@nanmicoder/dsh-agent-teams 0.1.22-rc.1 → 0.1.23

package/README.md

@@ -6,6 +6,12 @@
   <img src="./assets/readme/hero.svg" width="100%" alt="dsh-agent-teams turns one DeepSeek Harness session into a coordinated multi-agent team">
 </p>
 
+<div align="center">
+
+[![AtomGit](https://atomgit.com/NanmiCoder/dsh-agent-teams/star/new_badge.svg)](https://atomgit.com/NanmiCoder/dsh-agent-teams)
+
+</div>
+
 <p align="center">
   <a href="https://dshfind.com/en/plugins/NanmiCoder/dsh-agent-teams?ref=badge"><img src="https://img.shields.io/badge/recommended%20by-dshfind-FFD700?style=flat-square" alt="Recommended by dshfind"></a>
   <a href="https://dshfind.com/en/plugins/NanmiCoder/dsh-agent-teams?ref=badge"><img src="https://dshfind.com/api/badge/NanmiCoder/dsh-agent-teams?lang=en" alt="dshfind score"></a>
@@ -30,7 +36,7 @@ Ask in natural language. The plugin provides the team protocol, 14 coordination
 
 ## Releases
 
-[v0.1.22-rc.1](./release-notes/v0.1.22-rc.1.md) prepares for Harness desktop 0.2.0 and fixes Git installation by shipping prebuilt entries. This preview uses npm `next`; the recommended host is Harness `0.1.7-rc.2` (its `next` channel). See the exact [support matrix](./compatibility.json).
+[v0.1.23](./release-notes/v0.1.23.md) fixes team identity, member model routing, quality and repair gates, and cold fork recovery, and adds owner-configured member tool policies. This plugin release uses npm `latest`; the recommended host remains Harness `0.2.0-rc.2` (its `next` channel). See the exact [support matrix](./compatibility.json).
 
 ## Why AgentTeams?
 
@@ -49,32 +55,33 @@ The conversation card and activity panel use Harness's official locale service.
 
 ## Install and choose versions
 
-**Recommended pair: DeepSeek Harness `0.1.7-rc.2` + AgentTeams `0.1.22-rc.1`. Both packages are prereleases.**
+**Recommended pair: DeepSeek Harness `0.2.0-rc.2` + AgentTeams `0.1.23`. The host remains an RC.**
 
 | Use case | DeepSeek Harness | AgentTeams plugin |
 | --- | --- | --- |
-| **Recommended** | **`0.1.7-rc.2`** | **`0.1.22-rc.1`** |
-| Legacy RC | `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.5-rc.3` | `0.1.22-rc.1` |
-| Retaining an older RC | `0.1.2-rc.1` | `0.1.22-rc.1` |
-| Developer Alpha testing | `0.1.2-alpha.5` | `0.1.22-rc.1` |
-| Retaining an older Alpha | `0.1.2-alpha.2` | `0.1.22-rc.1` |
+| **Recommended** | **`0.2.0-rc.2`** | **`0.1.23`** |
+| Previous recommended RC | `0.1.7-rc.2` | `0.1.23` |
+| Legacy RC | `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.5-rc.3` | `0.1.23` |
+| Retaining an older RC | `0.1.2-rc.1` | `0.1.23` |
+| Developer Alpha testing | `0.1.2-alpha.5` | `0.1.23` |
+| Retaining an older Alpha | `0.1.2-alpha.2` | `0.1.23` |
 
 ### Desktop app
 
 In the app sidebar, open **Plugins → Add plugin** and enter the npm package spec:
 
 ```text
-@nanmicoder/dsh-agent-teams@0.1.22-rc.1
+@nanmicoder/dsh-agent-teams@0.1.23
 ```
 
 Install it, then choose **Enable now**. If the host asks for a restart, restart the desktop app. Use the package spec above for the published build; an npm or GitHub webpage URL is not the same install source. For Git installation, use a commit containing the verified build outputs described below.
 
-The desktop app supplies its own Harness core and package manager. Upgrading the global CLI does not upgrade that core, and replacing `--profile web` with `--profile desktop` in a CLI command does not install into the app. Check the embedded core against the compatibility list. The upcoming `0.2.0` desktop release is being pre-adapted against source commit `21638c56315ae6a2b552d6091945d3144c9af32e`; it is recorded separately as a source candidate, not in the published-host support matrix above. See the [0.2.0 pre-adaptation scope and evidence](./docs/harness-0.2.0-pre-adaptation/README.md).
+The desktop app supplies its own Harness core and package manager. Upgrading the global CLI does not upgrade that core, and an ordinary standalone CLI cannot manage its desktop profile. The CLI carrier installed by the desktop app can manage that profile in `0.2.0-rc.2`. Check the embedded core against the compatibility list. Harness `0.2.0-rc.2` is now the exact published target; its RC status is unchanged. The earlier source-only `0.2.0` prediction is no longer a support declaration. See the [release migration evidence](./docs/harness-0.2.0-rc.2/README.md).
 
 ### CLI / Web: 1. Install DeepSeek Harness
 
 ```sh
-npm install --global @deepseek-ai/dsh@0.1.7-rc.2
+npm install --global @deepseek-ai/dsh@0.2.0-rc.2
 dsh --version
 ```
 
@@ -82,10 +89,10 @@ Skip this if you already run this version. Alpha is opt-in: select an exact Alph
 
 ### CLI / Web: 2. Install the AgentTeams plugin
 
-Install or upgrade from npm (pinned to this `next` preview):
+Install or upgrade from npm (pinned to this `latest` release):
 
 ```sh
-dsh plugin --profile web add --save-exact @nanmicoder/dsh-agent-teams@0.1.22-rc.1
+dsh plugin --profile web add --save-exact @nanmicoder/dsh-agent-teams@0.1.23
 ```
 
 For a CLI-managed installation, replace `web` with your active CLI profile. **Stop and restart that profile's Harness process, then refresh the browser.** Installing the plugin does not upgrade Harness; the host and plugin have independent `latest` channels.
@@ -159,10 +166,26 @@ Defaults work without extra setup. A trusted profile can override member behavio
     memberModel: deepseek-v4
     memberMaxDepth: 0
     maxMembers: 8
+    toolPolicies:
+      researcher:
+        allow: [read, glob, grep]
+      implementer:
+        deny: [web_search]
 ```
 
 `memberMaxDepth` defaults to `0`: team members cannot create nested subagents. Set `1` to explicitly permit one descendant level; the limit also covers runtime/code-tool calls. Default members report through team messages only, avoiding duplicate native parent reports. Idle roster members make no model requests. Task assignments start distinct turns; coordination joins the nearest model step. Acceptance and consumption are tracked separately. Removal/archive drains the selected branch and its pending input before reporting success.
 
+`toolPolicies` is owner configuration: reusable per-member tool policies keyed by id. A member *selects* one by id — `tool_policy` on `agent_teams_add_member`, a member row of an inline `plan`, or a profile member row. The Captain model can select a declared policy but can never submit raw allow/deny lists or invent one at runtime.
+
+- `deny` hides the named global tools from that member's schemas and rejects their invocation.
+- `allow` keeps only the named global tools. The four coordination tools (`agent_teams_claim_task`, `agent_teams_update_task`, `agent_teams_send_message`, `agent_teams_status`) are always added to an allow list.
+- The captain-only tool list is always denied and cannot be reopened by a policy; a policy may not deny a required coordination tool.
+- Unknown ids, empty policies, and empty lists fail at mount or before a member is persisted.
+- `agent_teams_status` shows the selected policy id per member; the complete resolved filter is kept in `team.json` for audit, and the child's durable descriptor reapplies it after a restart.
+- Teams and members created without a policy keep their previous tool set and record shape. An empty `tool_policy` on `agent_teams_edit_plan` clears a staged member's policy.
+
+This is model tool visibility and invocation policy for global tools, not an OS sandbox or an authorization boundary.
+
 `memberProvider` is the sub-agent runtime backend (`spawn` / `fork`), not an LLM provider. Cross-LLM-provider routing uses the optional `provider` + `model` fields of `agent_teams_add_member`; `memberModel` is only a model default for all members. A member on the captain's current provider/model inherits the captain's reasoning effort, while a changed provider or model automatically uses the target model's default. To request a particular effort, pass the optional `reasoning_effort` field — one of the target model's supported effort ids, or `"default"` to force the model's own default.
 
 `slashCommand: false` disables the deterministic `/agent-teams` activation surfaces (slash command and gesture boundary), leaving the natural-language trigger as the only entry point.

package/README_ZH.md

@@ -6,6 +6,12 @@
   <img src="./assets/readme/hero.svg" width="100%" alt="dsh-agent-teams 把一个 DeepSeek Harness 会话变成可协作的多智能体团队">
 </p>
 
+<div align="center">
+
+[![AtomGit](https://atomgit.com/NanmiCoder/dsh-agent-teams/star/new_badge.svg)](https://atomgit.com/NanmiCoder/dsh-agent-teams)
+
+</div>
+
 <p align="center">
   <a href="https://dshfind.com/zh/plugins/NanmiCoder/dsh-agent-teams?ref=badge"><img src="https://img.shields.io/badge/%E7%94%B1%20dshfind-%E6%8E%A8%E8%8D%90-FFD700?style=flat-square" alt="由 dshfind 推荐"></a>
   <a href="https://dshfind.com/zh/plugins/NanmiCoder/dsh-agent-teams?ref=badge"><img src="https://dshfind.com/api/badge/NanmiCoder/dsh-agent-teams?lang=zh" alt="dshfind 评分"></a>
@@ -30,7 +36,7 @@
 
 ## 版本更新
 
-[v0.1.22-rc.1](./release-notes/v0.1.22-rc.1.md) 预适配 Harness 桌面端 0.2.0，并通过分发预编译入口修复 Git 安装。本预览版使用 npm `next` 渠道；推荐搭配 Harness `0.1.7-rc.2`（宿主的 `next` 渠道）。精确支持范围见 [compatibility.json](./compatibility.json)。
+[v0.1.23](./release-notes/v0.1.23.md) 修复团队标识、成员模型路由、质量与修复门禁及 fork 冷恢复，并新增由工作区所有者配置的成员工具策略。本插件正式版使用 npm `latest` 渠道；推荐宿主仍为 Harness `0.2.0-rc.2`（宿主的 `next` 渠道）。精确支持范围见 [compatibility.json](./compatibility.json)。
 
 ## 为什么需要 AgentTeams？
 
@@ -48,32 +54,33 @@
 
 ## 安装与版本选择
 
-**推荐组合：DeepSeek Harness `0.1.7-rc.2` + AgentTeams `0.1.22-rc.1`。两者均为预发布版本。**
+**推荐组合：DeepSeek Harness `0.2.0-rc.2` + AgentTeams `0.1.23`。宿主仍为 RC 版本。**
 
 | 使用场景 | DeepSeek Harness | AgentTeams 插件 |
 | --- | --- | --- |
-| **推荐版本** | **`0.1.7-rc.2`** | **`0.1.22-rc.1`** |
-| 保留旧 RC | `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.5-rc.3` | `0.1.22-rc.1` |
-| 保留旧 RC | `0.1.2-rc.1` | `0.1.22-rc.1` |
-| 开发者测试 Alpha | `0.1.2-alpha.5` | `0.1.22-rc.1` |
-| 保留旧 Alpha | `0.1.2-alpha.2` | `0.1.22-rc.1` |
+| **推荐版本** | **`0.2.0-rc.2`** | **`0.1.23`** |
+| 上一推荐 RC | `0.1.7-rc.2` | `0.1.23` |
+| 保留旧 RC | `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.5-rc.3` | `0.1.23` |
+| 保留旧 RC | `0.1.2-rc.1` | `0.1.23` |
+| 开发者测试 Alpha | `0.1.2-alpha.5` | `0.1.23` |
+| 保留旧 Alpha | `0.1.2-alpha.2` | `0.1.23` |
 
 ### 桌面端
 
 在应用侧栏打开「插件 → 添加插件」，输入 npm 包名和版本：
 
 ```text
-@nanmicoder/dsh-agent-teams@0.1.22-rc.1
+@nanmicoder/dsh-agent-teams@0.1.23
 ```
 
 安装完成后点击「立即启用」；宿主提示需要重启时，重启桌面应用。发布版请使用上面的包名，npm 或 GitHub 网页链接与 npm 包名不是同一种安装来源。从 Git 安装时，请选用包含下方所述已验证构建产物的提交。
 
-桌面应用自带 Harness 核心和包管理器。升级全局 CLI 不会升级桌面内核，也不能把命令中的 `--profile web` 换成 `--profile desktop` 来安装到桌面应用。请核对应用内置核心与兼容清单。即将发布的 `0.2.0` 桌面端正在基于源码提交 `21638c56315ae6a2b552d6091945d3144c9af32e` 做预适配，单独记录为源码候选，不进入上方已发布宿主支持矩阵。详见 [0.2.0 预适配范围与证据](./docs/harness-0.2.0-pre-adaptation/README.md)。
+桌面端自带 Harness 内核与包管理器，升级全局 CLI 不会升级桌面端；普通独立 CLI 不能管理桌面 profile，桌面端自带的 CLI carrier 在此版本可以管理。当前精确目标是已发布的 `0.2.0-rc.2`，仍属于 RC；此前源码预测的 `0.2.0` 已退出支持声明。详见[迁移验收记录](./docs/harness-0.2.0-rc.2/README.md)。
 
 ### CLI / Web：1. 安装 DeepSeek Harness
 
 ```sh
-npm install --global @deepseek-ai/dsh@0.1.7-rc.2
+npm install --global @deepseek-ai/dsh@0.2.0-rc.2
 dsh --version
 ```
 
@@ -81,10 +88,10 @@ dsh --version
 
 ### CLI / Web：2. 安装 AgentTeams 插件
 
-从 npm 安装或升级插件（命令锁定本次 `next` 预览版）：
+从 npm 安装或升级插件（命令锁定本次 `latest` 正式版）：
 
 ```sh
-dsh plugin --profile web add --save-exact @nanmicoder/dsh-agent-teams@0.1.22-rc.1
+dsh plugin --profile web add --save-exact @nanmicoder/dsh-agent-teams@0.1.23
 ```
 
 CLI 管理的安装可将 `web` 换成实际使用的 CLI profile。**安装后，停止并重新启动该 profile 的 Harness 进程，再刷新浏览器。** 安装插件不会自动升级宿主；Harness 的 `latest` 与插件的 `latest` 是两个独立渠道。
@@ -146,10 +153,26 @@ CLI 管理的安装可将 `web` 换成实际使用的 CLI profile。**安装后
     memberModel: deepseek-v4
     memberMaxDepth: 0
     maxMembers: 8
+    toolPolicies:
+      researcher:
+        allow: [read, glob, grep]
+      implementer:
+        deny: [web_search]
 ```
 
 `memberMaxDepth` 默认 `0`，团队成员不能再创建子代理；显式设为 `1` 可允许一层后代，运行时和代码工具调用同样受限。默认成员统一通过团队消息汇报，避免再走宿主消息重复通知队长。无任务成员不调用模型；任务分配开启独立轮次，纠正消息进入最近的模型步骤。消息投递与读取分别记录；移除和归档必须等成员分支及待处理输入清理完成后才报告成功。
 
+`toolPolicies` 是部署方配置：按 id 复用的成员工具策略。成员只能“按 id 选择”——`agent_teams_add_member` 的 `tool_policy`、内联 `plan` 的成员行，或 profile 成员行的 `tool_policy`。队长模型只能选择已声明的策略，不能提交原始 allow/deny 列表，也不能在运行时新建策略。
+
+- `deny` 让指定全局工具从该成员的 schema 中消失，并拒绝其调用。
+- `allow` 只保留列出的全局工具；四个协调工具（`agent_teams_claim_task`、`agent_teams_update_task`、`agent_teams_send_message`、`agent_teams_status`）始终会被加入 allow 列表。
+- 队长专属工具始终被拒绝，策略无法重新打开；策略也不允许拒绝必须保留的协调工具。
+- 未知 id、空策略、空列表会在挂载时或写入成员前直接失败。
+- `agent_teams_status` 会显示每个成员选择的策略 id；完整生效过滤器保存在 `team.json` 供审计，重启后由子会话的持久 descriptor 重新应用。
+- 未配置策略的团队与成员保持原有工具集和记录结构；`agent_teams_edit_plan` 传空 `tool_policy` 可清除暂存成员的策略。
+
+这是全局工具的模型可见性与调用限制，不是 OS 沙箱，也不是授权边界。
+
 普通调研、仓库审计可用 `agent_teams_create({name, description, approval:"required", plan:{members:[{name:"researcher"}], tasks:[{id:"audit", subject:"审计现有实现", assignee:"researcher"}]}})` 一次创建完整草案。任务的 `dependencies` 引用同一批中的 `id`，支持前向引用并校验环；结果返回实际任务 ID。`kind=review` 专用于对既有 implementation/repair 任务的质量复审，普通仓库审计使用默认的 `kind=work`。
 
 这里的 `memberProvider` 指子 Agent 的运行后端（`spawn` / `fork`），不是 LLM provider。跨 LLM provider 由 `agent_teams_add_member` 的可选 `provider` + `model` 参数表达；`memberModel` 只是所有成员的模型默认覆盖。成员沿用队长当前 provider/model 时会继承队长的思考强度；provider 或 model 任一改变时会自动使用目标模型的默认档。需要指定特定强度时，可传入可选的 `reasoning_effort` 参数（目标模型支持的档位 id，或 `"default"` 表示强制使用模型自身默认档）。

package/compatibility.json

@@ -1,12 +1,16 @@
 {
   "schemaVersion": 1,
-  "recommendedHost": "0.1.7-rc.2",
+  "recommendedHost": "0.2.0-rc.2",
   "previewTag": "next",
   "supportedHosts": [
     {
-      "version": "0.1.7-rc.2",
+      "version": "0.2.0-rc.2",
       "track": "recommended"
     },
+    {
+      "version": "0.1.7-rc.2",
+      "track": "legacy"
+    },
     {
       "version": "0.1.5-rc.3",
       "track": "legacy"
@@ -31,13 +35,5 @@
       "version": "0.1.2-alpha.2",
       "track": "legacy"
     }
-  ],
-  "sourceCandidates": [
-    {
-      "version": "0.2.0",
-      "repository": "https://github.com/deepseek-ai/deepseek-harness",
-      "commit": "21638c56315ae6a2b552d6091945d3144c9af32e",
-      "evidence": "docs/harness-0.2.0-pre-adaptation/README.md"
-    }
   ]
 }

package/lib/artifacts.js

@@ -0,0 +1,342 @@
+/**
+ * Workspace byte identity: the only module in this plugin that reads artifact
+ * bytes off disk.
+ *
+ * Two plugin surfaces need it:
+ *  · a quality verdict must record which revision it judged (issue #161), so
+ *    delivery can refuse to advertise bytes no review ever saw;
+ *  · an auto-generated work order must record the workspace it was derived
+ *    from (issue #174), so it can be marked stale after a later round edits a
+ *    cited file.
+ *
+ * Safety rules this module must never lose:
+ *  · directory traversal never follows symlinks, and every explicitly named
+ *    path is resolved with `realpath` and rejected when it leaves the
+ *    workspace — a symlink must not become a read of arbitrary host files, and
+ *    a symlink cycle must not become an infinite walk;
+ *  · a scope that cannot be enumerated completely (file cap, unreadable
+ *    directory, non-workspace-relative path) produces an explicit
+ *    {@link ArtifactScopeGap} instead of a short list that reads as complete;
+ *  · "could not be read" is recorded separately from "does not exist";
+ *  · plugins and secrets never enter a broad scope by accident.
+ *
+ * The gate rules themselves stay pure: they receive {@link ArtifactDigest}
+ * values from here and never touch the filesystem.
+ * @module dsh-agent-teams/artifacts
+ */
+import { createHash } from 'node:crypto';
+import { closeSync, lstatSync, openSync, readSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { isAbsolute, join, relative, sep } from 'node:path';
+import { isDefaultExcludedPath, normalizeWorkspacePath } from "./quality-gates.js";
+/**
+ * Directory segments never walked when a scope pattern names a directory:
+ * version control, the harness state root, plugin-private team state, and
+ * installed packages. They are either huge, plugin-private, or not project
+ * artifacts.
+ */
+const SKIPPED_SEGMENTS = new Set(['.git', '.dsh', '.agent-teams', 'node_modules']);
+/**
+ * Upper bound on files expanded from one scope. Verdicts are about a revision
+ * and an unbounded walk of a large tree would make every gate close slow, so
+ * the walk stops here — and says so with a gap, because a silently truncated
+ * list would let a change outside the list pass as "unchanged".
+ */
+export const MAX_EXPANDED_ARTIFACTS = 200;
+function errorCode(error) {
+    const code = error?.code;
+    return typeof code === 'string' ? code : 'EIO';
+}
+function workspaceRootOf(workspace) {
+    try {
+        return realpathSync(workspace);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `absolute` (already resolved) inside the workspace root? */
+function insideRoot(root, absolute) {
+    const rel = relative(root, absolute);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+/** `true` inside, `false` escapes the workspace, `undefined` unresolvable. */
+function resolvesInside(root, absolute) {
+    try {
+        return insideRoot(root, realpathSync(absolute));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Chunk size for the streaming digest. The activity panel polls the audit
+ * about once a second, so hashing must never read a whole artifact into
+ * memory: a multi-gigabyte file would otherwise stall the host process.
+ */
+const HASH_CHUNK_BYTES = 64 * 1024;
+/**
+ * sha256 one file in constant memory (one reusable chunk buffer), never
+ * loading the whole artifact. Throws the underlying filesystem error so the
+ * caller can distinguish "cannot read" from "absent".
+ */
+function hashFileConstantMemory(absolute) {
+    const handle = openSync(absolute, 'r');
+    try {
+        const hash = createHash('sha256');
+        const buffer = Buffer.allocUnsafe(HASH_CHUNK_BYTES);
+        let size = 0;
+        for (;;) {
+            const read = readSync(handle, buffer, 0, buffer.byteLength, null);
+            if (read <= 0)
+                break;
+            size += read;
+            // `update` consumes the bytes synchronously, so the buffer is reused.
+            hash.update(read === buffer.byteLength ? buffer : buffer.subarray(0, read));
+        }
+        return { sha256: hash.digest('hex'), size };
+    }
+    finally {
+        closeSync(handle);
+    }
+}
+function inspectPath(workspaceRoot, workspace, normalized) {
+    const absolute = join(workspace, normalized);
+    let stats;
+    try {
+        stats = lstatSync(absolute);
+    }
+    catch (error) {
+        const code = errorCode(error);
+        return code === 'ENOENT' || code === 'ENOTDIR'
+            ? { kind: 'absent' }
+            : { kind: 'unreadable', reason: `${normalized} cannot be inspected (${code})` };
+    }
+    if (workspaceRoot === undefined) {
+        return { kind: 'unreadable', reason: `${normalized} cannot be verified against the workspace root` };
+    }
+    // Containment is checked on the fully resolved path, not only when the last
+    // segment is a symlink: an intermediate symlinked directory would otherwise
+    // let any inner path read (or walk) host files outside the workspace.
+    const inside = resolvesInside(workspaceRoot, absolute);
+    if (inside === undefined)
+        return { kind: 'unreadable', reason: `${normalized} cannot be resolved (broken or cyclic link)` };
+    if (!inside)
+        return { kind: 'unreadable', reason: `${normalized} resolves outside the workspace; refusing to read it` };
+    if (stats.isSymbolicLink()) {
+        try {
+            stats = statSync(absolute);
+        }
+        catch (error) {
+            return { kind: 'unreadable', reason: `${normalized} symlink target cannot be inspected (${errorCode(error)})` };
+        }
+    }
+    if (stats.isDirectory())
+        return { kind: 'directory' };
+    if (!stats.isFile())
+        return { kind: 'unreadable', reason: `${normalized} is not a regular file` };
+    try {
+        const { sha256, size } = hashFileConstantMemory(absolute);
+        return {
+            kind: 'file',
+            digest: {
+                path: normalized,
+                present: true,
+                sha256,
+                size,
+                mtimeMs: stats.mtimeMs,
+            },
+        };
+    }
+    catch (error) {
+        return { kind: 'unreadable', reason: `${normalized} cannot be read (${errorCode(error)})` };
+    }
+}
+function isSkipped(relativePath) {
+    return relativePath.split('/').some((segment) => SKIPPED_SEGMENTS.has(segment)) || isDefaultExcludedPath(relativePath);
+}
+function walkDirectory(input) {
+    // The prefix itself must be inside the workspace before it is enumerated:
+    // `escape/` may be a symlink to an outside directory, and readdir would
+    // happily list host names through it. Nested prefixes come from
+    // non-symlink directory entries of an already-verified parent.
+    if (input.prefix !== '') {
+        if (input.workspaceRoot === undefined) {
+            input.gap(`${input.pattern}: the workspace root cannot be resolved, so it is not enumerated`);
+            return;
+        }
+        let inside;
+        try {
+            inside = insideRoot(input.workspaceRoot, realpathSync(join(input.workspace, input.prefix)));
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT' || errorCode(error) === 'ENOTDIR') {
+                input.gap(`${input.pattern}: ${input.prefix} does not exist, so the scope could not be enumerated`);
+                return;
+            }
+            inside = undefined;
+        }
+        if (inside === undefined) {
+            input.gap(`${input.pattern}: ${input.prefix} cannot be resolved (broken or cyclic link); refusing to enumerate it`);
+            return;
+        }
+        if (!inside) {
+            input.gap(`${input.pattern}: ${input.prefix} resolves outside the workspace; refusing to enumerate it`);
+            return;
+        }
+    }
+    const queue = input.prefix === '' ? [''] : [input.prefix];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        let entries;
+        try {
+            entries = readdirSync(join(input.workspace, current), { withFileTypes: true });
+        }
+        catch (error) {
+            input.gap(`${input.pattern}: cannot list ${current === '' ? '.' : current} (${errorCode(error)})`);
+            continue;
+        }
+        for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name))) {
+            const relativePath = `${current === '' ? '' : `${current}/`}${entry.name}`;
+            // Traversal never follows symlinks: a symlinked directory can point
+            // outside the workspace or form a cycle, and neither may become a read
+            // or an unbounded walk.
+            if (entry.isSymbolicLink())
+                continue;
+            if (isSkipped(relativePath))
+                continue;
+            if (entry.isDirectory()) {
+                queue.push(relativePath);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (input.full()) {
+                input.gap(`${input.pattern}: stopped at the ${MAX_EXPANDED_ARTIFACTS}-file cap, so its contents are only partially recorded`);
+                return;
+            }
+            input.push(relativePath);
+        }
+    }
+}
+/**
+ * Read a declared scope: expand directory patterns to their current files,
+ * keep explicitly named paths even when they do not exist (a later creation is
+ * drift too), and report every part that could not be fully resolved.
+ */
+export function readArtifactScope(workspace, patterns) {
+    const workspaceRoot = workspaceRootOf(workspace);
+    const gaps = [];
+    const concrete = [];
+    const seen = new Set();
+    const full = () => concrete.length >= MAX_EXPANDED_ARTIFACTS;
+    const push = (path) => {
+        if (seen.has(path))
+            return;
+        seen.add(path);
+        concrete.push(path);
+    };
+    const gap = (pattern, reason) => {
+        if (gaps.some((item) => item.pattern === pattern && item.reason === reason))
+            return;
+        gaps.push({ pattern, reason });
+    };
+    for (const raw of patterns) {
+        if (typeof raw !== 'string')
+            continue;
+        const trimmed = raw.trim();
+        const posix = trimmed.replaceAll('\\', '/');
+        const directory = posix.endsWith('/') || posix === '.';
+        const normalized = normalizeWorkspacePath(raw);
+        if (normalized === undefined) {
+            // Absolute paths, `..`, `~`, drive letters: illegal, and never a reason
+            // to fall back to the workspace root.
+            gap(trimmed, 'not a workspace-relative path (absolute paths and ".." can never match scope)');
+            continue;
+        }
+        if (!directory) {
+            if (normalized === '') {
+                gap(trimmed, 'empty path is not a file; use "." for the whole workspace');
+                continue;
+            }
+            if (full()) {
+                gap(trimmed, `stopped at the ${MAX_EXPANDED_ARTIFACTS}-path cap, so the scope is only partially recorded`);
+                continue;
+            }
+            push(normalized);
+            continue;
+        }
+        // Only an explicitly root-anchored pattern means the workspace root.
+        const rootAnchored = posix === '.' || posix === './' || posix.startsWith('./');
+        if (normalized === '' && !rootAnchored) {
+            gap(trimmed, 'unresolved directory pattern; use "./" explicitly for the workspace root');
+            continue;
+        }
+        if (full()) {
+            gap(trimmed, `stopped at the ${MAX_EXPANDED_ARTIFACTS}-path cap, so its contents are only partially recorded`);
+            continue;
+        }
+        walkDirectory({ workspace, workspaceRoot, pattern: trimmed, prefix: normalized, push, gap: (reason) => gap(trimmed, reason), full });
+    }
+    const artifacts = [];
+    // Index-based: expanding an explicitly named directory appends its files to
+    // `concrete`, and those must be digested in the same pass.
+    for (let index = 0; index < concrete.length; index += 1) {
+        const normalized = concrete[index];
+        const outcome = inspectPath(workspaceRoot, workspace, normalized);
+        if (outcome.kind === 'file') {
+            artifacts.push(outcome.digest);
+            continue;
+        }
+        if (outcome.kind === 'directory') {
+            // An explicitly named directory is expanded instead of being reported as
+            // unreadable: `src/lib` and `src/lib/` must behave the same.
+            walkDirectory({ workspace, workspaceRoot, pattern: normalized, prefix: normalized, push, gap: (reason) => gap(normalized, reason), full });
+            continue;
+        }
+        if (outcome.kind === 'absent') {
+            artifacts.push({ path: normalized, present: false });
+            continue;
+        }
+        artifacts.push({ path: normalized, present: false, unreadable: true, reason: outcome.reason });
+    }
+    return { artifacts: artifacts.sort((a, b) => a.path.localeCompare(b.path)), gaps };
+}
+/**
+ * Read the current bytes of workspace-relative paths (directories expand).
+ * Illegal and unreadable paths are reported, never silently dropped.
+ */
+export function digestWorkspacePaths(workspace, paths) {
+    return readArtifactScope(workspace, paths).artifacts;
+}
+/**
+ * Does this workspace-relative path currently exist as a file or directory?
+ * Uses the same containment rules as the digest reader: a symlink that leaves
+ * the workspace is not "an existing workspace path".
+ */
+export function workspacePathExists(workspace, path) {
+    const normalized = normalizeWorkspacePath(path);
+    if (normalized === undefined)
+        return false;
+    const outcome = inspectPath(workspaceRootOf(workspace), workspace, normalized);
+    return outcome.kind === 'file' || outcome.kind === 'directory';
+}
+/** Expand scope patterns to the concrete files they currently cover. */
+export function expandScopePaths(workspace, patterns) {
+    return readArtifactScope(workspace, patterns)
+        .artifacts
+        .filter((artifact) => artifact.present)
+        .map((artifact) => artifact.path)
+        .sort();
+}
+/**
+ * Read one coherent snapshot of the given scope patterns. Directory patterns
+ * expand to the files they currently contain; a pattern naming a path that
+ * does not exist is recorded as `present: false` so a later creation or
+ * deletion is visible as drift, and any incomplete coverage is carried in
+ * `gaps`.
+ */
+export function snapshotWorkspacePaths(workspace, patterns) {
+    const at = Date.now();
+    const { artifacts, gaps } = readArtifactScope(workspace, patterns);
+    return { at, artifacts, ...gaps.length === 0 ? {} : { gaps } };
+}

package/lib/capabilities.js

@@ -3,6 +3,7 @@ import { onAgentReady } from "./harness-compat.js";
 import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { readTeamSync, readRetiredMemberIdsSync } from "./state.js";
+import { leadIdentityOf, teamLeadMatch } from "./lineage.js";
 import { MEMBER_TOOL_NAMES, TEAM_TOOL_NAMES } from "./tool-names.js";
 export const TEAM_ACTIVATION_PROMPT = 'AgentTeams (Agent Teams) provides multi-agent team collaboration. Apply these rules when the user requests it (including /agent-teams) or when continuing an existing team. Mentioning, quoting, discussing, or declining AgentTeams alone is not a request to start work.';
 export const TEAM_MEMBER_PROMPT = 'You are an AgentTeams member. Follow your assigned member persona and task contract. Use agent_teams_claim_task, agent_teams_update_task, agent_teams_send_message and agent_teams_status for your own work. Include the current attempt_id in updates; report completion or failure to the captain. Do not create, approve, edit or resume a team. If your durable membership is unavailable, report that to the parent instead of creating a replacement.';
@@ -10,7 +11,8 @@ function stateRoot(agent, config) {
     return join(agent.session.header.cwd ?? process.cwd(), config.stateDir);
 }
 /** Synchronous startup/HMR hydration must finish before the first assembly. */
-function currentTeam(agent, config) {
+function currentTeam(ctx, agent, config) {
+    const lead = leadIdentityOf(ctx, agent.session);
     const root = stateRoot(agent, config);
     let entries;
     try {
@@ -26,7 +28,7 @@ function currentTeam(agent, config) {
         if (!entry.isDirectory() || entry.name === 'archive')
             continue;
         const team = readTeamSync(root, entry.name);
-        if (team === undefined || (team.captainSessionId !== agent.id
+        if (team === undefined || (!teamLeadMatch(team, lead)
             && !team.members.some(member => member.id === agent.id)))
             continue;
         if (found !== undefined)
@@ -55,8 +57,8 @@ export function installTeamCapabilities(ctx, config) {
         let member = config.isPendingMember(agent);
         try {
             member ||= readRetiredMemberIdsSync(stateRoot(agent, config)).has(agent.id);
-            const team = currentTeam(agent, config);
-            member ||= team !== undefined && team.captainSessionId !== agent.id;
+            const team = currentTeam(ctx, agent, config);
+            member ||= team !== undefined && !teamLeadMatch(team, leadIdentityOf(ctx, agent.session));
         }
         catch (error) {
             // Unrelated damaged state must not disable ordinary conversation.