@team-agent/installer 0.5.84 → 0.5.86

package/crates/team-agent/src/lifecycle/tests/pi_compiler_red.rs

@@ -6,9 +6,7 @@ use crate::lifecycle::launch::pi_mcp::{parse_pi_list_models_table, select_exact_
 use crate::model::enums::ProviderEffort;
 use crate::model::yaml::Value;
 use crate::model::ModelError;
-use crate::provider::adapters::pi::{
-    build_pi_command_argv, pi_tool_mapping, PiCommandRequest, PiSessionSelector, PiToolMapping,
-};
+use crate::provider::adapters::pi::{build_pi_command_argv, PiCommandRequest, PiSessionSelector};
 
 const CATALOG: &[u8] = include_bytes!("fixtures/pi_list_models_g0.stdout.txt");
 static NEXT_ROLE: AtomicU32 = AtomicU32::new(0);
@@ -51,13 +49,12 @@ fn compile_error(result: Result<CompiledRole, ModelError>) -> ModelError {
     }
 }
 
-fn command(tools: &[&str], effort: ProviderEffort, model: &str) -> Result<Vec<String>, String> {
+fn command(_tools: &[&str], effort: ProviderEffort, model: &str) -> Result<Vec<String>, String> {
     build_pi_command_argv(PiCommandRequest {
         extension: Path::new("/workspace/.team/runtime/pi/t1/pi-worker/team-mcp.ts"),
         model: Some(model),
         effort: Some(effort),
         system_prompt: "Pi worker contract.",
-        tool_categories: tools,
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/t1/pi-worker/sessions",
         )),
@@ -70,24 +67,22 @@ fn command(tools: &[&str], effort: ProviderEffort, model: &str) -> Result<Vec<St
 }
 
 #[test]
-fn pi_role_requires_mcp_team_and_preserves_provider_defaults() {
+fn pi_role_ignores_tools_and_preserves_provider_defaults() {
     let positive = compile_pi_role(&valid_role_with(""));
     assert!(positive.is_ok(), "fully explicit Pi role must compile");
 
-    let missing_mcp = valid_role_with("").replace("  - mcp_team\n", "");
+    let missing_tools = valid_role_with("").replace(
+        "tools:\n  - mcp_team\n  - fs_read\n  - fs_list\n  - fs_write\n  - execute_bash\n",
+        "",
+    );
+    compile_pi_role(&missing_tools).expect("omitted tools metadata must compile");
     let unqualified =
         valid_role_with("").replace("model: team-agent/qwen3.8-27b", "model: qwen3.8-27b");
-
-    for (label, role) in [
-        ("mcp_team", missing_mcp),
-        ("qualified exact model", unqualified),
-    ] {
-        let error = compile_error(compile_pi_role(&role));
-        assert!(
-            error.to_string().to_ascii_lowercase().contains(label),
-            "error must name {label}; got {error}"
-        );
-    }
+    let error = compile_error(compile_pi_role(&unqualified));
+    assert!(
+        error.to_string().to_ascii_lowercase().contains("qualified exact model"),
+        "error must name qualified model; got {error}"
+    );
 
     let defaults = valid_role_with("")
         .replace("model: team-agent/qwen3.8-27b\n", "")
@@ -195,42 +190,7 @@ fn pi_max_effort_is_supported_without_model_suffix() {
 }
 
 #[test]
-fn pi_role_tools_validate_team_capabilities_without_replacing_direct_pi_tools() {
-    assert_eq!(pi_tool_mapping("mcp_team"), PiToolMapping::Mcp);
-    assert_eq!(
-        pi_tool_mapping("fs_read"),
-        PiToolMapping::Builtin(&["read"])
-    );
-    assert_eq!(
-        pi_tool_mapping("fs_list"),
-        PiToolMapping::Builtin(&["grep", "find", "ls"])
-    );
-    assert_eq!(
-        pi_tool_mapping("fs_write"),
-        PiToolMapping::Builtin(&["edit", "write"])
-    );
-    assert_eq!(
-        pi_tool_mapping("execute_bash"),
-        PiToolMapping::Builtin(&["bash"])
-    );
-
-    for unsupported in ["git_diff", "network", "provider_builtin", "not_a_tool"] {
-        assert_eq!(
-            pi_tool_mapping(unsupported),
-            PiToolMapping::Unsupported,
-            "unknown categories must not silently broaden to bash"
-        );
-        assert!(
-            command(
-                &["mcp_team", unsupported],
-                ProviderEffort::Medium,
-                "team-agent/qwen3.8-27b"
-            )
-            .is_err(),
-            "unsupported tool must refuse the command: {unsupported}"
-        );
-    }
-
+fn pi_role_command_ignores_legacy_tool_metadata() {
     let argv = command(
         &["mcp_team", "fs_write", "fs_read", "fs_list", "execute_bash"],
         ProviderEffort::Medium,
@@ -242,34 +202,3 @@ fn pi_role_tools_validate_team_capabilities_without_replacing_direct_pi_tools()
         "role tools validate Team Agent capabilities but must not replace direct Pi tools: {argv:?}"
     );
 }
-
-#[test]
-fn pi_role_rejects_unsupported_categories_during_compile() {
-    compile_pi_role(&valid_role_with("")).expect("supported Pi tools must compile");
-
-    for unsupported in ["git_diff", "network", "provider_builtin"] {
-        let role = valid_role_with("").replace(
-            "  - execute_bash\n",
-            &format!("  - execute_bash\n  - {unsupported}\n"),
-        );
-        let error = compile_error(compile_pi_role(&role)).to_string();
-        assert!(
-            error.contains(&format!("Pi does not support Team Agent tool category {unsupported:?}")),
-            "compile must reject {unsupported} before launch preparation: {error}"
-        );
-        assert!(
-            error.contains("remove it from the role's tools"),
-            "compile error must provide an actionable fix: {error}"
-        );
-    }
-
-    let alias = valid_role_with("").replace(
-        "  - execute_bash\n",
-        "  - execute_bash\n  - \"@builtin\"\n",
-    );
-    let error = compile_error(compile_pi_role(&alias)).to_string();
-    assert!(
-        error.contains("Pi does not support Team Agent tool category \"provider_builtin\""),
-        "@builtin must use the same Pi capability contract: {error}"
-    );
-}

package/crates/team-agent/src/lifecycle/tests/pi_dual_entry_red.rs

@@ -300,7 +300,7 @@ fn pi_leader_and_teammate_body(hermetic: &HermeticTestEnv) {
         mcp_config: None,
         system_prompt: None,
         model: None,
-        tools: &[],
+        dangerously_skip_permissions: false,
         profile_launch: None,
         agent_id_hint: None,
         effort: None,

package/crates/team-agent/src/lifecycle/tests/pi_executable_mcp_red.rs

@@ -572,7 +572,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
         model: None,
         effort: None,
         system_prompt: "native leader fixture",
-        tool_categories: &["mcp_team"],
         team_mcp_tools: &["send_message"],
         mcp_config: &native_config,
         session_scope: PiSessionScope::NativeDefault,
@@ -605,7 +604,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "isolated worker fixture",
-        tool_categories: &["mcp_team"],
         team_mcp_tools: &["send_message"],
         mcp_config: &isolated_config,
         session_scope: PiSessionScope::Isolated,
@@ -633,7 +631,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
             model: None,
             effort: None,
             system_prompt: "isolated resume fixture",
-            tool_categories: &["mcp_team"],
             team_mcp_tools: &["send_message"],
             mcp_config: &isolated_config,
             session_scope: PiSessionScope::Isolated,
@@ -664,7 +661,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
             model: None,
             effort: None,
             system_prompt: "native resume fixture",
-            tool_categories: &["mcp_team"],
             team_mcp_tools: &["send_message"],
             mcp_config: &native_config,
             session_scope: PiSessionScope::NativeDefault,
@@ -699,7 +695,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
                 model: None,
                 effort: None,
                 system_prompt: "isolated negative resume fixture",
-                tool_categories: &["mcp_team"],
                 team_mcp_tools: &["send_message"],
                 mcp_config: &isolated_config,
                 session_scope: PiSessionScope::Isolated,

package/crates/team-agent/src/lifecycle/tests/pi_session_delivery_red.rs

@@ -58,7 +58,6 @@ fn resume_argv(path: &Path) -> Result<Vec<String>, ProviderError> {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "worker contract",
-        tool_categories: &["mcp_team"],
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/team-a/worker-a/sessions",
         )),

package/crates/team-agent/src/lifecycle/tests/restart_rebind_hotfix_252_red.rs

@@ -901,13 +901,13 @@ impl ProviderAdapter for StaticCaptureAdapter {
         Ok(vec!["fake".to_string()])
     }
 
-    fn build_command_with_tools(
+    fn build_command_with_permissions(
         &self,
         auth_mode: AuthMode,
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        _tools: &[&str],
+        _dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         self.build_command(auth_mode, mcp_config, system_prompt, model)
     }
@@ -959,7 +959,7 @@ impl ProviderAdapter for StaticCaptureAdapter {
         mcp_config: Option<&McpConfig>,
         _system_prompt: Option<&str>,
         _model: Option<&str>,
-        _tools: &[&str],
+        _dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         self.build_resume_command(session_id, auth_mode, mcp_config)
     }
@@ -980,7 +980,7 @@ impl ProviderAdapter for StaticCaptureAdapter {
         mcp_config: Option<&McpConfig>,
         _system_prompt: Option<&str>,
         _model: Option<&str>,
-        _tools: &[&str],
+        _dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         self.fork(session_id, auth_mode, mcp_config)
     }

package/crates/team-agent/src/lifecycle/tests.rs

@@ -64,7 +64,6 @@ mod cursor_require_explicit_model_red;
 mod cursor_restart_resume_red;
 mod display_adaptive_red;
 mod f032_startup_prompt_best_effort_red;
-mod g1_silent_faces;
 mod grok_effort_argv_red;
 mod grok_mcp_overlay_red;
 mod grok_require_explicit_model_red;

package/crates/team-agent/src/lifecycle/types.rs

@@ -540,8 +540,6 @@ pub struct LaunchReport {
     pub tmux_endpoint: Option<String>,
     /// 路由决策(每 task 一条;`routing.decision` 事件)。
     pub routes: Vec<RoutingDecision>,
-    /// 权限摘要(每 agent 一条)。
-    pub permissions: Vec<PermissionSummary>,
     /// leader receiver(attach 成功时;经 step10 leader::attach_leader_to_state)。
     pub leader_receiver_attached: bool,
     pub leader_bind_stage: Option<String>,
@@ -577,14 +575,6 @@ pub struct RoutingDecision {
     pub manual_override: bool,
 }
 
-/// 权限摘要(`resolve_permissions(agent)` 的 typed 版)。**PLACEHOLDER 字段**:
-/// 实际形状由 step6 compiler 的 `resolve_permissions` 决定,集成时映射。
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PermissionSummary {
-    pub agent_id: AgentId,
-    pub raw: serde_json::Value,
-}
-
 /// BUG-7 (0.3.1): quick-start cannot honestly report "ready" before the workers'
 /// MCP tool sets have actually loaded — provider-side schema rejections (codex
 /// invalid_function_parameters etc.) happen AFTER spawn and silently disable the

package/crates/team-agent/src/lifecycle/worker_command_context.rs

@@ -1,17 +1,13 @@
 //! ---
-//! purpose: 从 spec 里的一个 agent 定义，编译出 worker 启动所需的系统提示词与工具串
+//! purpose: 从 spec 里的一个 agent 定义，编译出 worker 启动所需的系统提示词
 //! contract:
 //!   provides:
 //!     - name: WorkerCommandAgent
 //!       what: 从 YAML 或 JSON 读出的单 agent 命令上下文
 //!     - name: compile_worker_system_prompt
 //!       what: 按身份、runtime 契约、通信模式、角色正文、输出契约、权限说明拼系统提示词
-//!     - name: resolved_tool_strings_for_command
-//!       what: 解析出该 agent 的工具串，声明了 bypass 时追加 dangerous_auto_approve 哨兵
 //!   depends:
-//!     - crate::model::permissions
 //!     - crate::communication_mode
-//!     - crate::provider::bypass_flags
 //! boundary:
 //!   - 只产出字符串，不 spawn 进程、不写盘
 //!   - bypass 只认 agent 自身声明，不从 team/runtime/leader argv 继承
@@ -22,9 +18,7 @@ use std::path::Path;
 
 use crate::communication_mode::CommunicationMode;
 use crate::lifecycle::types::LifecycleError;
-use crate::model::enums::{Enforcement, Provider};
-use crate::model::ids::AgentId;
-use crate::model::permissions::{resolve_permissions, AgentPermissionInput};
+use crate::model::enums::Provider;
 
 const RUNTIME_CONTRACT_SECTION: &str = r#"# Team Agent Teammate Runtime Contract
 
@@ -57,7 +51,6 @@ pub(crate) struct WorkerCommandAgent {
     id: Option<String>,
     provider: Provider,
     role: Option<String>,
-    declared_tools: Option<Vec<String>>,
     system_prompt_inline: Option<String>,
     system_prompt_file: Option<String>,
     output_contract_format: Option<String>,
@@ -94,16 +87,6 @@ impl WorkerCommandAgent {
                 .get("role")
                 .and_then(crate::model::yaml::Value::as_str)
                 .map(str::to_string),
-            declared_tools: agent
-                .get("tools")
-                .and_then(crate::model::yaml::Value::as_list)
-                .map(|items| {
-                    items
-                        .iter()
-                        .filter_map(crate::model::yaml::Value::as_str)
-                        .map(str::to_string)
-                        .collect()
-                }),
             system_prompt_inline: system_prompt
                 .and_then(|prompt| prompt.get("inline"))
                 .and_then(crate::model::yaml::Value::as_str)
@@ -158,16 +141,6 @@ impl WorkerCommandAgent {
                 .get("role")
                 .and_then(serde_json::Value::as_str)
                 .map(str::to_string),
-            declared_tools: agent
-                .get("tools")
-                .and_then(serde_json::Value::as_array)
-                .map(|items| {
-                    items
-                        .iter()
-                        .filter_map(serde_json::Value::as_str)
-                        .map(str::to_string)
-                        .collect()
-                }),
             system_prompt_inline: system_prompt
                 .and_then(|prompt| prompt.get("inline"))
                 .and_then(serde_json::Value::as_str)
@@ -233,9 +206,6 @@ pub(crate) fn compile_worker_system_prompt(
     if let Some(contract) = output_contract(agent, &report_result) {
         chunks.push(contract);
     }
-    if let Some(notes) = permission_notes(agent)? {
-        chunks.push(notes);
-    }
     Ok(chunks
         .into_iter()
         .filter(|chunk| !chunk.is_empty())
@@ -254,43 +224,6 @@ Do not invent a second team protocol or assume that a configured lazy MCP server
         .to_string()
 }
 
-/// ---
-/// purpose: 解析该 agent 最终生效的工具串
-/// params:
-///   provider: 用于查 bypass argv 定义的 provider
-/// returns: 排序后的工具串；agent 声明 bypass 时末尾追加 dangerous_auto_approve
-/// errors: 权限解析失败，或声明了 bypass 但该 provider 没有 bypass argv 定义时返回 RequirementUnmet
-/// ---
-pub(crate) fn resolved_tool_strings_for_command(
-    agent: &WorkerCommandAgent,
-    provider: Provider,
-) -> Result<Vec<String>, LifecycleError> {
-    let mut tools: Vec<String> = resolve_agent_permissions(agent, provider)?
-        .sorted_tool_strings()
-        .into_iter()
-        .map(str::to_string)
-        .collect();
-    // 0.5.66 bypass 单源:读 agent 自己的 `dangerously_skip_permissions` bool,
-    // 不再收 team/runtime/leader argv 派生的 `DangerousApproval`。true → 加
-    // `dangerous_auto_approve` 哨兵(adapter 消费点不变);provider 无 bypass
-    // argv 定义 → fail-loud,不静默 fallback。
-    if agent.dangerously_skip_permissions && provider != Provider::Pi {
-        let flag = crate::provider::bypass_flags::provider_bypass_flag(provider).ok_or_else(
-            || {
-                LifecycleError::RequirementUnmet(format!(
-                    "provider {} has no bypass argv flag defined; dangerously_skip_permissions=true cannot be honored",
-                    provider_display_name(provider)
-                ))
-            },
-        )?;
-        debug_assert!(flag.starts_with("--"));
-        if !tools.iter().any(|tool| tool == "dangerous_auto_approve") {
-            tools.push("dangerous_auto_approve".to_string());
-        }
-    }
-    Ok(tools)
-}
-
 /// Provider-facing MCP tool name. Only verified call forms are filled in.
 /// Unverified providers keep the historical dotted spelling.
 fn mcp_tool_name(provider: Provider, server: &str, tool: &str) -> String {
@@ -308,33 +241,6 @@ fn mcp_tool_name(provider: Provider, server: &str, tool: &str) -> String {
     }
 }
 
-fn provider_display_name(provider: Provider) -> &'static str {
-    match provider {
-        Provider::Claude => "claude",
-        Provider::ClaudeCode => "claude_code",
-        Provider::Codex => "codex",
-        Provider::Copilot => "copilot",
-        Provider::GeminiCli => "gemini_cli",
-        Provider::Grok => "grok",
-        Provider::CursorAgent => "cursor_agent",
-        Provider::Pi => "pi",
-        Provider::Fake => "fake",
-    }
-}
-
-fn resolve_agent_permissions(
-    agent: &WorkerCommandAgent,
-    provider: Provider,
-) -> Result<crate::model::permissions::ResolvedPermissions, LifecycleError> {
-    resolve_permissions(&AgentPermissionInput {
-        id: agent.id.as_deref().map(AgentId::new),
-        provider,
-        role: agent.role.clone(),
-        tools: agent.declared_tools.clone(),
-    })
-    .map_err(|e| LifecycleError::Compile(e.to_string()))
-}
-
 fn runtime_contract_section(send_message: &str, report_result: &str) -> String {
     RUNTIME_CONTRACT_SECTION
         .replace("{send_message}", send_message)
@@ -405,161 +311,14 @@ fn output_contract(agent: &WorkerCommandAgent, report_result: &str) -> Option<St
         .then(|| RESULT_ENVELOPE_OUTPUT_CONTRACT.replace("{report_result}", report_result))
 }
 
-fn permission_notes(agent: &WorkerCommandAgent) -> Result<Option<String>, LifecycleError> {
-    let permissions = resolve_agent_permissions(agent, agent.provider)?;
-    // C-2-1/C-2-2 cr verdict — Copilot 一期 framework 不替决 fs_read/fs_list/git_diff/
-    // provider_builtin(provider prompt 控);为诚实(MUST-NOT-13)在 system prompt 内
-    // 总是声明这些 provider-level prompt_only 工具,即便角色未显式声明。
-    let provider_prompt_only_extras = provider_default_prompt_only_tools(agent.provider);
-    let mut prompt_only: std::collections::BTreeSet<String> = permissions
-        .resolved_tools
-        .iter()
-        .filter(|tool| tool.enforcement == Enforcement::PromptOnly)
-        .filter_map(|tool| serde_json::to_value(tool.tool).ok())
-        .filter_map(|value| value.as_str().map(str::to_string))
-        .collect();
-    for tool in provider_prompt_only_extras {
-        prompt_only.insert((*tool).to_string());
-    }
-    if prompt_only.is_empty() {
-        return Ok(None);
-    }
-    let prompt_only: Vec<String> = prompt_only.into_iter().collect();
-    Ok(Some(format!(
-        "Permission note: these tools are prompt-only for this provider and not hard-enforced: {}",
-        prompt_only.join(", ")
-    )))
-}
-
-/// C-2-1 cr verdict — provider-level prompt_only tools that the framework cannot
-/// hard-enforce. The system prompt declares them so the worker is honest about
-/// where consent gates actually live (provider prompt vs framework).
-fn provider_default_prompt_only_tools(provider: Provider) -> &'static [&'static str] {
-    match provider {
-        // C-2-1: fs_read / fs_list / git_diff / provider_builtin 由 provider prompt
-        // 控制,framework 不替决(prompt_only 诚实声明)。
-        Provider::Copilot => &["fs_list", "fs_read", "git_diff", "provider_builtin"],
-        _ => &[],
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn empty_tools_use_role_defaults_and_aliases_resolve_before_command() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::ClaudeCode,
-            role: Some("developer".to_string()),
-            declared_tools: Some(Vec::new()),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: false,
-        };
-        let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert_eq!(
-            tools,
-            [
-                "execute_bash",
-                "fs_list",
-                "fs_read",
-                "fs_write",
-                "git_diff",
-                "mcp_team",
-                "provider_builtin"
-            ]
-        );
-
-        let agent = WorkerCommandAgent {
-            declared_tools: Some(vec!["fs_*".to_string(), "@team-orchestrator".to_string()]),
-            ..agent
-        };
-        let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert_eq!(tools, ["fs_list", "fs_read", "fs_write", "mcp_team"]);
-    }
-
-    // 0.5.66 bypass 单源 §4.1:true → tools 追加 `dangerous_auto_approve` 哨兵。
-    #[test]
-    fn test_true_field_produces_bypass_flag_argv() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::ClaudeCode,
-            role: Some("developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: true,
-        };
-        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert!(
-            tools.iter().any(|tool| tool == "dangerous_auto_approve"),
-            "true field must append the dangerous_auto_approve sentinel; tools={tools:?}"
-        );
-        assert!(
-            tools.iter().any(|tool| tool == "mcp_team"),
-            "normal tools must remain; tools={tools:?}"
-        );
-    }
-
-    // 0.5.66 bypass 单源 §4.1:false → 不追加哨兵。
-    #[test]
-    fn test_false_field_produces_no_bypass_flag_argv() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::ClaudeCode,
-            role: Some("developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: false,
-        };
-        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert!(
-            !tools.iter().any(|tool| tool == "dangerous_auto_approve"),
-            "false field must not append the sentinel; tools={tools:?}"
-        );
-    }
-
-    // 0.5.66 bypass 单源 §4.1:provider 未定义 bypass 参数 + true → fail-loud。
-    #[test]
-    fn test_provider_without_bypass_flag_definition_errors() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::GeminiCli,
-            role: Some("developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: true,
-        };
-        let err = resolved_tool_strings_for_command(&agent, Provider::GeminiCli).unwrap_err();
-        let msg = err.to_string();
-        assert!(
-            msg.contains("no bypass argv flag defined"),
-            "provider without bypass flag + true must fail-loud; got {msg}"
-        );
-        assert!(
-            msg.contains("gemini_cli"),
-            "error must name the provider; got {msg}"
-        );
-    }
-
     #[test]
     fn system_prompt_uses_identity_then_runtime_contract_python_order() {
         // #264 D6: Python truth source (prompt.py:39, live ps confirmed) builds
-        // chunks = [identity, TEAMMATE_SYSTEM_PROMPT, role_body, output, permissions].
+        // chunks = [identity, TEAMMATE_SYSTEM_PROMPT, role_body, output].
         // The previous assertion locked the inverted contract-first order with no
         // Python evidence; this is the corrected golden.
         // 0.3.5 union (copilot v2 C-1 / B2 MUST-4 行为层守): identity 必须 FIRST —
@@ -569,7 +328,6 @@ mod tests {
             id: Some("coder".to_string()),
             provider: Provider::Codex,
             role: Some("Runtime Developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
             system_prompt_inline: Some("Implement the assigned slice.".to_string()),
             system_prompt_file: None,
             output_contract_format: Some("result_envelope_v1".to_string()),
@@ -590,8 +348,7 @@ mod tests {
         let output = prompt
             .find("Final completion must call team_orchestrator.report_result exactly once")
             .unwrap();
-        let permissions = prompt.find("Permission note:").unwrap();
-        assert!(identity < runtime && runtime < role && role < output && output < permissions);
+        assert!(identity < runtime && runtime < role && role < output);
         let slowdown_phrase = format!("500/{}", 500 + 29);
         assert!(prompt.contains(&slowdown_phrase));
         assert!(prompt.contains("Runtime Developer"));
@@ -605,7 +362,6 @@ mod tests {
                     id: Some("worker".to_string()),
                     provider,
                     role: Some("developer".to_string()),
-                    declared_tools: Some(vec!["mcp_team".to_string()]),
                     system_prompt_inline: Some("worker body".to_string()),
                     system_prompt_file: None,
                     output_contract_format: Some("result_envelope_v1".to_string()),