@team-agent/installer 0.5.65 → 0.5.66

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -270,7 +270,6 @@ fn restart_with_selected_team_and_transport(
     let spec_workspace = runtime_spec.parent().ok_or_else(|| {
         LifecycleError::TeamSelect("active team spec workspace not found".to_string())
     })?;
-    let safety = crate::lifecycle::launch::effective_runtime_config(&spec)?;
     // Bug 1 (0.4.2 P0): the rebuilt spec is the single source of truth for the
     // active roster. Any agent in state.agents that is NOT in the rebuilt
     // spec is a stale leftover (role doc was deleted between sessions) and
@@ -526,7 +525,6 @@ fn restart_with_selected_team_and_transport(
             &selected.team_key,
             &session_name,
             transport,
-            &safety,
             tmux_endpoint_source,
             &state,
         )
@@ -551,12 +549,25 @@ fn restart_with_selected_team_and_transport(
         if let Some(parallel_result) = parallel_result {
             match parallel_result {
                 Ok(pspawn) => {
+                    let raw_agent = state
+                        .get("agents")
+                        .and_then(|v| v.get(decision.agent_id.as_str()))
+                        .cloned()
+                        .unwrap_or(serde_json::Value::Null);
+                    let rehydrated = rehydrate_agent_command_context_from_spec(
+                        spec_workspace,
+                        &decision.agent_id,
+                        &raw_agent,
+                    );
+                    let launched_bypass = matches!(
+                        rehydrated.get("dangerously_skip_permissions"),
+                        Some(serde_json::Value::Bool(true))
+                    );
                     apply_marked_respawn(
                         &selected.run_workspace,
                         &selected.team_key,
                         &mut state,
                         transport,
-                        &safety,
                         &phase_timer,
                         decision,
                         &pspawn.spawn,
@@ -565,6 +576,7 @@ fn restart_with_selected_team_and_transport(
                         &mut successful_agents,
                         &mut failed_agents,
                         &mut fatal_resume_failure,
+                        launched_bypass,
                     );
                 }
                 Err(error) => {
@@ -709,7 +721,7 @@ fn restart_with_selected_team_and_transport(
             session_id,
             session_live,
             transport,
-            Some(&safety),
+            None,
             layout_placement.as_ref(),
             None,
             tmux_endpoint_source,
@@ -737,6 +749,10 @@ fn restart_with_selected_team_and_transport(
             }
         };
         let verify_start = std::time::Instant::now();
+        let launched_bypass = matches!(
+            agent.get("dangerously_skip_permissions"),
+            Some(serde_json::Value::Bool(true))
+        );
         if let Err(error) = verify_spawned_agent_live(&decision.agent_id, &spawn, transport)
             .and_then(|_| {
                 mark_agent_respawned(
@@ -745,7 +761,7 @@ fn restart_with_selected_team_and_transport(
                     decision.restart_mode,
                     &spawn,
                     transport,
-                    &safety,
+                    launched_bypass,
                 )
             })
         {
@@ -787,7 +803,16 @@ fn restart_with_selected_team_and_transport(
             .and_then(|agents| agents.get_mut(decision.agent_id.as_str()))
             .and_then(serde_json::Value::as_object_mut)
         {
-            persist_effective_approval_policy_for_restart(agent, &safety);
+            // 0.5.66 bypass 单源:policy 从 agent 行字段派生。
+            let agent_provider = agent
+                .get("provider")
+                .and_then(serde_json::Value::as_str)
+                .and_then(crate::provider::wire::parse_canonical_provider)
+                .unwrap_or(crate::model::enums::Provider::Codex);
+            crate::lifecycle::launch::persist_effective_approval_policy_from_agent(
+                agent,
+                agent_provider,
+            );
         }
         // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
         // pair the state-side activity clear with a DB `agent_health` clear so
@@ -1958,7 +1983,7 @@ fn mark_agent_respawned(
     restart_mode: StartMode,
     spawn: &SpawnedAgentWindow,
     transport: &dyn crate::transport::Transport,
-    safety: &DangerousApproval,
+    launched_bypass: bool,
 ) -> Result<(), LifecycleError> {
     let Some(agent) = state
         .get_mut("agents")
@@ -2081,7 +2106,18 @@ fn mark_agent_respawned(
         }
     }
     crate::lifecycle::launch::persist_command_plan_state(agent, &spawn.plan, &spawn.profile_launch);
-    persist_effective_approval_policy_for_restart(agent, safety);
+    // 0.5.66 bypass 单源:policy 从 agent 行字段派生,不再用全队 `DangerousApproval`。
+    let agent_provider = agent
+        .get("provider")
+        .and_then(serde_json::Value::as_str)
+        .and_then(crate::provider::wire::parse_canonical_provider)
+        .unwrap_or(crate::model::enums::Provider::Codex);
+    crate::lifecycle::launch::persist_effective_approval_policy_from_agent(agent, agent_provider);
+    // 0.5.66 bypass 单源 §2.6:fresh spawn(restart)记录运行面 bypass 值。
+    agent.insert(
+        "as_launched_dangerously_skip_permissions".to_string(),
+        serde_json::json!(launched_bypass),
+    );
     if let Some(placement) = spawn.layout_placement.as_ref() {
         agent.insert(
             "layout_window".to_string(),
@@ -2510,7 +2546,6 @@ fn run_bounded_parallel_worker_spawns(
     team_key: &str,
     session_name: &SessionName,
     transport: &(dyn crate::transport::Transport),
-    safety: &DangerousApproval,
     tmux_endpoint_source: Option<&str>,
     state: &serde_json::Value,
 ) -> Vec<Option<Result<ParallelSpawnResult, String>>> {
@@ -2589,7 +2624,7 @@ fn run_bounded_parallel_worker_spawns(
         first_input.session_id.as_ref(),
         first_session_live,
         transport,
-        Some(safety),
+        None,
         first_input.layout_placement.as_ref(),
         None,
         tmux_endpoint_source,
@@ -2673,7 +2708,7 @@ fn run_bounded_parallel_worker_spawns(
                     input.session_id.as_ref(),
                     /* into_existing_session */ true,
                     transport,
-                    Some(safety),
+                    None,
                     input.layout_placement.as_ref(),
                     None,
                     tmux_endpoint_source,
@@ -2716,7 +2751,6 @@ fn apply_marked_respawn(
     team_key: &str,
     state: &mut serde_json::Value,
     transport: &(dyn crate::transport::Transport),
-    safety: &DangerousApproval,
     phase_timer: &RestartPhaseTimer,
     decision: &RestartedAgent,
     spawn: &SpawnedAgentWindow,
@@ -2725,6 +2759,7 @@ fn apply_marked_respawn(
     successful_agents: &mut Vec<RestartedAgent>,
     failed_agents: &mut Vec<RestartFailedAgent>,
     fatal_resume_failure: &mut bool,
+    launched_bypass: bool,
 ) {
     let verify_start = std::time::Instant::now();
     if let Err(error) =
@@ -2735,7 +2770,7 @@ fn apply_marked_respawn(
                 decision.restart_mode,
                 spawn,
                 transport,
-                safety,
+                launched_bypass,
             )
         })
     {
@@ -2776,7 +2811,16 @@ fn apply_marked_respawn(
         .and_then(|agents| agents.get_mut(decision.agent_id.as_str()))
         .and_then(serde_json::Value::as_object_mut)
     {
-        persist_effective_approval_policy_for_restart(agent, safety);
+        // 0.5.66 bypass 单源:policy 从 agent 行字段派生。
+        let agent_provider = agent
+            .get("provider")
+            .and_then(serde_json::Value::as_str)
+            .and_then(crate::provider::wire::parse_canonical_provider)
+            .unwrap_or(crate::model::enums::Provider::Codex);
+        crate::lifecycle::launch::persist_effective_approval_policy_from_agent(
+            agent,
+            agent_provider,
+        );
     }
     let _ = crate::db::agent_health_capture::clear_agent_health_observation(
         run_workspace,
@@ -3728,7 +3772,7 @@ tasks:
             StartMode::Resumed,
             &spawn,
             &RespawnEpochTransport,
-            &disabled_safety(),
+            false,
         )
         .expect("mark respawned");
 

package/crates/team-agent/src/lifecycle/tests/acceptance_b_batch_red.rs

@@ -393,7 +393,7 @@ fn write_min_team(ws: &Path, name: &str) -> PathBuf {
     .unwrap();
     std::fs::write(
         team.join("agents/worker_a.md"),
-        "---\nname: worker_a\nrole: Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker.\n",
+        "---\nname: worker_a\nrole: Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker.\n",
     )
     .unwrap();
     team

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -330,7 +330,7 @@ fn add_agent_joins_w2_into_running_roster_and_existing_session() {
     let role_file = team_dir.join("w2-role.md");
     std::fs::write(
         &role_file,
-        "---\nname: w2\nrole: Worker Two\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker two.\n",
+        "---\nname: w2\nrole: Worker Two\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker two.\n",
     )
     .unwrap();
     let transport = OfflineTransport::new().with_session_present(true);

package/crates/team-agent/src/lifecycle/tests/behavioral_diff_264_red.rs

@@ -528,7 +528,7 @@ fn write_team(workspace: &Path, fixture: &TeamFixture<'_>) -> PathBuf {
         std::fs::write(
             team.join("agents").join(format!("{}.md", agent.id)),
             format!(
-                "---\nname: {}\nrole: {}\nprovider: {}\n{model}auth_mode: {}\n{profile}tools:\n{tools}---\n\n{}\n",
+                "---\nname: {}\nrole: {}\nprovider: {}\n{model}auth_mode: {}\n{profile}dangerously_skip_permissions: false\ntools:\n{tools}---\n\n{}\n",
                 agent.id, agent.role, agent.provider, agent.auth_mode, agent.body
             ),
         )

package/crates/team-agent/src/lifecycle/tests/claude_compatible_config_red.rs

@@ -152,14 +152,14 @@ fn write_claude_profile_team(ws: &Path, team_key: &str, agent_id: &str) -> PathB
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {team_key}\nobjective: Claude compatible config contract.\nprovider: claude\nauth_mode: compatible_api\n---\n\nTeam.\n"
+            "---\nname: {team_key}\nobjective: Claude compatible config contract.\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\n---\n\nTeam.\n"
         ),
     )
     .unwrap();
     std::fs::write(
         team.join("agents").join(format!("{agent_id}.md")),
         format!(
-            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
         ),
     )
     .unwrap();

package/crates/team-agent/src/lifecycle/tests/claude_profile_launch_red.rs

@@ -218,14 +218,14 @@ fn write_claude_profile_team(ws: &Path, team_key: &str, agent_id: &str) -> PathB
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {team_key}\nobjective: Claude compatible profile launch contract.\nprovider: claude\nauth_mode: compatible_api\n---\n\nTeam.\n"
+            "---\nname: {team_key}\nobjective: Claude compatible profile launch contract.\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\n---\n\nTeam.\n"
         ),
     )
     .unwrap();
     std::fs::write(
         team.join("agents").join(format!("{agent_id}.md")),
         format!(
-            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
         ),
     )
     .unwrap();
@@ -247,14 +247,14 @@ fn write_claude_subscription_profile_team(ws: &Path, team_key: &str, agent_id: &
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {team_key}\nobjective: Claude subscription profile launch contract.\nprovider: claude\nauth_mode: subscription\n---\n\nTeam.\n"
+            "---\nname: {team_key}\nobjective: Claude subscription profile launch contract.\nprovider: claude\nauth_mode: subscription\ndangerously_skip_permissions: false\n---\n\nTeam.\n"
         ),
     )
     .unwrap();
     std::fs::write(
         team.join("agents").join(format!("{agent_id}.md")),
         format!(
-            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: subscription\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+            "---\nname: {agent_id}\nrole: Claude Worker\nprovider: claude\nauth_mode: subscription\ndangerously_skip_permissions: false\nprofile: local\nmodel: null\ntools:\n  - mcp_team\n---\n\nWorker.\n"
         ),
     )
     .unwrap();

package/crates/team-agent/src/lifecycle/tests/clone_fork_copilot_perms_red.rs

@@ -304,7 +304,7 @@ fn write_team_docs(workspace: &Path, provider: &str) {
     std::fs::write(
         workspace.join("agents").join(format!("{SOURCE}.md")),
         format!(
-            "---\nname: {SOURCE}\nrole: {SOURCE}\nprovider: {provider}\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{SOURCE} body.\n"
+            "---\nname: {SOURCE}\nrole: {SOURCE}\nprovider: {provider}\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{SOURCE} body.\n"
         ),
     )
     .expect("write source role doc");
@@ -323,7 +323,7 @@ fn write_copilot_team_docs(workspace: &Path) -> PathBuf {
     std::fs::write(
         team_dir.join("agents").join(format!("{SOURCE}.md")),
         format!(
-            "---\nname: {SOURCE}\nrole: Copilot Worker\nprovider: copilot\nmodel: gpt-5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nCopilot source body.\n"
+            "---\nname: {SOURCE}\nrole: Copilot Worker\nprovider: copilot\nmodel: gpt-5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nCopilot source body.\n"
         ),
     )
     .expect("write source role doc");
@@ -502,20 +502,16 @@ fn r8_copilot_fork_is_no_longer_capability_refused() {
 }
 
 /// R7 permission-clamp GUARDRAIL — a fork's effective approval policy is derived
-/// from the LEADER and never escalates above it (MUST-16). Naturally green at
-/// baseline (the role model forces permission_mode=restricted and inherits
-/// approval from the leader); its teeth engage after implement recompiles the
-/// role via RoleSourceResolver — any raw clone of a compiled permission above the
-/// leader trips it. The true escalation scenario (a source declaring capability
-/// above the leader) is a real-machine concern.
+/// from the LEADER and never escalates above it (MUST-16). 0.5.66 bypass 单源:
+/// fork 的 approval policy 由源角色的 `dangerously_skip_permissions` 派生
+/// (本 fixture = false → `source=disabled`),不再依赖 leader argv 继承。任何
+/// fork 都不得出现 `source=leader_process`(旧模型已删)或 capability 高于源。
 #[test]
 fn r7_fork_effective_permissions_are_clamped_to_leader_guardrail() {
     // Claude source + success-path backing shim so the fork COMPLETES and a NEW
-    // row exists to inspect — no vacuous pass on a refused fork. The dangerous
-    // leader is established by the PINNED ancestry seam (see ANCESTRY_ENV note):
-    // `source=leader_process` is only correct when a dangerous ancestor is
-    // actually detected, so the fixture must supply one instead of borrowing
-    // the host's.
+    // row exists to inspect — no vacuous pass on a refused fork. The source role
+    // declares `dangerously_skip_permissions: false`, so the fork's policy must
+    // resolve to `disabled` (fail-closed) — the new single-source model.
     let case = Case::start("cf-r7");
     let fork = case.fork(NEW);
     assert_eq!(
@@ -538,11 +534,17 @@ fn r7_fork_effective_permissions_are_clamped_to_leader_guardrail() {
     let above = policy
         .get("worker_capability_above_leader")
         .and_then(Value::as_bool);
-    assert_eq!(
+    assert_ne!(
         source,
         Some("leader_process"),
-        "guardrail: a fork's effective approval policy must be derived from the leader \
-         (source=leader_process), not raw-cloned from the source; MUST-16. policy={policy}"
+        "0.5.66: fork policy must never be leader_process (old ancestry model removed); \
+         policy={policy}"
+    );
+    assert_eq!(
+        source,
+        Some("disabled"),
+        "guardrail: a fork's approval policy derives from the role's dangerously_skip_permissions \
+         (false → disabled), never raw-cloned escalation; MUST-16. policy={policy}"
     );
     assert_ne!(
         above,
@@ -552,18 +554,9 @@ fn r7_fork_effective_permissions_are_clamped_to_leader_guardrail() {
     );
 }
 
-/// R7b reverse positive control — with a pinned RESTRICTED leader ancestry the
-/// fork's policy must resolve to `source=disabled` (fail-closed), never
-/// `leader_process`, and still never escalate. This is the CI-truth face of the
-/// clamp (a clean runner == no dangerous ancestor) and proves r7 does not pass
-/// by constant behavior: the same fixture flips leader_process↔disabled purely
-/// on the pinned seam. Mirrors the deterministic product contract
-/// `lifecycle/tests/core.rs` (clean mocked ancestry → Disabled).
-///
-/// NOTE deliberately NOT asserted with the seam UNSET: unpinned, the policy is
-/// a function of the host process tree (the exact non-hermeticity this
-/// revision removes), so an unset-seam assertion would be red on any host
-/// whose own leader runs dangerously.
+/// R7b reverse positive control — same source role (dangerously_skip_permissions:
+/// false) must also resolve to `source=disabled` under any ancestry seam. 0.5.66
+/// 起 policy 与 leader argv 无关:source 恒 `disabled`,fork 恒不升级(MUST-16)。
 #[test]
 fn r7b_fork_policy_under_restricted_leader_ancestry_is_disabled() {
     let case = Case::start_with_ancestry("cf-r7b", RESTRICTED_LEADER_ARGV);
@@ -587,16 +580,15 @@ fn r7b_fork_policy_under_restricted_leader_ancestry_is_disabled() {
     assert_eq!(
         policy.get("source").and_then(Value::as_str),
         Some("disabled"),
-        "reverse control: a restricted/clean leader ancestry must resolve to source=disabled \
-         (fail-closed), never leader_process. policy={policy}"
+        "fail-closed: source role declares dangerously_skip_permissions=false → fork policy must \
+         be disabled; policy={policy}"
     );
     assert_ne!(
         policy
             .get("worker_capability_above_leader")
             .and_then(Value::as_bool),
         Some(true),
-        "reverse control: a restricted leader must never yield a fork above the leader; MUST-16. \
-         policy={policy}"
+        "a fork must never yield a capability above the source; MUST-16. policy={policy}"
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/communication_mode_runtime_contract_red.rs

@@ -246,7 +246,7 @@ fn fixture(tag: &str, team_mode: Option<&str>) -> PathBuf {
         std::fs::write(
             root.join("agents").join(format!("worker_{id}.md")),
             format!(
-                "---\nname: worker_{id}\nrole: Communication Worker\nprovider: claude\ncommunication_mode: {id}\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL {id}\n"
+                "---\nname: worker_{id}\nrole: Communication Worker\nprovider: claude\ndangerously_skip_permissions: false\ncommunication_mode: {id}\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL {id}\n"
             ),
         )
         .unwrap();
@@ -265,7 +265,7 @@ fn default_fixture(tag: &str) -> PathBuf {
     }
     std::fs::write(
         root.join("agents").join("worker_default.md"),
-        "---\nname: worker_default\nrole: Communication Worker\nprovider: claude\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL default\n",
+        "---\nname: worker_default\nrole: Communication Worker\nprovider: claude\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nROLE BODY SENTINEL default\n",
     )
     .unwrap();
     root

package/crates/team-agent/src/lifecycle/tests/copilot_provider_red.rs

@@ -229,8 +229,9 @@ team_orchestrator or @<.team/runtime/mcp/worker_a.json>; got {value:?}"
 }
 
 /// Face 1 dangerous tier (C-5-1, verdict `dangerous_auto_approve_argv_contains_allow_all`):
-/// dangerous_auto_approve must map to `--allow-all` (claude --dangerously-skip-permissions
-/// parity, paths+urls included) — NOT the silently-narrower `--allow-all-tools`.
+/// role `dangerously_skip_permissions: true` must map to `--allow-all` (claude
+/// `--dangerously-skip-permissions` parity, paths+urls included) — NOT the
+/// silently-narrower `--allow-all-tools`. 0.5.66 bypass 单源:bypass 由角色字段驱动。
 #[test]
 #[serial(env)]
 fn copilot_argv_dangerous_maps_to_allow_all() {
@@ -254,7 +255,7 @@ fn copilot_argv_dangerous_maps_to_allow_all() {
     let mut failures = Vec::new();
     if !argv.iter().any(|arg| arg == "--allow-all") {
         failures.push(format!(
-            "C-5-1: dangerous_auto_approve must produce `--allow-all` (=--yolo, claude \
+            "C-5-1: dangerously_skip_permissions=true must produce `--allow-all` (=--yolo, claude \
 parity incl. paths+urls); argv={argv:?}"
         ));
     }
@@ -1101,8 +1102,8 @@ fn copilot_subscription_model_precedence_role_over_profile() {
     // point the agent at the profile
     let agent_md = team_dir.join("agents/worker_a.md");
     let body = std::fs::read_to_string(&agent_md).unwrap().replace(
-        "auth_mode: subscription\n",
-        "auth_mode: subscription\nprofile: subm\n",
+        "auth_mode: subscription\ndangerously_skip_permissions: false\n",
+        "auth_mode: subscription\ndangerously_skip_permissions: false\nprofile: subm\n",
     );
     std::fs::write(&agent_md, body).unwrap();
     seed_healthy_coordinator(&ws);
@@ -1387,7 +1388,7 @@ fn write_copilot_byok_team(ws: &Path, name: &str, model: Option<&str>) -> PathBu
     std::fs::write(
         team.join("agents/worker_a.md"),
         format!(
-            "---\nname: worker_a\nrole: Copilot Worker\nprovider: copilot\n{model_field}auth_mode: compatible_api\nprofile: byok\ntools:\n  - mcp_team\n---\n\nCOPILOT ROLE BODY SENTINEL: BYOK worker.\n"
+            "---\nname: worker_a\nrole: Copilot Worker\nprovider: copilot\n{model_field}auth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: byok\ntools:\n  - mcp_team\n---\n\nCOPILOT ROLE BODY SENTINEL: BYOK worker.\n"
         ),
     )
     .unwrap();
@@ -1412,15 +1413,16 @@ fn write_copilot_team(ws: &Path, name: &str, tools: &[&str], dangerous: bool) ->
     let _ = TeamOpts;
     let team = ws.join(name);
     std::fs::create_dir_all(team.join("agents")).unwrap();
-    let dangerous_line = if dangerous {
-        "dangerous_auto_approve: true\n"
+    // 0.5.66 bypass 单源:bypass 由角色字段驱动,不再是 TEAM.md dangerous_auto_approve。
+    let role_bypass = if dangerous {
+        "true"
     } else {
-        ""
+        "false"
     };
     std::fs::write(
         team.join("TEAM.md"),
         format!(
-            "---\nname: {name}\nobjective: copilot provider contract fixture.\nprovider: copilot\n{dangerous_line}---\n\nTeam fixture.\n"
+            "---\nname: {name}\nobjective: copilot provider contract fixture.\nprovider: copilot\n---\n\nTeam fixture.\n"
         ),
     )
     .unwrap();
@@ -1431,7 +1433,7 @@ fn write_copilot_team(ws: &Path, name: &str, tools: &[&str], dangerous: bool) ->
     std::fs::write(
         team.join("agents/worker_a.md"),
         format!(
-            "---\nname: worker_a\nrole: Copilot Worker\nprovider: copilot\nmodel: gpt-5\nauth_mode: subscription\ntools:\n{tool_lines}---\n\nCOPILOT ROLE BODY SENTINEL: serve the copilot adapter contract.\n"
+            "---\nname: worker_a\nrole: Copilot Worker\nprovider: copilot\nmodel: gpt-5\nauth_mode: subscription\ndangerously_skip_permissions: {role_bypass}\ntools:\n{tool_lines}---\n\nCOPILOT ROLE BODY SENTINEL: serve the copilot adapter contract.\n"
         ),
     )
     .unwrap();

package/crates/team-agent/src/lifecycle/tests/core.rs

@@ -1010,24 +1010,6 @@ fn quick_start_empty_dir_returns_typed_report_not_error_path_only() {
     }
 }
 
-// ───────────────────────────────────────────────────────────────────────
-// detect_dangerous_approval — launch/config.py
-// 默认进程(无 --dangerously-* 祖先)→ enabled=false / source=Disabled / inherited=false。
-// launch 在 inherited=false 且无 --yes 时 raise DangerousApprovalRequired(core.py:120)。
-// ───────────────────────────────────────────────────────────────────────
-
-#[test]
-#[serial_test::serial(env)]
-fn detect_dangerous_approval_clean_process_is_disabled() {
-    // Explicit mock ancestry keeps the test independent from the real Codex/CI
-    // process tree that runs cargo.
-    let _ancestry = EnvVarGuard::set("TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON", "[]");
-    let got = detect_dangerous_approval().expect("探测祖先链应 Ok");
-    assert!(!got.enabled, "干净进程不应启用危险审批");
-    assert_eq!(got.source, DangerousApprovalSource::Disabled);
-    assert!(!got.inherited);
-}
-
 #[test]
 #[serial_test::serial(env)]
 fn leader_pane_env_absent_pane_fails_fast() {

package/crates/team-agent/src/lifecycle/tests/core_034_real_red.rs

@@ -746,7 +746,7 @@ fn write_team(
         std::fs::write(
             team.join("agents").join(format!("{}.md", agent.id)),
             format!(
-                "---\nname: {}\nrole: {}\nprovider: {}\nmodel: fake\nauth_mode: subscription\ntools:\n{}---\n\n{}\n",
+                "---\nname: {}\nrole: {}\nprovider: {}\nmodel: fake\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n{}---\n\n{}\n",
                 agent.id, agent.role, agent.provider, tools, agent.body
             ),
         )

package/crates/team-agent/src/lifecycle/tests/display_adaptive_red.rs

@@ -358,7 +358,7 @@ impl DisplayFixture {
             std::fs::write(
                 team.join("agents").join(format!("{worker}.md")),
                 format!(
-                    "---\nname: {worker}\nrole: Adaptive fake worker {worker}\nprovider: fake\nmodel: fake\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nWorker.\n"
+                    "---\nname: {worker}\nrole: Adaptive fake worker {worker}\nprovider: fake\nmodel: fake\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nWorker.\n"
                 ),
             )
             .unwrap();

package/crates/team-agent/src/lifecycle/tests/f032_startup_prompt_best_effort_red.rs

@@ -27,7 +27,7 @@ static SEQ: AtomicU32 = AtomicU32::new(0);
 
 const TEAM_MD: &str =
     "---\nname: f032team\nobjective: F032 lifecycle prompt fault probe.\nprovider: codex\n---\n\nF032.\n";
-const ROLE_MD: &str = "---\nname: implementer\nrole: Implementation Engineer\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nImplement.\n";
+const ROLE_MD: &str = "---\nname: implementer\nrole: Implementation Engineer\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nImplement.\n";
 
 #[test]
 fn f032_launch_spawn_path_treats_startup_prompt_panic_as_best_effort() {

package/crates/team-agent/src/lifecycle/tests/harvest2_a_batch_red.rs

@@ -422,7 +422,10 @@ check behind it = false green); it must reflect an actual doctor result"
 /// T3-2 (claude_auth_hint parse failure): when `claude auth status` output is
 /// unparseable / unsuccessful, the hint must not default to Present (auth misreported
 /// as available). PATH-shims a `claude` that prints garbage and exits non-zero.
+/// Mutates the process-global PATH/HOME — must not race host_cotenant's ps/tmux
+/// shims (P0 pid-probe isolation), hence `#[serial(pid_probe)]`.
 #[test]
+#[serial(pid_probe)]
 fn t3_claude_auth_hint_parse_failure_is_not_present() {
     let home = tmp_ws("t3-auth-home");
     let shim_dir = home.join("bin");

package/crates/team-agent/src/lifecycle/tests/host_cotenant_death_p0_contract.rs

@@ -65,7 +65,7 @@ const POLLUTED_CALLER_AUTHORITY_ENVS: &[&str] = &[
 ];
 
 #[test]
-#[serial(env)]
+#[serial(env, pid_probe)]
 fn polluted_caller_env_never_authorizes_teardown_to_kill_foreign_tmux() {
     let env = hermetic_guard::HermeticTestEnv::enter("p0-caller-env-sentinel");
     let shim_dir = env.root().join("bin");
@@ -150,7 +150,7 @@ exec "$TEAM_AGENT_TEST_REAL_TMUX" "$@"
 }
 
 #[test]
-#[serial(env)]
+#[serial(env, pid_probe)]
 fn restart_allow_fresh_does_not_leave_same_role_host_cotenants() {
     let mut failures = Vec::new();
     let (env, workspace) = team_case("p0-restart", &["developer", "test-engineer", "arch-reviewer"]);
@@ -677,7 +677,7 @@ fn write_team_docs(workspace: &Path, workers: &[(&str, &str)]) {
     fs::create_dir_all(workspace.join("agents")).unwrap();
     fs::write(workspace.join("TEAM.md"), "---\nname: current\nobjective: P0 host co-tenant contract.\nprovider: codex\n---\n").unwrap();
     for (worker, model) in workers {
-        let role = format!("---\nname: {worker}\nrole: {worker}\nprovider: codex\nmodel: {model}\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\n{worker}.\n");
+        let role = format!("---\nname: {worker}\nrole: {worker}\nprovider: codex\nmodel: {model}\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\n{worker}.\n");
         fs::write(workspace.join("agents").join(format!("{worker}.md")), role).unwrap();
     }
 }

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -3,7 +3,7 @@ use super::*;
 
 // ═════════════════════════════════════════════════════════════════════════
 
-const DELEG_ROLE_ALPHA_COMPAT: &str = "---\nname: alpha\nrole: Alpha Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: compatible_api\nprofile: alpha-compat\ntools:\n  - mcp_team\n---\n\nAlpha.\n";
+const DELEG_ROLE_ALPHA_COMPAT: &str = "---\nname: alpha\nrole: Alpha Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: compatible_api\ndangerously_skip_permissions: false\nprofile: alpha-compat\ntools:\n  - mcp_team\n---\n\nAlpha.\n";
 
 type LaneKills = std::sync::Arc<std::sync::Mutex<Vec<String>>>;
 pub(super) type LaneSpawns = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<String>)>>>;
@@ -816,7 +816,7 @@ fn current_alias_authority_does_not_leak_into_real_sibling_same_id_retirement()
     );
 }
 
-const CHARLIE_ROLE: &str = "---\nname: charlie\nrole: Charlie Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nCharlie.\n";
+const CHARLIE_ROLE: &str = "---\nname: charlie\nrole: Charlie Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nCharlie.\n";
 
 struct HermeticTestEnv {
     root: std::path::PathBuf,