@wowyuarm/dsh-agent-team 0.1.4 → 0.1.6

package/packages/agent-team/lib/index.js

@@ -41,7 +41,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
 };
 import { randomUUID } from 'node:crypto';
 import { mkdir, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { isDeepStrictEqual } from 'node:util';
 import { Service } from '@deepseek-ai/cordis';
 import { installModelSelection } from '@deepseek-ai/dsh-agent';
@@ -52,8 +53,9 @@ import { SessionId } from '@deepseek-ai/dsh-session';
 import { effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { ATTACHMENT_MAX_BYTES, attachmentPayloadPath, attachmentsRoot, copyPathAttachment, newAttachmentId, readAttachment, sanitizeMediaType, sweepAttachmentCache, validatePathAttachment, writeAttachment } from "./attachments.js";
-import { acceptedTaskCompactionMembers, AutoCompactionCoordinator } from "./auto-compaction.js";
+import { acceptedTaskCompactionMembers, AutoCompactionCoordinator, PRE_COMPACTION_NOTICE_SUMMARY, preCompactionNoticeText } from "./auto-compaction.js";
 import { AGENT_TEAM_HUMAN_MEMBER_ID, AgentTeamLedger, agentTeamHumanActor } from "./ledger.js";
+import * as memberSkills from "./member-skills.js";
 import { classifyRecoverableError, RecoveryCoordinator, RECOVERY_MAX_CONSECUTIVE_ERRORS } from "./recovery.js";
 import { agentTeamDomainSpec } from "./spec.js";
 export { agentTeamDomainSpec, agentTeamOperationSchema } from "./spec.js";
@@ -61,6 +63,13 @@ export { AGENT_TEAM_HUMAN_MEMBER_ID, AGENT_TEAM_INITIALIZE_REQUEST_ID } from "./
 /** Process-stable marker carried by the final Team message tool definition. */
 export const AGENT_TEAM_PRESET_MARKER = Symbol.for('@wowyuarm/dsh-agent-team.preset');
 const AGENT_TEAM_PLUGIN_ID = '@wowyuarm/dsh-agent-team';
+/**
+ * Read-only core skills shipped beside the preset (the meta skill first:
+ * its description routes any skill-management work to itself). Resolved
+ * from this module's emitted location so it follows the installed plugin,
+ * like the preset roster's own root.
+ */
+const BUNDLED_SKILLS_DIRECTORY = resolve(dirname(fileURLToPath(import.meta.url)), '../core-skills');
 const INBOX_NOTICE_SUMMARY = 'Team Inbox has unread work.';
 const RECOVERY_NOTICE_SUMMARY = 'Recovery: continue your interrupted work.';
 const ORPHANED_MEMBER_DIAGNOSTIC = 'Member preset composition was lost after a reload; its tools are unavailable. Resume rebuilds the member in place.';
@@ -73,6 +82,14 @@ function sameChangeScope(left, right) {
         return left.threadRef === right.threadRef;
     return false;
 }
+/** Copy a Remote-supplied capability overlay into owned frozen storage. */
+function deepCopyCapabilities(capabilities) {
+    const copyAllow = (allow) => allow === undefined ? {} : { allow: [...allow] };
+    return {
+        ...(capabilities.tools === undefined ? {} : { tools: copyAllow(capabilities.tools.allow) }),
+        ...(capabilities.skills === undefined ? {} : { skills: copyAllow(capabilities.skills.allow) }),
+    };
+}
 /** Mark the preset's `team_message` definition as an Agent Team consumer. */
 export function markAgentTeamPreset(definition) {
     Object.defineProperty(definition, AGENT_TEAM_PRESET_MARKER, { value: true });
@@ -86,6 +103,22 @@ export const AGENT_TEAM_TOOL_NAMES = Object.freeze([
     'team_claim',
     'team_view',
 ]);
+/**
+ * A DM was durably recorded but its session injection could not run (no live
+ * handle, or the wake itself failed). The recorded DM stays durable; the
+ * sender should not blindly retry — the recipient recovers it through its DM
+ * history once its session is live again.
+ */
+export class AgentTeamDmDeliveryError extends Error {
+    recipientMemberId;
+    recipientHandle;
+    constructor(recipientMemberId, recipientHandle, message) {
+        super(message);
+        this.recipientMemberId = recipientMemberId;
+        this.recipientHandle = recipientHandle;
+        this.name = 'AgentTeamDmDeliveryError';
+    }
+}
 let AgentTeam = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
@@ -96,6 +129,7 @@ let AgentTeam = (() => {
     let _updateChannel_decorators;
     let _addMember_decorators;
     let _recoverMember_decorators;
+    let _clearMemberContext_decorators;
     let _updateMember_decorators;
     let _changeTask_decorators;
     let _promoteThread_decorators;
@@ -121,6 +155,7 @@ let AgentTeam = (() => {
             _updateChannel_decorators = [Remote('updateChannel')];
             _addMember_decorators = [Remote('addMember')];
             _recoverMember_decorators = [Remote('recoverMember')];
+            _clearMemberContext_decorators = [Remote('clearMemberContext')];
             _updateMember_decorators = [Remote('updateMember')];
             _changeTask_decorators = [Remote('changeTask')];
             _promoteThread_decorators = [Remote('promoteThread')];
@@ -143,6 +178,7 @@ let AgentTeam = (() => {
             __esDecorate(this, null, _updateChannel_decorators, { kind: "method", name: "updateChannel", static: false, private: false, access: { has: obj => "updateChannel" in obj, get: obj => obj.updateChannel }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _addMember_decorators, { kind: "method", name: "addMember", static: false, private: false, access: { has: obj => "addMember" in obj, get: obj => obj.addMember }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _recoverMember_decorators, { kind: "method", name: "recoverMember", static: false, private: false, access: { has: obj => "recoverMember" in obj, get: obj => obj.recoverMember }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _clearMemberContext_decorators, { kind: "method", name: "clearMemberContext", static: false, private: false, access: { has: obj => "clearMemberContext" in obj, get: obj => obj.clearMemberContext }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _updateMember_decorators, { kind: "method", name: "updateMember", static: false, private: false, access: { has: obj => "updateMember" in obj, get: obj => obj.updateMember }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _changeTask_decorators, { kind: "method", name: "changeTask", static: false, private: false, access: { has: obj => "changeTask" in obj, get: obj => obj.changeTask }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _promoteThread_decorators, { kind: "method", name: "promoteThread", static: false, private: false, access: { has: obj => "promoteThread" in obj, get: obj => obj.promoteThread }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -174,6 +210,10 @@ let AgentTeam = (() => {
         handles = new Map();
         /** Live selection refs let model edits take effect without disposing the Session. */
         modelSelections = new Map();
+        /** Live skill selection refs let capability edits re-filter the catalog without disposing the Session. */
+        skillSelections = new Map();
+        /** Per-Member private skill provider disposers; released with the Member's agent scope. */
+        skillProviderDisposals = new Map();
         /**
          * Why one Member shows error presence, per failure source. Reads prefer
          * activation, then runtime, then compaction; slots clear independently, so
@@ -182,6 +222,20 @@ let AgentTeam = (() => {
          * stale keys.
          */
         memberFailures = new Map();
+        /**
+         * Live per-Member tool restriction disposers, mirroring modelSelections:
+         * activation registers, disposal paths release, edits swap at a turn
+         * boundary. Deliberate interface reservation: the restriction seam is the
+         * primitive future Runtime Revision manifests orchestrate — do not remove
+         * during cleanup.
+         */
+        memberRestrictions = new Map();
+        /**
+         * Runtime-derived capability warnings, recomputed at every activation (like
+         * memberFailures, keyed by Member and never persisted): persisted warnings
+         * would lie after a Host restart or a Harness upgrade renames tools.
+         */
+        capabilityWarnings = new Map();
         autoCompaction;
         /** Agent ids with a turn in flight; restarts must wait for the boundary. */
         runningAgents = new Set();
@@ -216,6 +270,14 @@ let AgentTeam = (() => {
                     this.emitAutoCompactionChanged(memberId);
                 },
                 log: message => { this.ctx.logger.warn(`agent-team: ${message}`); },
+                // Advisory only: the Agent decides whether anything is worth persisting.
+                steerPreCompaction: agent => {
+                    const hint = createUserMessage({
+                        content: [{ type: 'text', text: preCompactionNoticeText() }],
+                        source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: PRE_COMPACTION_NOTICE_SUMMARY },
+                    });
+                    agent.steer(hint);
+                },
             });
         }
         /** Open the durable ledger and restore every enabled Member independently. */
@@ -246,8 +308,15 @@ let AgentTeam = (() => {
                     this.notifyMember(agent);
                 }
                 // A turn that ends without an error closes any automatic recovery episode.
-                if (status === 'idle' && member !== undefined && this.memberFailures.get(member.memberId)?.runtime === undefined) {
-                    this.recovery.onCleanTurnEnd(member.memberId);
+                // The idle transition is itself presence-affecting (working → available),
+                // so it must wake workspace watchers exactly like the running transition
+                // above; without this wake, cached Client member rows keep showing the
+                // Member as working after every turn until an unrelated change arrives.
+                if (status === 'idle' && member !== undefined) {
+                    if (this.memberFailures.get(member.memberId)?.runtime === undefined) {
+                        this.recovery.onCleanTurnEnd(member.memberId);
+                    }
+                    this.emitChanged([{ kind: 'workspace', workspaceId: member.workspaceId }]);
                 }
             });
             const domain = await this.ctx.storageDomain.open(agentTeamDomainSpec);
@@ -263,6 +332,14 @@ let AgentTeam = (() => {
                 await Promise.all([...this.handles.values()].map(handle => handle.dispose()));
                 this.handles.clear();
                 this.modelSelections.clear();
+                this.skillSelections.clear();
+                for (const dispose of this.skillProviderDisposals.values())
+                    dispose();
+                this.skillProviderDisposals.clear();
+                for (const dispose of this.memberRestrictions.values())
+                    dispose();
+                this.memberRestrictions.clear();
+                this.capabilityWarnings.clear();
                 this.runningAgents.clear();
                 await domain.close();
             }, 'agentTeam.dispose');
@@ -395,6 +472,7 @@ let AgentTeam = (() => {
                     description: request.description,
                     presetId: request.presetId,
                     ...(request.model === undefined ? {} : { model: Object.freeze({ ...request.model }) }),
+                    ...(request.capabilities === undefined ? {} : { capabilities: Object.freeze(deepCopyCapabilities(request.capabilities)) }),
                     privateMemoryPath: dshHomePath('agent-team', 'members', memberId),
                     state: 'enabled',
                 });
@@ -463,6 +541,69 @@ let AgentTeam = (() => {
             this.steerResume(member, this.manualResumeText());
             return Object.freeze({ status: this.memberStatus(member) });
         }
+        /**
+         * Start one enabled Member from a new context: dispose the live handle,
+         * archive the previous Session (its log stays on disk for history), and
+         * activate a fresh Session under a new sessionId, so preset, tools, private
+         * memory, and model selection all reload while the next turn carries no
+         * history. The durable operation moves the Member's sessionId; identity,
+         * memory path, and binding survive. A new id is what keeps the Web Client
+         * seat live: a disposed generation's resident instance keeps its `removed`
+         * bit forever, so renewing under the same id would leave a permanently
+         * grayed session view.
+         */
+        async clearMemberContext(request) {
+            return this.enqueueLifecycle(async () => {
+                this.requireAccepting();
+                this.requireWorkspace(request.workspaceId);
+                const stored = this.requireLedger().getMember(request.memberId);
+                if (stored === undefined || stored.workspaceId !== request.workspaceId)
+                    throw new Error(`unknown Member '${request.memberId}' in workspace '${request.workspaceId}'`);
+                if (stored.state !== 'enabled')
+                    throw new Error(`Agent Member '${stored.handle}' is ${stored.state}; only enabled Members can start from a new context`);
+                const active = this.handles.get(request.memberId);
+                if (active === undefined)
+                    throw new Error(`Agent Member '${stored.handle}' has no active session to clear`);
+                if (this.runningAgents.has(active.agent.id))
+                    throw new Error(`Agent Member '${stored.handle}' is still running; wait for the current turn to end before starting from a new context`);
+                const previousSessionId = stored.sessionId;
+                // The fresh id derives from the requestId, so a retried identical
+                // request mints the same id and the ledger dedupes it instead of
+                // colliding; the format matches addMember's `agent-team-<uuid>`.
+                const sessionId = SessionId(`agent-team-${request.requestId}`);
+                const result = await this.requireLedger().renewMemberSession({ ...request, sessionId, actor: agentTeamHumanActor() });
+                if (result.committed)
+                    this.emitCommitted(result.value.receipt);
+                else {
+                    // A retried identical request already renewed this Member; report the
+                    // recorded outcome without another dispose/reactivate cycle.
+                    return Object.freeze({ receipt: result.value.receipt, status: this.memberStatus(result.value.member) });
+                }
+                const renewed = result.value.member;
+                // Drop the old handle's transient state: pending recovery episodes and
+                // error markers belong to the disposed agent, not to the Member.
+                this.recovery.stopTracking(request.memberId);
+                await active.dispose();
+                this.handles.delete(request.memberId);
+                this.modelSelections.delete(request.memberId);
+                this.skillSelections.delete(request.memberId);
+                this.releaseMemberToolPolicy(request.memberId);
+                this.releaseMemberSkillProvider(request.memberId);
+                this.clearMemberFailure(request.memberId, 'activation');
+                this.clearMemberNotificationState(request.memberId);
+                // The previous log survives on disk; archiving hides it from every
+                // grouping surface so one Member keeps exactly one visible Session.
+                await this.ctx.workspaceRegistry.archiveSession(previousSessionId);
+                await this.activateMember(renewed, undefined, undefined, previousSessionId);
+                const reactivated = this.handles.get(request.memberId);
+                if (reactivated === undefined) {
+                    // Reactivation failed; the activation diagnostic carries the reason and
+                    // the durable renewal stays honest about the attempt.
+                    throw new Error(`Agent Member '${stored.handle}' failed to start a new context: ${this.memberFailures.get(request.memberId)?.activation ?? 'unknown error'}`);
+                }
+                return Object.freeze({ receipt: result.value.receipt, status: this.memberStatus(renewed) });
+            });
+        }
         /** Ledger handle for log lines; falls back to the raw id when unknown. */
         memberLabel(memberId) {
             return this.ledger?.getMember(memberId)?.handle ?? memberId;
@@ -538,9 +679,55 @@ let AgentTeam = (() => {
                         throw new Error(`Agent Member '${stored.handle}' has no live model selection`);
                     selection.current = stored.model ?? this.ctx.agentDefaultModel.currentSelection();
                 }
+                if (active !== undefined && !isDeepStrictEqual(previous?.capabilities ?? undefined, stored.capabilities ?? undefined)) {
+                    await this.applyCapabilityEdit(active, stored);
+                }
                 return Object.freeze({ receipt: result.value.receipt, status: this.memberStatus(stored) });
             });
         }
+        /**
+         * Live-apply a capability edit at a turn boundary: while the Agent runs, the
+         * current turn keeps its schemas and catalog; the swap happens once idle,
+         * so the next step recomputes schemas from the new restriction and the
+         * durable replacement skill catalog from the new selection, with the same
+         * Session and history surviving. Suspend/remove during the wait cancels
+         * the swap — the disposed handle released the old restriction already and
+         * no disposer leaks.
+         */
+        async applyCapabilityEdit(active, stored) {
+            const memberId = stored.memberId;
+            if (this.runningAgents.has(active.agent.id)) {
+                await new Promise(resolve => {
+                    const disposers = [];
+                    const settle = () => {
+                        for (const dispose of disposers.splice(0))
+                            dispose();
+                        resolve();
+                    };
+                    disposers.push(this.ctx.on('agent/status', (payload) => {
+                        if (payload.agent !== active.agent)
+                            return;
+                        // A turn that ends — clean idle or error — is the boundary; the
+                        // next step recomputes schemas from the new restriction.
+                        if (payload.status !== 'running')
+                            settle();
+                    }), 
+                    // Disposal (suspend/remove/reactivation) resolves the wait: the old
+                    // restriction went with the disposed scope, so only the ledger
+                    // intent remains to apply at the next activation.
+                    this.ctx.on('session/disposed', (session) => {
+                        if (session.id === active.agent.session.id)
+                            settle();
+                    }));
+                });
+                if (this.handles.get(memberId) !== active)
+                    return;
+            }
+            this.reapplyMemberToolPolicy(stored);
+            const skillSelection = this.skillSelections.get(memberId);
+            if (skillSelection !== undefined)
+                skillSelection.swap(stored.capabilities?.skills?.allow);
+        }
         /** Irreversibly remove one Member, archive its Session, and delete its private namespace. */
         async removeMember(request) {
             return this.enqueueLifecycle(async () => {
@@ -735,6 +922,49 @@ let AgentTeam = (() => {
                 this.emitCommitted(result.value.receipt);
             return result.value;
         }
+        /**
+         * Agent-only direct message: append the audit-only dm-sent operation, then
+         * inject the body into the recipient's live session. The ledger commit is
+         * the durable fact; the injection is a transient runtime effect, so a
+         * missing handle or a failed wake returns a structured delivery error while
+         * the recorded DM stays durable for the recipient's recovery path.
+         */
+        async dmForAgent(agent, request) {
+            const actor = this.memberCall(agent, request.workspaceId);
+            const result = await this.requireLedger().sendDm({ ...request, actor });
+            if (!result.committed)
+                return result.value;
+            this.emitCommitted(result.value.receipt);
+            const recipient = result.value.recipient;
+            const handle = this.handles.get(recipient.memberId);
+            if (handle === undefined) {
+                throw new AgentTeamDmDeliveryError(recipient.memberId, recipient.handle, `DM recorded but not delivered: Agent Member '${recipient.handle}' has no live session; it will find the message in its DM history after recovery`);
+            }
+            try {
+                const message = createUserMessage({
+                    content: [{ type: 'text', text: this.dmRelayText(agent, recipient, request.body.trim(), result.value.receipt.operationId) }],
+                    source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'relay' },
+                });
+                // An idle recipient gets one ordinary turn; a busy one is steered into
+                // its current turn — the same wake split subagent continuations use.
+                if (handle.agent.status === 'idle')
+                    handle.agent.followup(message);
+                else
+                    handle.agent.steer(message);
+            }
+            catch (error) {
+                throw new AgentTeamDmDeliveryError(recipient.memberId, recipient.handle, `DM recorded but not delivered: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            return result.value;
+        }
+        /** Relay body: the DM itself plus one bounded line of adjacent context. */
+        dmRelayText(senderAgent, recipient, body, excluding) {
+            const sender = this.memberForAgent(senderAgent);
+            const prior = this.requireLedger().dmHistoryBetween(senderAgent.id, recipient.memberId, excluding);
+            const header = `Direct message from @${sender?.handle ?? 'a Team Member'}:`;
+            const context = prior === undefined ? '' : `\n\n[most recent prior DM between you: ${prior}]`;
+            return `${header}\n\n${body}${context}`;
+        }
         threadHistoryForAgent(agent, request) {
             const actor = this.memberActor(agent);
             this.requireAgentWorkspace(actor, request.workspaceId);
@@ -831,7 +1061,7 @@ let AgentTeam = (() => {
                     throw error;
             }
         }
-        async activateMember(member, knownWorkspacePath, knownSessions) {
+        async activateMember(member, knownWorkspacePath, knownSessions, forkedFrom) {
             if (this.handles.has(member.memberId))
                 return;
             let created;
@@ -847,8 +1077,13 @@ let AgentTeam = (() => {
                 const selection = member.model ?? this.ctx.agentDefaultModel.currentSelection();
                 const agentOptions = { provider: selection.provider, model: selection.model };
                 const selected = { current: selection, assembled: undefined };
+                // Absent skills.allow loads every discovered private skill; a present
+                // allow-list filters the catalog by name through the live ref below.
+                // `swap` is bound by the provider at activation (no-op until then).
+                const skillSelection = { current: member.capabilities?.skills?.allow, swap: () => { } };
                 const setup = async (agentCtx) => {
                     await this.ctx.agentPresets.mount(agentCtx, member.presetId);
+                    this.applyMemberToolPolicy(agentCtx, member);
                     this.validateMemberPreset(agentCtx);
                     installModelSelection(agentCtx, selected);
                     return {
@@ -865,13 +1100,25 @@ let AgentTeam = (() => {
                     ? await this.ctx.agents.resume({ resumeSessionId: member.sessionId, agentOptions, setup })
                     : await this.ctx.agents.create({
                         sessionId: member.sessionId,
-                        meta: { cwd: workspacePath, agentPreset: member.presetId },
+                        // A context renewal records its fork lineage so the archived
+                        // previous Session stays discoverable from the durable header.
+                        meta: { cwd: workspacePath, agentPreset: member.presetId, ...(forkedFrom === undefined ? {} : { parentSession: forkedFrom }) },
                         agentOptions,
                         setup,
                     });
+                // The Member-private skill provider registers on the created agent's
+                // exact scope layer (the traceable-service seam, like the tool
+                // restriction): bundled read-only core skills plus this Member's own
+                // private directory.
+                this.skillProviderDisposals.set(member.memberId, memberSkills.mountMemberSkillProvider(created.agent.ctx, {
+                    skillsDirectory: join(member.privateMemoryPath, 'skills'),
+                    bundledSkillsDirectory: BUNDLED_SKILLS_DIRECTORY,
+                    selection: skillSelection,
+                }));
                 await workspace.attachSession(member.sessionId);
                 this.handles.set(member.memberId, created);
                 this.modelSelections.set(member.memberId, selected);
+                this.skillSelections.set(member.memberId, skillSelection);
                 this.clearMemberFailure(member.memberId, 'activation');
                 this.nameMemberSession(member, created.agent);
                 this.notifyMember(created.agent);
@@ -880,6 +1127,9 @@ let AgentTeam = (() => {
             catch (error) {
                 await created?.dispose();
                 this.modelSelections.delete(member.memberId);
+                this.skillSelections.delete(member.memberId);
+                this.releaseMemberToolPolicy(member.memberId);
+                this.releaseMemberSkillProvider(member.memberId);
                 this.setMemberFailure(member.memberId, 'activation', error instanceof Error ? error.message : String(error));
             }
             finally {
@@ -906,6 +1156,9 @@ let AgentTeam = (() => {
                 if (stale !== undefined) {
                     this.handles.delete(memberId);
                     this.modelSelections.delete(memberId);
+                    this.skillSelections.delete(memberId);
+                    this.releaseMemberToolPolicy(memberId);
+                    this.releaseMemberSkillProvider(memberId);
                     // The composition-loss diagnostic this heal answers is stale once the
                     // rebuild starts; a later activation must not resurface it.
                     this.clearMemberFailure(memberId, 'compaction');
@@ -946,8 +1199,79 @@ let AgentTeam = (() => {
             if (missing.length > 0)
                 throw new Error(`team-enabled preset is missing tools: ${missing.join(', ')}`);
         }
+        /**
+         * Apply one Member's persisted tool allow-list as a scoped restriction on
+         * the freshly composed preset surface, and derive activation-time warnings
+         * for entries the current tool surface no longer knows. Runs inside setup
+         * BEFORE validateMemberPreset so the validation observes the restricted
+         * view (the Host always unions the five Team tools over the configured
+         * list). Deliberate interface reservation: this restriction seam is the
+         * primitive future Runtime Revision manifests orchestrate — do not remove
+         * during cleanup.
+         */
+        applyMemberToolPolicy(agentCtx, member) {
+            const scope = scopeOf(agentCtx);
+            const configured = member.capabilities?.tools?.allow;
+            if (configured === undefined) {
+                this.capabilityWarnings.delete(member.memberId);
+                return;
+            }
+            // Drop names the current surface does not know rather than failing the
+            // activation: a Harness upgrade renaming a tool must not make the Member
+            // unavailable. The warning carries the known-name digest so a distant
+            // future reader can diagnose the drift.
+            const known = this.ctx.tools.schemas(scope).map(tool => tool.name);
+            const knownSet = new Set(known);
+            const dropped = configured.filter(name => !knownSet.has(name));
+            this.setCapabilityWarnings(member.memberId, dropped.map(name => ({ name, knownNames: known })));
+            const allow = [...new Set([...configured.filter(name => knownSet.has(name)), ...AGENT_TEAM_TOOL_NAMES])];
+            if (allow.length === 0)
+                return;
+            // tools.restrict() requires a scoped context and rejects names outside
+            // the inherited surface; both errors surface as this Member's activation
+            // failure without touching any other Member.
+            const dispose = agentCtx.tools.restrict({ allow });
+            this.memberRestrictions.set(member.memberId, dispose);
+        }
+        /** Swap a live Member's tool policy at a turn boundary: dispose the old restriction, apply the new. */
+        reapplyMemberToolPolicy(member) {
+            this.releaseMemberToolPolicy(member.memberId);
+            this.applyMemberToolPolicy(this.requireLiveMemberContext(member.memberId), member);
+        }
+        requireLiveMemberContext(memberId) {
+            const handle = this.handles.get(memberId);
+            if (handle === undefined)
+                throw new Error(`Agent Member '${this.memberLabel(memberId)}' has no live session for a tool-policy update`);
+            return handle.agent.ctx;
+        }
+        /** Release one Member's restriction disposer and warning state; safe to call twice. */
+        releaseMemberToolPolicy(memberId) {
+            const dispose = this.memberRestrictions.get(memberId);
+            if (dispose !== undefined) {
+                this.memberRestrictions.delete(memberId);
+                dispose();
+            }
+            this.capabilityWarnings.delete(memberId);
+        }
+        /** Release one Member's private skill provider; safe to call twice. */
+        releaseMemberSkillProvider(memberId) {
+            const dispose = this.skillProviderDisposals.get(memberId);
+            if (dispose === undefined)
+                return;
+            this.skillProviderDisposals.delete(memberId);
+            dispose();
+        }
+        setCapabilityWarnings(memberId, warnings) {
+            if (warnings.length === 0)
+                this.capabilityWarnings.delete(memberId);
+            else
+                this.capabilityWarnings.set(memberId, Object.freeze([...warnings]));
+        }
         async initializePrivateMemory(path) {
             await mkdir(join(path, 'notes'), { recursive: true });
+            // The Member-private skills directory starts empty; the per-Member
+            // provider scans exactly this root (default roots excluded).
+            await mkdir(join(path, 'skills'), { recursive: true });
             try {
                 await writeFile(join(path, 'memory.md'), '# Member memory\n\n## Stable facts\n- Add only verified, durable facts that help future work.\n\n## Notes index\n- Add focused `notes/*.md` entries here when a reusable detail needs on-demand reading.\n', { flag: 'wx' });
             }
@@ -982,7 +1306,13 @@ let AgentTeam = (() => {
             const runtimeError = failures?.runtime ?? failures?.compaction;
             if (runtimeError !== undefined)
                 return Object.freeze({ member, availability: 'active', presence: 'error', diagnostic: runtimeError });
-            return Object.freeze({ member, availability: 'active', presence: handle.agent.status === 'running' ? 'working' : 'available' });
+            // Capability warnings are runtime-derived at activation (handles-scoped,
+            // like failures): absent while capabilities resolve cleanly.
+            const capabilityWarnings = this.capabilityWarnings.get(member.memberId);
+            return Object.freeze({
+                member, availability: 'active', presence: handle.agent.status === 'running' ? 'working' : 'available',
+                ...(capabilityWarnings === undefined ? {} : { capabilityWarnings }),
+            });
         }
         setMemberFailure(memberId, slot, message) {
             const failures = this.memberFailures.get(memberId) ?? {};
@@ -1167,6 +1497,9 @@ let AgentTeam = (() => {
                 this.handles.delete(memberId);
             }
             this.modelSelections.delete(memberId);
+            this.skillSelections.delete(memberId);
+            this.releaseMemberToolPolicy(memberId);
+            this.releaseMemberSkillProvider(memberId);
             this.clearMemberFailure(memberId, 'activation');
         }
         clearMemberRecoveryState(member) {