@team-agent/installer 0.5.85 → 0.5.89

package/crates/team-agent/src/lifecycle/launch/readiness.rs

@@ -30,7 +30,6 @@ use std::process::Command;
 use crate::lifecycle::*;
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};

package/crates/team-agent/src/lifecycle/launch/spawn.rs

@@ -32,7 +32,6 @@ use crate::lifecycle::profile_launch::parse_provider;
 use crate::lifecycle::*;
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
@@ -123,11 +122,6 @@ pub(super) fn spawn_agents(
         )?;
         let system_prompt =
             crate::lifecycle::worker_command_context::compile_worker_system_prompt(&command_agent)?;
-        let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
-            &command_agent,
-            provider,
-        )?;
-        let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
         // 0.5.66 bypass 单源:per-agent safety 只服务 env 注入与审计,不参与 argv 决策。
         let safety = effective_runtime_config_for_worker_spawn(agent, provider)?;
         let mcp_team_id = runtime_team_key_for_spec(spec_path, spec, session_name);
@@ -158,7 +152,7 @@ pub(super) fn spawn_agents(
         // 0.4.x provider effort MVP step 4 + 7: resolve effort and emit
         // unsupported warning event when the spec asked for an effort the
         // provider can't satisfy.
-        let agent_effort = provider_effort_for_spawn(agent, provider);
+        let agent_effort = provider_effort_for_spawn(agent, provider)?;
         if let Some(event_value) = provider_effort_event_if_dropped(agent, provider, agent_id_raw) {
             let _ = crate::event_log::EventLog::new(workspace)
                 .write("provider.effort_unsupported", event_value);
@@ -168,7 +162,10 @@ pub(super) fn spawn_agents(
             mcp_config: Some(&mcp_config),
             system_prompt: Some(system_prompt.as_str()),
             model: command_model,
-            tools: &resolved_tool_refs,
+            dangerously_skip_permissions: matches!(
+                agent.get("dangerously_skip_permissions"),
+                Some(Value::Bool(true))
+            ),
             profile_launch: Some(&profile_launch),
             // Layer 1 self-healing (architect probe 2026-06-22): expose
             // agent_id as a display-name hint so Claude / Copilot
@@ -186,7 +183,6 @@ pub(super) fn spawn_agents(
                     model: command_model,
                     effort: agent_effort,
                     system_prompt: &system_prompt,
-                    tool_categories: &resolved_tool_refs,
                     team_mcp_tools: &["send_message", "report_result"],
                     mcp_config: &mcp_config,
                     session_scope: crate::lifecycle::launch::pi_mcp::PiSessionScope::Isolated,

package/crates/team-agent/src/lifecycle/launch/spec_state.rs

@@ -62,7 +62,6 @@ use std::process::Command;
 use crate::lifecycle::*;
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};

package/crates/team-agent/src/lifecycle/launch/state_projection.rs

@@ -37,7 +37,6 @@ use crate::lifecycle::profile_launch::parse_provider;
 use crate::lifecycle::*;
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};

package/crates/team-agent/src/lifecycle/launch/worker_env.rs

@@ -30,7 +30,6 @@ use std::process::Command;
 use crate::lifecycle::*;
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};

package/crates/team-agent/src/lifecycle/launch.rs

@@ -17,7 +17,6 @@ use std::process::Command;
 
 use crate::model::enums::{AuthMode, DisplayBackend, PaneLiveness, Provider, ProviderEffort};
 use crate::model::ids::AgentId;
-use crate::model::permissions::{self, AgentPermissionInput};
 use crate::model::yaml::{self, Value};
 use crate::state::persist::load_runtime_state;
 use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
@@ -133,13 +132,6 @@ pub fn launch_with_transport_in_workspace(
             session_name.as_str()
         )));
     }
-    let permissions = spec_agents(&spec)
-        .into_iter()
-        .map(|agent| PermissionSummary {
-            agent_id: agent,
-            raw: serde_json::json!({"source": "compiled_spec"}),
-        })
-        .collect::<Vec<_>>();
     let routes = spec_routes(&spec);
     let started = if dry_run {
         Vec::new()
@@ -208,7 +200,6 @@ pub fn launch_with_transport_in_workspace(
         dry_run,
         tmux_endpoint: transport.tmux_endpoint(),
         routes,
-        permissions,
         leader_receiver_attached: false,
         leader_bind_stage: None,
         leader_bind_reason: None,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -301,11 +301,6 @@ pub(super) fn spawn_agent_window(
     )?;
     let system_prompt =
         crate::lifecycle::worker_command_context::compile_worker_system_prompt(&command_agent)?;
-    let tools = crate::lifecycle::worker_command_context::resolved_tool_strings_for_command(
-        &command_agent,
-        provider,
-    )?;
-    let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
     // owner_team_id resolution priority (Issue 2 fix):
     //   1. caller's explicit override (restart paths pass `selected.team_key`)
     //   2. agent row's persisted `owner_team_id` (set by prior launch/restart)
@@ -360,7 +355,7 @@ pub(super) fn spawn_agent_window(
     let command_model = profile_launch.command_overrides.model.as_deref().or(model);
     // 0.4.x provider effort MVP: restart/resume preserves effort from the
     // persisted agent JSON (state's agent["effort"] field, set by launch).
-    let restart_effort = crate::lifecycle::launch::provider_effort_for_spawn_json(agent, provider);
+    let restart_effort = crate::lifecycle::launch::provider_effort_for_spawn_json(agent, provider)?;
     if let Some(event_value) = crate::lifecycle::launch::provider_effort_event_if_dropped_json(
         agent,
         provider,
@@ -374,7 +369,10 @@ pub(super) fn spawn_agent_window(
         mcp_config: Some(&mcp_config),
         system_prompt: Some(system_prompt.as_str()),
         model: command_model,
-        tools: &resolved_tool_refs,
+        dangerously_skip_permissions: agent
+            .get("dangerously_skip_permissions")
+            .and_then(serde_json::Value::as_bool)
+            .unwrap_or(false),
         profile_launch: Some(&profile_launch),
         agent_id_hint: Some(agent_id.as_str()),
         effort: restart_effort,
@@ -399,7 +397,6 @@ pub(super) fn spawn_agent_window(
             model: command_model,
             effort: restart_effort,
             system_prompt: &system_prompt,
-            tool_categories: &resolved_tool_refs,
             team_mcp_tools: &["send_message", "report_result"],
             mcp_config: &mcp_config,
             session_scope: crate::lifecycle::launch::pi_mcp::PiSessionScope::Isolated,
@@ -744,7 +741,6 @@ fn merge_command_context_fields(
     };
     for field in [
         "role",
-        "tools",
         "system_prompt",
         "output_contract",
         "provider",

package/crates/team-agent/src/lifecycle/tests/b0_reader_hideone_audit_contract.rs

@@ -99,17 +99,17 @@ fn stale_snapshot_cannot_flip_status_or_diagnose_ok_readiness() {
     let case = B0HideOneCase::new("status-diagnose-hide-one");
     let root = case.current_state();
     save_runtime_state(&case.workspace, &root).expect("seed current root state");
-    let probe = brief_probe::install_trusted_nodeprobe(
+    let tmux = brief_probe::install_native_tmux(
         &case.workspace.join("probe"),
         NEW_ENDPOINT,
         SESSION,
         WORKER,
         "%new",
-        "fake",
+        "bash",
     );
     let _path = case.env.with_env(
         "PATH",
-        &brief_probe::path_with_probe(&probe, std::env::var_os("PATH").as_deref()),
+        &brief_probe::path_with_probe(&tmux, std::env::var_os("PATH").as_deref()),
     );
 
     let status_before = case.run_json(&[

package/crates/team-agent/src/lifecycle/tests/claude_compatible_config_red.rs

@@ -97,15 +97,13 @@ fn managed_profile_command_plan_omits_mcp_config_even_when_mcp_config_is_availab
             }
         }),
     };
-    let tools = ["mcp_team"];
-
     let plan = get_adapter(Provider::Claude)
         .build_command_plan(ProviderCommandContext {
             auth_mode: AuthMode::CompatibleApi,
             mcp_config: Some(&config),
             system_prompt: Some("worker prompt requiring native MCP"),
             model: Some("profile-effective-haiku"),
-            tools: &tools,
+            dangerously_skip_permissions: false,
             profile_launch: Some(&profile),
             agent_id_hint: None,
             effort: None,

package/crates/team-agent/src/lifecycle/tests/clone_agent_preserves_source_tools.rs

@@ -1,9 +1,9 @@
 //! ---
-//! purpose: 回归——clone-agent 分身 tools 必须与源席集合相等，禁止静默夹成 leader 三件套
+//! purpose: 回归——clone-agent 分身保留源席 tools，编译 spec 不投影 tools
 //! contract:
 //!   provides:
 //!     - name: clone_agent_preserves_source_tools
-//!       what: 真跑 clone-agent 后，dynamic-role-files / runtime spec 与源席 tools 集合相等
+//!       what: 真跑 clone-agent 后，dynamic-role-files 保留源席 tools，runtime spec 不投影 tools
 //!   requires:
 //!     - name: source-six-set-vs-leader-three-set
 //!       what: 同一 team 里 leader 三件套 + 源席六件套的共享冲突面
@@ -275,6 +275,10 @@ fn role_tools(path: &Path) -> BTreeSet<String> {
         .collect()
 }
 
+fn set_of(items: &[&str]) -> BTreeSet<String> {
+    items.iter().map(|s| (*s).to_string()).collect()
+}
+
 fn load_runtime_spec(workspace: &Path) -> Value {
     let runtime = workspace.join(".team").join("runtime");
     let spec = std::fs::read_dir(&runtime)
@@ -287,17 +291,7 @@ fn load_runtime_spec(workspace: &Path) -> Value {
         .expect("parse spec")
 }
 
-fn yaml_tool_set(node: &Value) -> BTreeSet<String> {
-    node.get("tools")
-        .and_then(Value::as_list)
-        .unwrap_or_else(|| panic!("tools list missing"))
-        .iter()
-        .filter_map(Value::as_str)
-        .map(str::to_string)
-        .collect()
-}
-
-fn spec_tools(workspace: &Path, agent: &str) -> BTreeSet<String> {
+fn spec_projects_tools(workspace: &Path, agent: &str) -> bool {
     let parsed = load_runtime_spec(workspace);
     let agents = parsed
         .get("agents")
@@ -305,22 +299,18 @@ fn spec_tools(workspace: &Path, agent: &str) -> BTreeSet<String> {
         .expect("spec agents");
     for row in agents {
         if row.get("id").and_then(Value::as_str) == Some(agent) {
-            return yaml_tool_set(row);
+            return row.get("tools").is_some();
         }
     }
     panic!("agent {agent} missing from runtime spec");
 }
 
-fn leader_spec_tools(workspace: &Path) -> BTreeSet<String> {
-    yaml_tool_set(
-        load_runtime_spec(workspace)
-            .get("leader")
-            .expect("spec leader"),
-    )
-}
-
-fn set_of(items: &[&str]) -> BTreeSet<String> {
-    items.iter().map(|s| (*s).to_string()).collect()
+fn leader_spec_projects_tools(workspace: &Path) -> bool {
+    load_runtime_spec(workspace)
+        .get("leader")
+        .expect("spec leader")
+        .get("tools")
+        .is_some()
 }
 
 fn clone_ok(case: &Case, source: &str, dest: &str, phase: &str) {
@@ -347,7 +337,7 @@ fn clone_ok(case: &Case, source: &str, dest: &str, phase: &str) {
     );
 }
 
-/// clone 后分身 role + spec tools 必须等于源席；三件套源不得被扩成六件。
+/// clone 后分身 role 保留源席 tools；编译 spec 不投影 tools。
 #[test]
 fn clone_agent_preserves_source_tools() {
     let case = Case::start();
@@ -380,21 +370,18 @@ fn clone_agent_preserves_source_tools() {
         String::from_utf8_lossy(&qs.stdout)
     );
 
-    let source_spec = spec_tools(&case.workspace, SOURCE);
-    assert_eq!(
-        source_spec,
-        set_of(SIX),
-        "fixture source must be the six-set"
+    assert!(
+        !spec_projects_tools(&case.workspace, SOURCE),
+        "compiled source spec must not project tools metadata"
     );
-    let leader_spec = leader_spec_tools(&case.workspace);
-    assert_eq!(
-        leader_spec,
-        set_of(THREE),
-        "leader must stay the three-set ceiling so the conflict surface exists; leader={leader_spec:?}"
+    assert!(
+        !leader_spec_projects_tools(&case.workspace),
+        "compiled leader spec must not project tools metadata"
     );
 
     clone_ok(&case, SOURCE, CLONE, "first_clone");
 
+    let source_role = role_tools(&case.workspace.join("agents").join(format!("{SOURCE}.md")));
     let clone_role = role_tools(
         &case
             .workspace
@@ -402,23 +389,32 @@ fn clone_agent_preserves_source_tools() {
             .join("dynamic-role-files")
             .join(format!("{CLONE}.md")),
     );
-    let clone_spec = spec_tools(&case.workspace, CLONE);
     assert_eq!(
-        clone_role, source_spec,
-        "clone role tools must equal source; source={source_spec:?} clone={clone_role:?}"
+        clone_role, source_role,
+        "clone role tools must equal source; source={source_role:?} clone={clone_role:?}"
     );
-    assert_eq!(
-        clone_spec, source_spec,
-        "clone spec tools must equal source; source={source_spec:?} spec={clone_spec:?}"
+    assert!(
+        !spec_projects_tools(&case.workspace, CLONE),
+        "compiled clone spec must not project tools metadata"
     );
 
-    let narrow_src = spec_tools(&case.workspace, NARROW);
-    assert_eq!(narrow_src, set_of(THREE), "narrow source fixture");
+    let narrow_source_role = role_tools(&case.workspace.join("agents").join(format!("{NARROW}.md")));
+    assert_eq!(narrow_source_role, set_of(THREE), "narrow source fixture");
     clone_ok(&case, NARROW, NARROW_CLONE, "second_clone");
-    let narrow_clone = spec_tools(&case.workspace, NARROW_CLONE);
+    let narrow_clone_role = role_tools(
+        &case
+            .workspace
+            .join(".team")
+            .join("dynamic-role-files")
+            .join(format!("{NARROW_CLONE}.md")),
+    );
     assert_eq!(
-        narrow_clone, narrow_src,
-        "narrow clone must keep the three-set (preserve, do not widen); got={narrow_clone:?}"
+        narrow_clone_role, narrow_source_role,
+        "narrow clone role must keep the three-set (preserve, do not widen); got={narrow_clone_role:?}"
+    );
+    assert!(
+        !spec_projects_tools(&case.workspace, NARROW_CLONE),
+        "compiled narrow clone spec must not project tools metadata"
     );
 
     case.shutdown();

package/crates/team-agent/src/lifecycle/tests/copilot_provider_red.rs

@@ -17,7 +17,7 @@
 //!  1. worker argv golden (§C1 + C-5-1/3)        — copilot_argv_* tests
 //!  2. per-worker AGENTS.md == compiled prompt    — copilot_agents_md_* tests (C-1-1/2,
 //!     identity-first per the 0.3.4 B2/D6 lock)
-//!  3. permission mapping (C-2-1, via the prompt's Permission note + argv deny flags)
+//!  3. tools metadata transparency (C-2-1, no prompt permission note or argv deny flags)
 //!  4. fork = structured CapabilityUnsupported (C-4-2/3)
 //!  5. startup recognizer supports copilot trust/ready; turn-state Unknown never idles
 //!     (N11, C-3-1/4)
@@ -62,12 +62,12 @@ const ANCESTRY_KEY: &str = "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON";
 const NEUTRAL_ANCESTRY: &str = "[\"/bin/zsh\"]";
 const COPILOT_TMP_PREFIX: &str = "ta-rs-copilot";
 
-/// Face 1+3 (§C1 golden + C-5-3, verdict cases `copilot_argv_golden_per_role_tools`
-/// and `non_dangerous_argv_contains_deny_flags_no_allow_all`): a restricted copilot
-/// worker (mcp_team only) gets the full §C1 argv — noise control, inline/`@file` MCP
-/// config carrying team_orchestrator, a pre-assigned `--session-id` equal to the
-/// persisted `_pending_session_id`, `-C <workspace>`, deny flags for the missing
-/// capabilities, and NO --allow-all family flag.
+/// Face 1+3 (§C1 golden + C-5-3, verdict case `copilot_argv_golden_per_role_tools`):
+/// a copilot worker (mcp_team only) gets the full §C1 argv — noise control,
+/// inline/`@file` MCP config carrying team_orchestrator, a pre-assigned
+/// `--session-id` equal to the persisted `_pending_session_id`, and `-C <workspace>`.
+/// Tools metadata must not derive deny flags; non-dangerous workers still omit the
+/// --allow-all family flag.
 #[test]
 #[serial(env)]
 fn copilot_argv_golden_restricted_role() {
@@ -176,21 +176,11 @@ team_orchestrator or @<.team/runtime/mcp/worker_a.json>; got {value:?}"
             flag_value(argv, "-C")
         ));
     }
-    // C-5-3: restricted role (no execute_bash / fs_write / network) → deny flags, and
-    // no --allow-all family flag anywhere.
-    let deny_tools = flag_values(argv, "--deny-tool");
-    for denied in ["shell", "write"] {
-        if !deny_tools.iter().any(|tool| tool.contains(denied)) {
-            failures.push(format!(
-                "C-5-3: restricted copilot worker must carry --deny-tool '{denied}'; deny={deny_tools:?}"
-            ));
-        }
-    }
-    // RC-15 (C-5-2 v2): network deny is `--deny-tool 'url'` (the help has only shell/
-    // write/mcp/url tool kinds; v1's --deny-url is not the v2 form).
-    if !deny_tools.iter().any(|tool| tool.contains("url")) {
+    // Tools metadata is transparent compatibility data; it must not derive
+    // provider-specific deny flags (shell/write/url or any other category).
+    if argv.iter().any(|arg| arg == "--deny-tool") {
         failures.push(format!(
-            "RC-15/C-5-2: restricted copilot worker must deny network via --deny-tool 'url'; deny={deny_tools:?}"
+            "C-5-3: tools metadata must not derive copilot --deny-tool flags; argv={argv:?}"
         ));
     }
     // RC-10 (C-3-5/C-5-2): mcp_team is allowlisted by server name (no approval prompt).
@@ -289,8 +279,8 @@ used for the dangerous tier; argv={argv:?}"
 /// the spawn env must carry COPILOT_CUSTOM_INSTRUCTIONS_DIRS pointing at the
 /// per-worker dir (path contains the agent id; works with NO profile configured), the
 /// AGENTS.md there must BE the compiled worker system prompt (single source: identity
-/// first, runtime contract, role body, output contract, permission note — 0.3.4 B2/D6
-/// lock), and no global ~/.copilot/AGENTS.md may be written.
+/// first, runtime contract, role body, and output contract), and no global
+/// ~/.copilot/AGENTS.md may be written.
 #[test]
 #[serial(env)]
 fn copilot_agents_md_is_the_compiled_prompt_and_env_points_at_it() {
@@ -362,7 +352,6 @@ with the identity section FIRST; head={:?}",
             "# Team Agent Teammate Runtime Contract",
             "COPILOT ROLE BODY SENTINEL",
             "report_result exactly once",
-            "Permission note: these tools are prompt-only for this provider and not hard-enforced:",
         ] {
             if !agents_md.contains(marker) {
                 failures.push(format!(
@@ -386,14 +375,11 @@ with the identity section FIRST; head={:?}",
     );
 }
 
-/// Face 3 (C-2-1, verdict `permission_enforcement_table_copilot_row_prompt_only_for_fs`):
-/// the copilot enforcement row must honestly register the no-hard-deny tools as
-/// prompt-only. Observable single-source: the compiled prompt's Permission note (built
-/// from PROVIDER_ENFORCEMENT) for a full-capability role must list exactly
-/// fs_list/fs_read/git_diff/provider_builtin (sorted).
+/// Face 3: tools metadata is transparent compatibility data and must not produce
+/// a provider-specific Permission note in the compiled Copilot prompt.
 #[test]
 #[serial(env)]
-fn copilot_permission_note_registers_fs_tools_prompt_only() {
+fn copilot_prompt_omits_removed_permission_note() {
     let _hermetic = enter_hermetic("copilot-permission-note");
     let _guard = EnvGuard::set(&[(ANCESTRY_KEY, NEUTRAL_ANCESTRY)]);
     let ws = tmp_ws("enforcement");
@@ -428,21 +414,21 @@ fn copilot_permission_note_registers_fs_tools_prompt_only() {
         .env
         .get("COPILOT_CUSTOM_INSTRUCTIONS_DIRS")
         .cloned()
-        .unwrap_or_default();
-    let agents_md = std::fs::read_to_string(Path::new(&dir).join("AGENTS.md")).unwrap_or_default();
-
-    let note_line = agents_md
-        .lines()
-        .find(|line| line.starts_with("Permission note:"))
-        .unwrap_or("")
-        .to_string();
+        .expect("Copilot spawn must carry COPILOT_CUSTOM_INSTRUCTIONS_DIRS");
+    assert!(
+        !dir.is_empty(),
+        "Copilot instructions directory must not be empty"
+    );
+    let agents_md = std::fs::read_to_string(Path::new(&dir).join("AGENTS.md"))
+        .expect("per-worker Copilot AGENTS.md must be readable");
+    let identity = "You are Team Agent worker `worker_a` with role `Copilot Worker`.";
+    assert!(
+        agents_md.starts_with(identity) && agents_md.contains("COPILOT ROLE BODY SENTINEL"),
+        "C-2-1: compiled Copilot prompt must include its identity and role body; content={agents_md:?}"
+    );
     assert!(
-        note_line.contains("fs_list, fs_read, git_diff, provider_builtin"),
-        "C-2-1: the copilot enforcement row must register exactly \
-fs_read/fs_list/git_diff/provider_builtin as prompt-only (sorted in the Permission \
-note; execute_bash/fs_write/network/mcp_team are hard); note={note_line:?} \
-agents_md_present={}",
-        !agents_md.is_empty()
+        !agents_md.contains("Permission note:"),
+        "C-2-1: removed provider tool enforcement must not emit a Permission note; content={agents_md:?}"
     );
 }