@wowyuarm/dsh-agent-team 0.1.4 → 0.1.6

package/packages/agent-team/lib/ledger.js

@@ -23,6 +23,18 @@ function emptyProjection() {
 function assertUnhandledKind(operation) {
     throw new Error(`agent-team ledger does not handle operation kind '${operation.kind}'`);
 }
+/** Deep-freeze a Member capability overlay; absent stays absent. */
+function freezeCapabilities(capabilities) {
+    if (capabilities === undefined)
+        return {};
+    const freezeAllow = (allow) => allow === undefined ? {} : { allow: Object.freeze([...allow]) };
+    return {
+        capabilities: Object.freeze({
+            ...(capabilities.tools === undefined ? {} : { tools: Object.freeze(freezeAllow(capabilities.tools.allow)) }),
+            ...(capabilities.skills === undefined ? {} : { skills: Object.freeze(freezeAllow(capabilities.skills.allow)) }),
+        }),
+    };
+}
 /** Replay and append logic behind the Agent Team service interface. */
 export class AgentTeamLedger {
     table;
@@ -141,9 +153,11 @@ export class AgentTeamLedger {
                 this.requireChannel(request.workspaceId, channelRef);
             this.assertHandleAvailable(request.workspaceId, handle);
             this.assertModelSelection(request.member.model);
+            this.assertCapabilities(request.member.capabilities);
             const member = Object.freeze({
                 ...request.member, handle, description, presetId, state: 'enabled',
                 ...(request.member.model === undefined ? {} : { model: Object.freeze({ ...request.member.model }) }),
+                ...freezeCapabilities(request.member.capabilities),
             });
             const operation = Object.freeze({
                 ...this.operationBase(request, this.nextSequence()), kind: 'team/member-added',
@@ -173,12 +187,15 @@ export class AgentTeamLedger {
             if (handle !== prior.handle)
                 this.assertHandleAvailable(prior.workspaceId, handle, prior.memberId);
             this.assertModelSelection(request.model);
-            // An absent model must CLEAR any override (inherit the Host default);
-            // spreading `prior` verbatim would silently keep the pinned selection.
-            const { model: _priorModel, ...priorWithoutModel } = prior;
+            this.assertCapabilities(request.capabilities);
+            // An absent model or capabilities field must CLEAR any override
+            // (inherit the Host default / full standard capability surface);
+            // spreading `prior` verbatim would silently keep the pinned value.
+            const { model: _priorModel, capabilities: _priorCapabilities, ...priorWithoutOverlays } = prior;
             const member = Object.freeze({
-                ...priorWithoutModel, handle, description,
+                ...priorWithoutOverlays, handle, description,
                 ...(request.model === undefined ? {} : { model: Object.freeze({ ...request.model }) }),
+                ...freezeCapabilities(request.capabilities),
             });
             const operation = Object.freeze({
                 ...this.operationBase(request, this.nextSequence()), kind: 'team/member-updated',
@@ -195,6 +212,35 @@ export class AgentTeamLedger {
     resumeMember(request) {
         return this.setMemberState(request, 'enabled');
     }
+    /**
+     * Move one enabled Member onto a fresh Session: the durable operation
+     * records the sessionId transition while identity, memory, and binding
+     * survive. The Host disposes the old handle and archives the previous
+     * Session log around this write, so the next turn starts empty.
+     */
+    renewMemberSession(request) {
+        return this.enqueue(async () => {
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameMemberSessionRenewed(existing, request);
+                return this.resolved(this.memberResult(existing));
+            }
+            this.assertHumanActor(request.actor);
+            const prior = this.requireMember(request.memberId);
+            if (prior.state !== 'enabled')
+                throw new Error(`Agent Member '${prior.handle}' is ${prior.state}; only enabled Members can start from a new context`);
+            if (prior.sessionId === request.sessionId)
+                throw new Error(`Agent Member '${prior.handle}' already runs Session '${request.sessionId}'`);
+            const member = Object.freeze({ ...prior, sessionId: request.sessionId });
+            const operation = Object.freeze({
+                ...this.operationBase(request, this.nextSequence()), kind: 'team/member-session-renewed',
+                data: Object.freeze({ member, previousSessionId: prior.sessionId }),
+            });
+            await this.table.put(operation.operationId, operation);
+            this.apply(operation);
+            return this.committed(this.memberResult(operation));
+        });
+    }
     getMember(memberId) {
         return this.state.members.get(memberId);
     }
@@ -481,8 +527,10 @@ export class AgentTeamLedger {
             // Acceptance normally waits for every Claim to finish (in_review);
             // a Human may also accept early while work is in progress, which then
             // completes the still-active Claims inside the same atomic operation.
-            if (request.action === 'accept' && task.status !== 'in_review' && task.status !== 'in_progress') {
-                throw new Error(`Task '${task.taskRef}' must be in_review or in_progress before acceptance`);
+            // A never-claimed todo Task may be accepted directly as well: work
+            // finished outside the ledger is declared complete by the Human.
+            if (request.action === 'accept' && task.status !== 'in_review' && task.status !== 'in_progress' && task.status !== 'todo') {
+                throw new Error(`Task '${task.taskRef}' must be in_review, in_progress, or todo before acceptance`);
             }
             const priorActiveClaims = [...this.state.claims.values()].filter(claim => claim.taskRef === task.taskRef && claim.state === 'active');
             if (request.action === 'accept' && task.status === 'in_progress' && priorActiveClaims.length === 0) {
@@ -592,6 +640,74 @@ export class AgentTeamLedger {
             return this.committed(this.attentionResult(operation));
         });
     }
+    /**
+     * Append one Member-to-Member direct message as an audit-only operation.
+     * A DM is pure delivery: no Channel, Thread, revision, attention, or
+     * markers change, so apply() is a marker and no projection state moves.
+     */
+    sendDm(request) {
+        return this.enqueue(async () => {
+            const existing = this.state.byRequest.get(request.requestId);
+            if (existing !== undefined) {
+                this.assertSameDm(existing, request);
+                return this.resolved(this.dmResult(existing));
+            }
+            // Only an enabled Member in this Workspace may send a DM; the Human is
+            // not a sendable peer, and Members in other Workspaces are unreachable.
+            const sender = this.assertActorForWorkspace(request.actor, request.workspaceId);
+            if (sender.kind !== 'member')
+                throw new Error('agent-team DM requires Member authority');
+            const body = request.body.trim();
+            if (body === '')
+                throw new Error('DM body must not be empty');
+            const recipient = this.requireMember(request.recipientMemberId);
+            if (recipient.workspaceId !== request.workspaceId)
+                throw new Error(`Agent Member '${recipient.memberId}' is not in Workspace '${request.workspaceId}'`);
+            if (recipient.state !== 'enabled')
+                throw new Error(`Agent Member '${recipient.memberId}' is ${recipient.state}; DM delivery requires an enabled Member`);
+            if (recipient.memberId === AGENT_TEAM_HUMAN_MEMBER_ID || !recipient.sessionId)
+                throw new Error('DM recipient must be an Agent Member');
+            if (recipient.memberId === sender.memberId)
+                throw new Error('Members cannot DM themselves');
+            const operation = Object.freeze({
+                ...this.operationBase(request, this.nextSequence()), kind: 'team/dm-sent',
+                data: Object.freeze({ workspaceId: request.workspaceId, senderMemberId: sender.memberId,
+                    recipientMemberId: recipient.memberId, body }),
+            });
+            await this.table.put(operation.operationId, operation);
+            this.apply(operation);
+            return this.committed(this.dmResult(operation));
+        });
+    }
+    /**
+     * Bounded adjacent context for a DM relay: the truncated body of the most
+     * recent earlier DM between the two sessions, newest first. Returns
+     * undefined when this is their first exchange. `excluding` skips the
+     * operation id of the DM being delivered right now, so the context line is
+     * the adjacent prior exchange rather than a self-reference. Direction
+     * labels are from the reader's perspective: the reader is the recipient of
+     * the DM being delivered, so messages the reader sent are `you → them`.
+     */
+    dmHistoryBetween(senderSessionId, recipientMemberId, excluding) {
+        const sender = [...this.state.members.values()].find(member => member.sessionId === senderSessionId);
+        if (sender === undefined)
+            return undefined;
+        for (let index = this.state.ordered.length - 1; index >= 0; index -= 1) {
+            const operation = this.state.ordered[index];
+            if (operation.kind !== 'team/dm-sent' || operation.operationId === excluding)
+                continue;
+            const pair = operation.data.senderMemberId === sender.memberId && operation.data.recipientMemberId === recipientMemberId;
+            const mirror = operation.data.senderMemberId === recipientMemberId && operation.data.recipientMemberId === sender.memberId;
+            if (!pair && !mirror)
+                continue;
+            // pair: the other Member sent it to the reader → (them → you);
+            // mirror: the reader sent it to the other Member → (you → them).
+            const direction = pair ? 'them → you' : 'you → them';
+            const truncated = operation.data.body.length > 160 ? `${operation.data.body.slice(0, 160)}…` : operation.data.body;
+            return `(${direction}) ${truncated}`;
+        }
+        return undefined;
+    }
     attentionStatus(actor, request) {
         const authorized = this.assertActorForWorkspace(actor, request.workspaceId);
         const { task, thread } = this.threadContextForActor(authorized, request.workspaceId, request);
@@ -860,6 +976,8 @@ export class AgentTeamLedger {
             case 'team/member-suspended':
             case 'team/member-resumed':
             case 'team/member-session-restarted':
+            case 'team/member-context-cleared':
+            case 'team/member-session-renewed':
             case 'team/member-updated':
             case 'team/member-removed':
                 return [{ kind: 'workspace', workspaceId: operation.data.member.workspaceId }];
@@ -896,6 +1014,10 @@ export class AgentTeamLedger {
                 // A read advances only the reader's private watermark; no projection
                 // visible to other participants changes, so nobody is woken.
                 return [];
+            case 'team/dm-sent':
+                // A DM changes no shared projection: delivery is a session-level
+                // runtime effect, so no change waiter has anything to refetch.
+                return [];
             default:
                 return assertUnhandledKind(operation);
         }
@@ -949,9 +1071,12 @@ export class AgentTeamLedger {
             case 'team/member-suspended':
             case 'team/member-resumed':
             case 'team/member-session-restarted':
+            case 'team/member-context-cleared':
+            case 'team/member-session-renewed':
             case 'team/member-updated':
             case 'team/channel-member-added':
             case 'team/thread-read':
+            case 'team/dm-sent':
                 return [];
             default:
                 return assertUnhandledKind(operation);
@@ -1058,6 +1183,28 @@ export class AgentTeamLedger {
                 throw new Error('invalid Member restart');
             return;
         }
+        if (operation.kind === 'team/member-context-cleared') {
+            assertHuman();
+            const prior = projection.members.get(operation.data.member.memberId);
+            // Legacy in-place clear: the recorded Member is unchanged, and the
+            // projection deliberately does not change either.
+            if (prior === undefined || prior.state !== 'enabled' || !this.sameMemberIdentity(prior, operation.data.member))
+                throw new Error('invalid Member context clear');
+            return;
+        }
+        if (operation.kind === 'team/member-session-renewed') {
+            assertHuman();
+            const prior = projection.members.get(operation.data.member.memberId);
+            // The renewal moves exactly the sessionId: the prior Member must be
+            // enabled on the recorded previous Session, and every other fact must
+            // carry over unchanged.
+            if (prior === undefined || prior.state !== 'enabled'
+                || prior.sessionId !== operation.data.previousSessionId
+                || operation.data.member.sessionId === operation.data.previousSessionId
+                || !this.sameMemberFacts(prior, operation.data.member))
+                throw new Error('invalid Member session renewal');
+            return;
+        }
         if (operation.kind === 'team/channel-updated') {
             assertHuman();
             const prior = projection.channels.get(operation.data.channel.channelRef);
@@ -1305,6 +1452,18 @@ export class AgentTeamLedger {
             this.validateInboxDelta(operation.data.inbox, projection, refs, [], [], [activity]);
             return;
         }
+        if (operation.kind === 'team/dm-sent') {
+            const sender = assertMember();
+            const recipient = projection.members.get(operation.data.recipientMemberId);
+            if (recipient === undefined || recipient.workspaceId !== operation.data.workspaceId
+                || recipient.state !== 'enabled' || recipient.memberId === AGENT_TEAM_HUMAN_MEMBER_ID
+                || operation.data.senderMemberId !== sender.memberId
+                || operation.data.recipientMemberId === sender.memberId
+                || operation.data.body.trim() === '' || operation.data.body !== operation.data.body.trim()) {
+                throw new Error('invalid DM operation');
+            }
+            return;
+        }
         assertUnhandledKind(operation);
     }
     validateInboxDelta(delta, projection, _refs, additionalThreadRefs = [], additionalMessages = [], additionalActivities = []) {
@@ -1486,6 +1645,15 @@ export class AgentTeamLedger {
             // projection deliberately does not change.
             return;
         }
+        if (operation.kind === 'team/member-context-cleared') {
+            // Legacy audit-only marker: identity, memory path, and binding were
+            // untouched; the Host recreated the live Session empty under the same id.
+            return;
+        }
+        if (operation.kind === 'team/member-session-renewed') {
+            target.members.set(operation.data.member.memberId, operation.data.member);
+            return;
+        }
         if (operation.kind === 'team/channel-updated') {
             target.channels.set(operation.data.channel.channelRef, operation.data.channel);
             return;
@@ -1567,6 +1735,11 @@ export class AgentTeamLedger {
             this.applyInboxDelta(target, operation.data.inbox);
             return;
         }
+        if (operation.kind === 'team/dm-sent') {
+            // Audit-only: delivery is a transient runtime effect, so the durable
+            // projection deliberately does not change.
+            return;
+        }
         assertUnhandledKind(operation);
     }
     /** Facts arrive in ledger sequence order, so global and per-thread lists stay sorted by append only. */
@@ -2140,6 +2313,20 @@ export class AgentTeamLedger {
         if (model.provider.trim() === '' || model.model.trim() === '')
             throw new Error('member model selection must name a provider route and a model id');
     }
+    /**
+     * Capability allow-list entries are exact identifiers (skill names,
+     * reserved tool names); only whitespace-only values are rejected. Unknown
+     * names are intent, not errors — committing must stay replayable across
+     * Harness upgrades, so divergence is derived at activation instead.
+     */
+    assertCapabilities(capabilities) {
+        for (const surface of [capabilities?.tools?.allow, capabilities?.skills?.allow]) {
+            if (surface === undefined)
+                continue;
+            if (surface.some(name => name.trim() === ''))
+                throw new Error('capability allow-list names must not be empty');
+        }
+    }
     initialization() {
         const operation = this.state.ordered[0];
         if (operation === undefined)
@@ -2168,6 +2355,7 @@ export class AgentTeamLedger {
             || operation.data.member.workspaceId !== request.workspaceId || operation.data.member.handle !== request.handle.trim()
             || operation.data.member.description !== request.description.trim() || operation.data.member.presetId !== request.presetId.trim()
             || !isDeepStrictEqual(operation.data.member.model ?? undefined, request.member.model ?? undefined)
+            || !isDeepStrictEqual(operation.data.member.capabilities ?? undefined, request.member.capabilities ?? undefined)
             || !this.sameList(operation.data.channelRefs, this.normalizeUnique(request.channelRefs, 'initial Member Channels')))
             this.throwRequestCollision(request.requestId);
     }
@@ -2176,6 +2364,11 @@ export class AgentTeamLedger {
         if (operation.kind !== kind || !this.sameActor(operation.actor, request.actor) || operation.data.member.memberId !== request.memberId)
             this.throwRequestCollision(request.requestId);
     }
+    assertSameMemberSessionRenewed(operation, request) {
+        if (operation.kind !== 'team/member-session-renewed' || !this.sameActor(operation.actor, request.actor)
+            || operation.data.member.memberId !== request.memberId || operation.data.member.sessionId !== request.sessionId)
+            this.throwRequestCollision(request.requestId);
+    }
     assertSameChannelUpdate(operation, request) {
         if (operation.kind !== 'team/channel-updated' || !this.sameActor(operation.actor, request.actor)
             || operation.data.workspaceId !== request.workspaceId || operation.data.channel.channelRef !== request.channelRef
@@ -2186,7 +2379,8 @@ export class AgentTeamLedger {
         if (operation.kind !== 'team/member-updated' || !this.sameActor(operation.actor, request.actor)
             || operation.data.member.memberId !== request.memberId || operation.data.member.handle !== request.handle.trim()
             || operation.data.member.description !== request.description.trim()
-            || !isDeepStrictEqual(operation.data.member.model ?? undefined, request.model ?? undefined))
+            || !isDeepStrictEqual(operation.data.member.model ?? undefined, request.model ?? undefined)
+            || !isDeepStrictEqual(operation.data.member.capabilities ?? undefined, request.capabilities ?? undefined))
             this.throwRequestCollision(request.requestId);
     }
     assertSameChannelJoin(operation, request) {
@@ -2199,6 +2393,17 @@ export class AgentTeamLedger {
             || operation.data.workspaceId !== request.workspaceId || operation.data.channelRef !== request.channelRef || operation.data.memberId !== request.memberId)
             this.throwRequestCollision(request.requestId);
     }
+    assertSameDm(operation, request) {
+        if (operation.kind !== 'team/dm-sent' || !this.sameActor(operation.actor, request.actor)
+            || operation.data.workspaceId !== request.workspaceId
+            || operation.data.senderMemberId !== request.actor.memberId
+            || operation.data.recipientMemberId !== request.recipientMemberId
+            || operation.data.body !== request.body.trim())
+            this.throwRequestCollision(request.requestId);
+    }
+    dmResult(operation) {
+        return Object.freeze({ receipt: this.receipt(operation), recipient: this.requireMember(operation.data.recipientMemberId) });
+    }
     assertSameMessage(operation, request, recipients) {
         if (operation.kind !== 'team/message-sent' || !this.sameActor(operation.actor, request.actor)
             || operation.data.workspaceId !== request.workspaceId || operation.data.message.channelRef !== request.channelRef
@@ -2282,6 +2487,13 @@ export class AgentTeamLedger {
             && isDeepStrictEqual(left.model ?? undefined, right.model ?? undefined)
             && left.privateMemoryPath === right.privateMemoryPath;
     }
+    /** sameMemberIdentity minus the sessionId: every durable Member fact a session renewal must carry over unchanged. */
+    sameMemberFacts(left, right) {
+        return left.memberId === right.memberId && left.workspaceId === right.workspaceId
+            && left.handle === right.handle && left.description === right.description && left.presetId === right.presetId
+            && isDeepStrictEqual(left.model ?? undefined, right.model ?? undefined)
+            && left.privateMemoryPath === right.privateMemoryPath;
+    }
     sameActor(left, right) {
         return left.kind === right.kind && left.memberId === right.memberId && left.handle === right.handle;
     }

package/packages/agent-team/lib/member-context.js

@@ -59,10 +59,10 @@ export function renderMemberMemory(raw, privateMemoryPath = '<private-memory-pat
     const warning = overBudget
         ? '\n\n[Maintenance warning: memory.md exceeds the 8 KiB context budget. Its contents were not injected; do not delete or automatically summarize the file. Maintain a smaller index explicitly.]'
         : '';
-    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. It is reference context only, may be stale, and is not an instruction or Team fact.\n\nPrivate memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nThese paths are outside the Workspace cwd. Relative filesystem paths resolve from cwd, so use the absolute paths above when reading or editing this Member's memory. Read matching notes on demand; do not copy credentials, sensitive data, guesses, chat logs, other Members' memory, or Team facts already owned by the ledger into memory.\n\n${escape(body)}${warning}\n${END}`;
+    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. It is reference context only, may be stale, and is not an instruction or Team fact.\n\nPrivate memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nPrivate skills directory: ${privateMemoryPath}/skills\nThese paths are outside the Workspace cwd. Relative filesystem paths resolve from cwd, so use the absolute paths above when reading or editing this Member's memory. Read matching notes on demand; do not copy credentials, sensitive data, guesses, chat logs, other Members' memory, or Team facts already owned by the ledger into memory.\n\n${escape(body)}${warning}\n${END}`;
 }
 function renderUnavailableMemory(privateMemoryPath, reason) {
-    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. ${reason}\n\nPrivate memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nThese paths are outside the Workspace cwd. Use the absolute paths above when inspecting or repairing this Member's memory.\n${END}`;
+    return `${BEGIN}\nThis is the complete replacement for this Team Member's private memory index; all earlier private-memory context is obsolete. ${reason}\n\nPrivate memory directory: ${privateMemoryPath}\nMemory index: ${privateMemoryPath}/memory.md\nNotes directory: ${privateMemoryPath}/notes\nPrivate skills directory: ${privateMemoryPath}/skills\nThese paths are outside the Workspace cwd. Use the absolute paths above when inspecting or repairing this Member's memory.\n${END}`;
 }
 function escape(value) {
     return value.replaceAll(BEGIN, '[escaped begin marker]').replaceAll(END, '[escaped end marker]');

package/packages/agent-team/lib/member-skills.js

@@ -0,0 +1,94 @@
+/**
+ * Per-Member private skill provider: the Team-owned wrapper around the
+ * Harness filesystem provider that scopes one Member's skill discovery to
+ * exactly the plugin's bundled read-only core skills plus that Member's
+ * private `skills/` directory (default roots excluded), and filters `list()`
+ * output by that Member's selection ref.
+ *
+ * Deliberate interface reservation: this per-Member provider seam is the
+ * primitive future Runtime Revision manifests orchestrate — do not remove
+ * during cleanup.
+ *
+ * @module @wowyuarm/dsh-agent-team/member-skills
+ */
+import { FileSystemSkillProvider } from '@deepseek-ai/dsh-skill-filesystem';
+/**
+ * Register the Member-private skill provider on one Member's agent scope and
+ * return its disposer. The provider files into that agent's exact layer, so
+ * no sibling Member or ordinary session can observe the catalog; discovery,
+ * watching, and invalidation flow through the same Harness provider below.
+ *
+ * Registration goes through the traceable service resolved FROM the agent
+ * context (the same shape as `tools.restrict()`), never through a plugin
+ * mount: a plugin mounted from Host activation code lands on the Host's
+ * async-trace fiber instead of the agent scope, and a plugin `inject` would
+ * hold Member activation open while the Host is still starting. A deployment
+ * without the skill registry keeps its Members; they simply carry no private
+ * skill catalog.
+ */
+export function mountMemberSkillProvider(agentCtx, config) {
+    const selection = config.selection;
+    // A no-op swap stands in for deployments without the skill registry, so
+    // the Host's edit path never sees a half-initialized ref.
+    selection.swap = () => { };
+    const skills = agentCtx.get('skills');
+    if (skills === undefined)
+        return () => { };
+    return skills.registerProvider(control => {
+        const provider = new MemberPrivateSkillProvider(agentCtx, control, config, selection);
+        // The ref swap updates the live filter and drops cached catalogs through
+        // the provider's own registration, so the next catalog query (and the
+        // next step's durable replacement catalog) sees the new selection.
+        selection.swap = (allow) => {
+            selection.current = allow;
+            control.invalidate();
+        };
+        return provider;
+    });
+}
+/** One Member's bundled-plus-private skill roots wrapped as a filtered registry provider. */
+class MemberPrivateSkillProvider {
+    selection;
+    name;
+    wrapped;
+    constructor(ctx, control, config, selection) {
+        this.selection = selection;
+        this.name = `member-private:${config.skillsDirectory}`;
+        // Two Team-owned roots, no project/user/global leakage: the bundled
+        // read-only core skills first, then the Member's writable private
+        // directory. Within one provider both roots share the custom rank, and
+        // discovery keeps the first root's same-name candidate, so a bundled
+        // skill stays stable across plugin upgrades while a Member installs
+        // its own additions under their own names.
+        const customSkillDirs = config.bundledSkillsDirectory === undefined
+            ? [config.skillsDirectory]
+            : [config.bundledSkillsDirectory, config.skillsDirectory];
+        this.wrapped = new FileSystemSkillProvider(ctx, control, {
+            providerName: this.name,
+            includeDefaultRoots: false,
+            customSkillDirs,
+        });
+    }
+    /**
+     * Filter the wrapped discovery to the Member's selection. Filtering is
+     * list()-output only — the directory is still scanned and watched, so this
+     * is a performance/visibility semantic, not a security boundary.
+     */
+    async list(options) {
+        const output = await this.wrapped.list(options);
+        const allow = this.selection.current;
+        if (allow === undefined)
+            return output;
+        const allowed = new Set(allow);
+        return filterObservation(output, candidate => allowed.has(candidate.name));
+    }
+    async get(candidate, options) {
+        return this.wrapped.get(candidate, options);
+    }
+}
+/** Apply one name filter to either provider observation shape. */
+function filterObservation(output, keep) {
+    if (!('candidates' in output))
+        return output.filter(keep);
+    return { candidates: output.candidates.filter(keep), complete: output.complete };
+}

package/packages/agent-team/lib/spec.js

@@ -32,6 +32,19 @@ const modelSelectionSchema = z.object({
     model,
     ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
 }));
+// Pure intent: allow-list entries are plain strings. They are never
+// validated against a known-name set here — committing must survive Harness
+// upgrades that rename or remove tools, so divergence is derived at
+// activation instead (see AgentTeamCapabilityWarning).
+const memberCapabilitiesSchema = z.object({
+    // Deliberate interface reservation, no UI writes it today: Runtime Revision
+    // manifests depend on this seam — do not remove during cleanup.
+    tools: z.object({ allow: z.array(z.string().min(1)) }).strict().transform(omitUndefined).optional(),
+    skills: z.object({ allow: z.array(z.string().min(1)) }).strict().transform(omitUndefined).optional(),
+}).strict().transform(({ tools, skills }) => ({
+    ...(tools === undefined ? {} : { tools }),
+    ...(skills === undefined ? {} : { skills }),
+}));
 const memberSchema = z.object({
     memberId: memberIdSchema,
     sessionId: sessionIdSchema,
@@ -41,6 +54,8 @@ const memberSchema = z.object({
     presetId: z.string().min(1),
     // Ledgers written before per-Member model selection existed omit the field.
     model: modelSelectionSchema.optional(),
+    // Ledgers written before member capabilities existed omit the field.
+    capabilities: memberCapabilitiesSchema.optional(),
     privateMemoryPath: z.string().min(1),
     state: z.union([z.literal('enabled'), z.literal('suspended'), z.literal('inactive')]),
 }).strict();
@@ -237,6 +252,18 @@ const storedAgentTeamOperationSchema = z.discriminatedUnion('kind', [
         kind: z.literal('team/member-session-restarted'),
         data: z.object({ member: memberSchema }).strict(),
     }).strict(),
+    z.object({
+        ...operationBase,
+        previousOperationId: operationIdSchema.nullable(),
+        kind: z.literal('team/member-context-cleared'),
+        data: z.object({ member: memberSchema }).strict(),
+    }).strict(),
+    z.object({
+        ...operationBase,
+        previousOperationId: operationIdSchema.nullable(),
+        kind: z.literal('team/member-session-renewed'),
+        data: z.object({ member: memberSchema, previousSessionId: sessionIdSchema }).strict(),
+    }).strict(),
     z.object({
         ...operationBase,
         previousOperationId: operationIdSchema.nullable(),
@@ -372,6 +399,17 @@ const storedAgentTeamOperationSchema = z.discriminatedUnion('kind', [
             inbox: inboxDeltaSchema,
         }).strict(),
     }).strict(),
+    z.object({
+        ...operationBase,
+        previousOperationId: operationIdSchema.nullable(),
+        kind: z.literal('team/dm-sent'),
+        data: z.object({
+            workspaceId: workspaceIdSchema,
+            senderMemberId: memberIdSchema,
+            recipientMemberId: memberIdSchema,
+            body: z.string().min(1),
+        }).strict(),
+    }).strict(),
 ]);
 /** Durable validator for the closed Agent Team operation union; ledgers written before message occurredAt existed normalize on load. */
 export const agentTeamOperationSchema = storedAgentTeamOperationSchema.transform(stampOperationMessages);