@team-agent/installer 0.5.84 → 0.5.86

package/crates/team-agent/src/lifecycle/tests/copilot_provider_red.rs

@@ -17,7 +17,7 @@
 //!  1. worker argv golden (§C1 + C-5-1/3)        — copilot_argv_* tests
 //!  2. per-worker AGENTS.md == compiled prompt    — copilot_agents_md_* tests (C-1-1/2,
 //!     identity-first per the 0.3.4 B2/D6 lock)
-//!  3. permission mapping (C-2-1, via the prompt's Permission note + argv deny flags)
+//!  3. tools metadata transparency (C-2-1, no prompt permission note or argv deny flags)
 //!  4. fork = structured CapabilityUnsupported (C-4-2/3)
 //!  5. startup recognizer supports copilot trust/ready; turn-state Unknown never idles
 //!     (N11, C-3-1/4)
@@ -62,12 +62,12 @@ const ANCESTRY_KEY: &str = "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON";
 const NEUTRAL_ANCESTRY: &str = "[\"/bin/zsh\"]";
 const COPILOT_TMP_PREFIX: &str = "ta-rs-copilot";
 
-/// Face 1+3 (§C1 golden + C-5-3, verdict cases `copilot_argv_golden_per_role_tools`
-/// and `non_dangerous_argv_contains_deny_flags_no_allow_all`): a restricted copilot
-/// worker (mcp_team only) gets the full §C1 argv — noise control, inline/`@file` MCP
-/// config carrying team_orchestrator, a pre-assigned `--session-id` equal to the
-/// persisted `_pending_session_id`, `-C <workspace>`, deny flags for the missing
-/// capabilities, and NO --allow-all family flag.
+/// Face 1+3 (§C1 golden + C-5-3, verdict case `copilot_argv_golden_per_role_tools`):
+/// a copilot worker (mcp_team only) gets the full §C1 argv — noise control,
+/// inline/`@file` MCP config carrying team_orchestrator, a pre-assigned
+/// `--session-id` equal to the persisted `_pending_session_id`, and `-C <workspace>`.
+/// Tools metadata must not derive deny flags; non-dangerous workers still omit the
+/// --allow-all family flag.
 #[test]
 #[serial(env)]
 fn copilot_argv_golden_restricted_role() {
@@ -176,21 +176,11 @@ team_orchestrator or @<.team/runtime/mcp/worker_a.json>; got {value:?}"
             flag_value(argv, "-C")
         ));
     }
-    // C-5-3: restricted role (no execute_bash / fs_write / network) → deny flags, and
-    // no --allow-all family flag anywhere.
-    let deny_tools = flag_values(argv, "--deny-tool");
-    for denied in ["shell", "write"] {
-        if !deny_tools.iter().any(|tool| tool.contains(denied)) {
-            failures.push(format!(
-                "C-5-3: restricted copilot worker must carry --deny-tool '{denied}'; deny={deny_tools:?}"
-            ));
-        }
-    }
-    // RC-15 (C-5-2 v2): network deny is `--deny-tool 'url'` (the help has only shell/
-    // write/mcp/url tool kinds; v1's --deny-url is not the v2 form).
-    if !deny_tools.iter().any(|tool| tool.contains("url")) {
+    // Tools metadata is transparent compatibility data; it must not derive
+    // provider-specific deny flags (shell/write/url or any other category).
+    if argv.iter().any(|arg| arg == "--deny-tool") {
         failures.push(format!(
-            "RC-15/C-5-2: restricted copilot worker must deny network via --deny-tool 'url'; deny={deny_tools:?}"
+            "C-5-3: tools metadata must not derive copilot --deny-tool flags; argv={argv:?}"
         ));
     }
     // RC-10 (C-3-5/C-5-2): mcp_team is allowlisted by server name (no approval prompt).
@@ -289,8 +279,8 @@ used for the dangerous tier; argv={argv:?}"
 /// the spawn env must carry COPILOT_CUSTOM_INSTRUCTIONS_DIRS pointing at the
 /// per-worker dir (path contains the agent id; works with NO profile configured), the
 /// AGENTS.md there must BE the compiled worker system prompt (single source: identity
-/// first, runtime contract, role body, output contract, permission note — 0.3.4 B2/D6
-/// lock), and no global ~/.copilot/AGENTS.md may be written.
+/// first, runtime contract, role body, and output contract), and no global
+/// ~/.copilot/AGENTS.md may be written.
 #[test]
 #[serial(env)]
 fn copilot_agents_md_is_the_compiled_prompt_and_env_points_at_it() {
@@ -362,7 +352,6 @@ with the identity section FIRST; head={:?}",
             "# Team Agent Teammate Runtime Contract",
             "COPILOT ROLE BODY SENTINEL",
             "report_result exactly once",
-            "Permission note: these tools are prompt-only for this provider and not hard-enforced:",
         ] {
             if !agents_md.contains(marker) {
                 failures.push(format!(
@@ -386,14 +375,11 @@ with the identity section FIRST; head={:?}",
     );
 }
 
-/// Face 3 (C-2-1, verdict `permission_enforcement_table_copilot_row_prompt_only_for_fs`):
-/// the copilot enforcement row must honestly register the no-hard-deny tools as
-/// prompt-only. Observable single-source: the compiled prompt's Permission note (built
-/// from PROVIDER_ENFORCEMENT) for a full-capability role must list exactly
-/// fs_list/fs_read/git_diff/provider_builtin (sorted).
+/// Face 3: tools metadata is transparent compatibility data and must not produce
+/// a provider-specific Permission note in the compiled Copilot prompt.
 #[test]
 #[serial(env)]
-fn copilot_permission_note_registers_fs_tools_prompt_only() {
+fn copilot_prompt_omits_removed_permission_note() {
     let _hermetic = enter_hermetic("copilot-permission-note");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("enforcement");
@@ -428,21 +414,21 @@ fn copilot_permission_note_registers_fs_tools_prompt_only() {
         .env
         .get("COPILOT_CUSTOM_INSTRUCTIONS_DIRS")
         .cloned()
-        .unwrap_or_default();
-    let agents_md = std::fs::read_to_string(Path::new(&dir).join("AGENTS.md")).unwrap_or_default();
-
-    let note_line = agents_md
-        .lines()
-        .find(|line| line.starts_with("Permission note:"))
-        .unwrap_or("")
-        .to_string();
+        .expect("Copilot spawn must carry COPILOT_CUSTOM_INSTRUCTIONS_DIRS");
     assert!(
-        note_line.contains("fs_list, fs_read, git_diff, provider_builtin"),
-        "C-2-1: the copilot enforcement row must register exactly \
-fs_read/fs_list/git_diff/provider_builtin as prompt-only (sorted in the Permission \
-note; execute_bash/fs_write/network/mcp_team are hard); note={note_line:?} \
-agents_md_present={}",
-        !agents_md.is_empty()
+        !dir.is_empty(),
+        "Copilot instructions directory must not be empty"
+    );
+    let agents_md = std::fs::read_to_string(Path::new(&dir).join("AGENTS.md"))
+        .expect("per-worker Copilot AGENTS.md must be readable");
+    let identity = "You are Team Agent worker `worker_a` with role `Copilot Worker`.";
+    assert!(
+        agents_md.starts_with(identity) && agents_md.contains("COPILOT ROLE BODY SENTINEL"),
+        "C-2-1: compiled Copilot prompt must include its identity and role body; content={agents_md:?}"
+    );
+    assert!(
+        !agents_md.contains("Permission note:"),
+        "C-2-1: removed provider tool enforcement must not emit a Permission note; content={agents_md:?}"
     );
 }
 
@@ -993,6 +979,145 @@ fn copilot_mcp_config_uses_copilot_field_name() {
     );
 }
 
+fn assert_rules_t02_final_mcp(argv: &[String], ws: &Path, agent_id: &str, team: &str) {
+    let argument = flag_value(argv, "--additional-mcp-config").expect("final MCP flag");
+    let path = argument
+        .strip_prefix('@')
+        .expect("final plan references a file");
+    let config: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(path).unwrap()).unwrap();
+    let server = &config["mcpServers"]["team_orchestrator"];
+    assert_eq!(server["transport"], "stdio", "{config}");
+    assert!(server.get("type").is_none(), "{config}");
+    assert!(Path::new(server["command"].as_str().unwrap()).is_absolute());
+    assert_eq!(
+        server["args"],
+        serde_json::json!(["mcp-server", "--workspace", ws])
+    );
+    assert_eq!(
+        server["env"]["TEAM_AGENT_WORKSPACE"],
+        ws.to_string_lossy().as_ref()
+    );
+    assert_eq!(server["env"]["TEAM_AGENT_ID"], agent_id);
+    assert_eq!(server["env"]["TEAM_AGENT_OWNER_TEAM_ID"], team);
+    eprintln!("T02 final MCP: agent={agent_id} team={team} argv={argv:?} config={config}");
+}
+
+#[test]
+#[serial(env)]
+fn rules_t02_final_mcp_across_fresh_start_restart_and_add() {
+    let hermetic = enter_hermetic("rules-t02-final-mcp");
+    let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
+    let ws = hermetic.workspace("mcp");
+    let team_dir = write_copilot_team(&ws, "cp-resume", &["mcp_team"], false);
+    seed_healthy_coordinator(&ws);
+    let health = team_agent::coordinator::coordinator_health(
+        &team_agent::coordinator::WorkspacePath::new(ws.clone()),
+    );
+    assert!(
+        health.ok,
+        "seeded coordinator must prevent daemon spawn: {health:?}"
+    );
+    let fresh = RecordingTransport::new();
+    quick_start_with_transport_in_workspace(&ws, &team_dir, None, true, Some("cpresume"), &fresh)
+        .expect("fresh entry");
+    let argv = fresh.single_spawn().argv;
+    assert_rules_t02_final_mcp(&argv, &ws, "worker_a", "cpresume");
+    assert!(flag_value(&argv, "--session-id").is_some());
+    assert!(flag_value(&argv, "--resume").is_none());
+
+    seed_running_resumable(&ws, "worker_a");
+    seed_copilot_session_store(hermetic.home(), "99999999-aaaa-4bbb-8ccc-dddddddddddd");
+    for single in [true, false] {
+        // A previous file is an output, never the authority for the next spawn.
+        std::fs::write(ws.join(".team/runtime/mcp/worker_a.json"),
+            r#"{"mcpServers":{"team_orchestrator":{"type":"stdio","env":{"TEAM_AGENT_ID":"foreign"}}}}"#,
+        ).unwrap();
+        let transport = RecordingTransport::new();
+        if single {
+            team_agent::lifecycle::start_agent_with_transport(
+                &ws,
+                &team_agent::model::ids::AgentId::new("worker_a"),
+                true,
+                false,
+                false,
+                Some("cpresume"),
+                &transport,
+            )
+            .expect("single start entry");
+        } else {
+            team_agent::lifecycle::restart_with_transport(&ws, true, Some("cpresume"), &transport)
+                .expect("team restart entry");
+        }
+        let argv = transport.single_spawn().argv;
+        assert_rules_t02_final_mcp(&argv, &ws, "worker_a", "cpresume");
+        assert_eq!(
+            flag_value(&argv, "--resume").as_deref(),
+            Some("99999999-aaaa-4bbb-8ccc-dddddddddddd")
+        );
+        assert!(flag_value(&argv, "--session-id").is_none());
+    }
+
+    let role_file = ws.join("worker_b.md");
+    let role = std::fs::read_to_string(team_dir.join("agents/worker_a.md")).unwrap();
+    std::fs::write(&role_file, role.replace("worker_a", "worker_b")).unwrap();
+    let added = RecordingTransport::with_session_present();
+    team_agent::lifecycle::add_agent_with_transport(
+        &team_dir,
+        &team_agent::model::ids::AgentId::new("worker_b"),
+        &role_file,
+        false,
+        Some("cpresume"),
+        &added,
+    )
+    .expect("add entry");
+    assert_rules_t02_final_mcp(&added.single_spawn().argv, &ws, "worker_b", "cpresume");
+}
+
+#[test]
+fn rules_t02_inline_server_map_preserves_unknown_and_non_object_values() {
+    use team_agent::provider::adapters::copilot::copilot_translate_mcp_config;
+    let raw = serde_json::json!({
+        "stdio": {"type": "stdio", "command": "synthetic", "unknown": {"type": "nested"}},
+        "http": {"type": "http", "url": "https://example.invalid"},
+        "opaque": 7,
+    });
+    let translated = copilot_translate_mcp_config(&raw);
+    assert_eq!(
+        translated,
+        serde_json::json!({
+            "stdio": {"transport": "stdio", "command": "synthetic", "unknown": {"type": "nested"}},
+            "http": {"transport": "http", "url": "https://example.invalid"},
+            "opaque": 7,
+        })
+    );
+    assert!(translated.get("mcpServers").is_none());
+    for raw in [serde_json::json!(null), serde_json::json!([1, "opaque"])] {
+        assert_eq!(copilot_translate_mcp_config(&raw), raw);
+    }
+}
+
+#[test]
+#[serial(env)]
+fn rules_t02_non_copilot_writer_keeps_canonical_schema() {
+    let hermetic = enter_hermetic("rules-t02-canonical");
+    let ws = hermetic.workspace("canonical");
+    let config = team_agent::provider::get_adapter(Provider::ClaudeCode)
+        .mcp_config(team_agent::provider::AuthMode::Subscription)
+        .unwrap();
+    let path = team_agent::lifecycle::launch::write_worker_mcp_config_for_provider(
+        &ws,
+        "synthetic",
+        &config,
+        Some(Provider::ClaudeCode),
+    )
+    .unwrap();
+    let written: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(path).unwrap()).unwrap();
+    assert_eq!(written["mcpServers"], config.raw);
+    assert_eq!(written["mcpServers"]["team_orchestrator"]["type"], "stdio");
+}
+
 /// C-7-3 / RC-24: a resume command line must not carry `--session-id` and `--resume`
 /// together (conflicting session semantics). Driven through the real restart path so
 /// the public resume builder is exercised end to end.
@@ -1436,11 +1561,7 @@ fn write_copilot_team(ws: &Path, name: &str, tools: &[&str], dangerous: bool) ->
     let team = ws.join(name);
     std::fs::create_dir_all(team.join("agents")).unwrap();
     // 0.5.66 bypass 单源:bypass 由角色字段驱动,不再是 TEAM.md dangerous_auto_approve。
-    let role_bypass = if dangerous {
-        "true"
-    } else {
-        "false"
-    };
+    let role_bypass = if dangerous { "true" } else { "false" };
     std::fs::write(
         team.join("TEAM.md"),
         format!(
@@ -1637,6 +1758,7 @@ struct RecordedSpawn {
 struct RecordingTransport {
     spawns: Mutex<Vec<RecordedSpawn>>,
     session_present: Mutex<bool>,
+    panes: Mutex<Vec<PaneInfo>>,
 }
 
 impl RecordingTransport {
@@ -1681,8 +1803,22 @@ impl Transport for RecordingTransport {
             window: window.as_str().to_string(),
         });
         *self.session_present.lock().unwrap() = true;
+        let pane_id = PaneId::new(format!("%{}", spawns.len()));
+        self.panes.lock().unwrap().push(PaneInfo {
+            pane_id: pane_id.clone(),
+            session: session.clone(),
+            window_index: None,
+            window_name: Some(window.clone()),
+            pane_index: None,
+            tty: None,
+            current_command: None,
+            current_path: None,
+            active: false,
+            pane_pid: Some(30_000 + spawns.len() as u32),
+            leader_env: BTreeMap::new(),
+        });
         Ok(SpawnResult {
-            pane_id: PaneId::new(format!("%{}", spawns.len())),
+            pane_id,
             session: session.clone(),
             window: window.clone(),
             child_pid: Some(30_000 + spawns.len() as u32),
@@ -1747,7 +1883,7 @@ impl Transport for RecordingTransport {
     }
 
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
-        Ok(Vec::new())
+        Ok(self.panes.lock().unwrap().clone())
     }
 
     fn has_session(&self, _session: &SessionName) -> Result<bool, TransportError> {
@@ -1769,10 +1905,20 @@ impl Transport for RecordingTransport {
 
     fn kill_session(&self, _session: &SessionName) -> Result<(), TransportError> {
         *self.session_present.lock().unwrap() = false;
+        self.panes
+            .lock()
+            .unwrap()
+            .retain(|pane| &pane.session != _session);
         Ok(())
     }
 
-    fn kill_window(&self, _target: &Target) -> Result<(), TransportError> {
+    fn kill_window(&self, target: &Target) -> Result<(), TransportError> {
+        self.panes.lock().unwrap().retain(|pane| match target {
+            Target::Pane(id) => &pane.pane_id != id,
+            Target::SessionWindow { session, window } => {
+                &pane.session != session || pane.window_name.as_ref() != Some(window)
+            }
+        });
         Ok(())
     }
 
@@ -1796,6 +1942,17 @@ fn copilot_empty_mcp_list_shim(tag: &str) -> TempWorkspace {
     #[cfg(unix)]
     {
         use std::os::unix::fs::PermissionsExt;
+        // coordinator health needs the seeded test PID's real non-zombie status.
+        // Keep PATH isolated and refuse any broader process inspection.
+        std::fs::write(
+            bin.join("ps"),
+            format!(
+                "#!/bin/sh\nif [ \"$#\" = 4 ] && [ \"$1\" = -p ] && [ \"$2\" = {} ] && [ \"$3\" = -o ] && [ \"$4\" = stat= ]; then\n  exec /bin/ps \"$@\"\nfi\nexit 1\n",
+                std::process::id(),
+            ),
+        )
+        .unwrap();
+        std::fs::set_permissions(bin.join("ps"), std::fs::Permissions::from_mode(0o755)).unwrap();
         std::fs::set_permissions(bin.join("copilot"), std::fs::Permissions::from_mode(0o755))
             .unwrap();
     }

package/crates/team-agent/src/lifecycle/tests/core_034_real_red.rs

@@ -37,7 +37,7 @@ fn bin() -> &'static str {
 
 #[test]
 #[serial(env)]
-fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
+fn claude_worker_spawn_argv_uses_compiled_prompt_without_tool_restrictions() {
     let _hermetic = enter_hermetic("core034-claude-argv");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -80,7 +80,6 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
         "send_message(to='leader'",
         "report_result exactly once",
         "ROLE BODY SENTINEL",
-        "Permission note",
     ] {
         if !prompt.contains(marker) {
             failures.push(format!("B2 missing compiled prompt marker {marker:?}"));
@@ -90,31 +89,15 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
         failures.push("B2 prompt collapsed to the bare role label".to_string());
     }
 
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-    for forbidden in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        if disallowed.iter().any(|tool| tool == forbidden) {
-            failures.push(format!(
-                "B1 declared capability still disallowed via --disallowedTools {forbidden:?}"
-            ));
-        }
+    if argv_has_flag(&spawn.argv, "--disallowedTools") {
+        failures.push("B1 Claude argv must not derive --disallowedTools from tools metadata".to_string());
     }
     if argv_has_flag(&spawn.argv, "--allowedTools") {
-        failures.push(
-            "B1 Python parity violated: Claude argv must not switch to --allowedTools".to_string(),
-        );
+        failures.push("B1 Claude argv must not derive --allowedTools from tools metadata".to_string());
     }
     assert!(
         failures.is_empty(),
-        "B1/B2 worker argv contract failed:\n{}\nprompt={prompt:?}\ndisallowed={disallowed:?}\nargv={:?}",
+        "B1/B2 worker argv contract failed:\n{}\nprompt={prompt:?}\nargv={:?}",
         failures.join("\n"),
         spawn.argv
     );
@@ -122,7 +105,7 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
 
 #[test]
 #[serial(env)]
-fn claude_control_role_without_native_tools_still_disallows_native_tools() {
+fn claude_control_role_does_not_derive_native_tool_restrictions() {
     let _hermetic = enter_hermetic("core034-claude-control");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -156,29 +139,21 @@ fn claude_control_role_without_native_tools_still_disallows_native_tools() {
     .expect("quick-start should record the control worker command");
 
     let spawn = transport.single_spawn();
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-    for expected in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        assert!(
-            disallowed.iter().any(|tool| tool == expected),
-            "B1 negative case: mcp_team-only control roles must still disallow native Claude tools; \
-             missing={expected} disallowed={disallowed:?}\nargv={:?}",
-            spawn.argv
-        );
-    }
+    assert!(
+        !argv_has_flag(&spawn.argv, "--disallowedTools"),
+        "B1 control role must not derive native-tool restrictions from tools metadata; argv={:?}",
+        spawn.argv
+    );
+    assert!(
+        !argv_has_flag(&spawn.argv, "--allowedTools"),
+        "B1 control role must not derive an allowlist from tools metadata; argv={:?}",
+        spawn.argv
+    );
 }
 
 #[test]
 #[serial(env)]
-fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_tools() {
+fn restart_claude_worker_does_not_derive_tool_restrictions_when_runtime_state_has_no_raw_tools() {
     let _hermetic = enter_hermetic("core034-restart-tools");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -215,34 +190,20 @@ fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_
     let report = restart_with_transport(&ws, true, Some("restarttools"), &restart_transport)
         .expect("restart should reach worker command construction");
     let spawn = restart_transport.single_spawn();
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-
-    for forbidden in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        assert!(
-            !disallowed.iter().any(|tool| tool == forbidden),
-            "B1 restart contract: when runtime state lacks raw tools, restart must resolve tools from the selected spec/role through resolve_permissions. \
-             {forbidden} must not be disallowed for this role; disallowed={disallowed:?}\nargv={:?}\nreport={report:?}",
-            spawn.argv
-        );
-    }
+    assert!(
+        !argv_has_flag(&spawn.argv, "--disallowedTools"),
+        "B1 restart must not derive native-tool restrictions from tools metadata; argv={:?} report={report:?}",
+        spawn.argv
+    );
     assert!(
         !argv_has_flag(&spawn.argv, "--allowedTools"),
-        "B1 Python parity: restart must keep --disallowedTools semantics, not switch to --allowedTools; argv={:?}",
+        "B1 restart must not derive an allowlist from tools metadata; argv={:?} report={report:?}",
         spawn.argv
     );
 }
 
 #[test]
-fn worker_command_context_uses_single_prompt_and_permission_sources() {
+fn worker_command_context_uses_single_prompt_without_permission_sources() {
     let crate_root = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
     let src_root = crate_root.join("src");
     let launch = composite_source::composite_source("src/lifecycle/launch.rs");
@@ -276,10 +237,9 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
             && all_src.contains("runtime_contract_section")
             && all_src.contains("identity_section")
             && all_src.contains("role_body")
-            && all_src.contains("output_contract")
-            && all_src.contains("permission_notes"),
-        "B2 grep guard: worker command construction needs one compiled prompt helper with the CR-approved five sections \
-         (runtime_contract_section, identity_section, role_body, output_contract, permission_notes)."
+            && all_src.contains("output_contract"),
+        "B2 grep guard: worker command construction needs one compiled prompt helper with the CR-approved four sections \
+         (runtime_contract_section, identity_section, role_body, output_contract)."
     );
     assert!(
         !command_sources.contains("system_prompt: role"),
@@ -296,8 +256,9 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
     );
 
     assert!(
-        all_src.contains("resolve_permissions") && all_src.contains("resolved_tool_strings"),
-        "B1 grep guard: command argv tools must be calculated through a single resolve_permissions helper, including role defaults and leader ceiling."
+        !command_sources.contains("resolve_permissions")
+            && !command_sources.contains("resolved_tool_strings"),
+        "B1 grep guard: command construction must not derive argv restrictions from tools metadata."
     );
     assert!(
         !command_sources.contains("worker_tool_refs(agent_tool_strings")
@@ -305,8 +266,8 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
         "B1 grep guard: command construction must not raw-pass agent.tools/tool_refs into ProviderCommandContext."
     );
     assert!(
-        adapter.contains("--disallowedTools") && !adapter.contains("--allowedTools"),
-        "B1 Python parity: provider adapter must keep Claude --disallowedTools and not invent --allowedTools."
+        !adapter.contains("--disallowedTools") && !adapter.contains("--allowedTools"),
+        "B1 provider adapter must not derive Claude tool restrictions from tools metadata."
     );
     assert!(
         !adapter.contains("resolve_permissions"),
@@ -837,12 +798,6 @@ fn flag_value(argv: &[String], flag: &str) -> Option<String> {
         .find_map(|pair| (pair[0] == flag).then(|| pair[1].clone()))
 }
 
-fn flag_values(argv: &[String], flag: &str) -> Vec<String> {
-    argv.windows(2)
-        .filter_map(|pair| (pair[0] == flag).then(|| pair[1].clone()))
-        .collect()
-}
-
 fn argv_has_flag(argv: &[String], flag: &str) -> bool {
     argv.iter().any(|arg| arg == flag)
 }

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -520,8 +520,8 @@ fn launch_dry_run_resolves_real_plan_not_stub_error() {
         Ok(report) => {
             assert!(report.dry_run, "dry_run launch must report dry_run=true");
             assert!(
-                !report.routes.is_empty() || !report.permissions.is_empty(),
-                "dry_run launch must resolve a real route/permission plan from the compiled spec"
+                !report.routes.is_empty(),
+                "dry_run launch must resolve a real route plan from the compiled spec"
             );
         }
         // any OTHER Err (a real requirement/transport error) still proves the stub is gone.
@@ -3210,7 +3210,6 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "profile",
             "window",
             "mcp_config",
-            "permissions",
             "effective_approval_policy",
             // 0.5.66 bypass 单源:fresh spawn 记录运行面 bypass 值(restart drift 挡板)。
             "as_launched_dangerously_skip_permissions",
@@ -3239,16 +3238,6 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             .join(".team/runtime/mcp/implementer.json")
             .to_string_lossy())
     );
-    assert_eq!(
-        agent["permissions"],
-        json!({
-            "agent_id": "implementer",
-            "provider": "codex",
-            "tools": ["mcp_team"],
-            "resolved_tools": [{"tool": "mcp_team", "enforcement": "prompt_only"}],
-            "has_prompt_only": true
-        })
-    );
     assert!(agent["session_id"].is_null());
     assert!(agent["rollout_path"].is_null());
     assert!(agent["captured_at"].is_null());

package/crates/team-agent/src/lifecycle/tests/pi_catalog_red.rs

@@ -91,7 +91,6 @@ fn command_for_model(model: &str) -> Vec<String> {
         model: Some(model),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "worker contract",
-        tool_categories: &["mcp_team"],
         session_dir: Some(Path::new("/workspace/.team/runtime/pi/t1/w1/sessions")),
         session: PiSessionSelector::Fresh {
             session_id: "716ba0cb-c491-4471-b41a-43c8d5e1f05a",

package/crates/team-agent/src/lifecycle/tests/pi_command_red.rs

@@ -10,7 +10,6 @@ fn request(session: PiSessionSelector<'static>) -> PiCommandRequest<'static> {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::High),
         system_prompt: "frozen worker prompt",
-        tool_categories: &["mcp_team", "fs_read", "fs_write", "execute_bash"],
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/team-a/worker-a/sessions",
         )),
@@ -38,7 +37,6 @@ fn leader_request() -> PiCommandRequest<'static> {
         model: None,
         effort: None,
         system_prompt: "frozen leader prompt",
-        tool_categories: &["mcp_team", "fs_read", "fs_write", "execute_bash"],
         session_dir: None,
         session: PiSessionSelector::Fresh {
             session_id: "da8c3622-2378-4d05-a26c-e826a6ef6d63",