: per-agent effort override (resolved at compile).
         "effort",
     ];
@@ -481,6 +508,15 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
     }
 }
 
+/// 汇总错误里引用 agent 的可读标签:`<id>` 优先,退回 `<index> (role: <role>)`。
+fn agent_label(agent: &Yaml, idx: usize) -> String {
+    agent
+        .get("id")
+        .and_then(Yaml::as_str)
+        .map(|id| format!("`{id}`"))
+        .unwrap_or_else(|| format!("agents[{idx}]"))
+}
+
 fn check_routing(routing: Option<&Yaml>, errors: &mut Vec<String>) {
     check_keys_y(
         routing,
@@ -564,7 +600,6 @@ fn check_runtime(runtime: Option<&Yaml>, errors: &mut Vec<String>) {
         "max_active_agents",
         "startup_order",
         "display_backend",
-        "dangerous_auto_approve",
         "auto_attach_leader",
         "fast",
         "tick_interval_sec",
@@ -588,9 +623,6 @@ fn check_runtime(runtime: Option<&Yaml>, errors: &mut Vec<String>) {
             errors.push("/runtime/display_backend: invalid display backend".to_string());
         }
     }
-    if get("dangerous_auto_approve").is_some_and(|v| !matches!(v, Yaml::Bool(_))) {
-        errors.push("/runtime/dangerous_auto_approve: must be a boolean".to_string());
-    }
     if get("auto_trust_own_workspace").is_some_and(|v| !matches!(v, Yaml::Bool(_))) {
         errors.push("/runtime/auto_trust_own_workspace: must be a boolean".to_string());
     }
@@ -1020,6 +1052,58 @@ mod tests {
         );
     }
 
+    // 0.5.66 bypass 单源 §4.1:缺 `dangerously_skip_permissions` 字段 → 错误消息
+    // 必须列出每个缺字段的角色 id + 用户可读的必填说明。
+    #[test]
+    fn test_missing_dangerously_field_reports_role_list() {
+        // 从 fixture 文本里删掉第一个 agent 的字段,模拟该角色缺字段。
+        let text = include_str!("testdata/team.spec.yaml");
+        let without_first = text.replacen("    dangerously_skip_permissions: false\n", "", 1);
+        assert_ne!(text, without_first, "fixture must contain the field");
+        let spec = yaml::loads(&without_first).unwrap();
+        let errors = all_spec_errors(&spec);
+        let missing: Vec<&String> = errors
+            .iter()
+            .filter(|m| m.starts_with("/agents/dangerously_skip_permissions: missing"))
+            .collect();
+        assert_eq!(missing.len(), 1, "exactly one missing-field error, got: {errors:#?}");
+        assert!(
+            missing[0].contains("`codex_implementer`"),
+            "must name the role id, got: {}",
+            missing[0]
+        );
+        assert!(
+            missing[0].contains("This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed."),
+            "must carry the user-facing required-field message, got: {}",
+            missing[0]
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:非 bool 值 → fail-loud 类型错,同样带角色清单 + 硬串。
+    #[test]
+    fn test_invalid_dangerously_type_rejected() {
+        let text = include_str!("testdata/team.spec.yaml");
+        let bad = text.replacen("    dangerously_skip_permissions: false\n", "    dangerously_skip_permissions: \"yes\"\n", 1);
+        assert_ne!(text, bad, "fixture must contain the field");
+        let spec = yaml::loads(&bad).unwrap();
+        let errors = all_spec_errors(&spec);
+        let type_errs: Vec<&String> = errors
+            .iter()
+            .filter(|m| m.starts_with("/agents/dangerously_skip_permissions: must be a boolean"))
+            .collect();
+        assert_eq!(type_errs.len(), 1, "exactly one type error, got: {errors:#?}");
+        assert!(
+            type_errs[0].contains("`codex_implementer`"),
+            "must name the role id, got: {}",
+            type_errs[0]
+        );
+        assert!(
+            type_errs[0].contains("This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed."),
+            "must carry the user-facing required-field message, got: {}",
+            type_errs[0]
+        );
+    }
+
     #[test]
     fn empty_spec_matches_python_golden() {
         let spec = yaml::loads("{}").unwrap();
@@ -1050,4 +1134,43 @@ mod tests {
             ]
         );
     }
+
+    // 0.5.66 bypass 单源 §4.1:7 触发面共用同一 spec 校验层——compile_team 是它们的共同
+    // 必经点(quick-start/restart/add/fork 都调用),缺字段一律 fail-loud。此处验证
+    // compile 级校验确实 fail-loud,即各触发面(经 compile_team)都被覆盖。
+    #[test]
+    fn test_all_7_triggers_run_field_check() {
+        // compile_team 是 7 触发面的 spec 校验必经点:
+        //   quick-start(quick_start.rs:233 compile_team)
+        //   restart(rebuild.rs:3245 rebuild_runtime_spec_from_roles → compile_team)
+        //   add-agent(add_agent.rs:331 compile_role_agent)
+        //   clone-agent(clone_agent.rs:62 → add_agent)
+        //   fork-agent(fork_agent.rs:96 validate_spec)
+        //   start-agent / reset-agent(操作已编译 spec,团队创建时经 compile_team 校验)
+        // 验证 compile_team 对缺字段的角色文档 fail-loud。
+        let team = std::env::temp_dir().join(format!(
+            "ta-spec-7trigger-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&team);
+        std::fs::create_dir_all(team.join("agents")).unwrap();
+        std::fs::write(
+            team.join("TEAM.md"),
+            "---\nname: t7\nobjective: 7 trigger.\nprovider: codex\n---\n\nteam.\n",
+        )
+        .unwrap();
+        // 角色文档故意缺 dangerously_skip_permissions
+        std::fs::write(
+            team.join("agents").join("w.md"),
+            "---\nname: w\nrole: Worker\nprovider: codex\ntools:\n  - mcp_team\n---\n\nw.\n",
+        )
+        .unwrap();
+        let err = crate::compiler::compile_team(&team).unwrap_err().to_string();
+        assert!(
+            err.contains("missing front matter field dangerously_skip_permissions")
+                && err.contains("This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed."),
+            "compile_team must fail-loud on missing field (shared by all 7 triggers); got {err}"
+        );
+        let _ = std::fs::remove_dir_all(&team);
+    }
 }

package/crates/team-agent/src/model/testdata/spec_invalid_a.yaml

@@ -39,6 +39,7 @@ agents:
       - "provider_builtin"
       - "banana"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "implementation"
       - "bug_fix"
@@ -69,6 +70,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "research"
       - "architecture"
@@ -99,6 +101,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "review"
       - "risk_check"
@@ -141,7 +144,6 @@ runtime:
   session_name: "teamspec-full-example"
   auto_launch: true
   require_user_approval_before_launch: true
-  dangerous_auto_approve: false
   max_active_agents: 3
   startup_order:
     - "codex_implementer"

package/crates/team-agent/src/model/testdata/team.spec.golden.yaml

@@ -38,6 +38,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "implementation"
       - "bug_fix"
@@ -68,6 +69,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "research"
       - "architecture"
@@ -98,6 +100,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "review"
       - "risk_check"
@@ -140,7 +143,6 @@ runtime:
   session_name: "teamspec-full-example"
   auto_launch: true
   require_user_approval_before_launch: true
-  dangerous_auto_approve: false
   max_active_agents: 3
   startup_order:
     - "codex_implementer"

package/crates/team-agent/src/model/testdata/team.spec.yaml

@@ -38,6 +38,7 @@ agents:
       - mcp_team
       - provider_builtin
     permission_mode: restricted
+    dangerously_skip_permissions: false
     preferred_for:
       - implementation
       - bug_fix
@@ -68,6 +69,7 @@ agents:
       - mcp_team
       - provider_builtin
     permission_mode: restricted
+    dangerously_skip_permissions: false
     preferred_for:
       - research
       - architecture
@@ -98,6 +100,7 @@ agents:
       - mcp_team
       - provider_builtin
     permission_mode: restricted
+    dangerously_skip_permissions: false
     preferred_for:
       - review
       - risk_check
@@ -140,7 +143,6 @@ runtime:
   session_name: teamspec-full-example
   auto_launch: true
   require_user_approval_before_launch: true
-  dangerous_auto_approve: false
   max_active_agents: 3
   startup_order:
     - codex_implementer

package/crates/team-agent/src/provider/adapters/claude.rs

@@ -8,7 +8,7 @@
 //! resolver (`claude_context_model`) stay in `adapter.rs`; capture scanning
 //! helpers now live under `provider/session_scan/claude.rs`.
 
-use crate::model::enums::AuthMode;
+use crate::model::enums::{AuthMode, Provider};
 use crate::provider::adapter::{next_session_token, prompt_needs_native_mcp, BasicProviderAdapter};
 use crate::provider::{McpConfig, ProviderAdapter, ProviderError};
 
@@ -49,7 +49,10 @@ pub(crate) fn claude_base_command(
 ) -> Result<Vec<String>, ProviderError> {
     let mut argv = vec!["claude".to_string()];
     if claude_dangerous_auto_approve(tools) {
-        argv.push("--dangerously-skip-permissions".to_string());
+        // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给(单源)。
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Claude)
+            .expect("claude provider must define a bypass flag");
+        argv.push(flag.to_string());
     } else {
         argv.push("--permission-mode".to_string());
         argv.push("default".to_string());

package/crates/team-agent/src/provider/adapters/codex.rs

@@ -6,7 +6,7 @@
 //! `json_inline` stays in `adapter.rs` because it is also used by other
 //! sites; this file reaches it via `super::*`.
 
-use crate::model::enums::AuthMode;
+use crate::model::enums::{AuthMode, Provider};
 use crate::provider::adapter::json_inline;
 use crate::provider::{McpConfig, ProviderCommandOverrides};
 
@@ -41,7 +41,10 @@ pub(crate) fn codex_base_command(
         argv.push(profile.to_string());
     }
     if codex_dangerous_auto_approve(tools) {
-        argv.push("--dangerously-bypass-approvals-and-sandbox".to_string());
+        // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给。
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Codex)
+            .expect("codex provider must define a bypass flag");
+        argv.push(flag.to_string());
     } else {
         argv.push("--sandbox".to_string());
         argv.push(codex_sandbox_mode(tools).to_string());

package/crates/team-agent/src/provider/adapters/copilot.rs

@@ -7,7 +7,7 @@
 //! translation. Auth hint (`copilot_auth_hint`) stays in `adapter.rs`;
 //! session-store scanning lives under `provider/session_scan/copilot.rs`.
 
-use crate::model::enums::AuthMode;
+use crate::model::enums::{AuthMode, Provider};
 use crate::provider::McpConfig;
 
 pub(crate) fn copilot_base_command(
@@ -29,7 +29,10 @@ pub(crate) fn copilot_base_command(
         "--disable-builtin-mcps".to_string(),
     ];
     if copilot_dangerous_auto_approve(tools) {
-        argv.push("--allow-all".to_string());
+        // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给。
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Copilot)
+            .expect("copilot provider must define a bypass flag");
+        argv.push(flag.to_string());
     } else {
         for flag in copilot_permission_flags(tools) {
             argv.push(flag);

package/crates/team-agent/src/provider/bypass_flags.rs

@@ -0,0 +1,80 @@
+//!
+//! 0.5.66 bypass 单源统一 — provider → bypass argv flag 配置表。
+//!
+//! **唯一权威**:角色 md 的 `dangerously_skip_permissions: true` 决定是否加 bypass flag;
+//! 本文件只回答"某个 provider 的 bypass 命令行参数是什么"。
+//!
+//! 数据源自旧 `lifecycle/launch/approval.rs::dangerous_leader_flags()` 表迁来:
+//!   - claude/claude_code → `--dangerously-skip-permissions`
+//!   - codex → `--dangerously-bypass-approvals-and-sandbox`
+//!   - copilot → `--allow-all`(0.3.27 P1 E54 symptom 2 起)
+//!
+//! 未定义(返回 None)的 provider:调用侧必须 fail-loud(见
+//! `resolved_tool_strings_for_command`),不得静默 fallback。
+
+use crate::model::enums::Provider;
+
+/// 某 provider 的 bypass argv flag;未定义 → `None`。
+pub(crate) fn provider_bypass_flag(provider: Provider) -> Option<&'static str> {
+    match provider {
+        Provider::Claude | Provider::ClaudeCode => Some("--dangerously-skip-permissions"),
+        Provider::Codex => Some("--dangerously-bypass-approvals-and-sandbox"),
+        Provider::Copilot => Some("--allow-all"),
+        // TODO: 查 gemini_cli 的等价 bypass 参数;未定义前 fail-loud。
+        Provider::GeminiCli => None,
+        Provider::Fake => None,
+    }
+}
+
+/// 0.5.66 §3.2 跨 workspace 兼容警示用:扫 argv tokens 找已知 bypass flag。
+/// **只做检测,不做行为决策**(0.6.0 删)。
+///
+/// TODO(0.6.0): remove
+pub(crate) fn detect_bypass_flag_in_argv(argv_tokens: &[String]) -> Option<&'static str> {
+    for token in argv_tokens {
+        if token == "--dangerously-skip-permissions"
+            || token == "--dangerously-skip-permission"
+        {
+            return Some("--dangerously-skip-permissions");
+        }
+        if token == "--dangerously-bypass-approvals-and-sandbox" {
+            return Some("--dangerously-bypass-approvals-and-sandbox");
+        }
+        if token == "--allow-all" || token == "--yolo" {
+            return Some("--allow-all");
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn claude_family_bypass_flag() {
+        assert_eq!(
+            provider_bypass_flag(Provider::Claude),
+            Some("--dangerously-skip-permissions")
+        );
+        assert_eq!(
+            provider_bypass_flag(Provider::ClaudeCode),
+            Some("--dangerously-skip-permissions")
+        );
+    }
+
+    #[test]
+    fn codex_and_copilot_bypass_flags() {
+        assert_eq!(
+            provider_bypass_flag(Provider::Codex),
+            Some("--dangerously-bypass-approvals-and-sandbox")
+        );
+        assert_eq!(provider_bypass_flag(Provider::Copilot), Some("--allow-all"));
+    }
+
+    #[test]
+    fn undefined_providers_return_none() {
+        assert_eq!(provider_bypass_flag(Provider::GeminiCli), None);
+        assert_eq!(provider_bypass_flag(Provider::Fake), None);
+    }
+}

package/crates/team-agent/src/provider/mod.rs

@@ -32,6 +32,8 @@
 // 复用 model::enums 的 Provider/AuthMode,并 re-export(下游惯于 `provider::Provider` 取用)。
 pub use crate::model::enums::{AuthMode, Provider};
 
+/// 0.5.66 bypass 单源:provider → bypass argv flag 配置表(唯一权威)。
+pub(crate) mod bypass_flags;
 pub mod adapter;
 /// 0.4.x decoupling step 2: per-provider command builders + permission/auth
 /// helpers split out of `adapter.rs`. Pure extraction — behavior unchanged.

package/crates/team-agent/src/tmux_backend.rs

@@ -1723,8 +1723,8 @@ pub fn worker_provider_exit_marker(provider_label: &str) -> String {
 /// as a CHILD of a long-lived shell so provider exit does NOT collapse the
 /// worker pane (which under upstream tmux 3.6a private-server bugs can
 /// cascade into whole-server death). When the provider exits, the worker
-/// pane returns to an interactive shell with an explicit worker exit
-/// marker, matching manual `tmux new-window` then `<provider>` behaviour.
+/// pane remains alive with an explicit worker exit marker, then runs an
+/// inert `sh` tail that does not read terminal input.
 pub fn worker_shell_wrapper_command(
     argv: &[String],
     cwd: &Path,
@@ -1758,23 +1758,21 @@ pub fn worker_shell_wrapper_command(
         worker_provider_exit_marker(provider_label)
     )));
     parts.push("\"$rc\";".to_string());
-    parts.push("exec".to_string());
-    parts.push("\"${SHELL:-/bin/zsh}\"".to_string());
-    parts.push("-l".to_string());
+    parts.push(inert_pane_tail_command());
     parts.join(" ")
 }
 
 /// 0.4.x (CR C-2): leader shell wrapper — provider runs as a CHILD of a
 /// long-lived shell, not as the pane's primary process. When the provider
-/// exits, the pane returns to an interactive shell with an explicit exit
-/// marker, matching manual `tmux new-session` then `claude` behaviour.
+/// exits, the pane remains alive with an explicit exit marker, then runs an
+/// inert `sh` tail that does not read terminal input.
 ///
 /// Four required envelope sections (CR C-2):
 ///   1. cd <cwd>                    — same as `shell_command`
 ///   2. unset <KEY> ...             — provider env_unset block
 ///   3. KEY=val ... <provider>      — env exports + provider invocation
 ///                                    (NO `exec` — runs as child)
-///   4. printf exit marker; exec shell -l
+///   4. printf exit marker; exec inert sh tail
 ///
 /// `provider_label` is a human-readable provider name (e.g. "claude",
 /// "codex") embedded in the exit marker for diagnostics.
@@ -1809,7 +1807,7 @@ pub fn leader_shell_wrapper_command(
     }
     parts.extend(argv.iter().map(|arg| shell_quote(arg)));
     parts.push(";".to_string());
-    // 4. exit marker + fall back to interactive shell
+    // 4. exit marker + inert shell tail
     parts.push("rc=$?;".to_string());
     parts.push("printf".to_string());
     // CR R6: marker text comes from single-source `leader_provider_exit_marker`.
@@ -1818,12 +1816,18 @@ pub fn leader_shell_wrapper_command(
         leader_provider_exit_marker(provider_label)
     )));
     parts.push("\"$rc\";".to_string());
-    parts.push("exec".to_string());
-    parts.push("\"${SHELL:-/bin/zsh}\"".to_string());
-    parts.push("-l".to_string());
+    parts.push(inert_pane_tail_command());
     parts.join(" ")
 }
 
+fn inert_pane_tail_command() -> String {
+    // `sh` is deliberate: provider-exit health checks use the shell basename
+    // to reach the exit-marker branch. `sh -c` does not read commands from
+    // stdin; disabling echo also prevents input from appearing accepted.
+    let script = r#"trap '' INT QUIT; stty -echo 2>/dev/null; printf "%s\n" "[team-agent] Provider exited; this pane no longer accepts input. Restart from another pane with the appropriate team-agent start command."; while :; do sleep 3600 & wait "$!"; done"#;
+    format!("exec /bin/sh -c {}", shell_quote(script))
+}
+
 fn shell_quote(raw: &str) -> String {
     if raw.is_empty() {
         return "''".to_string();
@@ -2553,6 +2557,25 @@ impl Transport for TmuxBackend {
         Ok(SetEnvOutcome::Applied)
     }
 
+    fn set_window_option(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        option: &str,
+        value: &str,
+    ) -> Result<(), TransportError> {
+        let target = format!("{}:{}", session.as_str(), window.as_str());
+        let argv = vec![
+            "tmux".to_string(),
+            "set-window-option".to_string(),
+            "-t".to_string(),
+            target,
+            option.to_string(),
+            value.to_string(),
+        ];
+        self.run_ok(&argv)
+    }
+
     fn kill_server(&self) -> Result<(), TransportError> {
         TmuxBackend::kill_server(self);
         Ok(())

package/crates/team-agent/src/transport/test_support.rs

@@ -35,6 +35,7 @@ struct OfflineState {
     calls: Vec<&'static str>,
     spawns: Vec<SpawnRecord>,
     pane_titles: Vec<(String, String, String, String)>,
+    window_options: Vec<(String, String)>,
     inject_targets: Vec<Target>,
     inject_payloads: Vec<String>,
     tmux_endpoint: Option<String>,
@@ -70,6 +71,7 @@ impl Default for OfflineState {
             calls: Vec::new(),
             spawns: Vec::new(),
             pane_titles: Vec::new(),
+            window_options: Vec::new(),
             inject_targets: Vec::new(),
             inject_payloads: Vec::new(),
             tmux_endpoint: None,
@@ -267,6 +269,10 @@ impl OfflineTransport {
         self.with_state(|state| state.pane_titles.clone())
     }
 
+    pub fn window_options(&self) -> Vec<(String, String)> {
+        self.with_state(|state| state.window_options.clone())
+    }
+
     pub fn inject_targets(&self) -> Vec<Target> {
         self.with_state(|state| state.inject_targets.clone())
     }
@@ -555,6 +561,20 @@ impl Transport for OfflineTransport {
         Ok(SetEnvOutcome::Applied)
     }
 
+    fn set_window_option(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        option: &str,
+        value: &str,
+    ) -> Result<(), TransportError> {
+        self.with_state(|state| {
+            state.calls.push("set_window_option");
+            state.window_options.push((option.to_string(), value.to_string()));
+        });
+        Ok(())
+    }
+
     fn kill_session(&self, session: &SessionName) -> Result<(), TransportError> {
         self.with_state(|state| {
             state.calls.push("kill_session");

package/crates/team-agent/src/transport.rs

@@ -613,11 +613,11 @@ pub trait Transport: Send + Sync {
     /// variant that reuses the leader-wrapper mechanism so worker provider
     /// exit does not collapse the pane into `[exited]` (which under
     /// upstream tmux 3.6a private-server bugs can cascade into server
-    /// death). When the provider exits, the worker pane returns to an
-    /// interactive shell with an explicit worker exit marker — matching
-    /// manual `tmux new-window` then `<provider>` behaviour. Default falls
-    /// back to plain `spawn_first_with_env_unset` for backends that have
-    /// no shell layer (test-only `OfflineTransport`).
+    /// death). When the provider exits, the worker pane keeps an explicit
+    /// worker exit marker and runs the inert `/bin/sh -c` tail: it ignores
+    /// INT/QUIT and does not read pane stdin. Default falls back to plain
+    /// `spawn_first_with_env_unset` for backends that have no shell layer
+    /// (test-only `OfflineTransport`).
     fn spawn_first_with_worker_shell_wrapper(
         &self,
         session: &SessionName,
@@ -650,12 +650,12 @@ pub trait Transport: Send + Sync {
     /// 0.4.x (CR C-2): leader-specific spawn variant. Instead of `exec <cmd>`
     /// (which makes the provider the pane's primary process and turns the
     /// pane into `[exited]` when the provider exits), build a shell line
-    /// that runs the provider as a CHILD of a long-lived shell:
-    /// `cd ... && unset ... && KEY=val ... <cmd>; rc=$?; printf '\n[team-agent] <provider> exited with %s\n' "$rc"; exec "${SHELL:-/bin/zsh}" -l`.
-    /// When the provider exits, the pane returns to an interactive shell with
-    /// an explicit exit marker — matching manual `tmux new-session` then
-    /// `claude` behaviour. Default falls back to plain `spawn_first_with_env_unset`
-    /// for backends that have no shell layer (test-only `OfflineTransport`).
+    /// that runs the provider as a CHILD of a long-lived shell. When the
+    /// provider exits, the wrapper records the exit code and marker, then
+    /// execs an inert `/bin/sh -c` tail that ignores INT/QUIT and does not
+    /// read pane stdin. Default falls back to plain
+    /// `spawn_first_with_env_unset` for backends that have no shell layer
+    /// (test-only `OfflineTransport`).
     fn spawn_first_with_leader_shell_wrapper(
         &self,
         session: &SessionName,
@@ -762,6 +762,23 @@ pub trait Transport: Send + Sync {
         value: &str,
     ) -> Result<SetEnvOutcome, TransportError>;
 
+    /// A-55 (window rename race): set a tmux per-window option (e.g.
+    /// `allow-rename off`, `automatic-rename off`) on an existing window.
+    /// tmux=`set-window-option -t SESSION:WINDOW`; non-tmux backends refuse
+    /// via the default (typed unsupported).
+    fn set_window_option(
+        &self,
+        _session: &SessionName,
+        _window: &WindowName,
+        _option: &str,
+        _value: &str,
+    ) -> Result<(), TransportError> {
+        Err(TransportError::MuxUnavailable {
+            backend: self.kind(),
+            detail: "set-window-option is tmux-only".to_string(),
+        })
+    }
+
     // —— LIFECYCLE(SL)——
 
     fn kill_server(&self) -> Result<(), TransportError> {