@wowyuarm/dsh-agent-team 0.1.15 → 0.2.1

package/packages/agent-team/lib/context-continuity-host.js

@@ -6,9 +6,11 @@
  * Team notices, and how a rollover's durable identity is named).
  *
  * The engine owns every mechanic this module does not state: the idle-boundary
- * swap, carried input, checkpoint continuations, crash repair. Team owns the
- * Member vocabulary and the ledger-backed lifecycle behind
- * {@link TeamContextContinuityOptions.executeTransition}.
+ * swap, carried input, checkpoint continuations, crash repair, and the
+ * context-pressure policy itself. Team owns the Member vocabulary and the
+ * ledger-backed lifecycle behind
+ * {@link TeamContextContinuityOptions.executeTransition}, and the per-Member
+ * readings the pressure policy asks for.
  *
  * The projection state this host hands the coordinator is the engine's own
  * (`ContextProjectionState`), read from the unit `context-projection.ts`
@@ -16,8 +18,9 @@
  * @module @wowyuarm/dsh-agent-team/context-continuity-host
  */
 import { createHash } from 'node:crypto';
-import { ContextContinuityCoordinator, ContextMessageCodec, } from '@wowyuarm/dsh-context-continuity';
+import { ContextContinuityCoordinator, ContextMessageCodec, ContextPressurePolicy, } from '@wowyuarm/dsh-context-continuity';
 import { SessionId as SessionIdBrand } from '@deepseek-ai/dsh-session';
+import z from '@deepseek-ai/schemastery';
 import { AGENT_TEAM_PLUGIN_ID, isAgentTeamSource } from "./context-source.js";
 /**
  * The one writer of context-continuity messages for Team. Section names are
@@ -88,3 +91,194 @@ export class TeamContextContinuityHost {
 export function createTeamContextManagement(options) {
     return new ContextContinuityCoordinator(new TeamContextContinuityHost(options), TEAM_CONTEXT_CODEC);
 }
+/**
+ * Team's wording for the engine's pressure notice: the two labels name work in
+ * Team's own vocabulary, while the numbers, the ordering and the default action
+ * stay the engine's. A label is presentation; the notice's substance is not a
+ * knob.
+ */
+const TEAM_PRESSURE_TEXT = {
+    inHandLabel: 'Active Claims',
+    jobsLabel: 'Owner jobs',
+};
+/** How many of the generation's earlier user inputs one judgement is given. */
+const RECENT_INPUT_LIMIT = 8;
+/**
+ * The long-gap gate as row configuration: every field is optional, so a
+ * deployment states only the thresholds it disagrees with and the engine's own
+ * default answers the rest. The three answer different questions — how large a
+ * context the gate applies to, what counts as a long gap, and how long one
+ * judgement may take before the step proceeds without one — and the last is the
+ * one that decides whether a configured judge is ever heard, because a judge
+ * whose own budget is longer than this deadline never answers in time.
+ *
+ * All three are volatile, and the engine is what makes that safe: it reads
+ * every field at the step it applies to, never at construction, so a Host that
+ * keeps one gate object and refreshes its fields in place changes the policy a
+ * running generation is judged by. `judgeTimeoutMs` is the field that needs it
+ * most — the deadline a judge can answer within is a property of the endpoint,
+ * not of the bundle, and a deployment that discovers its endpoint is slow must
+ * be able to raise it without editing a patch layer and restarting.
+ */
+export const TEAM_PRESSURE_GATE_SCHEMA = z.object({
+    tokens: z.natural().volatile().description('Context size at or above which the long-gap gate may hold a step. Default: 128000.'),
+    idleMs: z.natural().volatile().description('How long a generation must have been idle for a step to count as a long gap. Default: 1800000 (30 minutes).'),
+    judgeTimeoutMs: z.natural().volatile().description("How long one relatedness judgement may take before the step proceeds without one. Default: 10000, not the engine's own 5000."),
+});
+/**
+ * Team's `PressurePolicyHost`. Every member is resolved per Member at call
+ * time, because one policy serves every Member this Host runs. The readings
+ * that need the step's own argument are fed for exactly one policy call —
+ * {@link beginStep} to {@link endStep} — so a judgement is never made from a
+ * neighbour Member's messages.
+ */
+export class TeamPressurePolicyHost {
+    options;
+    pluginId = AGENT_TEAM_PLUGIN_ID;
+    admitting = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    /** Record the input one step is admitting: the host's own pre-step argument. */
+    beginStep(memberId, messages) {
+        this.admitting.set(memberId, messages);
+    }
+    /** Forget that input again: the view lives only while its policy call runs. */
+    endStep(memberId) {
+        this.admitting.delete(memberId);
+    }
+    limitsFor(memberId) {
+        const agent = this.options.agentForMember(memberId);
+        return agent === undefined ? undefined : this.options.limitsForAgent(agent);
+    }
+    /**
+     * The Member's durable surface, for proving a reduction. Without a live Agent
+     * there is nothing to measure; the policy reaches this only for a Member whose
+     * limits resolved, which already requires one.
+     */
+    surfaceFor(memberId) {
+        const agent = this.options.agentForMember(memberId);
+        if (agent === undefined)
+            return { generation: 0 };
+        const tokens = agent.ctx.get('tokenMeter')?.measure(agent.session)?.totalTokens;
+        return { generation: agent.session.surface.replaceGeneration, ...(tokens === undefined ? {} : { tokens }) };
+    }
+    compactionFor(memberId) {
+        const agent = this.options.agentForMember(memberId);
+        return agent === undefined ? undefined : this.options.compactionForAgent(agent);
+    }
+    /**
+     * The Member's durable log, as the notice latch and the idle gap read it. The
+     * engine's contract asks for the span's own events and the inherited count
+     * beside them; the `ownEvents()` reader is what states that boundary today.
+     */
+    logSpanFor(memberId) {
+        const agent = this.options.agentForMember(memberId);
+        if (agent === undefined)
+            return { sessionId: '', inheritedEventCount: 0, events: [] };
+        return { sessionId: agent.session.id, inheritedEventCount: agent.session.inheritedEventCount, events: agent.session.ownEvents() };
+    }
+    inHandFor(memberId) {
+        return {
+            inHand: this.options.activeClaimLabels(memberId),
+            jobs: this.options.runningJobLabels(memberId),
+        };
+    }
+    /**
+     * The input this step is admitting, and the generation's earlier user input
+     * beside it. Both sides exclude Team's own notices: what the gate judges is
+     * what a human sent, and a rederived Team notification is neither the request
+     * being held nor evidence of what the request continues.
+     */
+    relatednessFor(memberId) {
+        const agent = this.options.agentForMember(memberId);
+        const admitted = this.admitting.get(memberId);
+        if (agent === undefined || admitted === undefined)
+            return undefined;
+        const input = externalInputText(admitted);
+        if (input.trim().length === 0)
+            return undefined;
+        return { input, recent: this.recentInput(agent, admitted) };
+    }
+    /**
+     * The generation's earlier human input, oldest first, without the messages
+     * this step is admitting: the judge is asked what the arriving request
+     * continues, so the arriving request is not also part of its own evidence.
+     */
+    recentInput(agent, admitted) {
+        const admittedIds = new Set(admitted.map(message => message.id));
+        return agent.session.deriveMessages()
+            .flatMap(message => message.role === 'user' && !admittedIds.has(message.id) && !isAgentTeamSource(message.source)
+            ? [messageText(message)]
+            : [])
+            .filter(text => text.trim().length > 0)
+            .slice(-RECENT_INPUT_LIMIT);
+    }
+    judgeFor(memberId) {
+        const resolve = this.options.judgeForAgent;
+        const agent = this.options.agentForMember(memberId);
+        if (resolve === undefined || agent === undefined)
+            return undefined;
+        return resolve(agent);
+    }
+    /**
+     * Steer one notice into the Member's running turn. A Member with no live
+     * Agent throws rather than reporting success: the caller holds a step on the
+     * strength of this call, and a held step whose instruction never arrived
+     * would stall the Member behind a message that does not exist.
+     */
+    steer(memberId, notice) {
+        const agent = this.options.agentForMember(memberId);
+        if (agent === undefined)
+            throw new Error('the Member has no live Agent to steer the notice into');
+        agent.steer(notice);
+    }
+    failedFor(memberId, diagnostic) {
+        this.options.failed(memberId, diagnostic);
+    }
+    log(message, memberId) {
+        this.options.log(message, memberId);
+    }
+}
+/**
+ * The engine's context-pressure policy over Team's Member lifecycle: the one
+ * place the two sides meet. It owns no decision of its own — the ordering, the
+ * notice latch, the fail-closed reduction proof and the long-gap gate are all
+ * the engine's — and adds only the step-scoped input view that only the host
+ * can have.
+ */
+export class TeamPressurePolicy {
+    host;
+    policy;
+    constructor(options) {
+        this.host = new TeamPressurePolicyHost(options);
+        this.policy = new ContextPressurePolicy(this.host, TEAM_PRESSURE_TEXT, options.gate);
+    }
+    /** The pre-step decision for one Member, with the input that step claims. */
+    async onPreStep(memberId, messages, signal) {
+        this.host.beginStep(memberId, messages);
+        try {
+            return await this.policy.onPreStep(memberId, signal);
+        }
+        finally {
+            this.host.endStep(memberId);
+        }
+    }
+    onRequestError(memberId, failure, signal) {
+        return this.policy.onRequestError(memberId, failure, signal);
+    }
+    onAssistantMessage(memberId) {
+        this.policy.onAssistantMessage(memberId);
+    }
+    dispose() {
+        this.policy.dispose();
+    }
+}
+/** The text a step is admitting that came from outside Team, in arrival order. */
+function externalInputText(messages) {
+    return messages.flatMap(message => isAgentTeamSource(message.source) ? [] : [messageText(message)]).join('\n');
+}
+/** One message's visible text, blocks in order. */
+function messageText(message) {
+    return message.content.flatMap(block => block.type === 'text' ? [block.text] : []).join('\n');
+}

package/packages/agent-team/lib/context-judge.js

@@ -0,0 +1,150 @@
+/**
+ * Team's relatedness judge: the long-gap gate's `jev` service, mounted by this
+ * bundle when a key resolves and left unmounted when none does.
+ *
+ * The key is the switch, so nothing here decides policy: a key in the Host
+ * row's `jev` config — or in the environment variable that config names —
+ * mounts the service, clearing it unmounts the service, and the gate asks
+ * whatever is mounted. A deployment that mounts its own `jev` row keeps
+ * working, because the judge is read as a service rather than as this mount.
+ *
+ * The mount also carries the one setting the two sides must agree on: jev's own
+ * call budget is derived from the gate's deadline, so a judge can never be
+ * configured to outlive the time the gate gives it — the mismatch that would
+ * otherwise leave every long-gap step ungated without a word.
+ * @module @wowyuarm/dsh-agent-team/context-judge
+ */
+import { DEFAULT_API_KEY_ENV, Jev } from '@wowyuarm/dsh-jev';
+/**
+ * The judge's call budget keeps this much of the gate's deadline for the hop
+ * back: the gate abandons a judgement that outlives its own deadline, so a
+ * judge allowed to use the whole deadline would always be abandoned first.
+ */
+const JUDGE_DEADLINE_MARGIN_MS = 1_000;
+/**
+ * Wait before the judge's second attempt. Pinned rather than inherited from the
+ * service's own default, because it is half of the same budget the deadline
+ * above sizes: a backoff longer than this would spend the gate's remaining time
+ * waiting instead of asking again.
+ */
+const JUDGE_RETRY_DELAY_MS = 500;
+/** The key a row states, or the one the named environment variable holds. */
+function resolvedKey(config, envName) {
+    const stated = config?.apiKey;
+    if (stated !== undefined && stated !== '')
+        return stated;
+    const fromEnv = process.env[envName];
+    return fromEnv === undefined || fromEnv === '' ? undefined : fromEnv;
+}
+/**
+ * The config one mount runs with. Exported because it is the whole contract
+ * between the gate's deadline and the judge's own budget, and a pure function
+ * is what a test can hold still.
+ */
+export function judgeMountConfig(config, key, envName, deadlineMs) {
+    return {
+        apiKey: key,
+        apiKeyEnv: envName,
+        ...(config?.model === undefined ? {} : { model: config.model }),
+        ...(config?.apiBase === undefined ? {} : { apiBase: config.apiBase }),
+        timeoutMs: Math.max(JUDGE_DEADLINE_MARGIN_MS, deadlineMs - JUDGE_DEADLINE_MARGIN_MS),
+        // Two attempts: this call sits on the path that starts a turn, so the
+        // budget stays small — but one transport blip should not cost the step its
+        // gate, which is what a single attempt did. The gate races the whole call
+        // against its deadline anyway, so a second attempt that cannot finish in
+        // time costs the turn nothing beyond what it already spent.
+        attempts: 2,
+        retryDelayMs: JUDGE_RETRY_DELAY_MS,
+    };
+}
+/**
+ * One Host's judge: the service it mounted, the failure that kept one from
+ * mounting, and the reconciliation that keeps the two in step with the row.
+ */
+export class TeamContextJudge {
+    ctx;
+    options;
+    fiber;
+    failure;
+    /** The mount the live fiber runs with, so an unchanged row does not restart it. */
+    mounted;
+    constructor(ctx, options) {
+        this.ctx = ctx;
+        this.options = options;
+    }
+    /**
+     * The judge a step may ask, or undefined when the deployment has none: this
+     * bundle's own mount first, then a service another row mounted.
+     */
+    judge() {
+        return this.fiber?.ctx.get('jev') ?? this.ctx.get('jev');
+    }
+    /** The environment variable this deployment reads the key from. */
+    keyEnv() {
+        const name = this.options.config()?.apiKeyEnv;
+        return name === undefined || name === '' ? DEFAULT_API_KEY_ENV : name;
+    }
+    /** Whether a key is resolvable right now, from the row or from its environment. */
+    key() {
+        return resolvedKey(this.options.config(), this.keyEnv());
+    }
+    /**
+     * Make the mount match the row: mount when a key resolves and none is
+     * mounted, re-configure a live mount whose settings changed, unmount when the
+     * key is gone. Called at init and on every volatile update of the row, so a
+     * key written in the Team settings surface takes effect without a restart.
+     */
+    async sync() {
+        const config = this.options.config();
+        const key = this.key();
+        if (key === undefined) {
+            this.failure = undefined;
+            await this.unmount();
+            return;
+        }
+        const wanted = judgeMountConfig(config, key, this.keyEnv(), this.options.deadlineMs());
+        const signature = JSON.stringify(wanted);
+        if (this.fiber !== undefined && signature === this.mounted)
+            return;
+        if (this.fiber === undefined) {
+            this.fiber = this.ctx.plugin(Jev, wanted);
+            this.mounted = signature;
+        }
+        else {
+            this.mounted = signature;
+            // `update` re-activates the fiber with the new config, and clears a
+            // previous failure, so a corrected endpoint recovers without a restart.
+            this.fiber.update(wanted);
+        }
+        try {
+            await this.fiber.await();
+            this.failure = undefined;
+        }
+        catch (error) {
+            // A rejected key or endpoint is a configuration failure the settings
+            // surface reports: the row keeps what the Human wrote, and the status
+            // says why the judge is not answering.
+            this.failure = error instanceof Error ? error.message : String(error);
+        }
+    }
+    /** Drop this bundle's mount, if it has one. */
+    async unmount() {
+        const fiber = this.fiber;
+        this.fiber = undefined;
+        this.mounted = undefined;
+        if (fiber !== undefined)
+            await fiber.dispose();
+    }
+    /** What the Team settings surface states about the judge. */
+    status() {
+        const keyEnv = this.keyEnv();
+        if (this.judge() !== undefined)
+            return { enabled: true, keyEnv };
+        return {
+            enabled: false,
+            reason: this.key() === undefined ? 'no-key' : 'unavailable',
+            ...(this.failure === undefined ? {} : { detail: this.failure }),
+            keyEnv,
+        };
+    }
+}

package/packages/agent-team/lib/context-source.js

@@ -34,19 +34,24 @@ export const AGENT_TEAM_V3_RENAMED_KIND = `plugin:${AGENT_TEAM_PLUGIN_ID}`;
 /** The kind the read-time conversion renames one producer's released V3 sources into. */
 export const v3RenamedSourceKind = (producer) => `plugin:${producer}`;
 /**
- * Whether one message source carries this plugin's own attribution. Both
- * identities are matched by exact kind equality — never by a `plugin:`
- * prefix test, which would claim third-party producers' rows as Team facts.
+ * Whether one source kind is a producer's own: the kind it writes now and the
+ * read-time conversion of its released V3 history. Both identities are matched
+ * by exact kind equality — never by a `plugin:` prefix test, which would claim
+ * third-party producers' rows as that producer's facts.
  */
+export function matchesProducerKind(kind, producer) {
+    return kind === producer || kind === v3RenamedSourceKind(producer);
+}
+/** Whether one message source carries this plugin's own attribution. */
 export function isAgentTeamSource(source) {
-    return source.kind === AGENT_TEAM_PLUGIN_ID || source.kind === AGENT_TEAM_V3_RENAMED_KIND;
+    return matchesProducerKind(source.kind, AGENT_TEAM_PLUGIN_ID);
 }
 /**
  * Whether one source kind carries this plugin's attribution, for call sites
- * whose sources arrive untyped. Exact identities only, never a prefix test.
+ * whose sources arrive untyped.
  */
 export function isAgentTeamSourceKind(kind) {
-    return kind === AGENT_TEAM_PLUGIN_ID || kind === AGENT_TEAM_V3_RENAMED_KIND;
+    return matchesProducerKind(kind, AGENT_TEAM_PLUGIN_ID);
 }
 /** Handoff snapshot section name carrying the model-authored prose. */
 export const HANDOFF_SECTION_NAME = 'HANDOFF';

package/packages/agent-team/lib/environment-check.js

@@ -0,0 +1,102 @@
+/** The one local environment check: how the running DSH compares to the line this bundle declares. */
+import { evaluatePluginCompatibility, getDshRuntimeVersion } from '@deepseek-ai/dsh-app-boot';
+import { bundleVersionOf, readInstalledManifest } from "./installed-manifest.js";
+/** Prefix of every peer that sits on the DSH version line; the bare scope is not one. */
+const DSH_PEER_PREFIX = '@deepseek-ai/dsh-';
+/** The `>=lower <upper>` shape every DSH peer carries; a comparator series, not a single version. */
+const SUPPORT_RANGE_SHAPE = /^>=(\S+)\s+<(\S+)$/u;
+/**
+ * Read the support line from the installed manifest's DSH peers, or nothing.
+ *
+ * Every `@deepseek-ai/dsh-*` peer must carry exactly the same range, and it must
+ * be a `>=<lower> <upper>` series: the version line is the manifest's own claim
+ * and a partially drifted manifest cannot state one. `scripts/check-version-consistency.mjs`
+ * holds the same shape to the certified baseline, so a run of this bundle
+ * states the same line its README does. Returns `undefined` when the peers
+ * disagree or the shape is unreadable.
+ */
+export function supportRangeOf(manifest) {
+    const fields = manifest;
+    if (typeof fields.peerDependencies !== 'object' || fields.peerDependencies === null)
+        return undefined;
+    const ranges = new Set();
+    for (const [name, range] of Object.entries(fields.peerDependencies)) {
+        if (!name.startsWith(DSH_PEER_PREFIX))
+            continue;
+        if (typeof range !== 'string')
+            return undefined;
+        ranges.add(range);
+    }
+    const distinct = [...ranges];
+    if (distinct.length !== 1)
+        return undefined;
+    const shape = SUPPORT_RANGE_SHAPE.exec(distinct[0]);
+    if (shape === null)
+        return undefined;
+    return Object.freeze({ lower: shape[1], upper: shape[2] });
+}
+/**
+ * Judge one already-resolved triple, so every branch is testable without an
+ * environment. The verdict comes from the Harness's own
+ * `evaluatePluginCompatibility` — the plugin manager decides installability with
+ * that same function, and prerelease ordering is exactly what a hand-written
+ * comparison gets wrong.
+ *
+ * @param manifest - the installed bundle's parsed manifest, the source of the declared support line.
+ * @param runtimeVersion - the running DSH version, or `'unknown'` when it could not be read.
+ * @param bundleVersion - the installed bundle version, or `'unknown'`.
+ * @param unavailable - why the running version is not known, recorded when it is `'unknown'`.
+ * @returns the report the settings page renders.
+ */
+export function evaluateEnvironment(manifest, runtimeVersion, bundleVersion, unavailable) {
+    const range = supportRangeOf(manifest);
+    const base = {
+        bundleVersion,
+        ...(range === undefined ? {} : { certifiedDshVersion: range.lower, supportRange: range }),
+    };
+    if (runtimeVersion === 'unknown') {
+        return Object.freeze({ ...base, verdict: 'undetermined', reason: unavailable ?? 'the running dsh version is unavailable' });
+    }
+    const running = { ...base, dshVersion: runtimeVersion };
+    // A real violation is answered first, and it is never downgraded to
+    // `undetermined`: a peer that drifted to a range of its own is a genuine
+    // "not satisfied" even though no single range can then be stated for the
+    // page. Only when nothing is violated does the question become whether the
+    // declared line can be stated at all.
+    // One evaluation covers every dsh peer in the manifest, and `range` above is
+    // derived from exactly those peers: re-judging the range it prints could not
+    // change this answer.
+    const satisfied = evaluatePluginCompatibility(manifest, {}, runtimeVersion) === undefined;
+    if (!satisfied)
+        return Object.freeze({ ...running, verdict: 'out-of-range' });
+    // Nothing is violated but there is no line to state: the page withholds the
+    // range rather than inventing one.
+    if (range === undefined) {
+        return Object.freeze({ ...base, verdict: 'undetermined', reason: 'the declared dsh support range is unreadable or drifted' });
+    }
+    return Object.freeze({ ...running, verdict: 'ok' });
+}
+/**
+ * Read this Host's own environment: the installed bundle version, the declared
+ * support line, and how the running DSH compares to it.
+ *
+ * The certified DSH version is the range's lower bound, never the newest cut
+ * tested against it: `docs/dsh-release-compatibility.md` §4 records a baseline
+ * inside the declared range without moving the peers, so every version spot
+ * keeps naming the bound. Reading it from anywhere else would reintroduce the
+ * hand-maintained constant this check exists to remove.
+ *
+ * @returns the report, with `verdict: 'undetermined'` for any fact not established.
+ */
+export function reportEnvironment() {
+    const manifest = readInstalledManifest() ?? {};
+    const bundleVersion = bundleVersionOf(manifest);
+    let runtime;
+    try {
+        runtime = getDshRuntimeVersion();
+    }
+    catch (error) {
+        return evaluateEnvironment(manifest, 'unknown', bundleVersion, error instanceof Error ? error.message : String(error));
+    }
+    return evaluateEnvironment(manifest, runtime, bundleVersion);
+}

package/packages/agent-team/lib/human-profile.js

@@ -1,8 +1,6 @@
-import { readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import z from '@deepseek-ai/schemastery';
 import { parse } from 'yaml';
+import { bundleVersionOf, readInstalledManifest } from "./installed-manifest.js";
 /**
  * Human identity profile: the one configurable display name plus the avatar
  * reference. `member:human` stays the durable identity everywhere; only the
@@ -17,6 +15,12 @@ import { parse } from 'yaml';
  * - avatar bytes live under a persistent directory below; the profile holds
  *   only the reference, never a data URL. The composer attachment cache is
  *   TTL-bound and must not hold avatar bytes.
+ *
+ * The legacy-section adoption below is transitional: it exists for installs
+ * upgraded from a pre-rc.1 profile document, and retires — with
+ * `LEGACY_HUMAN_PROFILE_SECTION`, `parseLegacyHumanProfile`, and
+ * `planLegacyAdoption` — once such installs are no longer supported. Nothing
+ * else in the Host reads that document.
  */
 /**
  * Settings namespace of the Human profile: the Team Host row's id in
@@ -33,36 +37,18 @@ export const HUMAN_PROFILE_DEFAULT_NAME = 'human';
 export const HUMAN_PROFILE_REPO_URL = 'https://github.com/wowyuarm/dsh-agent-team';
 /**
  * Bundle version shown in the settings footnote, and the current side of the
- * update check: the version of the package THIS Host runs from — read from the
- * installed manifest, so a `link:` checkout under the development profile and a
- * registry tarball under stable each state their own truth. It is not a
- * hand-maintained string: the 0.1.14 bundle shipped with `0.1.13` written in
- * it, which made the footnote name the previous release and the update check
- * offer the release the user already had.
+ * update check: the version of the package THIS Host runs from — the installed
+ * manifest's, read once at load through `./installed-manifest.ts`, so a `link:`
+ * checkout under the development profile and a registry tarball under stable
+ * each state their own truth. It is not a hand-maintained string: the 0.1.14
+ * bundle shipped with `0.1.13` written in it, which made the footnote name the
+ * previous release and the update check offer the release the user already had.
  *
- * Resolved once at load, three levels above this module — `packages/agent-team/{src,lib}`
- * sits that deep in both layouts, the same relative positioning
- * `member-runtime.ts` uses to find `core-skills`. An unreadable or malformed
- * manifest degrades to `'unknown'`: the Remote's `version: string` contract
- * holds and the update comparison simply compares nothing. The footnote is
- * informational only and never gates behavior.
+ * An unreadable or malformed manifest degrades to `'unknown'`: the Remote's
+ * `version: string` contract holds and the update comparison simply compares
+ * nothing. The footnote is informational only and never gates behavior.
  */
-export const HUMAN_PROFILE_VERSION = readInstalledBundleVersion();
-/** Version of the manifest this package installed from, or `'unknown'`. */
-function readInstalledBundleVersion() {
-    try {
-        const manifestPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../../package.json');
-        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        if (typeof manifest.version === 'string' && manifest.version !== '')
-            return manifest.version;
-    }
-    catch {
-        // Reading our own manifest must never fail the Host boot: a host that
-        // cannot find its own package.json is a broken install, and the footnote
-        // reporting 'unknown' says so more honestly than a stale number.
-    }
-    return 'unknown';
-}
+export const HUMAN_PROFILE_VERSION = bundleVersionOf(readInstalledManifest());
 /**
  * Schemastery schema of the Human profile: the Team Host row's Config. Both
  * fields are volatile, which is what lets an edit reach the running Host
@@ -139,12 +125,12 @@ export function parseLegacyHumanProfile(yamlText) {
  * Decide what adoption may write: nothing unless the stored profile is still
  * the pristine default, so a value the Human re-entered after the upgrade
  * always wins, and never the legacy default name itself. The current profile
- * carries explicit `undefined` on `avatarRef` — the Host getter spreads a
- * settings read — and so is not `HumanProfile` under
- * exactOptionalPropertyTypes; taking that shape directly keeps the Host call
- * cast-free. The returned fields are exactly the ops the profile page would
- * have written; byte existence for `avatarRef` is the caller's I/O and must
- * already hold.
+ * carries explicit `undefined` on `avatarRef` — the Host getter spreads the
+ * live Config read — and that shape does not satisfy the optional-property
+ * form under exactOptionalPropertyTypes; taking it directly keeps the Host
+ * call cast-free. The returned fields are exactly the ops the profile page
+ * would have written; byte existence for `avatarRef` is the caller's I/O and
+ * must already hold.
  */
 export function planLegacyAdoption(current, legacy) {
     if (current.name !== HUMAN_PROFILE_DEFAULT_NAME || current.avatarRef !== undefined)