@team-agent/installer 0.5.65 → 0.5.66

package/crates/team-agent/src/lifecycle/worker_command_context.rs

@@ -1,7 +1,7 @@
 use std::path::Path;
 
 use crate::communication_mode::CommunicationMode;
-use crate::lifecycle::types::{DangerousApproval, LifecycleError};
+use crate::lifecycle::types::LifecycleError;
 use crate::model::enums::{Enforcement, Provider};
 use crate::model::ids::AgentId;
 use crate::model::permissions::{resolve_permissions, AgentPermissionInput};
@@ -42,6 +42,8 @@ pub(crate) struct WorkerCommandAgent {
     system_prompt_file: Option<String>,
     output_contract_format: Option<String>,
     communication_mode: CommunicationMode,
+    /// 0.5.66 bypass 单源:agent-level `dangerously_skip_permissions`(必填 bool)。
+    dangerously_skip_permissions: bool,
 }
 
 impl WorkerCommandAgent {
@@ -92,6 +94,10 @@ impl WorkerCommandAgent {
                     .get("communication_mode")
                     .and_then(crate::model::yaml::Value::as_str),
             )?,
+            dangerously_skip_permissions: matches!(
+                agent.get("dangerously_skip_permissions"),
+                Some(crate::model::yaml::Value::Bool(true))
+            ),
         })
     }
 
@@ -142,6 +148,10 @@ impl WorkerCommandAgent {
                     .get("communication_mode")
                     .and_then(serde_json::Value::as_str),
             )?,
+            dangerously_skip_permissions: agent
+                .get("dangerously_skip_permissions")
+                .and_then(serde_json::Value::as_bool)
+                .unwrap_or(false),
         })
     }
 }
@@ -175,19 +185,44 @@ pub(crate) fn compile_worker_system_prompt(
 pub(crate) fn resolved_tool_strings_for_command(
     agent: &WorkerCommandAgent,
     provider: Provider,
-    safety: &DangerousApproval,
 ) -> Result<Vec<String>, LifecycleError> {
     let mut tools: Vec<String> = resolve_agent_permissions(agent, provider)?
         .sorted_tool_strings()
         .into_iter()
         .map(str::to_string)
         .collect();
-    if safety.enabled && !tools.iter().any(|tool| tool == "dangerous_auto_approve") {
-        tools.push("dangerous_auto_approve".to_string());
+    // 0.5.66 bypass 单源:读 agent 自己的 `dangerously_skip_permissions` bool,
+    // 不再收 team/runtime/leader argv 派生的 `DangerousApproval`。true → 加
+    // `dangerous_auto_approve` 哨兵(adapter 消费点不变);provider 无 bypass
+    // argv 定义 → fail-loud,不静默 fallback。
+    if agent.dangerously_skip_permissions {
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(provider).ok_or_else(
+            || {
+                LifecycleError::RequirementUnmet(format!(
+                    "provider {} has no bypass argv flag defined; dangerously_skip_permissions=true cannot be honored",
+                    provider_display_name(provider)
+                ))
+            },
+        )?;
+        debug_assert!(flag.starts_with("--"));
+        if !tools.iter().any(|tool| tool == "dangerous_auto_approve") {
+            tools.push("dangerous_auto_approve".to_string());
+        }
     }
     Ok(tools)
 }
 
+fn provider_display_name(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Fake => "fake",
+    }
+}
+
 fn resolve_agent_permissions(
     agent: &WorkerCommandAgent,
     provider: Provider,
@@ -282,20 +317,6 @@ fn provider_default_prompt_only_tools(provider: Provider) -> &'static [&'static
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::lifecycle::types::DangerousApprovalSource;
-
-    fn disabled_safety() -> DangerousApproval {
-        DangerousApproval {
-            enabled: false,
-            source: DangerousApprovalSource::Disabled,
-            inherited: false,
-            provider: None,
-            flag: None,
-            worker_capability_above_leader: false,
-            ancestry_binary_name: None,
-            unexpected_binary: false,
-        }
-    }
 
     #[test]
     fn empty_tools_use_role_defaults_and_aliases_resolve_before_command() {
@@ -308,10 +329,10 @@ mod tests {
             system_prompt_file: None,
             output_contract_format: None,
             communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: false,
         };
         let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode, &disabled_safety())
-                .unwrap();
+            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
         assert_eq!(
             tools,
             [
@@ -330,11 +351,82 @@ mod tests {
             ..agent
         };
         let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode, &disabled_safety())
-                .unwrap();
+            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
         assert_eq!(tools, ["fs_list", "fs_read", "fs_write", "mcp_team"]);
     }
 
+    // 0.5.66 bypass 单源 §4.1:true → tools 追加 `dangerous_auto_approve` 哨兵。
+    #[test]
+    fn test_true_field_produces_bypass_flag_argv() {
+        let agent = WorkerCommandAgent {
+            id: Some("dev".to_string()),
+            provider: Provider::ClaudeCode,
+            role: Some("developer".to_string()),
+            declared_tools: Some(vec!["mcp_team".to_string()]),
+            system_prompt_inline: None,
+            system_prompt_file: None,
+            output_contract_format: None,
+            communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: true,
+        };
+        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
+        assert!(
+            tools.iter().any(|tool| tool == "dangerous_auto_approve"),
+            "true field must append the dangerous_auto_approve sentinel; tools={tools:?}"
+        );
+        assert!(
+            tools.iter().any(|tool| tool == "mcp_team"),
+            "normal tools must remain; tools={tools:?}"
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:false → 不追加哨兵。
+    #[test]
+    fn test_false_field_produces_no_bypass_flag_argv() {
+        let agent = WorkerCommandAgent {
+            id: Some("dev".to_string()),
+            provider: Provider::ClaudeCode,
+            role: Some("developer".to_string()),
+            declared_tools: Some(vec!["mcp_team".to_string()]),
+            system_prompt_inline: None,
+            system_prompt_file: None,
+            output_contract_format: None,
+            communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: false,
+        };
+        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
+        assert!(
+            !tools.iter().any(|tool| tool == "dangerous_auto_approve"),
+            "false field must not append the sentinel; tools={tools:?}"
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:provider 未定义 bypass 参数 + true → fail-loud。
+    #[test]
+    fn test_provider_without_bypass_flag_definition_errors() {
+        let agent = WorkerCommandAgent {
+            id: Some("dev".to_string()),
+            provider: Provider::GeminiCli,
+            role: Some("developer".to_string()),
+            declared_tools: Some(vec!["mcp_team".to_string()]),
+            system_prompt_inline: None,
+            system_prompt_file: None,
+            output_contract_format: None,
+            communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: true,
+        };
+        let err = resolved_tool_strings_for_command(&agent, Provider::GeminiCli).unwrap_err();
+        let msg = err.to_string();
+        assert!(
+            msg.contains("no bypass argv flag defined"),
+            "provider without bypass flag + true must fail-loud; got {msg}"
+        );
+        assert!(
+            msg.contains("gemini_cli"),
+            "error must name the provider; got {msg}"
+        );
+    }
+
     #[test]
     fn system_prompt_uses_identity_then_runtime_contract_python_order() {
         // #264 D6: Python truth source (prompt.py:39, live ps confirmed) builds
@@ -353,6 +445,7 @@ mod tests {
             system_prompt_file: None,
             output_contract_format: Some("result_envelope_v1".to_string()),
             communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: false,
         };
         let prompt = compile_worker_system_prompt(&agent).unwrap();
         assert!(

package/crates/team-agent/src/messaging/tests/main_preserved.rs

@@ -94,7 +94,7 @@ fn collect_result_file_ingests_valid_known_task_envelope_into_results() {
     .unwrap();
     std::fs::write(
         team.join("agents").join("w1.md"),
-        "---\nname: w1\nrole: Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nW1.\n",
+        "---\nname: w1\nrole: Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ndangerously_skip_permissions: false\ntools:\n  - mcp_team\n---\n\nW1.\n",
     )
     .unwrap();
     let spec = crate::compiler::compile_team(&team).expect("compile collect team");

package/crates/team-agent/src/model/spec.rs

@@ -354,8 +354,31 @@ fn basic_schema_errors(spec: &Yaml) -> Vec<String> {
     );
     match spec.get("agents") {
         Some(Yaml::List(agents)) if !agents.is_empty() => {
+            // 0.5.66 bypass 单源:收集缺/错 `dangerously_skip_permissions` 的角色清单,
+            // 循环后一次性报出,满足"缺字段错误消息含每个缺字段的角色 id 清单"硬要求。
+            let mut missing_bypass: Vec<String> = Vec::new();
+            let mut bad_type_bypass: Vec<String> = Vec::new();
             for (idx, agent) in agents.iter().enumerate() {
                 check_agent(agent, &format!("/agents/{idx}"), &mut e);
+                match agent.get("dangerously_skip_permissions") {
+                    None => missing_bypass.push(agent_label(agent, idx)),
+                    Some(value) if !matches!(value, Yaml::Bool(_)) => {
+                        bad_type_bypass.push(agent_label(agent, idx))
+                    }
+                    Some(_) => {}
+                }
+            }
+            if !missing_bypass.is_empty() {
+                e.push(format!(
+                    "/agents/dangerously_skip_permissions: missing required field (role id(s): {}). This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed.",
+                    missing_bypass.join(", ")
+                ));
+            }
+            if !bad_type_bypass.is_empty() {
+                e.push(format!(
+                    "/agents/dangerously_skip_permissions: must be a boolean (role id(s): {}). This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed.",
+                    bad_type_bypass.join(", ")
+                ));
             }
         }
         _ => e.push("/agents: must be a non-empty list".to_string()),
@@ -384,7 +407,7 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "working_directory",
         "system_prompt",
         "tools",
-        "permission_mode",
+        "dangerously_skip_permissions",
         "preferred_for",
         "avoid_for",
         "output_contract",
@@ -397,7 +420,7 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "working_directory",
         "system_prompt",
         "tools",
-        "permission_mode",
+        "dangerously_skip_permissions",
         "preferred_for",
         "avoid_for",
         "output_contract",
@@ -407,6 +430,10 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "profile",
         "credential_ref",
         "forked_from",
+        // 存量角色 md 的 `permission_mode` 是历史无效值(compiler 曾恒发 restricted)。
+        // 0.5.66 起不再被 compiler 消费;保留在 allowed 以免存量文件 fail-loud
+        // (§3.1 迁移时顺手删除,0.6.0 可收紧)。
+        "permission_mode",
         // 0.4.x provider effort MVP step 3: per-agent effort override (resolved at compile).
         "effort",
     ];
@@ -481,6 +508,15 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
     }
 }
 
+/// 汇总错误里引用 agent 的可读标签:`<id>` 优先,退回 `<index> (role: <role>)`。
+fn agent_label(agent: &Yaml, idx: usize) -> String {
+    agent
+        .get("id")
+        .and_then(Yaml::as_str)
+        .map(|id| format!("`{id}`"))
+        .unwrap_or_else(|| format!("agents[{idx}]"))
+}
+
 fn check_routing(routing: Option<&Yaml>, errors: &mut Vec<String>) {
     check_keys_y(
         routing,
@@ -564,7 +600,6 @@ fn check_runtime(runtime: Option<&Yaml>, errors: &mut Vec<String>) {
         "max_active_agents",
         "startup_order",
         "display_backend",
-        "dangerous_auto_approve",
         "auto_attach_leader",
         "fast",
         "tick_interval_sec",
@@ -588,9 +623,6 @@ fn check_runtime(runtime: Option<&Yaml>, errors: &mut Vec<String>) {
             errors.push("/runtime/display_backend: invalid display backend".to_string());
         }
     }
-    if get("dangerous_auto_approve").is_some_and(|v| !matches!(v, Yaml::Bool(_))) {
-        errors.push("/runtime/dangerous_auto_approve: must be a boolean".to_string());
-    }
     if get("auto_trust_own_workspace").is_some_and(|v| !matches!(v, Yaml::Bool(_))) {
         errors.push("/runtime/auto_trust_own_workspace: must be a boolean".to_string());
     }
@@ -1020,6 +1052,58 @@ mod tests {
         );
     }
 
+    // 0.5.66 bypass 单源 §4.1:缺 `dangerously_skip_permissions` 字段 → 错误消息
+    // 必须列出每个缺字段的角色 id + 用户可读的必填说明。
+    #[test]
+    fn test_missing_dangerously_field_reports_role_list() {
+        // 从 fixture 文本里删掉第一个 agent 的字段,模拟该角色缺字段。
+        let text = include_str!("testdata/team.spec.yaml");
+        let without_first = text.replacen("    dangerously_skip_permissions: false\n", "", 1);
+        assert_ne!(text, without_first, "fixture must contain the field");
+        let spec = yaml::loads(&without_first).unwrap();
+        let errors = all_spec_errors(&spec);
+        let missing: Vec<&String> = errors
+            .iter()
+            .filter(|m| m.starts_with("/agents/dangerously_skip_permissions: missing"))
+            .collect();
+        assert_eq!(missing.len(), 1, "exactly one missing-field error, got: {errors:#?}");
+        assert!(
+            missing[0].contains("`codex_implementer`"),
+            "must name the role id, got: {}",
+            missing[0]
+        );
+        assert!(
+            missing[0].contains("This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed."),
+            "must carry the user-facing required-field message, got: {}",
+            missing[0]
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:非 bool 值 → fail-loud 类型错,同样带角色清单 + 硬串。
+    #[test]
+    fn test_invalid_dangerously_type_rejected() {
+        let text = include_str!("testdata/team.spec.yaml");
+        let bad = text.replacen("    dangerously_skip_permissions: false\n", "    dangerously_skip_permissions: \"yes\"\n", 1);
+        assert_ne!(text, bad, "fixture must contain the field");
+        let spec = yaml::loads(&bad).unwrap();
+        let errors = all_spec_errors(&spec);
+        let type_errs: Vec<&String> = errors
+            .iter()
+            .filter(|m| m.starts_with("/agents/dangerously_skip_permissions: must be a boolean"))
+            .collect();
+        assert_eq!(type_errs.len(), 1, "exactly one type error, got: {errors:#?}");
+        assert!(
+            type_errs[0].contains("`codex_implementer`"),
+            "must name the role id, got: {}",
+            type_errs[0]
+        );
+        assert!(
+            type_errs[0].contains("This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed."),
+            "must carry the user-facing required-field message, got: {}",
+            type_errs[0]
+        );
+    }
+
     #[test]
     fn empty_spec_matches_python_golden() {
         let spec = yaml::loads("{}").unwrap();
@@ -1050,4 +1134,43 @@ mod tests {
             ]
         );
     }
+
+    // 0.5.66 bypass 单源 §4.1:7 触发面共用同一 spec 校验层——compile_team 是它们的共同
+    // 必经点(quick-start/restart/add/fork 都调用),缺字段一律 fail-loud。此处验证
+    // compile 级校验确实 fail-loud,即各触发面(经 compile_team)都被覆盖。
+    #[test]
+    fn test_all_7_triggers_run_field_check() {
+        // compile_team 是 7 触发面的 spec 校验必经点:
+        //   quick-start(quick_start.rs:233 compile_team)
+        //   restart(rebuild.rs:3245 rebuild_runtime_spec_from_roles → compile_team)
+        //   add-agent(add_agent.rs:331 compile_role_agent)
+        //   clone-agent(clone_agent.rs:62 → add_agent)
+        //   fork-agent(fork_agent.rs:96 validate_spec)
+        //   start-agent / reset-agent(操作已编译 spec,团队创建时经 compile_team 校验)
+        // 验证 compile_team 对缺字段的角色文档 fail-loud。
+        let team = std::env::temp_dir().join(format!(
+            "ta-spec-7trigger-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::remove_dir_all(&team);
+        std::fs::create_dir_all(team.join("agents")).unwrap();
+        std::fs::write(
+            team.join("TEAM.md"),
+            "---\nname: t7\nobjective: 7 trigger.\nprovider: codex\n---\n\nteam.\n",
+        )
+        .unwrap();
+        // 角色文档故意缺 dangerously_skip_permissions
+        std::fs::write(
+            team.join("agents").join("w.md"),
+            "---\nname: w\nrole: Worker\nprovider: codex\ntools:\n  - mcp_team\n---\n\nw.\n",
+        )
+        .unwrap();
+        let err = crate::compiler::compile_team(&team).unwrap_err().to_string();
+        assert!(
+            err.contains("missing front matter field dangerously_skip_permissions")
+                && err.contains("This field must be declared explicitly; it controls whether the agent launches with permission prompts bypassed."),
+            "compile_team must fail-loud on missing field (shared by all 7 triggers); got {err}"
+        );
+        let _ = std::fs::remove_dir_all(&team);
+    }
 }

package/crates/team-agent/src/model/testdata/spec_invalid_a.yaml

@@ -39,6 +39,7 @@ agents:
       - "provider_builtin"
       - "banana"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "implementation"
       - "bug_fix"
@@ -69,6 +70,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "research"
       - "architecture"
@@ -99,6 +101,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "review"
       - "risk_check"
@@ -141,7 +144,6 @@ runtime:
   session_name: "teamspec-full-example"
   auto_launch: true
   require_user_approval_before_launch: true
-  dangerous_auto_approve: false
   max_active_agents: 3
   startup_order:
     - "codex_implementer"

package/crates/team-agent/src/model/testdata/team.spec.golden.yaml

@@ -38,6 +38,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "implementation"
       - "bug_fix"
@@ -68,6 +69,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "research"
       - "architecture"
@@ -98,6 +100,7 @@ agents:
       - "mcp_team"
       - "provider_builtin"
     permission_mode: "restricted"
+    dangerously_skip_permissions: false
     preferred_for:
       - "review"
       - "risk_check"
@@ -140,7 +143,6 @@ runtime:
   session_name: "teamspec-full-example"
   auto_launch: true
   require_user_approval_before_launch: true
-  dangerous_auto_approve: false
   max_active_agents: 3
   startup_order:
     - "codex_implementer"

package/crates/team-agent/src/model/testdata/team.spec.yaml

@@ -38,6 +38,7 @@ agents:
       - mcp_team
       - provider_builtin
     permission_mode: restricted
+    dangerously_skip_permissions: false
     preferred_for:
       - implementation
       - bug_fix
@@ -68,6 +69,7 @@ agents:
       - mcp_team
       - provider_builtin
     permission_mode: restricted
+    dangerously_skip_permissions: false
     preferred_for:
       - research
       - architecture
@@ -98,6 +100,7 @@ agents:
       - mcp_team
       - provider_builtin
     permission_mode: restricted
+    dangerously_skip_permissions: false
     preferred_for:
       - review
       - risk_check
@@ -140,7 +143,6 @@ runtime:
   session_name: teamspec-full-example
   auto_launch: true
   require_user_approval_before_launch: true
-  dangerous_auto_approve: false
   max_active_agents: 3
   startup_order:
     - codex_implementer

package/crates/team-agent/src/provider/adapters/claude.rs

@@ -8,7 +8,7 @@
 //! resolver (`claude_context_model`) stay in `adapter.rs`; capture scanning
 //! helpers now live under `provider/session_scan/claude.rs`.
 
-use crate::model::enums::AuthMode;
+use crate::model::enums::{AuthMode, Provider};
 use crate::provider::adapter::{next_session_token, prompt_needs_native_mcp, BasicProviderAdapter};
 use crate::provider::{McpConfig, ProviderAdapter, ProviderError};
 
@@ -49,7 +49,10 @@ pub(crate) fn claude_base_command(
 ) -> Result<Vec<String>, ProviderError> {
     let mut argv = vec!["claude".to_string()];
     if claude_dangerous_auto_approve(tools) {
-        argv.push("--dangerously-skip-permissions".to_string());
+        // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给(单源)。
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Claude)
+            .expect("claude provider must define a bypass flag");
+        argv.push(flag.to_string());
     } else {
         argv.push("--permission-mode".to_string());
         argv.push("default".to_string());

package/crates/team-agent/src/provider/adapters/codex.rs

@@ -6,7 +6,7 @@
 //! `json_inline` stays in `adapter.rs` because it is also used by other
 //! sites; this file reaches it via `super::*`.
 
-use crate::model::enums::AuthMode;
+use crate::model::enums::{AuthMode, Provider};
 use crate::provider::adapter::json_inline;
 use crate::provider::{McpConfig, ProviderCommandOverrides};
 
@@ -41,7 +41,10 @@ pub(crate) fn codex_base_command(
         argv.push(profile.to_string());
     }
     if codex_dangerous_auto_approve(tools) {
-        argv.push("--dangerously-bypass-approvals-and-sandbox".to_string());
+        // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给。
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Codex)
+            .expect("codex provider must define a bypass flag");
+        argv.push(flag.to_string());
     } else {
         argv.push("--sandbox".to_string());
         argv.push(codex_sandbox_mode(tools).to_string());

package/crates/team-agent/src/provider/adapters/copilot.rs

@@ -7,7 +7,7 @@
 //! translation. Auth hint (`copilot_auth_hint`) stays in `adapter.rs`;
 //! session-store scanning lives under `provider/session_scan/copilot.rs`.
 
-use crate::model::enums::AuthMode;
+use crate::model::enums::{AuthMode, Provider};
 use crate::provider::McpConfig;
 
 pub(crate) fn copilot_base_command(
@@ -29,7 +29,10 @@ pub(crate) fn copilot_base_command(
         "--disable-builtin-mcps".to_string(),
     ];
     if copilot_dangerous_auto_approve(tools) {
-        argv.push("--allow-all".to_string());
+        // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给。
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Copilot)
+            .expect("copilot provider must define a bypass flag");
+        argv.push(flag.to_string());
     } else {
         for flag in copilot_permission_flags(tools) {
             argv.push(flag);

package/crates/team-agent/src/provider/bypass_flags.rs

@@ -0,0 +1,80 @@
+//!
+//! 0.5.66 bypass 单源统一 — provider → bypass argv flag 配置表。
+//!
+//! **唯一权威**:角色 md 的 `dangerously_skip_permissions: true` 决定是否加 bypass flag;
+//! 本文件只回答"某个 provider 的 bypass 命令行参数是什么"。
+//!
+//! 数据源自旧 `lifecycle/launch/approval.rs::dangerous_leader_flags()` 表迁来:
+//!   - claude/claude_code → `--dangerously-skip-permissions`
+//!   - codex → `--dangerously-bypass-approvals-and-sandbox`
+//!   - copilot → `--allow-all`(0.3.27 P1 E54 symptom 2 起)
+//!
+//! 未定义(返回 None)的 provider:调用侧必须 fail-loud(见
+//! `resolved_tool_strings_for_command`),不得静默 fallback。
+
+use crate::model::enums::Provider;
+
+/// 某 provider 的 bypass argv flag;未定义 → `None`。
+pub(crate) fn provider_bypass_flag(provider: Provider) -> Option<&'static str> {
+    match provider {
+        Provider::Claude | Provider::ClaudeCode => Some("--dangerously-skip-permissions"),
+        Provider::Codex => Some("--dangerously-bypass-approvals-and-sandbox"),
+        Provider::Copilot => Some("--allow-all"),
+        // TODO: 查 gemini_cli 的等价 bypass 参数;未定义前 fail-loud。
+        Provider::GeminiCli => None,
+        Provider::Fake => None,
+    }
+}
+
+/// 0.5.66 §3.2 跨 workspace 兼容警示用:扫 argv tokens 找已知 bypass flag。
+/// **只做检测,不做行为决策**(0.6.0 删)。
+///
+/// TODO(0.6.0): remove
+pub(crate) fn detect_bypass_flag_in_argv(argv_tokens: &[String]) -> Option<&'static str> {
+    for token in argv_tokens {
+        if token == "--dangerously-skip-permissions"
+            || token == "--dangerously-skip-permission"
+        {
+            return Some("--dangerously-skip-permissions");
+        }
+        if token == "--dangerously-bypass-approvals-and-sandbox" {
+            return Some("--dangerously-bypass-approvals-and-sandbox");
+        }
+        if token == "--allow-all" || token == "--yolo" {
+            return Some("--allow-all");
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn claude_family_bypass_flag() {
+        assert_eq!(
+            provider_bypass_flag(Provider::Claude),
+            Some("--dangerously-skip-permissions")
+        );
+        assert_eq!(
+            provider_bypass_flag(Provider::ClaudeCode),
+            Some("--dangerously-skip-permissions")
+        );
+    }
+
+    #[test]
+    fn codex_and_copilot_bypass_flags() {
+        assert_eq!(
+            provider_bypass_flag(Provider::Codex),
+            Some("--dangerously-bypass-approvals-and-sandbox")
+        );
+        assert_eq!(provider_bypass_flag(Provider::Copilot), Some("--allow-all"));
+    }
+
+    #[test]
+    fn undefined_providers_return_none() {
+        assert_eq!(provider_bypass_flag(Provider::GeminiCli), None);
+        assert_eq!(provider_bypass_flag(Provider::Fake), None);
+    }
+}

package/crates/team-agent/src/provider/mod.rs

@@ -32,6 +32,8 @@
 // 复用 model::enums 的 Provider/AuthMode,并 re-export(下游惯于 `provider::Provider` 取用)。
 pub use crate::model::enums::{AuthMode, Provider};
 
+/// 0.5.66 bypass 单源:provider → bypass argv flag 配置表(唯一权威)。
+pub(crate) mod bypass_flags;
 pub mod adapter;
 /// 0.4.x decoupling step 2: per-provider command builders + permission/auth
 /// helpers split out of `adapter.rs`. Pure extraction — behavior unchanged.