@team-agent/installer 0.5.85 → 0.5.89

package/crates/team-agent/src/lifecycle/tests/core_034_real_red.rs

@@ -37,7 +37,7 @@ fn bin() -> &'static str {
 
 #[test]
 #[serial(env)]
-fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
+fn claude_worker_spawn_argv_uses_compiled_prompt_without_tool_restrictions() {
     let _hermetic = enter_hermetic("core034-claude-argv");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -80,7 +80,6 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
         "send_message(to='leader'",
         "report_result exactly once",
         "ROLE BODY SENTINEL",
-        "Permission note",
     ] {
         if !prompt.contains(marker) {
             failures.push(format!("B2 missing compiled prompt marker {marker:?}"));
@@ -90,31 +89,15 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
         failures.push("B2 prompt collapsed to the bare role label".to_string());
     }
 
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-    for forbidden in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        if disallowed.iter().any(|tool| tool == forbidden) {
-            failures.push(format!(
-                "B1 declared capability still disallowed via --disallowedTools {forbidden:?}"
-            ));
-        }
+    if argv_has_flag(&spawn.argv, "--disallowedTools") {
+        failures.push("B1 Claude argv must not derive --disallowedTools from tools metadata".to_string());
     }
     if argv_has_flag(&spawn.argv, "--allowedTools") {
-        failures.push(
-            "B1 Python parity violated: Claude argv must not switch to --allowedTools".to_string(),
-        );
+        failures.push("B1 Claude argv must not derive --allowedTools from tools metadata".to_string());
     }
     assert!(
         failures.is_empty(),
-        "B1/B2 worker argv contract failed:\n{}\nprompt={prompt:?}\ndisallowed={disallowed:?}\nargv={:?}",
+        "B1/B2 worker argv contract failed:\n{}\nprompt={prompt:?}\nargv={:?}",
         failures.join("\n"),
         spawn.argv
     );
@@ -122,7 +105,7 @@ fn claude_worker_spawn_argv_uses_compiled_prompt_and_resolved_role_tools() {
 
 #[test]
 #[serial(env)]
-fn claude_control_role_without_native_tools_still_disallows_native_tools() {
+fn claude_control_role_does_not_derive_native_tool_restrictions() {
     let _hermetic = enter_hermetic("core034-claude-control");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -156,29 +139,21 @@ fn claude_control_role_without_native_tools_still_disallows_native_tools() {
     .expect("quick-start should record the control worker command");
 
     let spawn = transport.single_spawn();
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-    for expected in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        assert!(
-            disallowed.iter().any(|tool| tool == expected),
-            "B1 negative case: mcp_team-only control roles must still disallow native Claude tools; \
-             missing={expected} disallowed={disallowed:?}\nargv={:?}",
-            spawn.argv
-        );
-    }
+    assert!(
+        !argv_has_flag(&spawn.argv, "--disallowedTools"),
+        "B1 control role must not derive native-tool restrictions from tools metadata; argv={:?}",
+        spawn.argv
+    );
+    assert!(
+        !argv_has_flag(&spawn.argv, "--allowedTools"),
+        "B1 control role must not derive an allowlist from tools metadata; argv={:?}",
+        spawn.argv
+    );
 }
 
 #[test]
 #[serial(env)]
-fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_tools() {
+fn restart_claude_worker_does_not_derive_tool_restrictions_when_runtime_state_has_no_raw_tools() {
     let _hermetic = enter_hermetic("core034-restart-tools");
     let _ancestry = EnvGuard::set(
         "TEAM_AGENT_TEST_PROCESS_ANCESTRY_ARGV_JSON",
@@ -215,34 +190,20 @@ fn restart_claude_worker_resolves_tools_from_spec_when_runtime_state_has_no_raw_
     let report = restart_with_transport(&ws, true, Some("restarttools"), &restart_transport)
         .expect("restart should reach worker command construction");
     let spawn = restart_transport.single_spawn();
-    let disallowed = flag_values(&spawn.argv, "--disallowedTools");
-
-    for forbidden in [
-        "Bash",
-        "Read",
-        "Edit",
-        "Write",
-        "MultiEdit",
-        "NotebookEdit",
-        "Glob",
-        "Grep",
-    ] {
-        assert!(
-            !disallowed.iter().any(|tool| tool == forbidden),
-            "B1 restart contract: when runtime state lacks raw tools, restart must resolve tools from the selected spec/role through resolve_permissions. \
-             {forbidden} must not be disallowed for this role; disallowed={disallowed:?}\nargv={:?}\nreport={report:?}",
-            spawn.argv
-        );
-    }
+    assert!(
+        !argv_has_flag(&spawn.argv, "--disallowedTools"),
+        "B1 restart must not derive native-tool restrictions from tools metadata; argv={:?} report={report:?}",
+        spawn.argv
+    );
     assert!(
         !argv_has_flag(&spawn.argv, "--allowedTools"),
-        "B1 Python parity: restart must keep --disallowedTools semantics, not switch to --allowedTools; argv={:?}",
+        "B1 restart must not derive an allowlist from tools metadata; argv={:?} report={report:?}",
         spawn.argv
     );
 }
 
 #[test]
-fn worker_command_context_uses_single_prompt_and_permission_sources() {
+fn worker_command_context_uses_single_prompt_without_permission_sources() {
     let crate_root = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
     let src_root = crate_root.join("src");
     let launch = composite_source::composite_source("src/lifecycle/launch.rs");
@@ -276,10 +237,9 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
             && all_src.contains("runtime_contract_section")
             && all_src.contains("identity_section")
             && all_src.contains("role_body")
-            && all_src.contains("output_contract")
-            && all_src.contains("permission_notes"),
-        "B2 grep guard: worker command construction needs one compiled prompt helper with the CR-approved five sections \
-         (runtime_contract_section, identity_section, role_body, output_contract, permission_notes)."
+            && all_src.contains("output_contract"),
+        "B2 grep guard: worker command construction needs one compiled prompt helper with the CR-approved four sections \
+         (runtime_contract_section, identity_section, role_body, output_contract)."
     );
     assert!(
         !command_sources.contains("system_prompt: role"),
@@ -296,8 +256,9 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
     );
 
     assert!(
-        all_src.contains("resolve_permissions") && all_src.contains("resolved_tool_strings"),
-        "B1 grep guard: command argv tools must be calculated through a single resolve_permissions helper, including role defaults and leader ceiling."
+        !command_sources.contains("resolve_permissions")
+            && !command_sources.contains("resolved_tool_strings"),
+        "B1 grep guard: command construction must not derive argv restrictions from tools metadata."
     );
     assert!(
         !command_sources.contains("worker_tool_refs(agent_tool_strings")
@@ -305,8 +266,8 @@ fn worker_command_context_uses_single_prompt_and_permission_sources() {
         "B1 grep guard: command construction must not raw-pass agent.tools/tool_refs into ProviderCommandContext."
     );
     assert!(
-        adapter.contains("--disallowedTools") && !adapter.contains("--allowedTools"),
-        "B1 Python parity: provider adapter must keep Claude --disallowedTools and not invent --allowedTools."
+        !adapter.contains("--disallowedTools") && !adapter.contains("--allowedTools"),
+        "B1 provider adapter must not derive Claude tool restrictions from tools metadata."
     );
     assert!(
         !adapter.contains("resolve_permissions"),
@@ -837,12 +798,6 @@ fn flag_value(argv: &[String], flag: &str) -> Option<String> {
         .find_map(|pair| (pair[0] == flag).then(|| pair[1].clone()))
 }
 
-fn flag_values(argv: &[String], flag: &str) -> Vec<String> {
-    argv.windows(2)
-        .filter_map(|pair| (pair[0] == flag).then(|| pair[1].clone()))
-        .collect()
-}
-
 fn argv_has_flag(argv: &[String], flag: &str) -> bool {
     argv.iter().any(|arg| arg == flag)
 }

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -520,8 +520,8 @@ fn launch_dry_run_resolves_real_plan_not_stub_error() {
         Ok(report) => {
             assert!(report.dry_run, "dry_run launch must report dry_run=true");
             assert!(
-                !report.routes.is_empty() || !report.permissions.is_empty(),
-                "dry_run launch must resolve a real route/permission plan from the compiled spec"
+                !report.routes.is_empty(),
+                "dry_run launch must resolve a real route plan from the compiled spec"
             );
         }
         // any OTHER Err (a real requirement/transport error) still proves the stub is gone.
@@ -3210,7 +3210,6 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "profile",
             "window",
             "mcp_config",
-            "permissions",
             "effective_approval_policy",
             // 0.5.66 bypass 单源:fresh spawn 记录运行面 bypass 值(restart drift 挡板)。
             "as_launched_dangerously_skip_permissions",
@@ -3239,16 +3238,6 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             .join(".team/runtime/mcp/implementer.json")
             .to_string_lossy())
     );
-    assert_eq!(
-        agent["permissions"],
-        json!({
-            "agent_id": "implementer",
-            "provider": "codex",
-            "tools": ["mcp_team"],
-            "resolved_tools": [{"tool": "mcp_team", "enforcement": "prompt_only"}],
-            "has_prompt_only": true
-        })
-    );
     assert!(agent["session_id"].is_null());
     assert!(agent["rollout_path"].is_null());
     assert!(agent["captured_at"].is_null());

package/crates/team-agent/src/lifecycle/tests/pi_catalog_red.rs

@@ -91,7 +91,6 @@ fn command_for_model(model: &str) -> Vec<String> {
         model: Some(model),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "worker contract",
-        tool_categories: &["mcp_team"],
         session_dir: Some(Path::new("/workspace/.team/runtime/pi/t1/w1/sessions")),
         session: PiSessionSelector::Fresh {
             session_id: "716ba0cb-c491-4471-b41a-43c8d5e1f05a",

package/crates/team-agent/src/lifecycle/tests/pi_command_red.rs

@@ -10,7 +10,6 @@ fn request(session: PiSessionSelector<'static>) -> PiCommandRequest<'static> {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::High),
         system_prompt: "frozen worker prompt",
-        tool_categories: &["mcp_team", "fs_read", "fs_write", "execute_bash"],
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/team-a/worker-a/sessions",
         )),
@@ -38,7 +37,6 @@ fn leader_request() -> PiCommandRequest<'static> {
         model: None,
         effort: None,
         system_prompt: "frozen leader prompt",
-        tool_categories: &["mcp_team", "fs_read", "fs_write", "execute_bash"],
         session_dir: None,
         session: PiSessionSelector::Fresh {
             session_id: "da8c3622-2378-4d05-a26c-e826a6ef6d63",

package/crates/team-agent/src/lifecycle/tests/pi_compiler_red.rs

@@ -6,9 +6,7 @@ use crate::lifecycle::launch::pi_mcp::{parse_pi_list_models_table, select_exact_
 use crate::model::enums::ProviderEffort;
 use crate::model::yaml::Value;
 use crate::model::ModelError;
-use crate::provider::adapters::pi::{
-    build_pi_command_argv, pi_tool_mapping, PiCommandRequest, PiSessionSelector, PiToolMapping,
-};
+use crate::provider::adapters::pi::{build_pi_command_argv, PiCommandRequest, PiSessionSelector};
 
 const CATALOG: &[u8] = include_bytes!("fixtures/pi_list_models_g0.stdout.txt");
 static NEXT_ROLE: AtomicU32 = AtomicU32::new(0);
@@ -51,13 +49,12 @@ fn compile_error(result: Result<CompiledRole, ModelError>) -> ModelError {
     }
 }
 
-fn command(tools: &[&str], effort: ProviderEffort, model: &str) -> Result<Vec<String>, String> {
+fn command(_tools: &[&str], effort: ProviderEffort, model: &str) -> Result<Vec<String>, String> {
     build_pi_command_argv(PiCommandRequest {
         extension: Path::new("/workspace/.team/runtime/pi/t1/pi-worker/team-mcp.ts"),
         model: Some(model),
         effort: Some(effort),
         system_prompt: "Pi worker contract.",
-        tool_categories: tools,
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/t1/pi-worker/sessions",
         )),
@@ -70,24 +67,22 @@ fn command(tools: &[&str], effort: ProviderEffort, model: &str) -> Result<Vec<St
 }
 
 #[test]
-fn pi_role_requires_mcp_team_and_preserves_provider_defaults() {
+fn pi_role_ignores_tools_and_preserves_provider_defaults() {
     let positive = compile_pi_role(&valid_role_with(""));
     assert!(positive.is_ok(), "fully explicit Pi role must compile");
 
-    let missing_mcp = valid_role_with("").replace("  - mcp_team\n", "");
+    let missing_tools = valid_role_with("").replace(
+        "tools:\n  - mcp_team\n  - fs_read\n  - fs_list\n  - fs_write\n  - execute_bash\n",
+        "",
+    );
+    compile_pi_role(&missing_tools).expect("omitted tools metadata must compile");
     let unqualified =
         valid_role_with("").replace("model: team-agent/qwen3.8-27b", "model: qwen3.8-27b");
-
-    for (label, role) in [
-        ("mcp_team", missing_mcp),
-        ("qualified exact model", unqualified),
-    ] {
-        let error = compile_error(compile_pi_role(&role));
-        assert!(
-            error.to_string().to_ascii_lowercase().contains(label),
-            "error must name {label}; got {error}"
-        );
-    }
+    let error = compile_error(compile_pi_role(&unqualified));
+    assert!(
+        error.to_string().to_ascii_lowercase().contains("qualified exact model"),
+        "error must name qualified model; got {error}"
+    );
 
     let defaults = valid_role_with("")
         .replace("model: team-agent/qwen3.8-27b\n", "")
@@ -195,42 +190,7 @@ fn pi_max_effort_is_supported_without_model_suffix() {
 }
 
 #[test]
-fn pi_role_tools_validate_team_capabilities_without_replacing_direct_pi_tools() {
-    assert_eq!(pi_tool_mapping("mcp_team"), PiToolMapping::Mcp);
-    assert_eq!(
-        pi_tool_mapping("fs_read"),
-        PiToolMapping::Builtin(&["read"])
-    );
-    assert_eq!(
-        pi_tool_mapping("fs_list"),
-        PiToolMapping::Builtin(&["grep", "find", "ls"])
-    );
-    assert_eq!(
-        pi_tool_mapping("fs_write"),
-        PiToolMapping::Builtin(&["edit", "write"])
-    );
-    assert_eq!(
-        pi_tool_mapping("execute_bash"),
-        PiToolMapping::Builtin(&["bash"])
-    );
-
-    for unsupported in ["git_diff", "network", "provider_builtin", "not_a_tool"] {
-        assert_eq!(
-            pi_tool_mapping(unsupported),
-            PiToolMapping::Unsupported,
-            "unknown categories must not silently broaden to bash"
-        );
-        assert!(
-            command(
-                &["mcp_team", unsupported],
-                ProviderEffort::Medium,
-                "team-agent/qwen3.8-27b"
-            )
-            .is_err(),
-            "unsupported tool must refuse the command: {unsupported}"
-        );
-    }
-
+fn pi_role_command_ignores_legacy_tool_metadata() {
     let argv = command(
         &["mcp_team", "fs_write", "fs_read", "fs_list", "execute_bash"],
         ProviderEffort::Medium,
@@ -242,34 +202,3 @@ fn pi_role_tools_validate_team_capabilities_without_replacing_direct_pi_tools()
         "role tools validate Team Agent capabilities but must not replace direct Pi tools: {argv:?}"
     );
 }
-
-#[test]
-fn pi_role_rejects_unsupported_categories_during_compile() {
-    compile_pi_role(&valid_role_with("")).expect("supported Pi tools must compile");
-
-    for unsupported in ["git_diff", "network", "provider_builtin"] {
-        let role = valid_role_with("").replace(
-            "  - execute_bash\n",
-            &format!("  - execute_bash\n  - {unsupported}\n"),
-        );
-        let error = compile_error(compile_pi_role(&role)).to_string();
-        assert!(
-            error.contains(&format!("Pi does not support Team Agent tool category {unsupported:?}")),
-            "compile must reject {unsupported} before launch preparation: {error}"
-        );
-        assert!(
-            error.contains("remove it from the role's tools"),
-            "compile error must provide an actionable fix: {error}"
-        );
-    }
-
-    let alias = valid_role_with("").replace(
-        "  - execute_bash\n",
-        "  - execute_bash\n  - \"@builtin\"\n",
-    );
-    let error = compile_error(compile_pi_role(&alias)).to_string();
-    assert!(
-        error.contains("Pi does not support Team Agent tool category \"provider_builtin\""),
-        "@builtin must use the same Pi capability contract: {error}"
-    );
-}

package/crates/team-agent/src/lifecycle/tests/pi_dual_entry_red.rs

@@ -300,7 +300,7 @@ fn pi_leader_and_teammate_body(hermetic: &HermeticTestEnv) {
         mcp_config: None,
         system_prompt: None,
         model: None,
-        tools: &[],
+        dangerously_skip_permissions: false,
         profile_launch: None,
         agent_id_hint: None,
         effort: None,

package/crates/team-agent/src/lifecycle/tests/pi_executable_mcp_red.rs

@@ -572,7 +572,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
         model: None,
         effort: None,
         system_prompt: "native leader fixture",
-        tool_categories: &["mcp_team"],
         team_mcp_tools: &["send_message"],
         mcp_config: &native_config,
         session_scope: PiSessionScope::NativeDefault,
@@ -605,7 +604,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "isolated worker fixture",
-        tool_categories: &["mcp_team"],
         team_mcp_tools: &["send_message"],
         mcp_config: &isolated_config,
         session_scope: PiSessionScope::Isolated,
@@ -633,7 +631,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
             model: None,
             effort: None,
             system_prompt: "isolated resume fixture",
-            tool_categories: &["mcp_team"],
             team_mcp_tools: &["send_message"],
             mcp_config: &isolated_config,
             session_scope: PiSessionScope::Isolated,
@@ -664,7 +661,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
             model: None,
             effort: None,
             system_prompt: "native resume fixture",
-            tool_categories: &["mcp_team"],
             team_mcp_tools: &["send_message"],
             mcp_config: &native_config,
             session_scope: PiSessionScope::NativeDefault,
@@ -699,7 +695,6 @@ fn pi_materializer_and_worker_routes_body(hermetic: &HermeticTestEnv) {
                 model: None,
                 effort: None,
                 system_prompt: "isolated negative resume fixture",
-                tool_categories: &["mcp_team"],
                 team_mcp_tools: &["send_message"],
                 mcp_config: &isolated_config,
                 session_scope: PiSessionScope::Isolated,

package/crates/team-agent/src/lifecycle/tests/pi_session_delivery_red.rs

@@ -58,7 +58,6 @@ fn resume_argv(path: &Path) -> Result<Vec<String>, ProviderError> {
         model: Some("team-agent/qwen3.8-27b"),
         effort: Some(ProviderEffort::Medium),
         system_prompt: "worker contract",
-        tool_categories: &["mcp_team"],
         session_dir: Some(Path::new(
             "/workspace/.team/runtime/pi/team-a/worker-a/sessions",
         )),

package/crates/team-agent/src/lifecycle/tests/restart_rebind_hotfix_252_red.rs

@@ -901,13 +901,13 @@ impl ProviderAdapter for StaticCaptureAdapter {
         Ok(vec!["fake".to_string()])
     }
 
-    fn build_command_with_tools(
+    fn build_command_with_permissions(
         &self,
         auth_mode: AuthMode,
         mcp_config: Option<&McpConfig>,
         system_prompt: Option<&str>,
         model: Option<&str>,
-        _tools: &[&str],
+        _dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         self.build_command(auth_mode, mcp_config, system_prompt, model)
     }
@@ -959,7 +959,7 @@ impl ProviderAdapter for StaticCaptureAdapter {
         mcp_config: Option<&McpConfig>,
         _system_prompt: Option<&str>,
         _model: Option<&str>,
-        _tools: &[&str],
+        _dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         self.build_resume_command(session_id, auth_mode, mcp_config)
     }
@@ -980,7 +980,7 @@ impl ProviderAdapter for StaticCaptureAdapter {
         mcp_config: Option<&McpConfig>,
         _system_prompt: Option<&str>,
         _model: Option<&str>,
-        _tools: &[&str],
+        _dangerously_skip_permissions: bool,
     ) -> Result<Vec<String>, ProviderError> {
         self.fork(session_id, auth_mode, mcp_config)
     }

package/crates/team-agent/src/lifecycle/tests.rs

@@ -64,7 +64,6 @@ mod cursor_require_explicit_model_red;
 mod cursor_restart_resume_red;
 mod display_adaptive_red;
 mod f032_startup_prompt_best_effort_red;
-mod g1_silent_faces;
 mod grok_effort_argv_red;
 mod grok_mcp_overlay_red;
 mod grok_require_explicit_model_red;

package/crates/team-agent/src/lifecycle/types.rs

@@ -540,8 +540,6 @@ pub struct LaunchReport {
     pub tmux_endpoint: Option<String>,
     /// 路由决策(每 task 一条;`routing.decision` 事件)。
     pub routes: Vec<RoutingDecision>,
-    /// 权限摘要(每 agent 一条)。
-    pub permissions: Vec<PermissionSummary>,
     /// leader receiver(attach 成功时;经 step10 leader::attach_leader_to_state)。
     pub leader_receiver_attached: bool,
     pub leader_bind_stage: Option<String>,
@@ -577,14 +575,6 @@ pub struct RoutingDecision {
     pub manual_override: bool,
 }
 
-/// 权限摘要(`resolve_permissions(agent)` 的 typed 版)。**PLACEHOLDER 字段**:
-/// 实际形状由 step6 compiler 的 `resolve_permissions` 决定,集成时映射。
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PermissionSummary {
-    pub agent_id: AgentId,
-    pub raw: serde_json::Value,
-}
-
 /// BUG-7 (0.3.1): quick-start cannot honestly report "ready" before the workers'
 /// MCP tool sets have actually loaded — provider-side schema rejections (codex
 /// invalid_function_parameters etc.) happen AFTER spawn and silently disable the