@team-agent/installer 0.5.84 → 0.5.86

package/crates/team-agent/src/provider/adapter.rs

@@ -54,27 +54,26 @@ pub trait ProviderAdapter {
         model: Option<&str>,
     ) -> Result<Vec<String>, ProviderError>;
 
-    /// Same as [`ProviderAdapter::build_command`], with the agent tool list supplied
-    /// so provider-specific sandbox flags can be computed without guessing.
-    fn build_command_with_tools(
+    /// Same as [`ProviderAdapter::build_command`], with the explicit bypass flag.
+    fn build_command_with_permissions(
         &self,
         auth_mode: AuthMode,
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        tools: &[&str],
+        dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError>;
 
     fn build_command_plan(
         &self,
         ctx: ProviderCommandContext<'_>,
     ) -> Result<CommandPlan, ProviderError> {
-        self.build_command_with_tools(
+        self.build_command_with_permissions(
             ctx.auth_mode,
             ctx.mcp_config,
             ctx.system_prompt,
             ctx.model,
-            ctx.tools,
+            ctx.dangerously_skip_permissions,
         )
         .map(CommandPlan::argv_only)
     }
@@ -139,7 +138,7 @@ pub trait ProviderAdapter {
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        tools: &[&str],
+        dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError>;
 
     fn build_resume_command_plan(
@@ -153,7 +152,7 @@ pub trait ProviderAdapter {
             ctx.mcp_config,
             ctx.system_prompt,
             ctx.model,
-            ctx.tools,
+            ctx.dangerously_skip_permissions,
         )
         .map(CommandPlan::argv_only)
     }
@@ -174,7 +173,7 @@ pub trait ProviderAdapter {
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        tools: &[&str],
+        dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError>;
 
     fn fork_plan(
@@ -188,7 +187,7 @@ pub trait ProviderAdapter {
             ctx.mcp_config,
             ctx.system_prompt,
             ctx.model,
-            ctx.tools,
+            ctx.dangerously_skip_permissions,
         )
         .map(CommandPlan::argv_only)
     }
@@ -429,16 +428,16 @@ impl ProviderAdapter for BasicProviderAdapter {
         system_prompt: Option<&str>,
         model: Option<&str>,
     ) -> Result<Vec<String>, ProviderError> {
-        self.build_command_with_tools(auth_mode, mcp_config, system_prompt, model, &[])
+        self.build_command_with_permissions(auth_mode, mcp_config, system_prompt, model, false)
     }
 
-    fn build_command_with_tools(
+    fn build_command_with_permissions(
         &self,
         auth_mode: AuthMode,
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        tools: &[&str],
+        dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         match self.provider {
             Provider::Claude | Provider::ClaudeCode => Ok(claude_launch_command(
@@ -447,7 +446,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                 mcp_config,
                 system_prompt,
                 model,
-                tools,
+                dangerously_skip_permissions,
             )?),
             Provider::Codex => Ok(codex_base_command(
                 None,
@@ -455,7 +454,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                 mcp_config,
                 system_prompt,
                 model,
-                tools,
+                dangerously_skip_permissions,
                 None,
                 None,
             )),
@@ -470,7 +469,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                 mcp_config,
                 system_prompt,
                 model,
-                tools,
+                dangerously_skip_permissions,
             )),
             Provider::GeminiCli => {
                 let mut argv = vec!["gemini".to_string()];
@@ -486,7 +485,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                 mcp_config,
                 system_prompt,
                 model,
-                tools,
+                dangerously_skip_permissions,
             )?),
             Provider::CursorAgent => Ok(cursor_agent_base_command(
                 self,
@@ -494,7 +493,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                 mcp_config,
                 system_prompt,
                 model,
-                tools,
+                dangerously_skip_permissions,
                 false,
                 None,
             )?),
@@ -542,7 +541,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     managed,
                     ctx.effort,
                 )?;
@@ -581,7 +580,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                 ctx.mcp_config,
                 ctx.system_prompt,
                 ctx.model,
-                ctx.tools,
+                ctx.dangerously_skip_permissions,
                 ctx.profile_launch.map(|profile| &profile.command_overrides),
                 ctx.effort,
             ))),
@@ -602,7 +601,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch
                         .is_some_and(|profile| profile.managed_mcp_config),
                     ctx.effort,
@@ -623,7 +622,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                 );
                 argv.push("--session-id".to_string());
                 argv.push(expected.clone());
@@ -643,7 +642,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch
                         .is_some_and(|profile| profile.managed_mcp_config),
                     ctx.effort,
@@ -659,12 +658,12 @@ impl ProviderAdapter for BasicProviderAdapter {
                 "Pi commands require the shared lifecycle materializer".to_string(),
             )),
             _ => self
-                .build_command_with_tools(
+                .build_command_with_permissions(
                     ctx.auth_mode,
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                 )
                 .map(CommandPlan::argv_only),
         }
@@ -760,7 +759,7 @@ impl ProviderAdapter for BasicProviderAdapter {
         auth_mode: AuthMode,
         mcp_config: Option<&McpConfig>,
     ) -> Result<Vec<String>, ProviderError> {
-        self.build_resume_command_with_context(session_id, auth_mode, mcp_config, None, None, &[])
+        self.build_resume_command_with_context(session_id, auth_mode, mcp_config, None, None, false)
     }
 
     fn build_resume_command_with_context(
@@ -770,7 +769,7 @@ impl ProviderAdapter for BasicProviderAdapter {
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        tools: &[&str],
+        dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         if !self.session_is_resumable(session_id, auth_mode)? {
             return Err(ProviderError::ResumeUnavailable(format!(
@@ -791,7 +790,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     None,
                     None,
                 );
@@ -805,7 +804,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     false,
                     None,
                 )?;
@@ -817,7 +816,7 @@ impl ProviderAdapter for BasicProviderAdapter {
             // copilot --resume 接受 id|name)。
             Provider::Copilot => {
                 let mut argv =
-                    copilot_base_command_resume(auth_mode, mcp_config, system_prompt, model, tools);
+                    copilot_base_command_resume(auth_mode, mcp_config, system_prompt, model, dangerously_skip_permissions);
                 argv.push("--resume".to_string());
                 argv.push(session_id.as_str().to_string());
                 Ok(argv)
@@ -830,7 +829,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     false,
                     None,
                 )?;
@@ -846,7 +845,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     false,
                     None,
                 )?;
@@ -888,7 +887,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     managed,
                     ctx.effort,
                 )?;
@@ -928,7 +927,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch.map(|profile| &profile.command_overrides),
                     ctx.effort,
                 );
@@ -947,7 +946,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch
                         .is_some_and(|profile| profile.managed_mcp_config),
                     ctx.effort,
@@ -974,7 +973,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch
                         .is_some_and(|profile| profile.managed_mcp_config),
                     ctx.effort,
@@ -990,7 +989,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                 )
                 .map(CommandPlan::argv_only),
         }
@@ -1002,7 +1001,7 @@ impl ProviderAdapter for BasicProviderAdapter {
         auth_mode: AuthMode,
         mcp_config: Option<&McpConfig>,
     ) -> Result<Vec<String>, ProviderError> {
-        self.fork_with_context(session_id, auth_mode, mcp_config, None, None, &[])
+        self.fork_with_context(session_id, auth_mode, mcp_config, None, None, false)
     }
 
     fn fork_with_context(
@@ -1012,7 +1011,7 @@ impl ProviderAdapter for BasicProviderAdapter {
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        tools: &[&str],
+        dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         if !self.caps().fork || auth_mode == AuthMode::CompatibleApi {
             return Err(ProviderError::CapabilityUnsupported(format!(
@@ -1033,7 +1032,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     None,
                     None,
                 );
@@ -1047,7 +1046,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     false,
                     None,
                 )?;
@@ -1073,7 +1072,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     mcp_config,
                     system_prompt,
                     model,
-                    tools,
+                    dangerously_skip_permissions,
                     false,
                     None,
                 )?;
@@ -1125,7 +1124,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     managed,
                     ctx.effort,
                 )?;
@@ -1156,7 +1155,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch.map(|profile| &profile.command_overrides),
                     ctx.effort,
                 );
@@ -1197,7 +1196,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                 );
                 argv.push("--resume".to_string());
                 argv.push(expected.as_str().to_string());
@@ -1220,7 +1219,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                     ctx.profile_launch
                         .is_some_and(|profile| profile.managed_mcp_config),
                     ctx.effort,
@@ -1239,7 +1238,7 @@ impl ProviderAdapter for BasicProviderAdapter {
                     ctx.mcp_config,
                     ctx.system_prompt,
                     ctx.model,
-                    ctx.tools,
+                    ctx.dangerously_skip_permissions,
                 )
                 .map(CommandPlan::argv_only),
         }
@@ -1402,9 +1401,8 @@ pub(crate) fn json_inline(value: &serde_json::Value) -> String {
 
 // 0.4.x decoupling step 2: provider-local command builders moved to provider/adapters/.
 // Only the entry points the trait impl actually calls are re-imported here;
-// the per-provider helper fns (dangerous_auto_approve, permission flags,
-// disallowed_tools, sandbox_mode, mcp_overrides) are called from within the
-// extracted base_command fns, not directly by this file.
+// The per-provider command helpers and MCP renderers are called from within
+// the extracted base-command functions, not directly by this file.
 use super::adapters::claude::{claude_base_command, claude_launch_command};
 use super::adapters::codex::codex_base_command;
 use super::adapters::copilot::{copilot_base_command, copilot_base_command_resume};

package/crates/team-agent/src/provider/adapters/claude.rs

@@ -3,7 +3,7 @@
 //!
 //! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
 //! extraction — byte-identical to the original inline forms. Scope kept
-//! small on purpose: base command + permission/disallowed-tool mapping +
+//! small on purpose: base command + launch wrapper +
 //! launch wrapper. Auth hints (`claude_auth_hint`) and the context-aware model
 //! resolver (`claude_context_model`) stay in `adapter.rs`; capture scanning
 //! helpers now live under `provider/session_scan/claude.rs`.
@@ -18,7 +18,7 @@ pub(crate) fn claude_launch_command(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
 ) -> Result<Vec<String>, ProviderError> {
     let mut argv = claude_base_command(
         adapter,
@@ -26,7 +26,7 @@ pub(crate) fn claude_launch_command(
         mcp_config,
         system_prompt,
         model,
-        tools,
+        dangerously_skip_permissions,
         false,
         None,
     )?;
@@ -41,14 +41,14 @@ pub(crate) fn claude_base_command(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
     managed_mcp_config: bool,
     // 0.4.x provider effort MVP step 5: when Some, inject `--effort <level>`
     // immediately after the model (before prompt/MCP).
     effort: Option<crate::model::enums::ProviderEffort>,
 ) -> Result<Vec<String>, ProviderError> {
     let mut argv = vec!["claude".to_string()];
-    if claude_dangerous_auto_approve(tools) {
+    if dangerously_skip_permissions {
         // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给(单源)。
         let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Claude)
             .expect("claude provider must define a bypass flag");
@@ -82,30 +82,5 @@ pub(crate) fn claude_base_command(
         argv.push("--mcp-config".to_string());
         argv.push(raw.to_string());
     }
-    for tool in claude_disallowed_tools(tools) {
-        argv.push("--disallowedTools".to_string());
-        argv.push(tool.to_string());
-    }
     Ok(argv)
 }
-
-pub(crate) fn claude_dangerous_auto_approve(tools: &[&str]) -> bool {
-    tools.contains(&"dangerous_auto_approve")
-}
-
-pub(crate) fn claude_disallowed_tools(tools: &[&str]) -> Vec<&'static str> {
-    let mut disallowed = Vec::new();
-    if !tools.contains(&"execute_bash") {
-        disallowed.push("Bash");
-    }
-    if !tools.contains(&"fs_read") {
-        disallowed.push("Read");
-    }
-    if !tools.contains(&"fs_write") {
-        disallowed.extend(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-    }
-    if !tools.contains(&"fs_list") {
-        disallowed.extend(["Glob", "Grep"]);
-    }
-    disallowed
-}

package/crates/team-agent/src/provider/adapters/codex.rs

@@ -1,12 +1,12 @@
 //!
-//! Codex provider-local command builder + permission/sandbox helpers.
+//! Codex provider-local command builder.
 //!
 //! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
 //! extraction — byte-identical to the original inline forms. Shared helper
 //! `json_inline` stays in `adapter.rs` because it is also used by other
 //! sites; this file reaches it via `super::*`.
 
-use crate::model::enums::{AuthMode, Provider};
+use crate::model::enums::AuthMode;
 use crate::provider::adapter::json_inline;
 use crate::provider::{McpConfig, ProviderCommandOverrides};
 
@@ -16,7 +16,7 @@ pub(crate) fn codex_base_command(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
     overrides: Option<&ProviderCommandOverrides>,
     // 0.4.x provider effort MVP step 6: when Some, inject
     // `-c model_reasoning_effort=<level>` AFTER existing profile
@@ -40,16 +40,11 @@ pub(crate) fn codex_base_command(
         argv.push("--profile".to_string());
         argv.push(profile.to_string());
     }
-    if codex_dangerous_auto_approve(tools) {
+    if dangerously_skip_permissions {
         // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给。
-        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Codex)
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(crate::model::enums::Provider::Codex)
             .expect("codex provider must define a bypass flag");
         argv.push(flag.to_string());
-    } else {
-        argv.push("--sandbox".to_string());
-        argv.push(codex_sandbox_mode(tools).to_string());
-        argv.push("--ask-for-approval".to_string());
-        argv.push("on-request".to_string());
     }
     if let Some(model) = model {
         argv.push("--model".to_string());
@@ -114,18 +109,3 @@ pub(crate) fn append_codex_mcp_overrides(argv: &mut Vec<String>, raw: &serde_jso
         argv.push(format!("mcp_servers.{name}.tool_timeout_sec=600.0"));
     }
 }
-
-pub(crate) fn codex_dangerous_auto_approve(tools: &[&str]) -> bool {
-    tools.contains(&"dangerous_auto_approve")
-}
-
-pub(crate) fn codex_sandbox_mode(tools: &[&str]) -> &'static str {
-    if tools
-        .iter()
-        .any(|tool| matches!(*tool, "fs_write" | "execute_bash"))
-    {
-        "workspace-write"
-    } else {
-        "read-only"
-    }
-}

package/crates/team-agent/src/provider/adapters/copilot.rs

@@ -1,13 +1,13 @@
 //!
-//! Copilot provider-local command builders + permission helpers.
+//! Copilot provider-local command builders.
 //!
 //! Extracted from `provider/adapter.rs` (0.4.x decoupling step 2). Pure
 //! extraction — byte-identical to the original inline forms. Scope kept
-//! small: base command + resume + permission flags + MCP type→transport
+//! small: base command + resume + MCP type→transport
 //! translation. Auth hint (`copilot_auth_hint`) stays in `adapter.rs`;
 //! session-store scanning lives under `provider/session_scan/copilot.rs`.
 
-use crate::model::enums::{AuthMode, Provider};
+use crate::model::enums::AuthMode;
 use crate::provider::McpConfig;
 
 pub(crate) fn copilot_base_command(
@@ -15,7 +15,7 @@ pub(crate) fn copilot_base_command(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
 ) -> Vec<String> {
     let _ = (auth_mode, system_prompt);
     let mut argv = vec![
@@ -28,15 +28,11 @@ pub(crate) fn copilot_base_command(
         // spawn-time `copilot mcp list` scan + per-name --disable-mcp-server.
         "--disable-builtin-mcps".to_string(),
     ];
-    if copilot_dangerous_auto_approve(tools) {
+    if dangerously_skip_permissions {
         // 0.5.66 bypass 单源:flag 由 provider_bypass_flag 表供给。
-        let flag = crate::provider::bypass_flags::provider_bypass_flag(Provider::Copilot)
+        let flag = crate::provider::bypass_flags::provider_bypass_flag(crate::model::enums::Provider::Copilot)
             .expect("copilot provider must define a bypass flag");
         argv.push(flag.to_string());
-    } else {
-        for flag in copilot_permission_flags(tools) {
-            argv.push(flag);
-        }
     }
     // mcp_team ∈ canonical → approval-free (whole-server pattern).
     argv.push("--allow-tool".to_string());
@@ -57,7 +53,7 @@ pub(crate) fn copilot_base_command(
 
 /// Translate `McpConfig.raw` canonical schema (`type`) into the copilot
 /// `mcp add`/`--additional-mcp-config` expected `transport` field
-/// (stdio|http|sse). Only the copilot adapter walks this translation —
+/// (stdio|http|sse). Shared by inline plans and lifecycle config files;
 /// claude/codex paths leave canonical schema untouched.
 pub(crate) fn copilot_translate_mcp_config(raw: &serde_json::Value) -> serde_json::Value {
     let Some(servers) = raw.as_object() else {
@@ -90,36 +86,7 @@ pub(crate) fn copilot_base_command_resume(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
 ) -> Vec<String> {
-    copilot_base_command(auth_mode, mcp_config, system_prompt, model, tools)
-}
-
-pub(crate) fn copilot_dangerous_auto_approve(tools: &[&str]) -> bool {
-    tools.contains(&"dangerous_auto_approve")
-}
-
-/// Granular deny mapping (canonical tool → copilot flag, all via
-/// `--deny-tool <kind>`; help-permissions Tool Permissions has four kinds:
-/// shell/write/mcp/url):
-///   execute_bash ∉ allowed → `--deny-tool 'shell'`
-///   fs_write     ∉ allowed → `--deny-tool 'write'`
-///   network      ∉ allowed → `--deny-tool 'url'`
-/// fs_read/fs_list have no copilot deny kind (honestly prompt_only).
-pub(crate) fn copilot_permission_flags(tools: &[&str]) -> Vec<String> {
-    let mut flags = Vec::new();
-    if !tools.contains(&"execute_bash") {
-        flags.push("--deny-tool".to_string());
-        flags.push("shell".to_string());
-    }
-    if !tools.contains(&"fs_write") {
-        flags.push("--deny-tool".to_string());
-        flags.push("write".to_string());
-    }
-    if !tools.contains(&"network") {
-        // `--deny-tool 'url'` (omit domain → match all URLs).
-        flags.push("--deny-tool".to_string());
-        flags.push("url".to_string());
-    }
-    flags
+    copilot_base_command(auth_mode, mcp_config, system_prompt, model, dangerously_skip_permissions)
 }

package/crates/team-agent/src/provider/adapters/cursor_agent.rs

@@ -32,7 +32,7 @@ pub(crate) fn cursor_agent_launch_command(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
 ) -> Result<Vec<String>, ProviderError> {
     cursor_agent_base_command(
         adapter,
@@ -40,7 +40,7 @@ pub(crate) fn cursor_agent_launch_command(
         mcp_config,
         system_prompt,
         model,
-        tools,
+        dangerously_skip_permissions,
         false,
         None,
     )
@@ -52,14 +52,14 @@ pub(crate) fn cursor_agent_base_command(
     mcp_config: Option<&McpConfig>,
     system_prompt: Option<&str>,
     model: Option<&str>,
-    tools: &[&str],
+    dangerously_skip_permissions: bool,
     managed_mcp_config: bool,
     effort: Option<crate::model::enums::ProviderEffort>,
 ) -> Result<Vec<String>, ProviderError> {
     let mut argv = vec!["agent".to_string()];
     // --trust 跳过 Workspace Trust 闸（已实测）。无此 flag 会停在 Do you trust。
     argv.push("--trust".to_string());
-    if cursor_agent_dangerous_auto_approve(tools) {
+    if dangerously_skip_permissions {
         argv.push("--force".to_string());
     }
     // 与 cursor_seat.sh 主路径一致。沙箱实际隔离面未再拆，但 flag 本身已实测。
@@ -80,7 +80,3 @@ pub(crate) fn cursor_agent_base_command(
     argv.push("{workspace}".to_string());
     Ok(argv)
 }
-
-pub(crate) fn cursor_agent_dangerous_auto_approve(tools: &[&str]) -> bool {
-    tools.contains(&"dangerous_auto_approve")
-}