@wowyuarm/dsh-agent-team 0.1.11 → 0.1.13

package/packages/agent-team/lib/member-context.js

@@ -1,4 +1,5 @@
 import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { createUserMessage } from '@deepseek-ai/dsh-llm';
 import { SessionLogOffset } from '@deepseek-ai/dsh-session';
 import { memberMemoryDirectoryPath } from "./member-runtime.js";
@@ -33,7 +34,8 @@ export function apply(ctx) {
                 ? 'memory.md is absent; the private memory index is empty.'
                 : 'memory.md is currently unreadable; do not use any earlier private memory context.');
         }
-        const text = `${renderMemberIdentity(member)}\n\n${memory}`;
+        const workspaces = renderMemberWorkspaces(host.workspacesForAgent(agent));
+        const text = `${renderMemberIdentity(member)}\n\n${memory}${workspaces === '' ? '' : `\n\n${workspaces}`}`;
         const latestText = agent.session.surface.nodes.toReversed().flatMap(sequence => {
             // `nodes` are event identities (SessionSeq); snapshotEvents takes log
             // offsets. Re-entering through the validating constructor keeps the two
@@ -61,6 +63,21 @@ export function renderMemberIdentity(member) {
         ? `Team identity: you are @${member.handle}.`
         : `Team identity: you are @${member.handle} — ${member.description}`;
 }
+/** A current address list, not a copy of instructions from another checkout. */
+export function renderMemberWorkspaces(workspaces) {
+    if (workspaces.length <= 1)
+        return '';
+    return [
+        'Team Workspace participation — this list replaces all earlier participation context.',
+        ...workspaces.map(workspace => `${workspace.workspaceId}${workspace.default ? ' (default; Session cwd)' : ''}: ${workspace.path === undefined
+            ? 'Workspace path unavailable; ask @human before filesystem work.'
+            : `${JSON.stringify(workspace.path)}; instructions: ${JSON.stringify(join(workspace.path, 'AGENTS.md'))}`}`),
+        'Your single Session and cwd stay in the default Workspace. Joining another Workspace does not move them.',
+        'For filesystem work in another Workspace, use absolute paths (or an explicit command cwd). Before working there, read its AGENTS.md and applicable directory instructions yourself; their contents are not injected here.',
+        'Pass workspace explicitly to team_view, team_thread, team_message and team_claim. team_inbox is the cross-Workspace triage entry point.',
+        'If an instruction is ambiguous about which Workspace it concerns, ask @human before acting. Participation does not itself join Channels.',
+    ].join('\n');
+}
 /** The four private-memory paths plus the out-of-cwd warning; callers append their own sentence. */
 function memoryPathsBlock(privateMemoryPath) {
     return `Private memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nPrivate skills directory: ${privateMemoryPath}/skills\nThese paths are outside the Workspace cwd.`;

package/packages/agent-team/lib/member-runtime.js

@@ -14,9 +14,10 @@
  * @module @wowyuarm/dsh-agent-team/member-runtime
  */
 import { mkdir, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { scopeOf } from '@deepseek-ai/dsh-scope';
+import { dshHomePath } from '@deepseek-ai/dsh-home-paths';
 import * as memberSkills from "./member-skills.js";
 /**
  * Read-only core skills shipped beside the preset (the meta skill first:
@@ -218,7 +219,8 @@ export class MemberRuntime {
      * `privateMemoryPath` is a durable Member fact the renewal path cannot
      * rewrite: when the legacy directory exists it is renamed onto the sanitized
      * path once (same-parent rename, atomic), so existing private memory
-     * survives instead of being silently orphaned.
+     * survives instead of being silently orphaned. A recorded path that names a
+     * different DSH home is never acted on — see `migrateLegacyMemoryDirectory`.
      *
      * A colon-form twin directory is also merged when it exists: a Member may
      * have written files under the ledger identity spelling (the branded
@@ -231,8 +233,14 @@ export class MemberRuntime {
      * and twin-only notes/skills are moved in without overwriting.
      */
     async initializePrivateMemory(path, legacyPath) {
-        if (legacyPath !== undefined && legacyPath !== path)
-            await migrateLegacyMemoryDirectory(legacyPath, path);
+        if (legacyPath !== undefined && legacyPath !== path) {
+            const migration = await migrateLegacyMemoryDirectory(legacyPath, path);
+            // A refusal means the record names a directory in ANOTHER DSH home: this
+            // process provisions the Member fresh here instead of taking that
+            // directory out of its own home.
+            if (migration === 'refused-foreign-home')
+                this.deps.ctx.logger.warn(`agent-team: refused to migrate the recorded Member private memory '${legacyPath}' into '${path}': they are not in the same directory, so the recorded directory names a different DSH home and is left untouched`);
+        }
         const twinPath = twinMemoryDirectoryPath(path);
         if (twinPath !== undefined)
             await mergeTwinMemoryDirectory(twinPath, path);
@@ -250,12 +258,20 @@ export class MemberRuntime {
     async cleanupRemovedMember(member) {
         // The ledger path may still name the legacy colon directory (never
         // activated after the fix): remove both spellings; rm is force-tolerant
-        // of the one that does not exist.
+        // of the one that does not exist. Every target must sit inside THIS
+        // process's members root: the recorded path is a durable absolute fact,
+        // and a process resolving another DSH home (an isolated test home, a
+        // second instance) would otherwise delete the directory that fact names —
+        // the real Member's private memory.
         const sanitized = memberMemoryDirectoryPath(member);
+        const targets = sanitized === member.privateMemoryPath ? [sanitized] : [sanitized, member.privateMemoryPath];
+        const owned = targets.filter(target => isInsideMembersRoot(target));
+        const refused = targets.filter(target => !isInsideMembersRoot(target));
+        if (refused.length > 0)
+            this.deps.ctx.logger.warn(`agent-team: refused to delete recorded Member private memory outside this DSH home: ${refused.map(target => `'${target}'`).join(', ')}`);
         const results = await Promise.allSettled([
             this.deps.ctx.workspaceRegistry.archiveSession(member.sessionId),
-            rm(sanitized, { recursive: true, force: true }),
-            ...(sanitized === member.privateMemoryPath ? [] : [rm(member.privateMemoryPath, { recursive: true, force: true })]),
+            ...owned.map(target => rm(target, { recursive: true, force: true })),
         ]);
         const failures = results.flatMap(result => result.status === 'rejected' ? [result.reason] : []);
         if (failures.length > 0)
@@ -288,6 +304,15 @@ export class MemberRuntime {
  * directory onto its sanitized path. A sanitized target that already exists
  * wins (idempotent across restarts and partially migrated installs); a legacy
  * source that never existed is simply the fresh-install case.
+ *
+ * The rename is confined to one parent directory, which is what the migration
+ * has always meant: the recorded path is a durable absolute fact, so a process
+ * resolving a different DSH home (an isolated test home, a second instance, a
+ * moved home) holds a sanitized target in ITS tree while the record still names
+ * the real one. Renaming across trees would take a Member's whole private
+ * memory out of its home — silently, since only the next session notices an
+ * empty index. Such a source is left exactly where it is, and only that
+ * refusal is reported back: every other outcome needs nothing from the caller.
  */
 async function migrateLegacyMemoryDirectory(legacyPath, path) {
     let legacy;
@@ -296,20 +321,34 @@ async function migrateLegacyMemoryDirectory(legacyPath, path) {
     }
     catch (error) {
         if (error.code === 'ENOENT')
-            return;
+            return undefined;
         throw error;
     }
     if (!legacy.isDirectory())
         throw new Error(`legacy Member memory path '${legacyPath}' exists but is not a directory`);
+    if (dirname(legacyPath) !== dirname(path))
+        return 'refused-foreign-home';
     try {
         await stat(path);
-        return; // Sanitized directory already present: migration already done or a new install.
+        return undefined; // Sanitized directory already present: migration already done or a new install.
     }
     catch (error) {
         if (error.code !== 'ENOENT')
             throw error;
     }
     await rename(legacyPath, path);
+    return undefined;
+}
+/**
+ * Whether one absolute path names a Member directory inside THIS process's
+ * members root. Only such a path is this process's to delete: a recorded path
+ * may name the same Member in another DSH home, where the removal happening
+ * here has no authority.
+ */
+function isInsideMembersRoot(candidate) {
+    const fromRoot = relative(dshHomePath('agent-team', 'members'), resolve(candidate));
+    // '' is the members root itself and '..' escapes it: only a real descendant is authorized.
+    return fromRoot.length > 0 && !fromRoot.startsWith('..') && !isAbsolute(fromRoot);
 }
 /** The colon-form twin path of one sanitized Member memory directory, when the segment form admits one. */
 function twinMemoryDirectoryPath(sanitizedPath) {

package/packages/agent-team/lib/mentions.js

@@ -0,0 +1,80 @@
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Character ranges the scanner must not read as mentions: fenced code blocks
+ * and inline code spans. Authors quote handles there to talk *about* a name
+ * rather than call it, and resolving those would notify the wrong Member.
+ * The alternation tries the fenced form first so a block is never mistaken for
+ * a run of inline spans.
+ */
+function codeRanges(body) {
+    const ranges = [];
+    for (const match of body.matchAll(/```[\s\S]*?```|`[^`\n]*`/g)) {
+        const start = match.index ?? 0;
+        ranges.push([start, start + match[0].length]);
+    }
+    return ranges;
+}
+const ALL_MARKER = /(?<![\p{L}\p{N}_@])@all(?=$|[^\p{L}\p{N}_])/iu;
+/** Whether one body carries the `@all` marker outside code. */
+export function hasAllMarker(body) {
+    const excluded = codeRanges(body);
+    const marker = ALL_MARKER.exec(body);
+    return marker !== null && !excluded.some(([start, end]) => marker.index >= start && marker.index < end);
+}
+/**
+ * Every `@Handle` occurrence in one body that names one of `handles`:
+ * case-insensitive, on Unicode word boundaries, longest handle first, outside
+ * code. Writing `@` is required: bare handles are ordinary words. This is the
+ * single definition of an authored mention — the Host delivery resolution and
+ * the Client's chip rendering and draft preview all read through it, so a name
+ * that renders as a chip is the same name that delivers a notification.
+ */
+export function scanBodyHandles(body, handles) {
+    const seen = new Set();
+    const usable = [];
+    for (const handle of handles) {
+        const key = handle.toLowerCase();
+        if (handle.trim() === '' || seen.has(key))
+            continue;
+        seen.add(key);
+        usable.push(handle);
+    }
+    if (usable.length === 0)
+        return Object.freeze([]);
+    const excluded = codeRanges(body);
+    // Longest first so `@Reeves` never resolves as `@Reeve` plus a stray letter.
+    const ordered = [...usable].sort((left, right) => right.length - left.length);
+    const pattern = new RegExp(`(?<![\\p{L}\\p{N}_@])@(?:${ordered.map(handle => escapeRegExp(handle)).join('|')})(?=$|[^\\p{L}\\p{N}_])`, 'giu');
+    const matches = [];
+    for (const match of body.matchAll(pattern)) {
+        const start = match.index ?? 0;
+        if (excluded.some(([rangeStart, rangeEnd]) => start >= rangeStart && start < rangeEnd))
+            continue;
+        const written = match[0].slice(1).toLowerCase();
+        const hit = ordered.find(handle => handle.toLowerCase() === written);
+        if (hit === undefined)
+            continue;
+        matches.push(Object.freeze({ handle: hit, start, end: start + match[0].length }));
+    }
+    return Object.freeze(matches);
+}
+/**
+ * Resolve the `@Handle` mentions authored in one Message body.
+ *
+ * Callers pass the candidates reachable in the Message's Channel, so a name
+ * that resolves here is already an addressable target; handles the Channel
+ * cannot reach simply stay prose.
+ *
+ * `sender` is excluded because a Message never mentions its own author, which
+ * also keeps the result usable as a recipient set without further filtering.
+ */
+export function resolveBodyMentions(body, candidates, sender) {
+    const usable = candidates.filter(candidate => candidate.memberId !== sender && candidate.handle.trim() !== '');
+    const all = hasAllMarker(body);
+    if (usable.length === 0)
+        return { memberIds: Object.freeze([]), all };
+    const matched = new Set(scanBodyHandles(body, usable.map(candidate => candidate.handle)).map(match => match.handle.toLowerCase()));
+    return { memberIds: Object.freeze(usable.filter(candidate => matched.has(candidate.handle.toLowerCase())).map(candidate => candidate.memberId)), all };
+}

package/packages/agent-team/lib/spec.js

@@ -254,6 +254,7 @@ const threadReadSnapshotDataSchema = z.object({
     facts: z.array(readFactSchema),
     readThroughSequence: z.number().int().nonnegative(),
     remainingUnreadCount: z.number().int().nonnegative(),
+    earlierFactCount: z.number().int().nonnegative().optional(),
     attention: attentionSchema.optional(),
     inbox: inboxDeltaSchema,
 }).strict().transform(omitUndefined);
@@ -364,6 +365,25 @@ const storedAgentTeamOperationSchema = z.discriminatedUnion('kind', [
             ...releaseSnapshotFields,
         }).strict(),
     }).strict(),
+    z.object({
+        ...operationBase,
+        previousOperationId: operationIdSchema.nullable(),
+        kind: z.literal('team/member-workspace-joined'),
+        data: z.object({
+            workspaceId: workspaceIdSchema,
+            memberId: memberIdSchema,
+        }).strict(),
+    }).strict(),
+    z.object({
+        ...operationBase,
+        previousOperationId: operationIdSchema.nullable(),
+        kind: z.literal('team/member-workspace-left'),
+        data: z.object({
+            workspaceId: workspaceIdSchema,
+            memberId: memberIdSchema,
+            ...releaseSnapshotFields,
+        }).strict(),
+    }).strict(),
     z.object({
         ...operationBase,
         previousOperationId: operationIdSchema.nullable(),