@team-agent/installer 0.5.65 → 0.5.66

package/crates/team-agent/src/lifecycle/launch/spec_state.rs

@@ -33,7 +33,6 @@ use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
 
 use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
 
-use super::approval::detect_dangerous_approval;
 use super::identity::spec_display_backend;
 use super::leader_context::{
     attributed_provider_for_pane_across_tmux_sockets, caller_provider_for_seed_with_lookup,
@@ -387,64 +386,86 @@ pub(super) fn spec_default_assignee(spec: &Value) -> Option<AgentId> {
         .or_else(|| spec_agents(spec).into_iter().next())
 }
 
-pub(crate) fn effective_runtime_config(spec: &Value) -> Result<DangerousApproval, LifecycleError> {
-    let enabled = spec
-        .get("runtime")
-        .and_then(|v| v.get("dangerous_auto_approve"))
-        .is_some_and(Value::is_truthy);
-    if enabled {
-        let leader = detect_dangerous_approval()?;
-        Ok(DangerousApproval {
-            enabled: true,
-            source: DangerousApprovalSource::RuntimeConfig,
+/// 0.5.66 bypass 单源:从**单个 agent**(yaml spec)的 `dangerously_skip_permissions` 构造
+/// `DangerousApproval`(取代旧"runtime config + leader argv"全队一份)。
+/// true → source=RuntimeConfig(角色声明即用户明确同意,coordinator 的
+/// `explicit_yes_confirmed` 自动放行);false → Disabled。
+pub(crate) fn effective_runtime_config_for_worker_spawn(
+    agent: &Value,
+    provider: Provider,
+) -> Result<DangerousApproval, LifecycleError> {
+    let enabled = matches!(
+        agent.get("dangerously_skip_permissions"),
+        Some(Value::Bool(true))
+    );
+    if !enabled {
+        return Ok(DangerousApproval {
+            enabled: false,
+            source: DangerousApprovalSource::Disabled,
             inherited: false,
             provider: None,
             flag: None,
-            worker_capability_above_leader: !leader.enabled,
-            ancestry_binary_name: leader.ancestry_binary_name,
+            worker_capability_above_leader: false,
+            ancestry_binary_name: None,
             unexpected_binary: false,
-        })
-    } else {
-        Ok(detect_dangerous_approval()?)
+        });
     }
+    let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+    Ok(DangerousApproval {
+        enabled: true,
+        source: DangerousApprovalSource::RuntimeConfig,
+        inherited: false,
+        provider: Some(provider_display_str(provider).to_string()),
+        flag: flag.map(str::to_string),
+        worker_capability_above_leader: false,
+        ancestry_binary_name: None,
+        unexpected_binary: false,
+    })
 }
 
-pub(crate) fn effective_runtime_config_for_worker_spawn(
+/// 0.5.66 bypass 单源:restart/state 路径的 serde_json 版(agent 来自 state JSON)。
+pub(crate) fn effective_runtime_config_for_worker_spawn_json(
+    agent: &serde_json::Value,
+    provider: Provider,
 ) -> Result<DangerousApproval, LifecycleError> {
-    detect_dangerous_approval()
+    let enabled = agent
+        .get("dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false);
+    if !enabled {
+        return Ok(DangerousApproval {
+            enabled: false,
+            source: DangerousApprovalSource::Disabled,
+            inherited: false,
+            provider: None,
+            flag: None,
+            worker_capability_above_leader: false,
+            ancestry_binary_name: None,
+            unexpected_binary: false,
+        });
+    }
+    let flag = crate::provider::bypass_flags::provider_bypass_flag(provider);
+    Ok(DangerousApproval {
+        enabled: true,
+        source: DangerousApprovalSource::RuntimeConfig,
+        inherited: false,
+        provider: Some(provider_display_str(provider).to_string()),
+        flag: flag.map(str::to_string),
+        worker_capability_above_leader: false,
+        ancestry_binary_name: None,
+        unexpected_binary: false,
+    })
 }
 
-pub(super) fn write_launch_permission_audit(
-    workspace: &Path,
-    safety: &DangerousApproval,
-) -> Result<(), LifecycleError> {
-    crate::event_log::EventLog::new(workspace)
-        .write(
-            "launch.permissions_resolved",
-            serde_json::json!({
-                "dangerous_auto_approve": safety.enabled,
-                "dangerous_auto_approve_source": safety.source,
-                "dangerous_auto_approve_inherited": safety.inherited,
-                "dangerous_auto_approve_provider": safety.provider,
-                "dangerous_auto_approve_flag": safety.flag,
-                "worker_capability_above_leader": safety.worker_capability_above_leader,
-                "ancestry_binary_name": safety.ancestry_binary_name,
-            }),
-        )
-        .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
-    if safety.unexpected_binary {
-        crate::event_log::EventLog::new(workspace)
-            .write(
-                "dangerous_flag_in_unexpected_binary",
-                serde_json::json!({
-                    "provider": safety.provider,
-                    "flag": safety.flag,
-                    "ancestry_binary_name": safety.ancestry_binary_name,
-                }),
-            )
-            .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+pub(crate) fn provider_display_str(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Fake => "fake",
     }
-    Ok(())
 }
 
 pub(super) fn team_workspace(team_dir: &Path) -> PathBuf {
@@ -455,3 +476,39 @@ pub(super) fn team_workspace(team_dir: &Path) -> PathBuf {
             .unwrap_or_else(|| team_dir.to_path_buf())
     })
 }
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+    use crate::model::enums::Provider;
+
+    fn yaml_agent(bypass: bool) -> Value {
+        crate::model::yaml::loads(&format!(
+            "id: a\nrole: r\nprovider: codex\ndangerously_skip_permissions: {bypass}\n"
+        ))
+        .unwrap()
+    }
+
+    // 0.5.66 bypass 单源 §4.1:true → enabled + source=runtime_config(角色声明即明确同意)。
+    #[test]
+    fn test_effective_safety_from_true_field() {
+        let safety =
+            effective_runtime_config_for_worker_spawn(&yaml_agent(true), Provider::Codex).unwrap();
+        assert!(safety.enabled);
+        assert_eq!(safety.source, DangerousApprovalSource::RuntimeConfig);
+        assert_eq!(
+            safety.flag.as_deref(),
+            Some("--dangerously-bypass-approvals-and-sandbox")
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:false → Disabled。
+    #[test]
+    fn test_effective_safety_from_false_field() {
+        let safety =
+            effective_runtime_config_for_worker_spawn(&yaml_agent(false), Provider::Codex).unwrap();
+        assert!(!safety.enabled);
+        assert_eq!(safety.source, DangerousApprovalSource::Disabled);
+    }
+}

package/crates/team-agent/src/lifecycle/launch/state_projection.rs

@@ -28,7 +28,6 @@ pub(super) fn persist_spawn_agent_state(
     session_name: &SessionName,
     transport: &dyn Transport,
     started: &[StartedAgent],
-    safety: &DangerousApproval,
 ) -> Result<(), LifecycleError> {
     let state_path = crate::state::persist::runtime_state_path(workspace);
     let mut state = match crate::state::repository::StateRepository::new(workspace)
@@ -134,7 +133,6 @@ pub(super) fn persist_spawn_agent_state(
                 &team_id,
                 Some(agent_id_to_pane_id(started, id)),
                 pane_pid,
-                safety,
                 started_agent,
                 Some(&profile_dir),
             )?,

package/crates/team-agent/src/lifecycle/launch.rs

@@ -70,6 +70,7 @@ pub fn launch_with_transport_in_workspace(
     transport: &dyn Transport,
 ) -> Result<LaunchReport, LifecycleError> {
     let _ = skip_profile_smoke;
+    let _ = auto_approve; // 0.5.66: bypass 单源后无 runtime.dangerous_auto_approve,`--yes` 为 no-op。
     // 0.5.38 (`.team/artifacts/startup-latency-locate.md` §5): launch.phase
     // timer with monotonic `elapsed_ms` for latency triage.
     let phase_timer = crate::lifecycle::restart::RestartPhaseTimer::start();
@@ -82,14 +83,12 @@ pub fn launch_with_transport_in_workspace(
     let text = std::fs::read_to_string(spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
+    // 0.5.66 §3.2 跨 workspace 兼容警示:leader argv 带 bypass flag 但当前团队
+    // 所有角色都未声明 dangerously_skip_permissions=true → 写 warning 事件不阻塞。
+    // TODO(0.6.0): remove(0.6.0 彻底删源头 A 后此警示无意义)。
+    emit_dangerous_flag_no_role_declared_warning(workspace, &spec);
     phase_timer.emit(workspace, "launch.phase", "compile_spec");
     let session_name = spec_session_name(&spec);
-    let safety = effective_runtime_config(&spec)?;
-    if safety.enabled && !safety.inherited && !auto_approve && !dry_run {
-        return Err(LifecycleError::DangerousApprovalRequired(
-            "runtime dangerous_auto_approve is enabled".to_string(),
-        ));
-    }
     if !dry_run && transport_has_session(transport, &session_name) {
         return Err(LifecycleError::SessionConflict(format!(
             "tmux session already exists: {}",
@@ -103,7 +102,6 @@ pub fn launch_with_transport_in_workspace(
             raw: serde_json::json!({"source": "compiled_spec"}),
         })
         .collect::<Vec<_>>();
-    write_launch_permission_audit(workspace, &safety)?;
     let routes = spec_routes(&spec);
     let started = if dry_run {
         Vec::new()
@@ -114,7 +112,6 @@ pub fn launch_with_transport_in_workspace(
             spec_path,
             &spec,
             &session_name,
-            &safety,
             transport,
         )?;
         persist_spawn_agent_state(
@@ -124,7 +121,6 @@ pub fn launch_with_transport_in_workspace(
             &session_name,
             transport,
             &started,
-            &safety,
         )?;
         // 0.5.38: per-worker timing tags (source="launch") so operators can
         // trace which worker's spawn dominates wall time. Zeros for now on
@@ -181,17 +177,55 @@ pub fn launch_with_transport_in_workspace(
         tmux_endpoint: transport.tmux_endpoint(),
         routes,
         permissions,
-        safety,
         leader_receiver_attached: false,
         session_capture_incomplete_agents: Vec::new(),
     })
 }
 
+/// 0.5.66 §3.2 跨 workspace 升级警示(仅警示,不做行为决策)。
+/// leader argv 含 bypass flag、但当前 spec 所有 agent 都未声明
+/// `dangerously_skip_permissions=true` → 写 `dangerously_flag_present_but_no_role_declared`。
+///
+/// TODO(0.6.0): remove(0.6.0 删源头 A 后此警示无意义)。
+fn emit_dangerous_flag_no_role_declared_warning(workspace: &Path, spec: &Value) {
+    let argv: Vec<String> = std::env::args().collect();
+    emit_dangerous_flag_no_role_declared_warning_with_argv(workspace, spec, &argv);
+}
+
+/// 带显式 argv 的可测版。
+fn emit_dangerous_flag_no_role_declared_warning_with_argv(
+    workspace: &Path,
+    spec: &Value,
+    argv: &[String],
+) {
+    if crate::provider::bypass_flags::detect_bypass_flag_in_argv(argv).is_none() {
+        return;
+    }
+    let any_role_declared = spec_agent_values(spec).iter().any(|agent| {
+        matches!(
+            agent.get("dangerously_skip_permissions"),
+            Some(Value::Bool(true))
+        )
+    });
+    if any_role_declared {
+        return;
+    }
+    let _ = crate::event_log::EventLog::new(workspace).write(
+        "dangerously_flag_present_but_no_role_declared",
+        serde_json::json!({
+            "message": "leader process carries a bypass flag but no role in this team declares \
+                       dangerously_skip_permissions=true; bypass no longer inherits to workers \
+                       (0.5.66 single-source). Declare the field per role to opt in.",
+        }),
+    );
+}
+
 mod plan;
 pub(crate) use plan::{handle_report_result, start_plan};
 
 pub mod spawn;
 pub(super) use spawn::*;
+pub(crate) use spawn::agent_id_spec_source_path;
 
 mod layout;
 pub(super) use layout::*;
@@ -221,7 +255,10 @@ pub(crate) use leader_context::{
 
 mod agent_state;
 pub(super) use agent_state::*;
-pub(crate) use agent_state::{effective_approval_policy, persist_effective_approval_policy};
+pub(crate) use agent_state::{
+    effective_approval_policy, persist_effective_approval_policy,
+    persist_effective_approval_policy_from_agent,
+};
 
 mod mcp_config;
 pub(super) use mcp_config::*;
@@ -266,14 +303,6 @@ pub mod readiness;
 pub(crate) use readiness::launched_team_receiver_is_attached;
 pub(super) use readiness::*;
 
-mod approval;
-pub use approval::detect_dangerous_approval;
-use approval::{
-    binary_matches_provider, binary_name, dangerous_leader_flags,
-    detect_dangerous_approval_in_argv, disabled_dangerous_approval, process_ancestry_argv,
-    process_argv_tokens, process_parent_pid,
-};
-
 mod add_agent;
 pub(super) use add_agent::*;
 pub use add_agent::{add_agent, add_agent_force};
@@ -309,14 +338,81 @@ pub(crate) use ownership::{ensure_owner_allowed, ensure_owner_allowed_for_state,
 
 pub mod spec_state;
 pub(crate) use spec_state::{
-    effective_runtime_config, effective_runtime_config_for_worker_spawn,
     override_spec_session_name, override_spec_workspace, spec_agent_id_set, write_spec_atomic,
 };
+pub(crate) use spec_state::{
+    effective_runtime_config_for_worker_spawn, effective_runtime_config_for_worker_spawn_json,
+};
 use spec_state::{
     env_nonempty, has_positive_caller_leader_env, initial_runtime_state,
     override_spec_display_backend, override_spec_runtime_str,
     seed_launched_owner_from_caller_with_provider_lookup, seed_launched_owner_from_env,
     spec_agent_values, spec_agents, spec_default_assignee, spec_routes, spec_session_name,
-    spec_tasks_json, team_workspace, write_launch_permission_audit, yaml_value_to_json,
+    spec_tasks_json, team_workspace, yaml_value_to_json,
 };
 pub use spec_state::worker_session_name_pub;
+
+#[cfg(test)]
+mod tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    // 0.5.66 §4.1 test_leader_flag_present_but_no_role_true_writes_warning_event:
+    // leader argv 带 bypass flag + 无角色声明 true → 写 warning 事件。
+    #[test]
+    fn test_leader_flag_present_but_no_role_true_writes_warning_event() {
+        let ws = std::env::temp_dir().join(format!(
+            "ta-bypass-warning-test-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&ws);
+        std::fs::create_dir_all(&ws).unwrap();
+        let spec = yaml::loads(
+            "version: 1\nteam: {}\nleader: {}\nagents:\n  - id: a\n    role: r\n    provider: fake\n    dangerously_skip_permissions: false\n",
+        )
+        .unwrap();
+        let argv = vec![
+            "team-agent".to_string(),
+            "--dangerously-skip-permissions".to_string(),
+        ];
+        emit_dangerous_flag_no_role_declared_warning_with_argv(&ws, &spec, &argv);
+        let events = crate::event_log::EventLog::new(&ws).tail(0).unwrap();
+        assert!(
+            events.iter().any(|event| {
+                event.get("event").and_then(serde_json::Value::as_str)
+                    == Some("dangerously_flag_present_but_no_role_declared")
+            }),
+            "leader flag + no role declared must write the warning event; events={events:?}"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
+    // 0.5.66 §4.1 同测试的反向:有角色声明 true → 不写 warning。
+    #[test]
+    fn test_leader_flag_present_but_role_declared_no_warning() {
+        let ws = std::env::temp_dir().join(format!(
+            "ta-bypass-warning-none-test-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&ws);
+        std::fs::create_dir_all(&ws).unwrap();
+        let spec = yaml::loads(
+            "version: 1\nteam: {}\nleader: {}\nagents:\n  - id: a\n    role: r\n    provider: fake\n    dangerously_skip_permissions: true\n",
+        )
+        .unwrap();
+        let argv = vec![
+            "team-agent".to_string(),
+            "--dangerously-skip-permissions".to_string(),
+        ];
+        emit_dangerous_flag_no_role_declared_warning_with_argv(&ws, &spec, &argv);
+        let events = crate::event_log::EventLog::new(&ws).tail(0).unwrap();
+        assert!(
+            !events.iter().any(|event| {
+                event.get("event").and_then(serde_json::Value::as_str)
+                    == Some("dangerously_flag_present_but_no_role_declared")
+            }),
+            "role declared true must suppress the warning; events={events:?}"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+}

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -181,6 +181,31 @@ pub(crate) fn start_agent_at_paths(
         );
     }
     let agent_live = agent_live && (!has_collision || noop_pane.is_some());
+    // 0.5.66 bypass 单源 §2.6 — dangerously_skip_permissions drift 挡板:
+    // Noop 路径不 spawn,若声明面(角色 md / spec)与运行面(as-launched)不一致,
+    // 拒 Noop 报明,防"改了 md 却以为生效、进程仍带旧 bypass 跑着"的暗门。
+    let file_bypass = agent
+        .get("dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool);
+    let launched_bypass = raw_agent
+        .get("as_launched_dangerously_skip_permissions")
+        .and_then(serde_json::Value::as_bool);
+    if !force && agent_live && check_bypass_drift(file_bypass, launched_bypass) {
+        // 0.5.66 bypass 单源 §2.7:Noop drift 拒也写审计事件。
+        let _ = crate::event_log::EventLog::new(workspace).write(
+            "worker.spawn_dangerously_skip_permissions_drift_denied",
+            serde_json::json!({
+                "agent_id": agent_id.as_str(),
+                "file_value": file_bypass,
+                "launched_value": launched_bypass,
+                "action": "noop_denied_require_remove_add_or_force",
+            }),
+        );
+        return Err(LifecycleError::RequirementUnmet(format!(
+            "dangerously_skip_permissions drift for agent {agent_id}: file={file_bypass:?} but running process launched with {launched_bypass:?}. \
+             Run `remove-agent {agent_id}` then `add-agent {agent_id}` to apply, or `restart --force {agent_id}` to accept fresh spawn."
+        )));
+    }
     if !force && agent_live {
         let old_binding = pane_binding_snapshot(&raw_agent);
         let refreshed_binding = noop_pane.as_ref().map(pane_binding_from_live);
@@ -257,7 +282,10 @@ pub(crate) fn start_agent_at_paths(
     };
     let into_existing_session =
         session_live_or_default(transport, &session_name, session_name_present(&state));
-    let safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn()?;
+    let safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn_json(
+        &agent,
+        provider,
+    )?;
     let layout_placement = if adaptive_layout {
         crate::lifecycle::launch::adaptive_existing_placement_for_agent(
             &state,
@@ -323,6 +351,30 @@ pub(crate) fn start_agent_at_paths(
         &safety,
         start_mode,
     )?;
+    // 0.5.66 bypass 单源 §2.7:启动即带 bypass → 审计留痕。
+    if safety.enabled {
+        let state_agent = state
+            .get("agents")
+            .and_then(|v| v.get(agent_id.as_str()));
+        let _ = crate::event_log::EventLog::new(workspace).write(
+            "worker.spawn_dangerously_skip_permissions",
+            serde_json::json!({
+                "agent_id": agent_id.as_str(),
+                "role": state_agent
+                    .and_then(|a| a.get("role"))
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or_default(),
+                "provider": state_agent
+                    .and_then(|a| a.get("provider"))
+                    .and_then(serde_json::Value::as_str)
+                    .unwrap_or_default(),
+                "trigger": "start-agent",
+                "spec_source_path": crate::lifecycle::launch::agent_id_spec_source_path(
+                    workspace, agent_id.as_str(),
+                ),
+            }),
+        );
+    }
     // **0.3.24 add-agent socket drift fix**: keep `state.tmux_endpoint` /
     // `state.tmux_socket` synchronized with the transport actually used for the
     // spawn. Without this, add-agent / fork-agent could spawn to a socket that
@@ -1078,6 +1130,12 @@ fn mark_agent_started(
     // lifecycle/topology fields so absence == UNKNOWN until the next
     // coordinator tick or pane fallback produces a post-spawn observation.
     clear_agent_runtime_activity_observation(agent);
+    // 0.5.66 bypass 单源 §2.6:fresh spawn 那一刻记录运行面 bypass 值,
+    // 供下一次 restart 的 Noop drift 挡板比较。
+    agent.insert(
+        "as_launched_dangerously_skip_permissions".to_string(),
+        serde_json::json!(safety.enabled),
+    );
     // S1-CAPTURE-001 (0.4.8, CR M3 provider-agnostic): on a Fresh /
     // FreshAfterMissingRollout start, the prior session's authoritative
     // capture tuple MUST be cleared before persist_command_plan_state
@@ -1609,7 +1667,6 @@ fn write_start_agent_start_event(
     let adapter = crate::provider::get_adapter(provider);
     // Contract C / F6.4: event log must record the same context-aware argv that the
     // actual spawn used — so the role/tools/MCP context appears in `start_agent.agent_start`.
-    let safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn()?;
     let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_json(
         agent,
         Some(agent_id.as_str()),
@@ -1620,7 +1677,6 @@ fn write_start_agent_start_event(
     let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
         &command_agent,
         provider,
-        &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     let mcp_config = adapter
@@ -1831,6 +1887,17 @@ fn write_reset_complete_event(
     Ok(())
 }
 
+/// 0.5.66 bypass 单源 §2.6:声明面(file)与运行面(as-launched)是否 drift。
+/// 缺 as-launched(从未 spawn)= 视为未启动,不 drift(首次 Noop 无进程可比)。
+fn check_bypass_drift(file: Option<bool>, launched: Option<bool>) -> bool {
+    match (file, launched) {
+        (Some(file), Some(launched)) => file != launched,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1907,4 +1974,23 @@ mod tests {
             "other-agent collision checks must also include tmux_socket"
         );
     }
+
+    // 0.5.66 bypass 单源 §4.1:Noop drift 检测——声明面与运行面不一致 → drift。
+    #[test]
+    fn test_restart_noop_denied_on_drift() {
+        // file=true, launched=false → drift(改了 md 升 bypass 但进程没带)。
+        assert!(check_bypass_drift(Some(true), Some(false)));
+        // file=false, launched=true → drift(改了 md 撤 bypass 但进程还带着)。
+        assert!(check_bypass_drift(Some(false), Some(true)));
+    }
+
+    // 0.5.66 bypass 单源 §4.1:无 drift 或从未 spawn(as-launched 缺)→ 不拒。
+    #[test]
+    fn test_restart_fresh_spawn_after_drift_uses_file_value() {
+        assert!(!check_bypass_drift(Some(true), Some(true)));
+        assert!(!check_bypass_drift(Some(false), Some(false)));
+        // 从未 spawn:as-launched 缺失 → 不 drift(首次 Noop 无进程可比)。
+        assert!(!check_bypass_drift(Some(true), None));
+        assert!(!check_bypass_drift(None, None));
+    }
 }

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -213,7 +213,10 @@ pub(super) fn spawn_agent_window(
     let safety = if let Some(safety) = safety {
         safety
     } else {
-        detected_safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn()?;
+        detected_safety = crate::lifecycle::launch::effective_runtime_config_for_worker_spawn_json(
+            agent,
+            provider,
+        )?;
         &detected_safety
     };
     let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_json(
@@ -226,7 +229,6 @@ pub(super) fn spawn_agent_window(
     let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
         &command_agent,
         provider,
-        safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     // owner_team_id resolution priority (Issue 2 fix):
@@ -591,6 +593,8 @@ fn merge_command_context_fields(
         "effort",
         "profile",
         "permission_mode",
+        // 0.5.66 bypass 单源:rehydrate 同步合入,restart 的 safety 构造读到新值。
+        "dangerously_skip_permissions",
     ] {
         if let Some(value) = spec_agent.get(field).and_then(yaml_value_to_json) {
             obj.insert(field.to_string(), value);
@@ -799,13 +803,6 @@ pub(super) fn lifecycle_worker_tmux_backend_for_state(
         .backend
 }
 
-pub(super) fn persist_effective_approval_policy_for_restart(
-    agent: &mut serde_json::Map<String, serde_json::Value>,
-    safety: &DangerousApproval,
-) {
-    crate::lifecycle::launch::persist_effective_approval_policy(agent, safety);
-}
-
 pub(super) fn save_restart_projected_state(
     workspace: &Path,
     state: &mut serde_json::Value,