@team-agent/installer 0.5.85 → 0.5.86

package/crates/team-agent/src/lifecycle/launch.rs

@@ -17,7 +17,6 @@ use std::process::Command;
 
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
@@ -133,13 +132,6 @@ pub fn launch_with_transport_in_workspace(
             session_name.as_str()
         )));
     }
-    let permissions = spec_agents(&spec)
-        .into_iter()
-        .map(|agent| PermissionSummary {
-            agent_id: agent,
-            raw: serde_json::json!({"source": "compiled_spec"}),
-        })
-        .collect::<Vec<_>>();
     let routes = spec_routes(&spec);
     let started = if dry_run {
         Vec::new()
@@ -208,7 +200,6 @@ pub fn launch_with_transport_in_workspace(
         dry_run,
         tmux_endpoint: transport.tmux_endpoint(),
         routes,
-        permissions,
         leader_receiver_attached: false,
         leader_bind_stage: None,
         leader_bind_reason: None,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -301,11 +301,6 @@ pub(super) fn spawn_agent_window(
     )?;
     let system_prompt =
         crate::lifecycle::worker_command_context::compile_worker_system_prompt(&command_agent)?;
-    let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
-        &command_agent,
-        provider,
-    )?;
-    let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     // owner_team_id resolution priority (Issue 2 fix):
     //   1. caller's explicit override (restart paths pass `selected.team_key`)
     //   2. agent row's persisted `owner_team_id` (set by prior launch/restart)
@@ -374,7 +369,10 @@ pub(super) fn spawn_agent_window(
         mcp_config: Some(&mcp_config),
         system_prompt: Some(system_prompt.as_str()),
         model: command_model,
-        tools: &resolved_tool_refs,
+        dangerously_skip_permissions: agent
+            .get("dangerously_skip_permissions")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(false),
         profile_launch: Some(&profile_launch),
         agent_id_hint: Some(agent_id.as_str()),
         effort: restart_effort,
@@ -399,7 +397,6 @@ pub(super) fn spawn_agent_window(
             model: command_model,
             effort: restart_effort,
             system_prompt: &system_prompt,
-            tool_categories: &resolved_tool_refs,
             team_mcp_tools: &["send_message", "report_result"],
             mcp_config: &mcp_config,
             session_scope: crate::lifecycle::launch::pi_mcp::PiSessionScope::Isolated,
@@ -744,7 +741,6 @@ fn merge_command_context_fields(
     };
     for field in [
         "role",
-        "tools",
         "system_prompt",
         "output_contract",
         "provider",

package/crates/team-agent/src/lifecycle/tests/claude_compatible_config_red.rs

@@ -97,15 +97,13 @@ fn managed_profile_command_plan_omits_mcp_config_even_when_mcp_config_is_availab
             }
         }),
     };
-    let tools = ["mcp_team"];
-
     let plan = get_adapter(Provider::Claude)
         .build_command_plan(ProviderCommandContext {
             auth_mode: AuthMode::CompatibleApi,
             mcp_config: Some(&config),
             system_prompt: Some("worker prompt requiring native MCP"),
             model: Some("profile-effective-haiku"),
-            tools: &tools,
+            dangerously_skip_permissions: false,
             profile_launch: Some(&profile),
             agent_id_hint: None,
             effort: None,

package/crates/team-agent/src/lifecycle/tests/clone_agent_preserves_source_tools.rs

@@ -1,9 +1,9 @@
 //! ---
-//! purpose: 回归——clone-agent 分身 tools 必须与源席集合相等，禁止静默夹成 leader 三件套
+//! purpose: 回归——clone-agent 分身保留源席 tools，编译 spec 不投影 tools
 //! contract:
 //!   provides:
 //!     - name: clone_agent_preserves_source_tools
-//!       what: 真跑 clone-agent 后，dynamic-role-files / runtime spec 与源席 tools 集合相等
+//!       what: 真跑 clone-agent 后，dynamic-role-files 保留源席 tools，runtime spec 不投影 tools
 //!   requires:
 //!     - name: source-six-set-vs-leader-three-set
 //!       what: 同一 team 里 leader 三件套 + 源席六件套的共享冲突面
@@ -275,6 +275,10 @@ fn role_tools(path: &Path) -> BTreeSet<String> {
         .collect()
 }
 
+fn set_of(items: &[&str]) -> BTreeSet<String> {
+    items.iter().map(|s| (*s).to_string()).collect()
+}
+
 fn load_runtime_spec(workspace: &Path) -> Value {
     let runtime = workspace.join(".team").join("runtime");
     let spec = std::fs::read_dir(&runtime)
@@ -287,17 +291,7 @@ fn load_runtime_spec(workspace: &Path) -> Value {
         .expect("parse spec")
 }
 
-fn yaml_tool_set(node: &Value) -> BTreeSet<String> {
-    node.get("tools")
-        .and_then(Value::as_list)
-        .unwrap_or_else(|| panic!("tools list missing"))
-        .iter()
-        .filter_map(Value::as_str)
-        .map(str::to_string)
-        .collect()
-}
-
-fn spec_tools(workspace: &Path, agent: &str) -> BTreeSet<String> {
+fn spec_projects_tools(workspace: &Path, agent: &str) -> bool {
     let parsed = load_runtime_spec(workspace);
     let agents = parsed
         .get("agents")
@@ -305,22 +299,18 @@ fn spec_tools(workspace: &Path, agent: &str) -> BTreeSet<String> {
         .expect("spec agents");
     for row in agents {
         if row.get("id").and_then(Value::as_str) == Some(agent) {
-            return yaml_tool_set(row);
+            return row.get("tools").is_some();
         }
     }
     panic!("agent {agent} missing from runtime spec");
 }
 
-fn leader_spec_tools(workspace: &Path) -> BTreeSet<String> {
-    yaml_tool_set(
-        load_runtime_spec(workspace)
-            .get("leader")
-            .expect("spec leader"),
-    )
-}
-
-fn set_of(items: &[&str]) -> BTreeSet<String> {
-    items.iter().map(|s| (*s).to_string()).collect()
+fn leader_spec_projects_tools(workspace: &Path) -> bool {
+    load_runtime_spec(workspace)
+        .get("leader")
+        .expect("spec leader")
+        .get("tools")
+        .is_some()
 }
 
 fn clone_ok(case: &Case, source: &str, dest: &str, phase: &str) {
@@ -347,7 +337,7 @@ fn clone_ok(case: &Case, source: &str, dest: &str, phase: &str) {
     );
 }
 
-/// clone 后分身 role + spec tools 必须等于源席；三件套源不得被扩成六件。
+/// clone 后分身 role 保留源席 tools；编译 spec 不投影 tools。
 #[test]
 fn clone_agent_preserves_source_tools() {
     let case = Case::start();
@@ -380,21 +370,18 @@ fn clone_agent_preserves_source_tools() {
         String::from_utf8_lossy(&qs.stdout)
     );
 
-    let source_spec = spec_tools(&case.workspace, SOURCE);
-    assert_eq!(
-        source_spec,
-        set_of(SIX),
-        "fixture source must be the six-set"
+    assert!(
+        !spec_projects_tools(&case.workspace, SOURCE),
+        "compiled source spec must not project tools metadata"
     );
-    let leader_spec = leader_spec_tools(&case.workspace);
-    assert_eq!(
-        leader_spec,
-        set_of(THREE),
-        "leader must stay the three-set ceiling so the conflict surface exists; leader={leader_spec:?}"
+    assert!(
+        !leader_spec_projects_tools(&case.workspace),
+        "compiled leader spec must not project tools metadata"
     );
 
     clone_ok(&case, SOURCE, CLONE, "first_clone");
 
+    let source_role = role_tools(&case.workspace.join("agents").join(format!("{SOURCE}.md")));
     let clone_role = role_tools(
         &case
             .workspace
@@ -402,23 +389,32 @@ fn clone_agent_preserves_source_tools() {
             .join("dynamic-role-files")
             .join(format!("{CLONE}.md")),
     );
-    let clone_spec = spec_tools(&case.workspace, CLONE);
     assert_eq!(
-        clone_role, source_spec,
-        "clone role tools must equal source; source={source_spec:?} clone={clone_role:?}"
+        clone_role, source_role,
+        "clone role tools must equal source; source={source_role:?} clone={clone_role:?}"
     );
-    assert_eq!(
-        clone_spec, source_spec,
-        "clone spec tools must equal source; source={source_spec:?} spec={clone_spec:?}"
+    assert!(
+        !spec_projects_tools(&case.workspace, CLONE),
+        "compiled clone spec must not project tools metadata"
     );
 
-    let narrow_src = spec_tools(&case.workspace, NARROW);
-    assert_eq!(narrow_src, set_of(THREE), "narrow source fixture");
+    let narrow_source_role = role_tools(&case.workspace.join("agents").join(format!("{NARROW}.md")));
+    assert_eq!(narrow_source_role, set_of(THREE), "narrow source fixture");
     clone_ok(&case, NARROW, NARROW_CLONE, "second_clone");
-    let narrow_clone = spec_tools(&case.workspace, NARROW_CLONE);
+    let narrow_clone_role = role_tools(
+        &case
+            .workspace
+            .join(".team")
+            .join("dynamic-role-files")
+            .join(format!("{NARROW_CLONE}.md")),
+    );
     assert_eq!(
-        narrow_clone, narrow_src,
-        "narrow clone must keep the three-set (preserve, do not widen); got={narrow_clone:?}"
+        narrow_clone_role, narrow_source_role,
+        "narrow clone role must keep the three-set (preserve, do not widen); got={narrow_clone_role:?}"
+    );
+    assert!(
+        !spec_projects_tools(&case.workspace, NARROW_CLONE),
+        "compiled narrow clone spec must not project tools metadata"
     );
 
     case.shutdown();

package/crates/team-agent/src/lifecycle/tests/copilot_provider_red.rs

@@ -17,7 +17,7 @@
 //!  1. worker argv golden (§C1 + C-5-1/3)        — copilot_argv_* tests
 //!  2. per-worker AGENTS.md == compiled prompt    — copilot_agents_md_* tests (C-1-1/2,
 //!     identity-first per the 0.3.4 B2/D6 lock)
-//!  3. permission mapping (C-2-1, via the prompt's Permission note + argv deny flags)
+//!  3. tools metadata transparency (C-2-1, no prompt permission note or argv deny flags)
 //!  4. fork = structured CapabilityUnsupported (C-4-2/3)
 //!  5. startup recognizer supports copilot trust/ready; turn-state Unknown never idles
 //!     (N11, C-3-1/4)
@@ -62,12 +62,12 @@ const ANCESTRY_KEY: &str = "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON";
 const NEUTRAL_ANCESTRY: &str = "[\"/bin/zsh\"]";
 const COPILOT_TMP_PREFIX: &str = "ta-rs-copilot";
 
-/// Face 1+3 (§C1 golden + C-5-3, verdict cases `copilot_argv_golden_per_role_tools`
-/// and `non_dangerous_argv_contains_deny_flags_no_allow_all`): a restricted copilot
-/// worker (mcp_team only) gets the full §C1 argv — noise control, inline/`@file` MCP
-/// config carrying team_orchestrator, a pre-assigned `--session-id` equal to the
-/// persisted `_pending_session_id`, `-C <workspace>`, deny flags for the missing
-/// capabilities, and NO --allow-all family flag.
+/// Face 1+3 (§C1 golden + C-5-3, verdict case `copilot_argv_golden_per_role_tools`):
+/// a copilot worker (mcp_team only) gets the full §C1 argv — noise control,
+/// inline/`@file` MCP config carrying team_orchestrator, a pre-assigned
+/// `--session-id` equal to the persisted `_pending_session_id`, and `-C <workspace>`.
+/// Tools metadata must not derive deny flags; non-dangerous workers still omit the
+/// --allow-all family flag.
 #[test]
 #[serial(env)]
 fn copilot_argv_golden_restricted_role() {
@@ -176,21 +176,11 @@ team_orchestrator or @<.team/runtime/mcp/worker_a.json>; got {value:?}"
             flag_value(argv, "-C")
         ));
     }
-    // C-5-3: restricted role (no execute_bash / fs_write / network) → deny flags, and
-    // no --allow-all family flag anywhere.
-    let deny_tools = flag_values(argv, "--deny-tool");
-    for denied in ["shell", "write"] {
-        if !deny_tools.iter().any(|tool| tool.contains(denied)) {
-            failures.push(format!(
-                "C-5-3: restricted copilot worker must carry --deny-tool '{denied}'; deny={deny_tools:?}"
-            ));
-        }
-    }
-    // RC-15 (C-5-2 v2): network deny is `--deny-tool 'url'` (the help has only shell/
-    // write/mcp/url tool kinds; v1's --deny-url is not the v2 form).
-    if !deny_tools.iter().any(|tool| tool.contains("url")) {
+    // Tools metadata is transparent compatibility data; it must not derive
+    // provider-specific deny flags (shell/write/url or any other category).
+    if argv.iter().any(|arg| arg == "--deny-tool") {
         failures.push(format!(
-            "RC-15/C-5-2: restricted copilot worker must deny network via --deny-tool 'url'; deny={deny_tools:?}"
+            "C-5-3: tools metadata must not derive copilot --deny-tool flags; argv={argv:?}"
         ));
     }
     // RC-10 (C-3-5/C-5-2): mcp_team is allowlisted by server name (no approval prompt).
@@ -289,8 +279,8 @@ used for the dangerous tier; argv={argv:?}"
 /// the spawn env must carry COPILOT_CUSTOM_INSTRUCTIONS_DIRS pointing at the
 /// per-worker dir (path contains the agent id; works with NO profile configured), the
 /// AGENTS.md there must BE the compiled worker system prompt (single source: identity
-/// first, runtime contract, role body, output contract, permission note — 0.3.4 B2/D6
-/// lock), and no global ~/.copilot/AGENTS.md may be written.
+/// first, runtime contract, role body, and output contract), and no global
+/// ~/.copilot/AGENTS.md may be written.
 #[test]
 #[serial(env)]
 fn copilot_agents_md_is_the_compiled_prompt_and_env_points_at_it() {
@@ -362,7 +352,6 @@ with the identity section FIRST; head={:?}",
             "# Team Agent Teammate Runtime Contract",
             "COPILOT ROLE BODY SENTINEL",
             "report_result exactly once",
-            "Permission note: these tools are prompt-only for this provider and not hard-enforced:",
         ] {
             if !agents_md.contains(marker) {
                 failures.push(format!(
@@ -386,14 +375,11 @@ with the identity section FIRST; head={:?}",
     );
 }
 
-/// Face 3 (C-2-1, verdict `permission_enforcement_table_copilot_row_prompt_only_for_fs`):
-/// the copilot enforcement row must honestly register the no-hard-deny tools as
-/// prompt-only. Observable single-source: the compiled prompt's Permission note (built
-/// from PROVIDER_ENFORCEMENT) for a full-capability role must list exactly
-/// fs_list/fs_read/git_diff/provider_builtin (sorted).
+/// Face 3: tools metadata is transparent compatibility data and must not produce
+/// a provider-specific Permission note in the compiled Copilot prompt.
 #[test]
 #[serial(env)]
-fn copilot_permission_note_registers_fs_tools_prompt_only() {
+fn copilot_prompt_omits_removed_permission_note() {
     let _hermetic = enter_hermetic("copilot-permission-note");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("enforcement");
@@ -428,21 +414,21 @@ fn copilot_permission_note_registers_fs_tools_prompt_only() {
         .env
         .get("COPILOT_CUSTOM_INSTRUCTIONS_DIRS")
         .cloned()
-        .unwrap_or_default();
-    let agents_md = std::fs::read_to_string(Path::new(&dir).join("AGENTS.md")).unwrap_or_default();
-
-    let note_line = agents_md
-        .lines()
-        .find(|line| line.starts_with("Permission note:"))
-        .unwrap_or("")
-        .to_string();
+        .expect("Copilot spawn must carry COPILOT_CUSTOM_INSTRUCTIONS_DIRS");
+    assert!(
+        !dir.is_empty(),
+        "Copilot instructions directory must not be empty"
+    );
+    let agents_md = std::fs::read_to_string(Path::new(&dir).join("AGENTS.md"))
+        .expect("per-worker Copilot AGENTS.md must be readable");
+    let identity = "You are Team Agent worker `worker_a` with role `Copilot Worker`.";
+    assert!(
+        agents_md.starts_with(identity) && agents_md.contains("COPILOT ROLE BODY SENTINEL"),
+        "C-2-1: compiled Copilot prompt must include its identity and role body; content={agents_md:?}"
+    );
     assert!(
-        note_line.contains("fs_list, fs_read, git_diff, provider_builtin"),
-        "C-2-1: the copilot enforcement row must register exactly \
-fs_read/fs_list/git_diff/provider_builtin as prompt-only (sorted in the Permission \
-note; execute_bash/fs_write/network/mcp_team are hard); note={note_line:?} \
-agents_md_present={}",
-        !agents_md.is_empty()
+        !agents_md.contains("Permission note:"),
+        "C-2-1: removed provider tool enforcement must not emit a Permission note; content={agents_md:?}"
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/core_034_real_red.rs

@@ -37,7 +37,7 @@ fn bin() -> &'static str {
 
 #[test]
 #[serial(env)]
-fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
+fn claude_worker_spawn_argv_uses_compiled_prompt_without_tool_restrictions() {
     let _hermetic = enter_hermetic("core034-claude-argv");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -80,7 +80,6 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
         "send_message(to='leader'",
         "report_result exactly once",
         "ROLE BODY SENTINEL",
-        "Permission note",
     ] {
         if !prompt.contains(marker) {
             failures.push(format!("B2 missing compiled prompt marker {marker:?}"));
@@ -90,31 +89,15 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
         failures.push("B2 prompt collapsed to the bare role label".to_string());
     }
 
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-    for forbidden in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        if disallowed.iter().any(|tool| tool == forbidden) {
-            failures.push(format!(
-                "B1 declared capability still disallowed via --disallowedTools {forbidden:?}"
-            ));
-        }
+    if argv_has_flag(&spawn.argv, "--disallowedTools") {
+        failures.push("B1 Claude argv must not derive --disallowedTools from tools metadata".to_string());
     }
     if argv_has_flag(&spawn.argv, "--allowedTools") {
-        failures.push(
-            "B1 Python parity violated: Claude argv must not switch to --allowedTools".to_string(),
-        );
+        failures.push("B1 Claude argv must not derive --allowedTools from tools metadata".to_string());
     }
     assert!(
         failures.is_empty(),
-        "B1/B2 worker argv contract failed:\n{}\nprompt={prompt:?}\ndisallowed={disallowed:?}\nargv={:?}",
+        "B1/B2 worker argv contract failed:\n{}\nprompt={prompt:?}\nargv={:?}",
         failures.join("\n"),
         spawn.argv
     );
@@ -122,7 +105,7 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
 
 #[test]
 #[serial(env)]
-fn claude_control_role_without_native_tools_still_disallows_native_tools() {
+fn claude_control_role_does_not_derive_native_tool_restrictions() {
     let _hermetic = enter_hermetic("core034-claude-control");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -156,29 +139,21 @@ fn claude_control_role_without_native_tools_still_disallows_native_tools() {
     .expect("quick-start should record the control worker command");
 
     let spawn = transport.single_spawn();
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-    for expected in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        assert!(
-            disallowed.iter().any(|tool| tool == expected),
-            "B1 negative case: mcp_team-only control roles must still disallow native Claude tools; \
-             missing={expected} disallowed={disallowed:?}\nargv={:?}",
-            spawn.argv
-        );
-    }
+    assert!(
+        !argv_has_flag(&spawn.argv, "--disallowedTools"),
+        "B1 control role must not derive native-tool restrictions from tools metadata; argv={:?}",
+        spawn.argv
+    );
+    assert!(
+        !argv_has_flag(&spawn.argv, "--allowedTools"),
+        "B1 control role must not derive an allowlist from tools metadata; argv={:?}",
+        spawn.argv
+    );
 }
 
 #[test]
 #[serial(env)]
-fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_tools() {
+fn restart_claude_worker_does_not_derive_tool_restrictions_when_runtime_state_has_no_raw_tools() {
     let _hermetic = enter_hermetic("core034-restart-tools");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -215,34 +190,20 @@ fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_
     let report = restart_with_transport(&ws, true, Some("restarttools"), &restart_transport)
         .expect("restart should reach worker command construction");
     let spawn = restart_transport.single_spawn();
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-
-    for forbidden in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        assert!(
-            !disallowed.iter().any(|tool| tool == forbidden),
-            "B1 restart contract: when runtime state lacks raw tools, restart must resolve tools from the selected spec/role through resolve_permissions. \
-             {forbidden} must not be disallowed for this role; disallowed={disallowed:?}\nargv={:?}\nreport={report:?}",
-            spawn.argv
-        );
-    }
+    assert!(
+        !argv_has_flag(&spawn.argv, "--disallowedTools"),
+        "B1 restart must not derive native-tool restrictions from tools metadata; argv={:?} report={report:?}",
+        spawn.argv
+    );
     assert!(
         !argv_has_flag(&spawn.argv, "--allowedTools"),
-        "B1 Python parity: restart must keep --disallowedTools semantics, not switch to --allowedTools; argv={:?}",
+        "B1 restart must not derive an allowlist from tools metadata; argv={:?} report={report:?}",
         spawn.argv
     );
 }
 
 #[test]
-fn worker_command_context_uses_single_prompt_and_permission_sources() {
+fn worker_command_context_uses_single_prompt_without_permission_sources() {
     let crate_root = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
     let src_root = crate_root.join("src");
     let launch = composite_source::composite_source("src/lifecycle/launch.rs");
@@ -276,10 +237,9 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
             && all_src.contains("runtime_contract_section")
             && all_src.contains("identity_section")
             && all_src.contains("role_body")
-            && all_src.contains("output_contract")
-            && all_src.contains("permission_notes"),
-        "B2 grep guard: worker command construction needs one compiled prompt helper with the CR-approved five sections \
-         (runtime_contract_section, identity_section, role_body, output_contract, permission_notes)."
+            && all_src.contains("output_contract"),
+        "B2 grep guard: worker command construction needs one compiled prompt helper with the CR-approved four sections \
+         (runtime_contract_section, identity_section, role_body, output_contract)."
     );
     assert!(
         !command_sources.contains("system_prompt: role"),
@@ -296,8 +256,9 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
     );
 
     assert!(
-        all_src.contains("resolve_permissions") && all_src.contains("resolved_tool_strings"),
-        "B1 grep guard: command argv tools must be calculated through a single resolve_permissions helper, including role defaults and leader ceiling."
+        !command_sources.contains("resolve_permissions")
+            && !command_sources.contains("resolved_tool_strings"),
+        "B1 grep guard: command construction must not derive argv restrictions from tools metadata."
     );
     assert!(
         !command_sources.contains("worker_tool_refs(agent_tool_strings")
@@ -305,8 +266,8 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
         "B1 grep guard: command construction must not raw-pass agent.tools/tool_refs into ProviderCommandContext."
     );
     assert!(
-        adapter.contains("--disallowedTools") && !adapter.contains("--allowedTools"),
-        "B1 Python parity: provider adapter must keep Claude --disallowedTools and not invent --allowedTools."
+        !adapter.contains("--disallowedTools") && !adapter.contains("--allowedTools"),
+        "B1 provider adapter must not derive Claude tool restrictions from tools metadata."
     );
     assert!(
         !adapter.contains("resolve_permissions"),
@@ -837,12 +798,6 @@ fn flag_value(argv: &[String], flag: &str) -> Option<String> {
         .find_map(|pair| (pair[0] == flag).then(|| pair[1].clone()))
 }
 
-fn flag_values(argv: &[String], flag: &str) -> Vec<String> {
-    argv.windows(2)
-        .filter_map(|pair| (pair[0] == flag).then(|| pair[1].clone()))
-        .collect()
-}
-
 fn argv_has_flag(argv: &[String], flag: &str) -> bool {
     argv.iter().any(|arg| arg == flag)
 }

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -520,8 +520,8 @@ fn launch_dry_run_resolves_real_plan_not_stub_error() {
         Ok(report) => {
             assert!(report.dry_run, "dry_run launch must report dry_run=true");
             assert!(
-                !report.routes.is_empty() || !report.permissions.is_empty(),
-                "dry_run launch must resolve a real route/permission plan from the compiled spec"
+                !report.routes.is_empty(),
+                "dry_run launch must resolve a real route plan from the compiled spec"
             );
         }
         // any OTHER Err (a real requirement/transport error) still proves the stub is gone.
@@ -3210,7 +3210,6 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "profile",
             "window",
             "mcp_config",
-            "permissions",
             "effective_approval_policy",
             // 0.5.66 bypass 单源:fresh spawn 记录运行面 bypass 值(restart drift 挡板)。
             "as_launched_dangerously_skip_permissions",
@@ -3239,16 +3238,6 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             .join(".team/runtime/mcp/implementer.json")
             .to_string_lossy())
     );
-    assert_eq!(
-        agent["permissions"],
-        json!({
-            "agent_id": "implementer",
-            "provider": "codex",
-            "tools": ["mcp_team"],
-            "resolved_tools": [{"tool": "mcp_team", "enforcement": "prompt_only"}],
-            "has_prompt_only": true
-        })
-    );
     assert!(agent["session_id"].is_null());
     assert!(agent["rollout_path"].is_null());
     assert!(agent["captured_at"].is_null());

package/crates/team-agent/src/lifecycle/tests/pi_catalog_red.rs

@@ -91,7 +91,6 @@ fn command_for_model(model: &str) -> Vec<String> {
         model: Some(model),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "worker contract",
-        tool_categories: &["mcp_team"],
         session_dir: Some(Path::new("/workspace/.team/runtime/pi/t1/w1/sessions")),
         session: PiSessionSelector::Fresh {
             session_id: "716ba0cb-c491-4471-b41a-43c8d5e1f05a",

package/crates/team-agent/src/lifecycle/tests/pi_command_red.rs

@@ -10,7 +10,6 @@ fn request(session: PiSessionSelector<'static>) -> PiCommandRequest<'static> {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::High),
         system_prompt: "frozen worker prompt",
-        tool_categories: &["mcp_team", "fs_read", "fs_write", "execute_bash"],
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/team-a/worker-a/sessions",
         )),
@@ -38,7 +37,6 @@ fn leader_request() -> PiCommandRequest<'static> {
         model: None,
         effort: None,
         system_prompt: "frozen leader prompt",
-        tool_categories: &["mcp_team", "fs_read", "fs_write", "execute_bash"],
         session_dir: None,
         session: PiSessionSelector::Fresh {
             session_id: "da8c3622-2378-4d05-a26c-e826a6ef6d63",