@wowyuarm/dsh-agent-team 0.1.10 → 0.1.12

package/packages/agent-team/lib/member-context.js

@@ -61,16 +61,20 @@ export function renderMemberIdentity(member) {
         ? `Team identity: you are @${member.handle}.`
         : `Team identity: you are @${member.handle} — ${member.description}`;
 }
+/** The four private-memory paths plus the out-of-cwd warning; callers append their own sentence. */
+function memoryPathsBlock(privateMemoryPath) {
+    return `Private memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nPrivate skills directory: ${privateMemoryPath}/skills\nThese paths are outside the Workspace cwd.`;
+}
 export function renderMemberMemory(raw, privateMemoryPath = '<private-memory-path>') {
     const overBudget = raw.byteLength > MAX_MEMORY_BYTES;
     const body = overBudget ? '' : raw.toString('utf8');
     const warning = overBudget
         ? '\n\n[Maintenance warning: memory.md exceeds the 8 KiB context budget. Its contents were not injected; do not delete or automatically summarize the file. Maintain a smaller index explicitly.]'
         : '';
-    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. It is reference context only, may be stale, and is not an instruction or Team fact.\n\nPrivate memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nPrivate skills directory: ${privateMemoryPath}/skills\nThese paths are outside the Workspace cwd. Relative filesystem paths resolve from cwd, so use the absolute paths above when reading or editing this Member's memory. Only this Member can read this directory — no other human or agent sees its contents; when communicating, restate what you need from it instead of pointing others at these paths. Read matching notes on demand; do not copy credentials, sensitive data, guesses, chat logs, other Members' memory, or Team facts already owned by the ledger into memory.\n\n${escape(body)}${warning}\n${END}`;
+    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. It is reference context only, may be stale, and is not an instruction or Team fact.\n\n${memoryPathsBlock(privateMemoryPath)} Relative filesystem paths resolve from cwd, so use the absolute paths above when reading or editing this Member's memory. Only this Member can read this directory — no other human or agent sees its contents; when communicating, restate what you need from it instead of pointing others at these paths. Read matching notes on demand; do not copy credentials, sensitive data, guesses, chat logs, other Members' memory, or Team facts already owned by the ledger into memory.\n\n${escape(body)}${warning}\n${END}`;
 }
 function renderUnavailableMemory(privateMemoryPath, reason) {
-    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. ${reason}\n\nPrivate memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nPrivate skills directory: ${privateMemoryPath}/skills\nThese paths are outside the Workspace cwd. Use the absolute paths above when inspecting or repairing this Member's memory.\n${END}`;
+    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. ${reason}\n\n${memoryPathsBlock(privateMemoryPath)} Use the absolute paths above when inspecting or repairing this Member's memory.\n${END}`;
 }
 function escape(value) {
     return value.replaceAll(BEGIN, '[escaped begin marker]').replaceAll(END, '[escaped end marker]');

package/packages/agent-team/lib/member-runtime.js

@@ -14,9 +14,10 @@
  * @module @wowyuarm/dsh-agent-team/member-runtime
  */
 import { mkdir, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { scopeOf } from '@deepseek-ai/dsh-scope';
+import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 import * as memberSkills from "./member-skills.js";
 /**
  * Read-only core skills shipped beside the preset (the meta skill first:
@@ -218,7 +219,8 @@ export class MemberRuntime {
      * `privateMemoryPath` is a durable Member fact the renewal path cannot
      * rewrite: when the legacy directory exists it is renamed onto the sanitized
      * path once (same-parent rename, atomic), so existing private memory
-     * survives instead of being silently orphaned.
+     * survives instead of being silently orphaned. A recorded path that names a
+     * different DSH home is never acted on — see `migrateLegacyMemoryDirectory`.
      *
      * A colon-form twin directory is also merged when it exists: a Member may
      * have written files under the ledger identity spelling (the branded
@@ -231,8 +233,14 @@ export class MemberRuntime {
      * and twin-only notes/skills are moved in without overwriting.
      */
     async initializePrivateMemory(path, legacyPath) {
-        if (legacyPath !== undefined && legacyPath !== path)
-            await migrateLegacyMemoryDirectory(legacyPath, path);
+        if (legacyPath !== undefined && legacyPath !== path) {
+            const migration = await migrateLegacyMemoryDirectory(legacyPath, path);
+            // A refusal means the record names a directory in ANOTHER DSH home: this
+            // process provisions the Member fresh here instead of taking that
+            // directory out of its own home.
+            if (migration === 'refused-foreign-home')
+                this.deps.ctx.logger.warn(`agent-team: refused to migrate the recorded Member private memory '${legacyPath}' into '${path}': they are not in the same directory, so the recorded directory names a different DSH home and is left untouched`);
+        }
         const twinPath = twinMemoryDirectoryPath(path);
         if (twinPath !== undefined)
             await mergeTwinMemoryDirectory(twinPath, path);
@@ -250,12 +258,20 @@ export class MemberRuntime {
     async cleanupRemovedMember(member) {
         // The ledger path may still name the legacy colon directory (never
         // activated after the fix): remove both spellings; rm is force-tolerant
-        // of the one that does not exist.
+        // of the one that does not exist. Every target must sit inside THIS
+        // process's members root: the recorded path is a durable absolute fact,
+        // and a process resolving another DSH home (an isolated test home, a
+        // second instance) would otherwise delete the directory that fact names —
+        // the real Member's private memory.
         const sanitized = memberMemoryDirectoryPath(member);
+        const targets = sanitized === member.privateMemoryPath ? [sanitized] : [sanitized, member.privateMemoryPath];
+        const owned = targets.filter(target => isInsideMembersRoot(target));
+        const refused = targets.filter(target => !isInsideMembersRoot(target));
+        if (refused.length > 0)
+            this.deps.ctx.logger.warn(`agent-team: refused to delete recorded Member private memory outside this DSH home: ${refused.map(target => `'${target}'`).join(', ')}`);
         const results = await Promise.allSettled([
             this.deps.ctx.workspaceRegistry.archiveSession(member.sessionId),
-            rm(sanitized, { recursive: true, force: true }),
-            ...(sanitized === member.privateMemoryPath ? [] : [rm(member.privateMemoryPath, { recursive: true, force: true })]),
+            ...owned.map(target => rm(target, { recursive: true, force: true })),
         ]);
         const failures = results.flatMap(result => result.status === 'rejected' ? [result.reason] : []);
         if (failures.length > 0)
@@ -288,6 +304,14 @@ export class MemberRuntime {
  * directory onto its sanitized path. A sanitized target that already exists
  * wins (idempotent across restarts and partially migrated installs); a legacy
  * source that never existed is simply the fresh-install case.
+ *
+ * The rename is confined to one parent directory, which is what the migration
+ * has always meant: the recorded path is a durable absolute fact, so a process
+ * resolving a different DSH home (an isolated test home, a second instance, a
+ * moved home) holds a sanitized target in ITS tree while the record still names
+ * the real one. Renaming across trees would take a Member's whole private
+ * memory out of its home — silently, since only the next session notices an
+ * empty index. Such a source is left exactly where it is.
  */
 async function migrateLegacyMemoryDirectory(legacyPath, path) {
     let legacy;
@@ -296,20 +320,34 @@ async function migrateLegacyMemoryDirectory(legacyPath, path) {
     }
     catch (error) {
         if (error.code === 'ENOENT')
-            return;
+            return 'absent';
         throw error;
     }
     if (!legacy.isDirectory())
         throw new Error(`legacy Member memory path '${legacyPath}' exists but is not a directory`);
+    if (dirname(legacyPath) !== dirname(path))
+        return 'refused-foreign-home';
     try {
         await stat(path);
-        return; // Sanitized directory already present: migration already done or a new install.
+        return 'target-present'; // Sanitized directory already present: migration already done or a new install.
     }
     catch (error) {
         if (error.code !== 'ENOENT')
             throw error;
     }
     await rename(legacyPath, path);
+    return 'migrated';
+}
+/**
+ * Whether one absolute path names a Member directory inside THIS process's
+ * members root. Only such a path is this process's to delete: a recorded path
+ * may name the same Member in another DSH home, where the removal happening
+ * here has no authority.
+ */
+function isInsideMembersRoot(candidate) {
+    const fromRoot = relative(dshHomePath('agent-team', 'members'), resolve(candidate));
+    // '' is the members root itself and '..' escapes it: only a real descendant is authorized.
+    return fromRoot.length > 0 && !fromRoot.startsWith('..') && !isAbsolute(fromRoot);
 }
 /** The colon-form twin path of one sanitized Member memory directory, when the segment form admits one. */
 function twinMemoryDirectoryPath(sanitizedPath) {

package/packages/agent-team/lib/member-time-context.js

@@ -28,6 +28,7 @@
  */
 import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { formatTeamDuration, formatTeamTimestamp } from "./time-format.js";
+import { advanceOwnedSessionEventCursor } from "./session-event-cursor.js";
 export const name = 'wowyuarm-agent-team-member-time-context';
 /** Default minimum spacing between two snapshots within one turn, in ms. */
 export const CLOCK_REFRESH_INTERVAL_MS = 1_800_000;
@@ -90,8 +91,22 @@ export function renderClockSnapshot(input) {
         + `Elapsed since the preceding ${baseline}: ${elapsed}.\n`
         + 'Team collaboration timestamps use UTC+8. Sequence and revision, not wall-clock time, determine ordering and concurrency.';
 }
+/**
+ * The clock baseline folded incrementally over one Session's own events. A
+ * rollover starts a fresh Session log, and the cache below is keyed by Session
+ * id, so the fold never guesses elapsed across generations: a missing prior
+ * event renders `unavailable`, not a fabricated baseline.
+ */
+const CLOCK_FOLD = {
+    start: emptyBaseline(),
+    step: (state, event) => applyClockEvent(state, event),
+};
 export function apply(ctx, config = {}) {
     const refreshIntervalMs = config.refreshIntervalMs ?? CLOCK_REFRESH_INTERVAL_MS;
+    // Per-step fold state, reused for this plugin lifecycle: one entry per
+    // Member, replaced when that Member's Session changes, so a rollover neither
+    // resumes across generations nor retains every generation it leaves behind.
+    const cursors = new Map();
     ctx.on('agent/pre-step', async ({ agent, turn, step, signal }, next) => {
         const decision = await next();
         if (decision.kind === 'reject' || signal.aborted)
@@ -102,13 +117,13 @@ export function apply(ctx, config = {}) {
         const host = ctx.get('agentTeam');
         if (host === undefined)
             return decision;
-        if (host.memberForAgent(agent) === undefined)
+        const member = host.memberForAgent(agent);
+        if (member === undefined)
             return decision;
         const now = Date.now();
-        // A rollover starts a fresh Session log, so the fold never guesses
-        // elapsed across generations: a missing prior event renders
-        // `unavailable`, not a fabricated baseline.
-        const baseline = foldClockBaseline(agent.session.ownEvents());
+        const owned = advanceOwnedSessionEventCursor(cursors.get(member.memberId), agent.session.id, CLOCK_FOLD, agent.session.ownEvents(), agent.session.inheritedEventCount);
+        cursors.set(member.memberId, owned);
+        const baseline = owned.cursor.value;
         // Turn-first-step always samples; later steps sample only at the refresh
         // interval, so a quick tool-dense turn stays at one line.
         if (!shouldSampleClock(step, now, baseline, refreshIntervalMs))

package/packages/agent-team/lib/mentions.js

@@ -0,0 +1,56 @@
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Character ranges the scanner must not read as mentions: fenced code blocks
+ * and inline code spans. Authors quote handles there to talk *about* a name
+ * rather than call it, and resolving those would notify the wrong Member.
+ * The alternation tries the fenced form first so a block is never mistaken for
+ * a run of inline spans.
+ */
+function codeRanges(body) {
+    const ranges = [];
+    for (const match of body.matchAll(/```[\s\S]*?```|`[^`\n]*`/g)) {
+        const start = match.index ?? 0;
+        ranges.push([start, start + match[0].length]);
+    }
+    return ranges;
+}
+const ALL_MARKER = /(?<![\p{L}\p{N}_@])@all(?=$|[^\p{L}\p{N}_])/iu;
+/**
+ * Resolve the `@Handle` mentions authored in one Message body. Matching is
+ * deliberately the same shape the Client renders with — case-insensitive, on
+ * Unicode word boundaries, longest handle first — so a name that renders as a
+ * chip is the same name that delivers a notification.
+ *
+ * Callers pass the candidates reachable in the Message's Channel, so a name
+ * that resolves here is already an addressable target; handles the Channel
+ * cannot reach simply stay prose. Writing `@` is required: bare handles are
+ * ordinary words, and treating them as mentions would notify on every
+ * incidental name-drop.
+ *
+ * `sender` is excluded because a Message never mentions its own author, which
+ * also keeps the result usable as a recipient set without further filtering.
+ */
+export function resolveBodyMentions(body, candidates, sender) {
+    const usable = candidates.filter(candidate => candidate.memberId !== sender && candidate.handle.trim() !== '');
+    const excluded = codeRanges(body);
+    const inCode = (index) => excluded.some(([start, end]) => index >= start && index < end);
+    const allMarker = ALL_MARKER.exec(body);
+    const all = allMarker !== null && !inCode(allMarker.index);
+    if (usable.length === 0)
+        return { memberIds: Object.freeze([]), all };
+    // Longest first so `@Reeves` never resolves as `@Reeve` plus a stray letter.
+    const ordered = [...usable].sort((left, right) => right.handle.length - left.handle.length);
+    const pattern = new RegExp(`(?<![\\p{L}\\p{N}_@])@(?:${ordered.map(candidate => escapeRegExp(candidate.handle)).join('|')})(?=$|[^\\p{L}\\p{N}_])`, 'giu');
+    const matched = new Set();
+    for (const match of body.matchAll(pattern)) {
+        if (inCode(match.index ?? 0))
+            continue;
+        const written = match[0].slice(1).toLowerCase();
+        const hit = ordered.find(candidate => candidate.handle.toLowerCase() === written);
+        if (hit !== undefined)
+            matched.add(hit.memberId);
+    }
+    return { memberIds: Object.freeze(usable.filter(candidate => matched.has(candidate.memberId)).map(candidate => candidate.memberId)), all };
+}

package/packages/agent-team/lib/pressure-policy.js

@@ -18,6 +18,26 @@ import { CONTEXT_WINDOW_EXCEEDED_CODE } from '@deepseek-ai/dsh-llm';
 import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { CONTEXT_PRESSURE_NOTICE_SUMMARY } from "./context-management.js";
 import { AGENT_TEAM_PLUGIN_ID } from "./context-source.js";
+import { advanceOwnedSessionEventCursor } from "./session-event-cursor.js";
+/**
+ * Whether this Session's own span already carries the pressure notice: either
+ * surfaced as a `user/message` or still queued in a durable
+ * `agent/inbox/spliced` insert. Expressed as a fold rather than a scan because
+ * the answer is monotone — once delivered it stays delivered for the
+ * generation — so the cursor only ever has to read events it has not seen.
+ */
+export const PRESSURE_NOTICE_FOLD = {
+    start: false,
+    step: (delivered, event) => {
+        if (delivered)
+            return true;
+        if (event.type === 'user/message' && isPressureNotice(event.data))
+            return true;
+        if (event.type === 'agent/inbox/spliced' && event.data.inserted.some(isPressureNotice))
+            return true;
+        return false;
+    },
+};
 /** One pressure-notice text; concise, structured, and inside the reserve. */
 export function contextPressureNoticeText(input) {
     const claims = input.activeClaims.length === 0 ? 'none' : input.activeClaims.join(', ');
@@ -41,6 +61,14 @@ export class PressurePolicyCoordinator {
      * Process-only by design: a restart re-earns one sequence per chain.
      */
     overflowRetries = new Map();
+    /**
+     * Whether the one-shot notice was already delivered, folded incrementally per
+     * Member. The scan below is a monotone "has this ever happened" fold over the
+     * Session's own events, so a cursor can replace re-scanning the whole log on
+     * every step; identity guarding falls back to a cold fold when the Member's
+     * Session changed under the entry.
+     */
+    noticeSeen = new Map();
     disposed = false;
     constructor(options) {
         this.options = options;
@@ -55,14 +83,10 @@ export class PressurePolicyCoordinator {
      * rollover starts a fresh Session whose own event span has no notice yet,
      * which is exactly the documented re-arm.
      */
-    noticeDelivered(agent) {
-        for (const event of agent.session.ownEvents()) {
-            if (event.type === 'user/message' && isPressureNotice(event.data))
-                return true;
-            if (event.type === 'agent/inbox/spliced' && event.data.inserted.some(isPressureNotice))
-                return true;
-        }
-        return false;
+    noticeDelivered(agent, memberId) {
+        const owned = advanceOwnedSessionEventCursor(this.noticeSeen.get(memberId), agent.session.id, PRESSURE_NOTICE_FOLD, agent.session.ownEvents(), agent.session.inheritedEventCount);
+        this.noticeSeen.set(memberId, owned);
+        return owned.cursor.value;
     }
     dispose() {
         this.disposed = true;
@@ -98,7 +122,7 @@ export class PressurePolicyCoordinator {
             const outcome = await this.enforceHardLimit(agent, member.memberId, member.sessionId, signal);
             return outcome ? { kind: 'continue' } : { kind: 'reject' };
         }
-        if (usageTokens >= handoffAt && !this.noticeDelivered(agent)) {
+        if (usageTokens >= handoffAt && !this.noticeDelivered(agent, member.memberId)) {
             const notice = createUserMessage({
                 content: [{ type: 'text', text: contextPressureNoticeText({
                             usageTokens, handoffAt, hardLimit,

package/packages/agent-team/lib/session-event-cursor.js

@@ -0,0 +1,116 @@
+/**
+ * Incremental Session-log fold with an identity guard.
+ *
+ * Several Host projections are pure left folds over one Member Session's own
+ * events: context intent, the clock baseline, and the one-shot pressure
+ * notice. Folding the whole log on every event makes each of them cost
+ * O(session length) per step, so a long Session gets steadily slower. This
+ * module keeps the fold value together with how far it has consumed the log,
+ * so a step folds only the tail that arrived since — the same idiom the
+ * Harness Session itself uses for its own derived folds.
+ *
+ * The module is deliberately Session-agnostic: it takes a plain event array
+ * plus the log offset that array starts at, so a caller (including a
+ * measurement harness) can drive it without constructing a Session.
+ *
+ * Correctness rests on the log being append-only, which it is: Session logs
+ * have no truncation API, `seq` is the log index, and `seq === log.length` is
+ * a documented contiguity contract. A Session adopts a different log only by
+ * being constructed from another seed, which replaces the whole slice rather
+ * than editing one position.
+ *
+ * The guard covers the observable ways that contract can break: a changed
+ * `logFrom`, a shorter log, a different event type at the anchor. Each
+ * re-folds from `logFrom`, so a fork, resume, or rollover degrades to the cost
+ * of a cold fold and never to a wrong picture.
+ *
+ * Named residual: the guard anchors on `(seq, type)`, so an event replaced in
+ * place by another of the SAME type at the SAME seq is not detected, and the
+ * cursor would keep its old value and fold only the tail. Reaching that state
+ * requires a caller to violate the append-only contract above — reading one
+ * Session's cursor against a log someone rewrote in place. A content-sensitive
+ * anchor would not close it either: only the anchor position is re-read, so a
+ * swap at any earlier folded position passes a boundary digest just as
+ * silently, while costing a payload digest on every advance. Closing it
+ * properly means fingerprinting every folded event, which is the full refold
+ * this module exists to avoid; if the contract ever changes, that is the fix.
+ * @module @wowyuarm/dsh-agent-team/session-event-cursor
+ */
+/**
+ * Open a cursor for a log slice that starts at `logFrom` (a Session's
+ * `inheritedEventCount` for its own events, or 0 for a full log). Nothing is
+ * consumed yet, so the first {@link advanceSessionEventCursor} folds the whole
+ * slice.
+ */
+export function initSessionEventCursor(fold, logFrom = 0) {
+    return { value: fold.start, foldedThrough: logFrom, logFrom, anchor: null };
+}
+/**
+ * Fold the log tail that arrived since the cursor stopped and return the
+ * advanced cursor; the same reference comes back when there is nothing new.
+ *
+ * `events` is the slice starting at `logFrom`, and `logEnd` is the EXCLUSIVE
+ * end offset of that slice in the owning log — the same coordinate space as
+ * `logFrom`, not `events.length`. An inherited Session's own events start at
+ * its `inheritedEventCount`, so for a 14-event log with 10 inherited events
+ * the slice is `events[0..4]` spanning `logFrom = 10` to `logEnd = 14`. This
+ * mirrors the Session's own `snapshotEvents(fromSeq, toSeqExclusive)`.
+ *
+ * Both offsets are passed explicitly rather than read from the cursor so the
+ * caller states the log it is folding, which is also what makes the fallback
+ * below decidable.
+ */
+export function advanceSessionEventCursor(cursor, events, logFrom, logEnd, fold) {
+    if (logEnd !== logFrom + events.length) {
+        // The slice and the log it claims to describe disagree, so the tail it is
+        // missing is indistinguishable from events that were never there. Refuse
+        // rather than fold a shape the caller did not state.
+        throw new RangeError(`session event cursor: ${events.length} events cannot span [${logFrom}, ${logEnd})`);
+    }
+    // Resume only from a position the log can still justify. Every other case
+    // re-folds from `logFrom`: one path handles truncation, a changed fork
+    // prefix, and a rebuilt log alike, so no caller has to classify them.
+    const resumable = cursor.logFrom === logFrom
+        && cursor.foldedThrough >= logFrom
+        && cursor.foldedThrough <= logEnd
+        && (cursor.foldedThrough === logFrom || anchorMatches(cursor, events));
+    const from = resumable ? cursor.foldedThrough : logFrom;
+    if (from === logEnd)
+        return cursor;
+    let value = resumable ? cursor.value : fold.start;
+    for (let index = from; index < logEnd; index += 1)
+        value = fold.step(value, events[index - logFrom]);
+    return { value, foldedThrough: logEnd, logFrom, anchor: anchorOf(events[logEnd - 1 - logFrom]) };
+}
+/**
+ * Whether the event the cursor stopped on still occupies that position with
+ * the type it had. The position is checked as well as the type because `seq`
+ * is a log index: an event that moved is a different event.
+ */
+function anchorMatches(cursor, events) {
+    const anchor = cursor.anchor;
+    if (anchor === null)
+        return false;
+    const seen = events[anchor.seq - cursor.logFrom];
+    return seen !== undefined && seen.seq === anchor.seq && seen.type === anchor.type;
+}
+/** The identity a cursor anchors on when it stops at the last consumed event. */
+function anchorOf(event) {
+    if (event === undefined)
+        return null;
+    return { seq: event.seq, type: event.type };
+}
+/**
+ * Advance one owner's fold and answer with the entry to store back, so every
+ * caller keeps the same one-entry-per-owner invariant.
+ *
+ * `events` is that Session's whole own-events slice starting at `logFrom` (its
+ * `inheritedEventCount`), so the slice's end is the log's end. The cursor is
+ * resumed only while `owned` still belongs to `sessionId`; every other case
+ * starts cold at `logFrom`, which is the same degradation the cursor's own
+ * guard performs for a rewritten log.
+ */
+export function advanceOwnedSessionEventCursor(owned, sessionId, fold, events, logFrom) {
+    const cursor = owned !== undefined && owned.sessionId === sessionId ? owned.cursor : initSessionEventCursor(fold, logFrom);
+    return { sessionId, cursor: advanceSessionEventCursor(cursor, events, logFrom, logFrom + events.length, fold) };
+}

package/packages/agent-team/lib/session-remediation.js

@@ -266,11 +266,6 @@ function physicalParentSession(rows) {
     const parent = rows[0]?.parentSession;
     return typeof parent === 'string' ? parent : undefined;
 }
-/**
- * The startup remediation pass. Never throws to its caller: a failed or
- * partial walk logs and leaves the completion cache unrecorded, so the next
- * start retries exactly the Members that need it.
- */
 export class SessionRemediation {
     ctx;
     persistence;
@@ -303,29 +298,43 @@ export class SessionRemediation {
         for (const member of members) {
             if (member.state !== 'enabled')
                 continue;
-            if (this.cacheStillValid(member))
+            const outcome = await this.remediateMember(member);
+            if (outcome.cacheHit)
                 continue;
             walked += 1;
-            let repairedCount = 0;
-            let untouchedCount = 0;
-            try {
-                const summary = await this.remediateLineage(member);
-                repairedCount = summary.repaired;
-                untouchedCount = summary.untouched;
-            }
-            catch (error) {
-                // Unexpected per-Member failure: log and leave the cache unrecorded.
-                this.ctx.logger.warn(`agent-team: legacy Session remediation for member '${member.handle}' did not complete: ${error instanceof Error ? error.message : String(error)}`);
-                continue;
-            }
-            repaired += repairedCount;
-            untouched += untouchedCount;
-            await this.recordCompletion(member);
+            repaired += outcome.repaired;
+            untouched += outcome.untouched;
         }
         if (walked > 0) {
             this.ctx.logger.info(`agent-team: legacy Session remediation walked ${walked} member lineage(s): ${repaired} artifact(s) repaired, ${untouched} left untouched`);
         }
     }
+    /**
+     * Remediate one Member's lineage; the bounded in-place heal a restart
+     * performs after an activation refused on a session. `completed` with zero
+     * repairs is the deterministic nothing-to-do answer (a finished walk found
+     * nothing provably this plugin's, or the cache already covered the Member);
+     * `completed: false` means the walk itself failed and a later attempt
+     * should retry. Never throws.
+     */
+    async remediateMember(member) {
+        if (member.state !== 'enabled' || this.cacheStillValid(member))
+            return { repaired: 0, untouched: 0, completed: true, cacheHit: true };
+        try {
+            const summary = await this.remediateLineage(member);
+            // A walk that failed a repair is not evidence of a clean lineage: it is
+            // left uncached so the next start retries exactly this Member, and it
+            // reports `completed: false` so no caller reads it as the deterministic
+            // nothing-to-do answer.
+            if (summary.failed === 0)
+                await this.recordCompletion(member);
+            return { repaired: summary.repaired, untouched: summary.untouched, completed: summary.failed === 0, cacheHit: false };
+        }
+        catch (error) {
+            this.ctx.logger.warn(`agent-team: legacy Session remediation for member '${member.handle}' did not complete: ${error instanceof Error ? error.message : String(error)}`);
+            return { repaired: 0, untouched: 0, completed: false, cacheHit: false };
+        }
+    }
     /** Whether the cached walk still covers this Member under the current format. */
     cacheStillValid(member) {
         const record = this.table?.get(member.memberId);
@@ -360,6 +369,7 @@ export class SessionRemediation {
     async remediateLineage(member) {
         let repaired = 0;
         let untouched = 0;
+        let failed = 0;
         const seen = new Set();
         let sessionId = member.sessionId;
         for (let depth = 0; sessionId !== undefined && !seen.has(sessionId) && depth < MAX_LINEAGE_DEPTH; depth += 1) {
@@ -369,9 +379,11 @@ export class SessionRemediation {
                 repaired += 1;
             else if (outcome.status === 'left-untouched')
                 untouched += 1;
+            else if (outcome.status === 'repair-failed')
+                failed += 1;
             sessionId = outcome.parentSession === undefined ? undefined : outcome.parentSession;
         }
-        return { repaired, untouched };
+        return { repaired, untouched, failed };
     }
     /** Remediate one lineage Session: verify readability, and repair when the refusal is this plugin's legacy source shape. */
     async remediateOne(sessionId, member) {
@@ -409,7 +421,7 @@ export class SessionRemediation {
         }
         catch (readError) {
             this.ctx.logger.warn(`agent-team: could not decode the stored artifact of Session '${sessionId}' (${basename(path)}): ${readError instanceof Error ? readError.message : String(readError)}`);
-            return { status: 'left-untouched', parentSession: undefined, reason: 'artifact undecodable' };
+            return { status: 'repair-failed', parentSession: undefined, reason: 'artifact undecodable' };
         }
         const parentSession = physicalParentSession(rows);
         if (!rows.some(row => containsLegacySource(row))) {
@@ -423,7 +435,7 @@ export class SessionRemediation {
         }
         catch (proofError) {
             this.ctx.logger.warn(`agent-team: Session '${sessionId}' of member '${member.handle}' still refuses after the legacy source rewrite (${proofError instanceof Error ? proofError.message : String(proofError)}); leaving it untouched`);
-            return { status: 'left-untouched', parentSession, reason: 'residual refusal after rewrite' };
+            return { status: 'repair-failed', parentSession, reason: 'residual refusal after rewrite' };
         }
         try {
             const published = await this.publishSibling(path, encodeCurrentArtifact(artifact));
@@ -434,7 +446,7 @@ export class SessionRemediation {
         }
         catch (publishError) {
             this.ctx.logger.warn(`agent-team: could not publish the remediated sibling for Session '${sessionId}' (${basename(path)}): ${publishError instanceof Error ? publishError.message : String(publishError)}`);
-            return { status: 'left-untouched', parentSession, reason: 'publish failed' };
+            return { status: 'repair-failed', parentSession, reason: 'publish failed' };
         }
         // Success is proven by the storage layer itself, not by our own writer.
         try {
@@ -448,7 +460,7 @@ export class SessionRemediation {
         }
         catch (verifyError) {
             this.ctx.logger.warn(`agent-team: the remediated sibling for Session '${sessionId}' was published but still refuses: ${verifyError instanceof Error ? verifyError.message : String(verifyError)}`);
-            return { status: 'left-untouched', parentSession, reason: 'sibling refused after publish' };
+            return { status: 'repair-failed', parentSession, reason: 'sibling refused after publish' };
         }
         this.ctx.logger.info(`agent-team: repaired legacy source kinds in Session '${sessionId}' of member '${member.handle}' by publishing a current-format sibling; the original artifact is untouched`);
         return { status: 'repaired', parentSession };