@team-agent/installer 0.5.85 → 0.5.89

package/crates/team-agent/src/lifecycle/worker_command_context.rs

@@ -1,17 +1,13 @@
 //! ---
-//! purpose: 从 spec 里的一个 agent 定义，编译出 worker 启动所需的系统提示词与工具串
+//! purpose: 从 spec 里的一个 agent 定义，编译出 worker 启动所需的系统提示词
 //! contract:
 //!   provides:
 //!     - name: WorkerCommandAgent
 //!       what: 从 YAML 或 JSON 读出的单 agent 命令上下文
 //!     - name: compile_worker_system_prompt
 //!       what: 按身份、runtime 契约、通信模式、角色正文、输出契约、权限说明拼系统提示词
-//!     - name: resolved_tool_strings_for_command
-//!       what: 解析出该 agent 的工具串，声明了 bypass 时追加 dangerous_auto_approve 哨兵
 //!   depends:
-//!     - crate::model::permissions
 //!     - crate::communication_mode
-//!     - crate::provider::bypass_flags
 //! boundary:
 //!   - 只产出字符串，不 spawn 进程、不写盘
 //!   - bypass 只认 agent 自身声明，不从 team/runtime/leader argv 继承
@@ -22,9 +18,7 @@ use std::path::Path;
 
 use crate::communication_mode::CommunicationMode;
 use crate::lifecycle::types::LifecycleError;
-use crate::model::enums::{Enforcement, Provider};
-use crate::model::ids::AgentId;
-use crate::model::permissions::{resolve_permissions, AgentPermissionInput};
+use crate::model::enums::Provider;
 
 const RUNTIME_CONTRACT_SECTION: &str = r#"# Team Agent Teammate Runtime Contract
 
@@ -57,7 +51,6 @@ pub(crate) struct WorkerCommandAgent {
     id: Option<String>,
     provider: Provider,
     role: Option<String>,
-    declared_tools: Option<Vec<String>>,
     system_prompt_inline: Option<String>,
     system_prompt_file: Option<String>,
     output_contract_format: Option<String>,
@@ -94,16 +87,6 @@ impl WorkerCommandAgent {
                 .get("role")
                 .and_then(crate::model::yaml::Value::as_str)
                 .map(str::to_string),
-            declared_tools: agent
-                .get("tools")
-                .and_then(crate::model::yaml::Value::as_list)
-                .map(|items| {
-                    items
-                        .iter()
-                        .filter_map(crate::model::yaml::Value::as_str)
-                        .map(str::to_string)
-                        .collect()
-                }),
             system_prompt_inline: system_prompt
                 .and_then(|prompt| prompt.get("inline"))
                 .and_then(crate::model::yaml::Value::as_str)
@@ -158,16 +141,6 @@ impl WorkerCommandAgent {
                 .get("role")
                 .and_then(serde_json::Value::as_str)
                 .map(str::to_string),
-            declared_tools: agent
-                .get("tools")
-                .and_then(serde_json::Value::as_array)
-                .map(|items| {
-                    items
-                        .iter()
-                        .filter_map(serde_json::Value::as_str)
-                        .map(str::to_string)
-                        .collect()
-                }),
             system_prompt_inline: system_prompt
                 .and_then(|prompt| prompt.get("inline"))
                 .and_then(serde_json::Value::as_str)
@@ -233,9 +206,6 @@ pub(crate) fn compile_worker_system_prompt(
     if let Some(contract) = output_contract(agent, &report_result) {
         chunks.push(contract);
     }
-    if let Some(notes) = permission_notes(agent)? {
-        chunks.push(notes);
-    }
     Ok(chunks
         .into_iter()
         .filter(|chunk| !chunk.is_empty())
@@ -254,43 +224,6 @@ Do not invent a second team protocol or assume that a configured lazy MCP server
         .to_string()
 }
 
-/// ---
-/// purpose: 解析该 agent 最终生效的工具串
-/// params:
-///   provider: 用于查 bypass argv 定义的 provider
-/// returns: 排序后的工具串；agent 声明 bypass 时末尾追加 dangerous_auto_approve
-/// errors: 权限解析失败，或声明了 bypass 但该 provider 没有 bypass argv 定义时返回 RequirementUnmet
-/// ---
-pub(crate) fn resolved_tool_strings_for_command(
-    agent: &WorkerCommandAgent,
-    provider: Provider,
-) -> Result<Vec<String>, LifecycleError> {
-    let mut tools: Vec<String> = resolve_agent_permissions(agent, provider)?
-        .sorted_tool_strings()
-        .into_iter()
-        .map(str::to_string)
-        .collect();
-    // 0.5.66 bypass 单源:读 agent 自己的 `dangerously_skip_permissions` bool,
-    // 不再收 team/runtime/leader argv 派生的 `DangerousApproval`。true → 加
-    // `dangerous_auto_approve` 哨兵(adapter 消费点不变);provider 无 bypass
-    // argv 定义 → fail-loud,不静默 fallback。
-    if agent.dangerously_skip_permissions && provider != Provider::Pi {
-        let flag = crate::provider::bypass_flags::provider_bypass_flag(provider).ok_or_else(
-            || {
-                LifecycleError::RequirementUnmet(format!(
-                    "provider {} has no bypass argv flag defined; dangerously_skip_permissions=true cannot be honored",
-                    provider_display_name(provider)
-                ))
-            },
-        )?;
-        debug_assert!(flag.starts_with("--"));
-        if !tools.iter().any(|tool| tool == "dangerous_auto_approve") {
-            tools.push("dangerous_auto_approve".to_string());
-        }
-    }
-    Ok(tools)
-}
-
 /// Provider-facing MCP tool name. Only verified call forms are filled in.
 /// Unverified providers keep the historical dotted spelling.
 fn mcp_tool_name(provider: Provider, server: &str, tool: &str) -> String {
@@ -308,33 +241,6 @@ fn mcp_tool_name(provider: Provider, server: &str, tool: &str) -> String {
     }
 }
 
-fn provider_display_name(provider: Provider) -> &'static str {
-    match provider {
-        Provider::Claude => "claude",
-        Provider::ClaudeCode => "claude_code",
-        Provider::Codex => "codex",
-        Provider::Copilot => "copilot",
-        Provider::GeminiCli => "gemini_cli",
-        Provider::Grok => "grok",
-        Provider::CursorAgent => "cursor_agent",
-        Provider::Pi => "pi",
-        Provider::Fake => "fake",
-    }
-}
-
-fn resolve_agent_permissions(
-    agent: &WorkerCommandAgent,
-    provider: Provider,
-) -> Result<crate::model::permissions::ResolvedPermissions, LifecycleError> {
-    resolve_permissions(&AgentPermissionInput {
-        id: agent.id.as_deref().map(AgentId::new),
-        provider,
-        role: agent.role.clone(),
-        tools: agent.declared_tools.clone(),
-    })
-    .map_err(|e| LifecycleError::Compile(e.to_string()))
-}
-
 fn runtime_contract_section(send_message: &str, report_result: &str) -> String {
     RUNTIME_CONTRACT_SECTION
         .replace("{send_message}", send_message)
@@ -405,161 +311,14 @@ fn output_contract(agent: &WorkerCommandAgent, report_result: &str) -> Option<St
         .then(|| RESULT_ENVELOPE_OUTPUT_CONTRACT.replace("{report_result}", report_result))
 }
 
-fn permission_notes(agent: &WorkerCommandAgent) -> Result<Option<String>, LifecycleError> {
-    let permissions = resolve_agent_permissions(agent, agent.provider)?;
-    // C-2-1/C-2-2 cr verdict — Copilot 一期 framework 不替决 fs_read/fs_list/git_diff/
-    // provider_builtin(provider prompt 控);为诚实(MUST-NOT-13)在 system prompt 内
-    // 总是声明这些 provider-level prompt_only 工具,即便角色未显式声明。
-    let provider_prompt_only_extras = provider_default_prompt_only_tools(agent.provider);
-    let mut prompt_only: std::collections::BTreeSet<String> = permissions
-        .resolved_tools
-        .iter()
-        .filter(|tool| tool.enforcement == Enforcement::PromptOnly)
-        .filter_map(|tool| serde_json::to_value(tool.tool).ok())
-        .filter_map(|value| value.as_str().map(str::to_string))
-        .collect();
-    for tool in provider_prompt_only_extras {
-        prompt_only.insert((*tool).to_string());
-    }
-    if prompt_only.is_empty() {
-        return Ok(None);
-    }
-    let prompt_only: Vec<String> = prompt_only.into_iter().collect();
-    Ok(Some(format!(
-        "Permission note: these tools are prompt-only for this provider and not hard-enforced: {}",
-        prompt_only.join(", ")
-    )))
-}
-
-/// C-2-1 cr verdict — provider-level prompt_only tools that the framework cannot
-/// hard-enforce. The system prompt declares them so the worker is honest about
-/// where consent gates actually live (provider prompt vs framework).
-fn provider_default_prompt_only_tools(provider: Provider) -> &'static [&'static str] {
-    match provider {
-        // C-2-1: fs_read / fs_list / git_diff / provider_builtin 由 provider prompt
-        // 控制,framework 不替决(prompt_only 诚实声明)。
-        Provider::Copilot => &["fs_list", "fs_read", "git_diff", "provider_builtin"],
-        _ => &[],
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    #[test]
-    fn empty_tools_use_role_defaults_and_aliases_resolve_before_command() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::ClaudeCode,
-            role: Some("developer".to_string()),
-            declared_tools: Some(Vec::new()),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: false,
-        };
-        let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert_eq!(
-            tools,
-            [
-                "execute_bash",
-                "fs_list",
-                "fs_read",
-                "fs_write",
-                "git_diff",
-                "mcp_team",
-                "provider_builtin"
-            ]
-        );
-
-        let agent = WorkerCommandAgent {
-            declared_tools: Some(vec!["fs_*".to_string(), "@team-orchestrator".to_string()]),
-            ..agent
-        };
-        let tools =
-            resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert_eq!(tools, ["fs_list", "fs_read", "fs_write", "mcp_team"]);
-    }
-
-    // 0.5.66 bypass 单源 §4.1:true → tools 追加 `dangerous_auto_approve` 哨兵。
-    #[test]
-    fn test_true_field_produces_bypass_flag_argv() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::ClaudeCode,
-            role: Some("developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: true,
-        };
-        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert!(
-            tools.iter().any(|tool| tool == "dangerous_auto_approve"),
-            "true field must append the dangerous_auto_approve sentinel; tools={tools:?}"
-        );
-        assert!(
-            tools.iter().any(|tool| tool == "mcp_team"),
-            "normal tools must remain; tools={tools:?}"
-        );
-    }
-
-    // 0.5.66 bypass 单源 §4.1:false → 不追加哨兵。
-    #[test]
-    fn test_false_field_produces_no_bypass_flag_argv() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::ClaudeCode,
-            role: Some("developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: false,
-        };
-        let tools = resolved_tool_strings_for_command(&agent, Provider::ClaudeCode).unwrap();
-        assert!(
-            !tools.iter().any(|tool| tool == "dangerous_auto_approve"),
-            "false field must not append the sentinel; tools={tools:?}"
-        );
-    }
-
-    // 0.5.66 bypass 单源 §4.1:provider 未定义 bypass 参数 + true → fail-loud。
-    #[test]
-    fn test_provider_without_bypass_flag_definition_errors() {
-        let agent = WorkerCommandAgent {
-            id: Some("dev".to_string()),
-            provider: Provider::GeminiCli,
-            role: Some("developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
-            system_prompt_inline: None,
-            system_prompt_file: None,
-            output_contract_format: None,
-            communication_mode: CommunicationMode::default(),
-            dangerously_skip_permissions: true,
-        };
-        let err = resolved_tool_strings_for_command(&agent, Provider::GeminiCli).unwrap_err();
-        let msg = err.to_string();
-        assert!(
-            msg.contains("no bypass argv flag defined"),
-            "provider without bypass flag + true must fail-loud; got {msg}"
-        );
-        assert!(
-            msg.contains("gemini_cli"),
-            "error must name the provider; got {msg}"
-        );
-    }
-
     #[test]
     fn system_prompt_uses_identity_then_runtime_contract_python_order() {
         // #264 D6: Python truth source (prompt.py:39, live ps confirmed) builds
-        // chunks = [identity, TEAMMATE_SYSTEM_PROMPT, role_body, output, permissions].
+        // chunks = [identity, TEAMMATE_SYSTEM_PROMPT, role_body, output].
         // The previous assertion locked the inverted contract-first order with no
         // Python evidence; this is the corrected golden.
         // 0.3.5 union (copilot v2 C-1 / B2 MUST-4 行为层守): identity 必须 FIRST —
@@ -569,7 +328,6 @@ mod tests {
             id: Some("coder".to_string()),
             provider: Provider::Codex,
             role: Some("Runtime Developer".to_string()),
-            declared_tools: Some(vec!["mcp_team".to_string()]),
             system_prompt_inline: Some("Implement the assigned slice.".to_string()),
             system_prompt_file: None,
             output_contract_format: Some("result_envelope_v1".to_string()),
@@ -590,8 +348,7 @@ mod tests {
         let output = prompt
             .find("Final completion must call team_orchestrator.report_result exactly once")
             .unwrap();
-        let permissions = prompt.find("Permission note:").unwrap();
-        assert!(identity < runtime && runtime < role && role < output && output < permissions);
+        assert!(identity < runtime && runtime < role && role < output);
         let slowdown_phrase = format!("500/{}", 500 + 29);
         assert!(prompt.contains(&slowdown_phrase));
         assert!(prompt.contains("Runtime Developer"));
@@ -605,7 +362,6 @@ mod tests {
                     id: Some("worker".to_string()),
                     provider,
                     role: Some("developer".to_string()),
-                    declared_tools: Some(vec!["mcp_team".to_string()]),
                     system_prompt_inline: Some("worker body".to_string()),
                     system_prompt_file: None,
                     output_contract_format: Some("result_envelope_v1".to_string()),

package/crates/team-agent/src/model/enums.rs

@@ -86,9 +86,8 @@ impl ProviderEffort {
         matches!(self, Self::Max)
     }
 
-    /// True when the given provider supports this effort level. `max` is
-    /// Claude-only; other levels are supported by Claude, Codex, and Grok.
-    /// Copilot/Gemini/CursorAgent/Fake ignore the field (warning at runtime).
+    /// Native command support. Claude/Pi accept max; Codex/Grok accept
+    /// the other levels. Use resolve_for_provider for admission/ignore policy.
     pub fn is_supported_by(self, provider: Provider) -> bool {
         match provider {
             Provider::Claude | Provider::ClaudeCode | Provider::Pi => true,
@@ -98,6 +97,21 @@ impl ProviderEffort {
             }
         }
     }
+
+    /// One admission policy for compiler, direct specs and runtime commands.
+    /// Ok(None) preserves the legacy warning-and-ignore providers.
+    pub fn resolve_for_provider(self, provider: Provider) -> Result<Option<Self>, &'static str> {
+        if provider == Provider::CursorAgent {
+            return Err("cursor_agent does not support effort; the Cursor CLI has no --effort flag");
+        }
+        if self.is_supported_by(provider) {
+            Ok(Some(self))
+        } else if self.is_claude_only() {
+            Err("effort 'max' is only supported by claude/claude_code/pi")
+        } else {
+            Ok(None)
+        }
+    }
 }
 
 /// auth 模式(`AUTH_MODES` `profiles/constants.py:6`)。
@@ -227,29 +241,6 @@ pub enum PermissionMode {
     Trusted,
 }
 
-/// 规范化 tool(`CANONICAL_TOOLS` `permissions.py:5-14`)。别名(`fs_*`/`@builtin`/`*`)
-/// 在 `expand_tools` 展开 —— 那是单独的 alias 输入枚举,不在此(step 2 后续)。
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Tool {
-    FsRead,
-    FsWrite,
-    FsList,
-    ExecuteBash,
-    GitDiff,
-    Network,
-    McpTeam,
-    ProviderBuiltin,
-}
-
-/// provider×tool enforcement(`PROVIDER_ENFORCEMENT` `permissions.py:44-65`)。
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Enforcement {
-    Hard,
-    PromptOnly,
-}
-
 /// tmux pane 存活态(`state.py:336-341`)。**`Unknown` 既不可当 dead 也不可当 live**
 /// (owner-gate `state.py:382` 用 `!= LIVE`)—— 穷尽 match,不 fallthrough(§11)。
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
@@ -345,18 +336,6 @@ mod tests {
                 serde_json::to_string(&DisplayBackend::Adaptive).unwrap(),
                 "\"adaptive\"",
             ),
-            (
-                serde_json::to_string(&Tool::ExecuteBash).unwrap(),
-                "\"execute_bash\"",
-            ),
-            (
-                serde_json::to_string(&Tool::ProviderBuiltin).unwrap(),
-                "\"provider_builtin\"",
-            ),
-            (
-                serde_json::to_string(&Enforcement::PromptOnly).unwrap(),
-                "\"prompt_only\"",
-            ),
             (
                 serde_json::to_string(&PaneLiveness::Unknown).unwrap(),
                 "\"unknown\"",

package/crates/team-agent/src/model/mod.rs

@@ -21,7 +21,6 @@ pub mod ids;
 pub(crate) mod name_similarity;
 pub mod pane_authority_refusal;
 pub mod paths;
-pub mod permissions;
 pub mod routing;
 pub mod spec;
 pub mod task_graph;

package/crates/team-agent/src/model/spec.rs

@@ -6,21 +6,19 @@
 //! serde_json `preserve_order` 保证 child 迭代序 == Python 插入序。
 //!
 //! 本文件先落地 `validate_result_envelope`(自包含,step 7/11 的门)。`validate_spec`
-//! 依赖 `expand_tools`(permissions)+ `find_dependency_cycle`(task_graph)+ yaml Value,
-//! 待那几个叶子模块集成后再加。
+//! 依赖 `find_dependency_cycle`(task_graph)+ yaml Value。
 
 use std::path::Path;
 
 use serde_json::Value;
 
-use crate::model::enums::{Provider, TaskStatus};
+use crate::model::enums::TaskStatus;
 use crate::model::errors::ModelError;
 use crate::model::ids::TaskId;
 use crate::model::task_graph::{find_dependency_cycle, TaskNode};
 use crate::model::yaml::Value as Yaml;
-use crate::model::{permissions, yaml};
-use crate::provider::adapters::pi::first_unsupported_pi_tool_category;
-use crate::provider::wire::{is_claude_family, parse_canonical_provider};
+use crate::model::yaml;
+use crate::provider::wire::parse_canonical_provider;
 
 /// result_envelope_v1 顶层 required(= allowed)。
 const RESULT_REQUIRED: &[&str] = &[
@@ -333,12 +331,13 @@ fn basic_schema_errors(spec: &Yaml) -> Vec<String> {
     if !matches!(mode, Some("supervisor_worker" | "swarm_limited")) {
         e.push("/team/mode: invalid mode".to_string());
     }
-    let leader_keys = &["id", "role", "provider", "model", "tools", "context_policy"];
+    let leader_keys = &["id", "role", "provider", "model", "context_policy"];
+    let leader_allowed = &["id", "role", "provider", "model", "tools", "context_policy"];
     check_keys_y(
         spec.get("leader"),
         "/leader",
         leader_keys,
-        leader_keys,
+        leader_allowed,
         &mut e,
     );
     let cp_keys = &[
@@ -407,7 +406,6 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         "model",
         "working_directory",
         "system_prompt",
-        "tools",
         "dangerously_skip_permissions",
         "preferred_for",
         "avoid_for",
@@ -465,15 +463,16 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
                     "{path}/effort: unknown effort '{raw}' (allowed: low|medium|high|xhigh|max)"
                 ));
             }
-            Some(effort) if effort.is_claude_only() => {
+            Some(effort) => {
                 let provider = agent.get("provider").and_then(Yaml::as_str).unwrap_or("");
-                if !parse_canonical_provider(provider).is_some_and(is_claude_family) {
-                    errors.push(format!(
-                        "{path}/effort: effort '{raw}' is only supported by claude/claude_code (provider: {provider})"
-                    ));
+                if let Some(provider_enum) = parse_canonical_provider(provider) {
+                    if let Err(reason) = effort.resolve_for_provider(provider_enum) {
+                        errors.push(format!(
+                            "{path}/effort: {reason} (effort: {raw}; provider: {provider})"
+                        ));
+                    }
                 }
             }
-            Some(_) => {}
         }
     }
     check_keys_y(
@@ -483,7 +482,6 @@ fn check_agent(agent: &Yaml, path: &str, errors: &mut Vec<String>) {
         &["inline", "file"],
         errors,
     );
-    check_list_y(agent.get("tools"), &format!("{path}/tools"), errors);
     check_list_y(
         agent.get("preferred_for"),
         &format!("{path}/preferred_for"),
@@ -787,67 +785,6 @@ fn semantic_errors(spec: &Yaml, base_dir: &Path) -> Vec<String> {
                 ));
             }
         }
-        let tools: Vec<&str> = agent
-            .get("tools")
-            .and_then(Yaml::as_list)
-            .unwrap_or(&[])
-            .iter()
-            .filter_map(Yaml::as_str)
-            .collect();
-        let expanded_tools = permissions::expand_tool_strings(tools);
-        for tool in &expanded_tools {
-            if !permissions::is_canonical_tool(tool) {
-                e.push(format!(
-                    "/agents/{idx}/tools: unknown tool {}",
-                    py_repr_str(tool)
-                ));
-            }
-        }
-        if parse_canonical_provider(provider.and_then(Yaml::as_str).unwrap_or(""))
-            == Some(Provider::Pi)
-        {
-            if let Some(category) = first_unsupported_pi_tool_category(
-                expanded_tools
-                    .iter()
-                    .filter(|tool| permissions::is_canonical_tool(tool))
-                    .map(String::as_str),
-            ) {
-                e.push(format!(
-                    "/agents/{idx}/tools: Pi does not support Team Agent tool category {category:?}; remove it from this agent's tools"
-                ));
-            }
-        }
-    }
-
-    let leader_tools: Vec<&str> = leader
-        .and_then(|l| l.get("tools"))
-        .and_then(Yaml::as_list)
-        .unwrap_or(&[])
-        .iter()
-        .filter_map(Yaml::as_str)
-        .collect();
-    let expanded_leader_tools = permissions::expand_tool_strings(leader_tools);
-    for tool in &expanded_leader_tools {
-        if !permissions::is_canonical_tool(tool) {
-            e.push(format!(
-                "/leader/tools: unknown tool {}",
-                py_repr_str(tool)
-            ));
-        }
-    }
-    if parse_canonical_provider(leader_provider.and_then(Yaml::as_str).unwrap_or(""))
-        == Some(Provider::Pi)
-    {
-        if let Some(category) = first_unsupported_pi_tool_category(
-            expanded_leader_tools
-                .iter()
-                .filter(|tool| permissions::is_canonical_tool(tool))
-                .map(String::as_str),
-        ) {
-            e.push(format!(
-                "/leader/tools: Pi does not support Team Agent tool category {category:?}; remove it from the leader's tools"
-            ));
-        }
     }
 
     let routing = spec.get("routing");
@@ -1070,7 +1007,7 @@ mod tests {
     }
 
     #[test]
-    fn pi_spec_accepts_native_categories_and_rejects_provider_builtin() {
+    fn tools_are_transparent_for_all_providers() {
         let pi_text = include_str!("testdata/team.spec.yaml")
             .lines()
             .filter(|line| {
@@ -1093,22 +1030,26 @@ mod tests {
             1,
         );
         let bad_agent = yaml::loads(&bad_agent_text).unwrap();
-        let error = validate_spec(&bad_agent, Path::new(TD)).unwrap_err().to_string();
         assert!(
-            error.contains("/agents/0/tools: Pi does not support Team Agent tool category \"provider_builtin\""),
-            "spec validation must reject the Pi agent category: {error}"
+            validate_spec(&bad_agent, Path::new(TD)).is_ok(),
+            "Pi tools metadata must be ignored"
         );
 
-        let bad_leader_text = pi_text.replacen(
-            "    - mcp_team\n",
-            "    - mcp_team\n    - provider_builtin\n",
-            1,
-        );
-        let bad_leader = yaml::loads(&bad_leader_text).unwrap();
-        let error = validate_spec(&bad_leader, Path::new(TD)).unwrap_err().to_string();
+        let missing_tools = pi_text
+            .replacen(
+                "  tools:\n    - fs_read\n    - fs_list\n    - mcp_team\n",
+                "",
+                1,
+            )
+            .replacen(
+                "    tools:\n      - fs_read\n      - fs_write\n      - fs_list\n      - execute_bash\n      - mcp_team\n",
+                "",
+                1,
+            );
+        let missing_tools = yaml::loads(&missing_tools).unwrap();
         assert!(
-            error.contains("/leader/tools: Pi does not support Team Agent tool category \"provider_builtin\""),
-            "spec validation must reject the Pi leader category: {error}"
+            validate_spec(&missing_tools, Path::new(TD)).is_ok(),
+            "omitted tools metadata must be accepted"
         );
     }
 
@@ -1121,7 +1062,6 @@ mod tests {
                 "/version: must equal 1",
                 "/team/mode: invalid mode",
                 "/leader/provider: unknown provider 'badprov'",
-                "/agents/0/tools: unknown tool 'banana'",
             ]
         );
     }