@team-agent/installer 0.5.65 → 0.5.68

package/crates/team-agent/src/lifecycle/worker_command_context.rs

@@ -1,7 +1,27 @@
+//! ---
+//! purpose: 从 spec 里的一个 agent 定义，编译出 worker 启动所需的系统提示词与工具串
+//! contract:
+//!   provides:
+//!     - name: WorkerCommandAgent
+//!       what: 从 YAML 或 JSON 读出的单 agent 命令上下文
+//!     - name: compile_worker_system_prompt
+//!       what: 按身份、runtime 契约、通信模式、角色正文、输出契约、权限说明拼系统提示词
+//!     - name: resolved_tool_strings_for_command
+//!       what: 解析出该 agent 的工具串，声明了 bypass 时追加 dangerous_auto_approve 哨兵
+//!   depends:
+//!     - crate::model::permissions
+//!     - crate::communication_mode
+//!     - crate::provider::bypass_flags
+//! boundary:
+//!   - 只产出字符串，不 spawn 进程、不写盘
+//!   - bypass 只认 agent 自身声明，不从 team/runtime/leader argv 继承
+//!   - provider 没有 bypass argv 定义时报错，不静默降级
+//! maturity: wired
+//! ---
 use std::path::Path;
 
 use crate::communication_mode::CommunicationMode;
-use crate::lifecycle::types::{DangerousApproval, LifecycleError};
+use crate::lifecycle::types::LifecycleError;
 use crate::model::enums::{Enforcement, Provider};
 use crate::model::ids::AgentId;
 use crate::model::permissions::{resolve_permissions, AgentPermissionInput};
@@ -13,9 +33,9 @@ output. All communication must go through Team Agent MCP tools.
 
 ## Communication (mandatory)
 
-- Coordinate with teammate: team_orchestrator.send_message(to='<agent_id>', content='...')
-- Broadcast to all teammates: team_orchestrator.send_message(to='*', content='...')
-- Task complete: team_orchestrator.report_result(summary='...') — call exactly once
+- Coordinate with teammate: {send_message}(to='<agent_id>', content='...')
+- Broadcast to all teammates: {send_message}(to='*', content='...')
+- Task complete: {report_result}(summary='...') — call exactly once
 
 ## Rules
 
@@ -29,7 +49,7 @@ output. All communication must go through Team Agent MCP tools.
 // semantics (leader-attach dependence + fallback status) that the
 // generic runtime section deliberately leaves out.
 const RESULT_ENVELOPE_OUTPUT_CONTRACT: &str =
-    "Final completion must call team_orchestrator.report_result exactly once with a short summary \
+    "Final completion must call {report_result} exactly once with a short summary \
 and optional status/changes/tests; the MCP runtime injects the result into the attached leader pane. \
 If no leader is attached, the tool returns a fallback/failed result instead of completion.";
 
@@ -42,9 +62,21 @@ pub(crate) struct WorkerCommandAgent {
     system_prompt_file: Option<String>,
     output_contract_format: Option<String>,
     communication_mode: CommunicationMode,
+    /// 0.5.66 bypass 单源:agent-level `dangerously_skip_permissions`(必填 bool)。
+    dangerously_skip_permissions: bool,
 }
 
 impl WorkerCommandAgent {
+/// ---
+/// purpose: 从 spec 的 YAML agent 节点读出命令上下文
+/// params:
+///   agent: 单个 agent 的 YAML 节点
+///   fallback_id: agent 节点没写 id 时的兜底 id
+///   provider: 已解析的 provider
+/// returns: 填好的 WorkerCommandAgent
+/// errors: communication_mode 取值非法时返回 LifecycleError
+/// contract_id: lifecycle.worker_command_agent.from_source
+/// ---
     pub(crate) fn from_yaml(
         agent: &crate::model::yaml::Value,
         fallback_id: Option<&str>,
@@ -92,9 +124,23 @@ impl WorkerCommandAgent {
                     .get("communication_mode")
                     .and_then(crate::model::yaml::Value::as_str),
             )?,
+            dangerously_skip_permissions: matches!(
+                agent.get("dangerously_skip_permissions"),
+                Some(crate::model::yaml::Value::Bool(true))
+            ),
         })
     }
 
+/// ---
+/// purpose: 从 runtime state 的 JSON agent 节点读出命令上下文
+/// params:
+///   agent: 单个 agent 的 JSON 节点
+///   fallback_id: agent 节点没写 id 时的兜底 id
+///   provider: 已解析的 provider
+/// returns: 填好的 WorkerCommandAgent
+/// errors: communication_mode 取值非法时返回 LifecycleError
+/// contract_id: lifecycle.worker_command_agent.from_source
+/// ---
     pub(crate) fn from_json(
         agent: &serde_json::Value,
         fallback_id: Option<&str>,
@@ -142,10 +188,19 @@ impl WorkerCommandAgent {
                     .get("communication_mode")
                     .and_then(serde_json::Value::as_str),
             )?,
+            dangerously_skip_permissions: agent
+                .get("dangerously_skip_permissions")
+                .and_then(serde_json::Value::as_bool)
+                .unwrap_or(false),
         })
     }
 }
 
+/// ---
+/// purpose: 拼出 worker 的系统提示词，身份段必须排在最前
+/// returns: 各段以空行分隔的提示词，空段被丢弃
+/// errors: 角色正文读取失败或权限解析失败时返回 LifecycleError
+/// ---
 pub(crate) fn compile_worker_system_prompt(
     agent: &WorkerCommandAgent,
 ) -> Result<String, LifecycleError> {
@@ -153,13 +208,15 @@ pub(crate) fn compile_worker_system_prompt(
     // identity line anchors the very first section (live Python worker argv confirms).
     // C-1 cr verdict / B2 灵魂件 — identity 必须 FIRST(MUST-4 行为层守:空白上下文问
     // "你是谁"必须先答 Team Agent worker 身份)。runtime contract 跟后。
+    let send_message = mcp_tool_name(agent.provider, "team_orchestrator", "send_message");
+    let report_result = mcp_tool_name(agent.provider, "team_orchestrator", "report_result");
     let mut chunks = vec![
         identity_section(agent),
-        runtime_contract_section(),
-        agent.communication_mode.runtime_contract().to_string(),
+        runtime_contract_section(&send_message, &report_result),
+        agent.communication_mode.runtime_contract(&send_message),
         role_body(agent)?,
     ];
-    if let Some(contract) = output_contract(agent) {
+    if let Some(contract) = output_contract(agent, &report_result) {
         chunks.push(contract);
     }
     if let Some(notes) = permission_notes(agent)? {
@@ -172,22 +229,72 @@ pub(crate) fn compile_worker_system_prompt(
         .join("\n\n"))
 }
 
+/// ---
+/// purpose: 解析该 agent 最终生效的工具串
+/// params:
+///   provider: 用于查 bypass argv 定义的 provider
+/// returns: 排序后的工具串；agent 声明 bypass 时末尾追加 dangerous_auto_approve
+/// errors: 权限解析失败，或声明了 bypass 但该 provider 没有 bypass argv 定义时返回 RequirementUnmet
+/// ---
 pub(crate) fn resolved_tool_strings_for_command(
     agent: &WorkerCommandAgent,
     provider: Provider,
-    safety: &DangerousApproval,
 ) -> Result<Vec<String>, LifecycleError> {
     let mut tools: Vec<String> = resolve_agent_permissions(agent, provider)?
         .sorted_tool_strings()
         .into_iter()
         .map(str::to_string)
         .collect();
-    if safety.enabled && !tools.iter().any(|tool| tool == "dangerous_auto_approve") {
-        tools.push("dangerous_auto_approve".to_string());
+    // 0.5.66 bypass 单源:读 agent 自己的 `dangerously_skip_permissions` bool,
+    // 不再收 team/runtime/leader argv 派生的 `DangerousApproval`。true → 加
+    // `dangerous_auto_approve` 哨兵(adapter 消费点不变);provider 无 bypass
+    // argv 定义 → fail-loud,不静默 fallback。
+    if agent.dangerously_skip_permissions {
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(provider).ok_or_else(
+            || {
+                LifecycleError::RequirementUnmet(format!(
+                    "provider {} has no bypass argv flag defined; dangerously_skip_permissions=true cannot be honored",
+                    provider_display_name(provider)
+                ))
+            },
+        )?;
+        debug_assert!(flag.starts_with("--"));
+        if !tools.iter().any(|tool| tool == "dangerous_auto_approve") {
+            tools.push("dangerous_auto_approve".to_string());
+        }
     }
     Ok(tools)
 }
 
+/// Provider-facing MCP tool name. Only verified call forms are filled in.
+/// Unverified providers keep the historical dotted spelling.
+fn mcp_tool_name(provider: Provider, server: &str, tool: &str) -> String {
+    match provider {
+        Provider::Claude | Provider::ClaudeCode => format!("mcp__{server}__{tool}"),
+        Provider::Grok => format!("{server}__{tool}"),
+        // CursorAgent / Codex / Copilot / GeminiCli / Fake: 未验证，沿用现状点号。
+        // CursorAgent 不可与 grok 同臂：仓库里没有活转录，`{server}__{tool}` 是推断。
+        Provider::CursorAgent
+        | Provider::Codex
+        | Provider::Copilot
+        | Provider::GeminiCli
+        | Provider::Fake => format!("{server}.{tool}"),
+    }
+}
+
+fn provider_display_name(provider: Provider) -> &'static str {
+    match provider {
+        Provider::Claude => "claude",
+        Provider::ClaudeCode => "claude_code",
+        Provider::Codex => "codex",
+        Provider::Copilot => "copilot",
+        Provider::GeminiCli => "gemini_cli",
+        Provider::Grok => "grok",
+        Provider::CursorAgent => "cursor_agent",
+        Provider::Fake => "fake",
+    }
+}
+
 fn resolve_agent_permissions(
     agent: &WorkerCommandAgent,
     provider: Provider,
@@ -201,8 +308,10 @@ fn resolve_agent_permissions(
     .map_err(|e| LifecycleError::Compile(e.to_string()))
 }
 
-fn runtime_contract_section() -> String {
-    RUNTIME_CONTRACT_SECTION.to_string()
+fn runtime_contract_section(send_message: &str, report_result: &str) -> String {
+    RUNTIME_CONTRACT_SECTION
+        .replace("{send_message}", send_message)
+        .replace("{report_result}", report_result)
 }
 
 fn communication_mode(value: Option<&str>) -> Result<CommunicationMode, LifecycleError> {
@@ -236,9 +345,9 @@ fn role_body(agent: &WorkerCommandAgent) -> Result<String, LifecycleError> {
     Ok(chunks.join("\n\n"))
 }
 
-fn output_contract(agent: &WorkerCommandAgent) -> Option<String> {
+fn output_contract(agent: &WorkerCommandAgent, report_result: &str) -> Option<String> {
     (agent.output_contract_format.as_deref() == Some("result_envelope_v1"))
-        .then(|| RESULT_ENVELOPE_OUTPUT_CONTRACT.to_string())
+        .then(|| RESULT_ENVELOPE_OUTPUT_CONTRACT.replace("{report_result}", report_result))
 }
 
 fn permission_notes(agent: &WorkerCommandAgent) -> Result<Option<String>, LifecycleError> {
@@ -282,20 +391,6 @@ fn provider_default_prompt_only_tools(provider: Provider) -> &'static [&'static
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::lifecycle::types::DangerousApprovalSource;
-
-    fn disabled_safety() -> DangerousApproval {
-        DangerousApproval {
-            enabled: false,
-            source: DangerousApprovalSource::Disabled,
-            inherited: false,
-            provider: None,
-            flag: None,
-            worker_capability_above_leader: false,
-            ancestry_binary_name: None,
-            unexpected_binary: false,
-        }
-    }
 
     #[test]
     fn empty_tools_use_role_defaults_and_aliases_resolve_before_command() {
@@ -308,10 +403,10 @@ mod tests {
             system_prompt_file: None,
             output_contract_format: None,
             communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: false,
         };
         let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode, &disabled_safety())
-                .unwrap();
+            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
         assert_eq!(
             tools,
             [
@@ -330,11 +425,82 @@ mod tests {
             ..agent
         };
         let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode, &disabled_safety())
-                .unwrap();
+            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
         assert_eq!(tools, ["fs_list", "fs_read", "fs_write", "mcp_team"]);
     }
 
+    // 0.5.66 bypass 单源 §4.1:true → tools 追加 `dangerous_auto_approve` 哨兵。
+    #[test]
+    fn test_true_field_produces_bypass_flag_argv() {
+        let agent = WorkerCommandAgent {
+            id: Some("dev".to_string()),
+            provider: Provider::ClaudeCode,
+            role: Some("developer".to_string()),
+            declared_tools: Some(vec!["mcp_team".to_string()]),
+            system_prompt_inline: None,
+            system_prompt_file: None,
+            output_contract_format: None,
+            communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: true,
+        };
+        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
+        assert!(
+            tools.iter().any(|tool| tool == "dangerous_auto_approve"),
+            "true field must append the dangerous_auto_approve sentinel; tools={tools:?}"
+        );
+        assert!(
+            tools.iter().any(|tool| tool == "mcp_team"),
+            "normal tools must remain; tools={tools:?}"
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:false → 不追加哨兵。
+    #[test]
+    fn test_false_field_produces_no_bypass_flag_argv() {
+        let agent = WorkerCommandAgent {
+            id: Some("dev".to_string()),
+            provider: Provider::ClaudeCode,
+            role: Some("developer".to_string()),
+            declared_tools: Some(vec!["mcp_team".to_string()]),
+            system_prompt_inline: None,
+            system_prompt_file: None,
+            output_contract_format: None,
+            communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: false,
+        };
+        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
+        assert!(
+            !tools.iter().any(|tool| tool == "dangerous_auto_approve"),
+            "false field must not append the sentinel; tools={tools:?}"
+        );
+    }
+
+    // 0.5.66 bypass 单源 §4.1:provider 未定义 bypass 参数 + true → fail-loud。
+    #[test]
+    fn test_provider_without_bypass_flag_definition_errors() {
+        let agent = WorkerCommandAgent {
+            id: Some("dev".to_string()),
+            provider: Provider::GeminiCli,
+            role: Some("developer".to_string()),
+            declared_tools: Some(vec!["mcp_team".to_string()]),
+            system_prompt_inline: None,
+            system_prompt_file: None,
+            output_contract_format: None,
+            communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: true,
+        };
+        let err = resolved_tool_strings_for_command(&agent, Provider::GeminiCli).unwrap_err();
+        let msg = err.to_string();
+        assert!(
+            msg.contains("no bypass argv flag defined"),
+            "provider without bypass flag + true must fail-loud; got {msg}"
+        );
+        assert!(
+            msg.contains("gemini_cli"),
+            "error must name the provider; got {msg}"
+        );
+    }
+
     #[test]
     fn system_prompt_uses_identity_then_runtime_contract_python_order() {
         // #264 D6: Python truth source (prompt.py:39, live ps confirmed) builds
@@ -353,6 +519,7 @@ mod tests {
             system_prompt_file: None,
             output_contract_format: Some("result_envelope_v1".to_string()),
             communication_mode: CommunicationMode::default(),
+            dangerously_skip_permissions: false,
         };
         let prompt = compile_worker_system_prompt(&agent).unwrap();
         assert!(

package/crates/team-agent/src/mcp_server/tests/scoped.rs

@@ -1,3 +1,73 @@
+/// ---
+/// purpose: scoped MCP no-compaction update_state filesystem contract
+/// contract:
+///   provides:
+///     - name: update_state_path_contracts
+///       what: proves the raw no-compaction response preserves its state-file path in an owned fixture
+///   depends:
+///     - name: mcp_state_fixture
+///       what: fixture-owned root and provenance from tests.rs
+/// boundary:
+///   - retain the raw {ok,state_file} result shape
+///   - the owned selector checks workspace, state-file, and runtime paths remain fixture-owned
+/// maturity: wired
+/// ---
+
+fn verify_cleanup_surviving_receipt(
+    receipt_path: &std::path::Path,
+    raw_workspace: &std::path::Path,
+    canonical_workspace: &std::path::Path,
+    state_file: &std::path::Path,
+    runtime_state: &std::path::Path,
+) {
+    let bytes = std::fs::read(receipt_path)
+        .expect("provenance receipt must survive fixture Drop");
+    let receipt: Value = serde_json::from_slice(&bytes).expect("provenance receipt must be JSON");
+    assert_eq!(receipt["schema"], json!("mcp-state-provenance-v1"));
+    let payload = &receipt["payload"];
+    let payload_bytes = serde_json::to_vec(payload).unwrap();
+    assert_eq!(
+        receipt["payload_sha256"],
+        json!(format!("{:x}", sha2::Sha256::digest(&payload_bytes)))
+    );
+    assert_eq!(
+        payload["raw_workspace"],
+        json!(raw_workspace.display().to_string())
+    );
+    assert_eq!(
+        payload["canonical_workspace"],
+        json!(canonical_workspace.display().to_string())
+    );
+    assert_eq!(
+        payload["resolved_state_file"],
+        json!(state_file.display().to_string())
+    );
+    assert_eq!(
+        payload["runtime_state_path"],
+        json!(runtime_state.display().to_string())
+    );
+    let facts = payload["facts"].as_array().unwrap();
+    for name in [
+        "root",
+        "raw_workspace",
+        "canonical_workspace",
+        "team_dir",
+        "runtime_dir",
+        "state_parent",
+        "runtime_state",
+        "state_file",
+    ] {
+        let fact = facts
+            .iter()
+            .find(|fact| fact["name"] == json!(name))
+            .unwrap_or_else(|| panic!("provenance fact missing: {name}"));
+        assert!(fact["path"].as_str().is_some());
+        assert!(fact["uid"].as_u64().is_some());
+        assert!(fact["mode"].as_u64().is_some());
+        assert!(fact["device"].as_u64().is_some());
+    }
+}
+
     #[test]
     fn dispatch_send_message_worker_accepted_returned_verbatim() {
         // A-7: accepted requires a REAL stored message_id (no fabricated ids), so the
@@ -52,8 +122,10 @@
     // state_file (not a golden whitelist key), so the key vanishes.
     #[test]
     fn update_state_state_file_survives_no_compaction() {
+        let fixture = McpStateFixture::new("writable");
+        let expected = fixture.state_file("team_state.md");
         let tools = TeamOrchestratorTools::with_identity(
-            &unique_ws("update-state-raw"),
+            &fixture.workspace,
             Some(AgentId::new("leader")),
             None,
         );
@@ -62,6 +134,33 @@
         assert!(v.get("state_file").and_then(Value::as_str).is_some(),
             "state_file must survive (update_state is not _compact_tool_result'd)");
         assert_eq!(keys(&v), vec!["ok", "state_file"]);
+        let returned_state_file = PathBuf::from(v["state_file"].as_str().unwrap());
+        assert_eq!(returned_state_file, expected);
+        let runtime_state = crate::state::persist::runtime_state_path(&fixture.workspace);
+        assert!(fixture.under_root(&returned_state_file));
+        assert!(fixture.under_root(&runtime_state));
+        let canonical_workspace =
+            crate::model::paths::canonical_run_workspace(&fixture.workspace).unwrap();
+        let receipt = fixture.record_provenance(&fixture.workspace, &returned_state_file);
+        let root = fixture.root.clone();
+        drop(fixture);
+        assert!(!root.exists(), "fixture root must be removed before receipt verification");
+        verify_cleanup_surviving_receipt(
+            &receipt,
+            &root.join("workspace"),
+            &canonical_workspace,
+            &returned_state_file,
+            &runtime_state,
+        );
+        let receipt_bytes = std::fs::read(&receipt).unwrap();
+        println!(
+            "F10_PROVENANCE_RECEIPT path={} sha256={:x} payload={}",
+            receipt.display(),
+            sha2::Sha256::digest(&receipt_bytes),
+            String::from_utf8_lossy(&receipt_bytes)
+        );
+        std::fs::remove_file(&receipt).unwrap();
+        assert!(!receipt.exists(), "cleanup must remove only the exact receipt path");
     }
 
     // ── #36 report_result setdefault: populated envelope keys WIN over args ─────