@team-agent/installer 0.5.65 → 0.5.66

package/crates/team-agent/src/leader/start.rs

@@ -1059,6 +1059,16 @@ fn execute_managed_leader_plan_attempt(
         workspace,
         session_existed_before,
     )?;
+    // A-55 (window rename race): tmux defaults `allow-rename` + `automatic-rename`
+    // ON, so the pane's shell wrapper can print an OSC title-set escape during
+    // init (zshrc/starship/PROMPT_COMMAND) and rename the window away from WINDOW
+    // between spawn-poll and attach — making `attach-session -t SESSION:WINDOW`
+    // fail with "can't find window: WINDOW". Lock both off right after spawn,
+    // before run_leader_argv. Best-effort: a failure must NOT abort the launcher
+    // (old tmux may lack the option), but it is audited below.
+    let (rename_result, rename_stderr) =
+        lock_down_window_rename(&transport, session, &spawned.window);
+    write_window_rename_lockdown_event(workspace, &rename_result, &rename_stderr);
     if let Err(error) = persist_managed_leader_binding(plan, workspace, &spawned) {
         cleanup_managed_leader_resources(
             &transport,
@@ -2246,6 +2256,44 @@ fn write_leader_startup_prompt_event(workspace: &Path, event: &str, fields: serd
     let _ = crate::event_log::EventLog::new(workspace).write(event, fields);
 }
 
+/// A-55 (window rename race): lock the freshly-spawned leader window against
+/// rename — `allow-rename off` (refuse pane-internal OSC title-set renames)
+/// AND `automatic-rename off` (refuse tmux's own command-driven rename). Both
+/// must be set; tmux treats them as independent. Best-effort: a failure must
+/// NOT abort the launcher (old tmux may lack the option) — return the outcome
+/// for audit instead of propagating an error. Returns (result, tmux_stderr).
+fn lock_down_window_rename(
+    transport: &dyn Transport,
+    session: &SessionName,
+    window: &WindowName,
+) -> (String, String) {
+    let allow_rename = transport.set_window_option(session, window, "allow-rename", "off");
+    let automatic_rename = transport.set_window_option(session, window, "automatic-rename", "off");
+    let (result, stderr) = match (&allow_rename, &automatic_rename) {
+        (Ok(()), Ok(())) => ("ok".to_string(), String::new()),
+        (Ok(()), Err(error)) => ("failed".to_string(), error.to_string()),
+        (Err(error), Ok(())) => ("failed".to_string(), error.to_string()),
+        (Err(a), Err(b)) => (
+            "failed".to_string(),
+            format!("allow-rename: {a}; automatic-rename: {b}"),
+        ),
+    };
+    (result, stderr)
+}
+
+/// A-55: audit the rename-lockdown outcome to the event log. Failure does not
+/// abort the launcher; record ok/failed + tmux stderr for regression triage.
+fn write_window_rename_lockdown_event(workspace: &Path, result: &str, stderr: &str) {
+    write_leader_startup_prompt_event(
+        workspace,
+        "leader.launcher.window_rename_lockdown",
+        serde_json::json!({
+            "result": result,
+            "tmux_stderr": stderr,
+        }),
+    );
+}
+
 fn ensure_tmux_installed() -> Result<(), LeaderError> {
     match Command::new("tmux").arg("-V").output() {
         Ok(output) if output.status.success() => Ok(()),
@@ -2350,8 +2398,8 @@ mod tests {
     use super::{
         ensure_managed_provider_live_after_attach, execute_leader_plan_after_ambient_authority,
         format_launcher_failure, handle_exec_provider_startup_prompts,
-        is_interactive_shell_basename, push_bounded_stderr, shlex_quote,
-        VerifiedAmbientPaneAuthority, LEADER_STDERR_LIMIT,
+        is_interactive_shell_basename, lock_down_window_rename, push_bounded_stderr, shlex_quote,
+        write_window_rename_lockdown_event, VerifiedAmbientPaneAuthority, LEADER_STDERR_LIMIT,
     };
 
     struct ScriptedTransport {
@@ -2359,6 +2407,8 @@ mod tests {
         sent: Mutex<Vec<(Target, Vec<Key>)>>,
         liveness: PaneLiveness,
         targets: Vec<PaneInfo>,
+        window_options: Mutex<Vec<(String, String)>>,
+        window_option_error: Mutex<Option<String>>,
     }
 
     impl ScriptedTransport {
@@ -2368,6 +2418,8 @@ mod tests {
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
                 targets: Vec::new(),
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(None),
             }
         }
 
@@ -2377,6 +2429,8 @@ mod tests {
                 sent: Mutex::new(Vec::new()),
                 liveness,
                 targets: Vec::new(),
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(None),
             }
         }
 
@@ -2386,6 +2440,21 @@ mod tests {
                 sent: Mutex::new(Vec::new()),
                 liveness,
                 targets,
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(None),
+            }
+        }
+
+        /// A-55: a ScriptedTransport whose `set_window_option` always fails with
+        /// the given tmux stderr — proves the lockdown never aborts the launcher.
+        fn with_window_option_error(error: &str) -> Self {
+            Self {
+                screens: Mutex::new(Vec::new()),
+                sent: Mutex::new(Vec::new()),
+                liveness: PaneLiveness::Unknown,
+                targets: Vec::new(),
+                window_options: Mutex::new(Vec::new()),
+                window_option_error: Mutex::new(Some(error.to_string())),
             }
         }
 
@@ -2395,6 +2464,14 @@ mod tests {
                 Err(poisoned) => poisoned.into_inner().clone(),
             }
         }
+
+        /// All `set-window-option option value` pairs, in call order.
+        fn window_options(&self) -> Vec<(String, String)> {
+            match self.window_options.lock() {
+                Ok(guard) => guard.clone(),
+                Err(poisoned) => poisoned.into_inner().clone(),
+            }
+        }
     }
 
     impl Transport for ScriptedTransport {
@@ -2511,6 +2588,34 @@ mod tests {
             Ok(SetEnvOutcome::Applied)
         }
 
+        fn set_window_option(
+            &self,
+            _session: &SessionName,
+            _window: &WindowName,
+            option: &str,
+            value: &str,
+        ) -> Result<(), TransportError> {
+            if let Some(stderr) = self
+                .window_option_error
+                .lock()
+                .ok()
+                .and_then(|guard| guard.clone())
+            {
+                return Err(TransportError::Subprocess {
+                    argv: vec!["tmux".to_string(), "set-window-option".to_string()],
+                    code: Some(1),
+                    stderr,
+                });
+            }
+            match self.window_options.lock() {
+                Ok(mut guard) => guard.push((option.to_string(), value.to_string())),
+                Err(poisoned) => poisoned
+                    .into_inner()
+                    .push((option.to_string(), value.to_string())),
+            }
+            Ok(())
+        }
+
         fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
             Ok(())
         }
@@ -2988,4 +3093,64 @@ mod tests {
         assert_eq!(captured.len(), LEADER_STDERR_LIMIT);
         assert!(captured.ends_with(b"XYZ"));
     }
+
+    #[test]
+    fn managed_leader_launch_disables_window_rename() {
+        let transport = ScriptedTransport::with_liveness(PaneLiveness::Live);
+        let session = SessionName::new("team-agent-leader-claude_code-demo");
+        let window = WindowName::new("claude_code");
+
+        let (result, stderr) = lock_down_window_rename(&transport, &session, &window);
+
+        assert_eq!(result, "ok", "both set-window-option calls must succeed");
+        assert!(stderr.is_empty());
+        let options = transport.window_options();
+        assert_eq!(
+            options,
+            vec![
+                ("allow-rename".to_string(), "off".to_string()),
+                ("automatic-rename".to_string(), "off".to_string()),
+            ],
+            "both rename lockdown options must be issued, in order"
+        );
+    }
+
+    #[test]
+    fn launcher_survives_set_window_option_failure() {
+        let workspace =
+            std::env::temp_dir().join(format!("ta-rename-lockdown-fail-{}", std::process::id()));
+        std::fs::create_dir_all(&workspace).unwrap();
+        let transport = ScriptedTransport::with_window_option_error(
+            "set-window-option: unknown option: allow-rename",
+        );
+        let session = SessionName::new("team-agent-leader-claude_code-demo");
+        let window = WindowName::new("claude_code");
+
+        // Lockdown must NOT abort the launcher: it returns a failed outcome
+        // (recorded for audit) instead of propagating an error.
+        let (result, stderr) = lock_down_window_rename(&transport, &session, &window);
+
+        assert_eq!(result, "failed", "a set-window-option failure is audited, not fatal");
+        assert!(
+            stderr.contains("unknown option"),
+            "tmux stderr must surface in the audit payload: {stderr}"
+        );
+
+        // The audit event lands in the workspace event log with result=failed.
+        write_window_rename_lockdown_event(&workspace, &result, &stderr);
+        let events = crate::event_log::EventLog::new(&workspace).tail(0).unwrap();
+        let lockdown = events
+            .iter()
+            .find(|event| {
+                event["event"] == "leader.launcher.window_rename_lockdown"
+            })
+            .expect("rename_lockdown event must be written even on failure");
+        assert_eq!(lockdown["result"], "failed");
+        assert!(
+            lockdown["tmux_stderr"].as_str().unwrap_or_default().contains("unknown option"),
+            "event must carry tmux stderr for regression triage: {lockdown}"
+        );
+
+        std::fs::remove_dir_all(&workspace).ok();
+    }
 }

package/crates/team-agent/src/leader/tests/team_in_team_state_scope_red.rs

@@ -1054,7 +1054,7 @@ fn team_dir(root: &Path, name: &str, agents: &[(&str, &str)]) -> PathBuf {
 
 fn role_doc(name: &str, role: &str) -> String {
     format!(
-        "---\nname: {name}\nrole: {role}\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{role}.\n"
+        "---\nname: {name}\nrole: {role}\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{role}.\n"
     )
 }
 

package/crates/team-agent/src/lifecycle/launch/add_agent.rs

@@ -337,7 +337,6 @@ pub(super) fn add_agent_with_transport_at_paths(
         )));
     }
     inject_agent_into_spec(&mut spec, compiled.agent, &compiled.id)?;
-    let safety = effective_runtime_config(&spec)?;
     // E5 spec 迁移:重编译的 spec 原子写到 .team/runtime/<team_key>/(不落用户目录 team_dir)。
     let spec_path = crate::model::paths::runtime_spec_path(run_workspace, &canonical_team_key);
     // E42 (0.3.24 P0): capture pre-write bytes for atomic rollback. If anything
@@ -362,7 +361,6 @@ pub(super) fn add_agent_with_transport_at_paths(
         agent_id,
         &meta,
         role_file_path,
-        &safety,
     ) {
         rollback_add_agent_atomic(
             run_workspace,

package/crates/team-agent/src/lifecycle/launch/add_agent_state.rs

@@ -116,7 +116,6 @@ pub(super) fn upsert_agent_state_from_role(
     agent_id: &AgentId,
     meta: &Value,
     dynamic_role_file: &Path,
-    safety: &DangerousApproval,
 ) -> Result<(), LifecycleError> {
     let mut state =
         crate::state::projection::select_runtime_state(workspace, Some(canonical_team_key))
@@ -195,7 +194,13 @@ pub(super) fn upsert_agent_state_from_role(
         }
     }
     if let Some(obj) = entry.as_object_mut() {
-        persist_effective_approval_policy(obj, safety);
+        // 0.5.66 bypass 单源:policy 从 role 文档字段派生,不再用全队 `DangerousApproval`。
+        let meta_provider = meta
+            .get("provider")
+            .and_then(Value::as_str)
+            .and_then(crate::provider::wire::parse_provider)
+            .unwrap_or(Provider::Codex);
+        persist_effective_approval_policy_from_yaml_agent(obj, meta, meta_provider);
     }
     agent_map.insert(agent_id.as_str().to_string(), entry);
     crate::lifecycle::restart::remove::clear_agent_retirement_in_state(&mut state, agent_id);

package/crates/team-agent/src/lifecycle/launch/agent_state.rs

@@ -24,7 +24,6 @@ pub(super) fn running_agent_state(
     team_id: &str,
     pane_id: Option<&str>,
     pane_pid: Option<u32>,
-    safety: &DangerousApproval,
     started_agent: Option<&StartedAgent>,
     profile_dir: Option<&Path>,
 ) -> Result<serde_json::Value, LifecycleError> {
@@ -84,7 +83,16 @@ pub(super) fn running_agent_state(
         permissions_json(agent, id, provider)
             .map_err(|e| LifecycleError::Compile(e.to_string()))?,
     );
-    persist_effective_approval_policy(&mut state, safety);
+    // 0.5.66 bypass 单源:policy 从 agent 字段派生,不再用全队 `DangerousApproval`。
+    persist_effective_approval_policy_from_yaml_agent(&mut state, agent, provider);
+    // 0.5.66 bypass 单源 §2.6:fresh spawn 记录运行面 bypass 值(供 restart drift 挡板)。
+    state.insert(
+        "as_launched_dangerously_skip_permissions".to_string(),
+        serde_json::json!(matches!(
+            agent.get("dangerously_skip_permissions"),
+            Some(Value::Bool(true))
+        )),
+    );
     state.insert("session_id".to_string(), serde_json::Value::Null);
     state.insert("rollout_path".to_string(), serde_json::Value::Null);
     state.insert("captured_at".to_string(), serde_json::Value::Null);
@@ -162,3 +170,130 @@ pub(super) fn dangerous_approval_source_str(source: DangerousApprovalSource) ->
         DangerousApprovalSource::Disabled => "disabled",
     }
 }
+
+/// 0.5.66 bypass 单源:从 agent 行 + provider 构造 approval policy JSON
+/// (restart/fork/add 落盘用;取代全队 `DangerousApproval` 派生)。
+pub(crate) fn effective_approval_policy_from_agent(
+    agent: &serde_json::Value,
+    provider: Provider,
+) -> serde_json::Value {
+    let enabled = agent
+        .get("dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false);
+    if !enabled {
+        return serde_json::json!({
+            "enabled": false,
+            "source": "disabled",
+            "inherited": false,
+            "explicit_yes_confirmed": false,
+            "provider": null,
+            "flag": null,
+            "worker_capability_above_leader": false,
+        });
+    }
+    let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+    serde_json::json!({
+        "enabled": true,
+        "source": "runtime_config",
+        "inherited": false,
+        "explicit_yes_confirmed": true,
+        "provider": provider_wire_str(provider),
+        "flag": flag,
+        "worker_capability_above_leader": false,
+    })
+}
+
+fn provider_wire_str(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Fake => "fake",
+    }
+}
+
+/// 0.5.66 bypass 单源:从 agent 行(state Map)+ provider 落盘 approval policy。
+/// 目标与来源是同一 agent 行。
+pub(crate) fn persist_effective_approval_policy_from_agent(
+    agent_state: &mut serde_json::Map<String, serde_json::Value>,
+    provider: Provider,
+) {
+    let agent = serde_json::Value::Object(agent_state.clone());
+    agent_state.insert(
+        "effective_approval_policy".to_string(),
+        effective_approval_policy_from_agent(&agent, provider),
+    );
+}
+
+/// 0.5.66 bypass 单源:yaml spec agent 版(launch/state_projection 用)。
+pub(crate) fn persist_effective_approval_policy_from_yaml_agent(
+    agent_state: &mut serde_json::Map<String, serde_json::Value>,
+    agent: &Value,
+    provider: Provider,
+) {
+    let enabled = matches!(agent.get("dangerously_skip_permissions"), Some(Value::Bool(true)));
+    let policy = if !enabled {
+        serde_json::json!({
+            "enabled": false,
+            "source": "disabled",
+            "inherited": false,
+            "explicit_yes_confirmed": false,
+            "provider": null,
+            "flag": null,
+            "worker_capability_above_leader": false,
+        })
+    } else {
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+        serde_json::json!({
+            "enabled": true,
+            "source": "runtime_config",
+            "inherited": false,
+            "explicit_yes_confirmed": true,
+            "provider": provider_wire_str(provider),
+            "flag": flag,
+            "worker_capability_above_leader": false,
+        })
+    };
+    agent_state.insert("effective_approval_policy".to_string(), policy);
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    fn yaml_agent(bypass: bool) -> Value {
+        crate::model::yaml::loads(&format!(
+            "id: a\nrole: r\nprovider: codex\ndangerously_skip_permissions: {bypass}\n"
+        ))
+        .unwrap()
+    }
+
+    // 0.5.66 bypass 单源 §4.1:true 角色 → policy 落盘为 enabled=true / runtime_config,
+    // 且 running_agent_state 记录 as_launched_dangerously_skip_permissions=true(审计留痕前提)。
+    #[test]
+    fn test_audit_log_written_on_true_spawn() {
+        let mut state = serde_json::Map::new();
+        persist_effective_approval_policy_from_yaml_agent(&mut state, &yaml_agent(true), Provider::Codex);
+        let policy = state.get("effective_approval_policy").unwrap();
+        assert_eq!(policy["enabled"], serde_json::json!(true));
+        assert_eq!(policy["source"], serde_json::json!("runtime_config"));
+        assert_eq!(
+            policy["flag"],
+            serde_json::json!("--dangerously-bypass-approvals-and-sandbox")
+        );
+        // 运行面记录(as-launched)供 restart drift 挡板。
+        let mut run_state = serde_json::Map::new();
+        run_state.insert(
+            "as_launched_dangerously_skip_permissions".to_string(),
+            serde_json::json!(matches!(
+                yaml_agent(true).get("dangerously_skip_permissions"),
+                Some(Value::Bool(true))
+            )),
+        );
+        assert_eq!(run_state["as_launched_dangerously_skip_permissions"], serde_json::json!(true));
+    }
+}

package/crates/team-agent/src/lifecycle/launch/fork_agent.rs

@@ -121,7 +121,7 @@ pub fn fork_agent_with_transport(
         )));
     }
     let model = new_agent.get("model").and_then(Value::as_str);
-    let safety = effective_runtime_config(&new_spec)?;
+    let safety = effective_runtime_config_for_worker_spawn(new_agent, provider)?;
     let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_yaml(
         new_agent,
         Some(as_agent_id.as_str()),
@@ -132,7 +132,6 @@ pub fn fork_agent_with_transport(
     let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
         &command_agent,
         provider,
-        &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     let mcp_config = adapter.mcp_config(auth_mode).map_err(|e| {

package/crates/team-agent/src/lifecycle/launch/fork_finalize.rs

@@ -232,6 +232,11 @@ pub(super) fn finalize_fork_state(
         .and_then(serde_json::Value::as_object_mut)
     {
         persist_effective_approval_policy(agent, input.safety);
+        // 0.5.66 bypass 单源 §2.6:fork fresh spawn 记录运行面 bypass 值。
+        agent.insert(
+            "as_launched_dangerously_skip_permissions".to_string(),
+            serde_json::json!(input.safety.enabled),
+        );
     }
     maybe_fail_fork_after_spawn("save_runtime_state")?;
     crate::state::repository::StateRepository::new(input.workspace)

package/crates/team-agent/src/lifecycle/launch/spawn.rs

@@ -27,7 +27,6 @@ pub(super) fn spawn_agents(
     spec_path: &Path,
     spec: &Value,
     session_name: &SessionName,
-    safety: &DangerousApproval,
     transport: &dyn Transport,
 ) -> Result<Vec<StartedAgent>, LifecycleError> {
     // E5 解耦:team_dir(角色定义 + profiles 所在)≠ spec_path.parent()(spec 已迁出到 .team/runtime)。
@@ -100,9 +99,10 @@ pub(super) fn spawn_agents(
         let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
             &command_agent,
             provider,
-            safety,
         )?;
         let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
+        // 0.5.66 bypass 单源:per-agent safety 只服务 env 注入与审计,不参与 argv 决策。
+        let safety = effective_runtime_config_for_worker_spawn(agent, provider)?;
         let mcp_team_id = runtime_team_key_for_spec(spec_path, spec, session_name);
         let mcp_config = adapter
             .mcp_config(auth_mode)
@@ -283,6 +283,25 @@ pub(super) fn spawn_agents(
                     "spawn_epoch": spawn_epoch,
                 })),
             );
+            // 0.5.66 bypass 单源 §2.7:最终 argv 含 bypass flag → 审计留痕。
+            if matches!(
+                agent.get("dangerously_skip_permissions"),
+                Some(Value::Bool(true))
+            ) {
+                let _ = event_log.write(
+                    "worker.spawn_dangerously_skip_permissions",
+                    serde_json::json!({
+                        "agent_id": agent_id_raw,
+                        "role": agent
+                            .get("role")
+                            .and_then(Value::as_str)
+                            .unwrap_or_default(),
+                        "provider": provider,
+                        "trigger": "launch",
+                        "spec_source_path": agent_id_spec_source_path(workspace, agent_id_raw),
+                    }),
+                );
+            }
         }
         // 0.3.28 Step 4b: replaced the `adaptive_layout_plan` 3-pane tiling
         // with Python-parity 1-window-per-agent placement. Window name =
@@ -381,3 +400,21 @@ pub(super) fn spawn_agents(
     }
     Ok(started)
 }
+
+/// 0.5.66 bypass 单源 §2.7:审计事件里角色 md 的 spec 来源路径(尽力解析,失败空串)。
+pub(crate) fn agent_id_spec_source_path(workspace: &Path, agent_id: &str) -> String {
+    let team_dir = crate::state::persist::load_runtime_state(workspace)
+        .ok()
+        .and_then(|state| {
+            state
+                .get("team_dir")
+                .and_then(serde_json::Value::as_str)
+                .filter(|s| !s.is_empty())
+                .map(PathBuf::from)
+        });
+    team_dir
+        .map(|dir| dir.join("agents").join(format!("{agent_id}.md")))
+        .unwrap_or_else(|| workspace.join(".team/current/agents").join(format!("{agent_id}.md")))
+        .display()
+        .to_string()
+}