@wowyuarm/dsh-agent-team 0.1.5 → 0.1.6

package/README.md

@@ -7,12 +7,18 @@
 [![Release](https://img.shields.io/github/v/release/wowyuarm/dsh-agent-team?include_prereleases&style=flat-square)](https://github.com/wowyuarm/dsh-agent-team/releases)
 [![Listed on Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com/p/wowyuarm/dsh-agent-team/)
 
-**dsh-agent-team** helps a human manage tasks in an orderly way and use agents as true collaborators: agents are persistent identities for their sessions; Workspaces organize agents and sessions per project; Channels carry responsibilities; Task Threads chain session agents into one line of progress.
+**dsh-agent-team** gives DeepSeek Harness a persistent agent team for long-running collaboration: agents are durable identities for their sessions, keeping memory and responsibilities across them; Workspaces organize agents and sessions per project; Channels carry responsibilities; Task Threads chain session agents into one line of progress.
 
 An opt-in plugin for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness): install it only where Team mode is needed; ordinary DSH sessions keep their normal preset roster.
 
 ## Preview
 
+Agent Team is opt-in: after installation the ordinary DSH page stays as-is, and Team mode is one additional entry in the sidebar footer.
+
+![Ordinary DSH Web UI with the Team entry highlighted in the sidebar footer](assets/readme/dsh-entry.png)
+
+Entering Team mode shows Channels, managed Agents, and the collaboration timeline:
+
 ![Team mode in the DSH Web UI: Channels and seven online Agents in the sidebar; the Main Channel shows Task references and the composer’s task switch](assets/readme/team-mode.png)
 
 ### Task Threads
@@ -21,6 +27,10 @@ A Task Thread keeps Claims, Agent handoffs, Human acceptance, and follow-up repl
 
 ![Completed Task Thread in the DSH Web UI: a Claim, Agent handoffs, Human acceptance activity, and the reply composer](assets/readme/task-thread.png)
 
+### No context babysitting
+
+Member sessions compact automatically once token usage passes the threshold, and each member gets a pre-compaction hint to persist its key conclusions first. Every member keeps its own memory and notes across sessions, so identity and knowledge survive session renewal.
+
 ## Quick start
 
 ### 1. Check DSH
@@ -117,6 +127,10 @@ npm pack --dry-run
 
 Architecture and the collaboration contract are documented in [`docs/architecture.md`](docs/architecture.md) and [`docs/team-collaboration.md`](docs/team-collaboration.md).
 
+## Acknowledgments
+
+The collaboration shape of dsh-agent-team — named agent members, Channels, Task Threads, @mention routing, and per-member memory — originates from and borrows several design ideas from [Raft](https://raft.build/). Thank you for the work.
+
 ## License
 
 [MIT](LICENSE)

package/README.zh.md

@@ -7,12 +7,18 @@
 [![Release](https://img.shields.io/github/v/release/wowyuarm/dsh-agent-team?include_prereleases&style=flat-square)](https://github.com/wowyuarm/dsh-agent-team/releases)
 [![Listed on Awesome DSH Plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com/p/wowyuarm/dsh-agent-team/)
 
-**dsh-agent-team** 帮助 human 有序管理任务、把 agents 用成真正的协作者：Agent 是 session 的持久身份；Workspace 按项目组织 agents 与 sessions；Channel 承载职责分派；Task Thread 把多个 session agent 串成一条推进线。
+**dsh-agent-team** 给 DSH 一个可长期协作的持久 Agent 团队：Agent 是 session 的持久身份，跨会话保持记忆与职责；Workspace 按项目组织 agents 与 sessions；Channel 承载职责分派；Task Thread 把多个 session agent 串成一条推进线。
 
 一个为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 提供的按需启用插件：只在需要 Team mode 的 profile 安装，普通 DSH Session 保持原有 preset roster。
 
 ## 预览
 
+Agent Team 是按需启用的：安装后普通 DSH 页面保持原样，Team mode 只是侧栏底部多出的一个入口。
+
+![普通 DSH Web UI，侧栏底部高亮 Team 入口](assets/readme/dsh-entry.png)
+
+进入 Team mode 后是频道、受管 Agent 与协作时间线：
+
 ![DSH Web UI 中的 Team mode：侧边栏展示频道与 7 位在线 Agent；Main 频道含 Task 引用和 composer 的作为任务开关](assets/readme/team-mode.png)
 
 ### Task Thread
@@ -21,6 +27,10 @@ Task Thread 把 Claim、Agent 交接、Human 验收和后续回复保留在同
 
 ![DSH Web UI 中已完成的 Task Thread：含 Claim、Agent 交接、Human 验收活动和回复 composer](assets/readme/task-thread.png)
 
+### 无需操心上下文
+
+成员会话在 token 用量超过阈值后自动压缩，压缩前会提示成员先沉淀关键结论。每个成员的 memory 与 notes 跨会话保留，身份与知识不随会话续期丢失。
+
 ## 快速开始
 
 ### 1. 检查 DSH
@@ -117,6 +127,10 @@ npm pack --dry-run
 
 架构和协作协议见 [`docs/architecture.zh.md`](docs/architecture.zh.md) 与 [`docs/team-collaboration.zh.md`](docs/team-collaboration.zh.md)。
 
+## 致谢
+
+dsh-agent-team 的协作形态——具名 Agent 成员、Channel、Task Thread、@mention 路由与成员级记忆——来源于 [Raft](https://raft.build/) 并借鉴了它的若干设计。感谢他们的工作。
+
 ## 许可证
 
 [MIT](LICENSE)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wowyuarm/dsh-agent-team",
-  "version": "0.1.5",
-  "description": "Help humans organize tasks and let agents collaborate - a Team plugin for DeepSeek Harness",
+  "version": "0.1.6",
+  "description": "A persistent agent team for long-running collaboration in DeepSeek Harness",
   "repository": {
     "type": "git",
     "url": "https://github.com/wowyuarm/dsh-agent-team.git"
@@ -12,6 +12,7 @@
     "cordis.patch.yml",
     "packages/agent-team/lib/**/*",
     "packages/agent-team/preset/**/*",
+    "packages/agent-team/core-skills/**/*",
     "packages/tool-agent-team/lib/**/*",
     "packages/client-agent-team/lib/**/*",
     "README.md",
@@ -105,6 +106,10 @@
       "types": "./packages/agent-team/lib/types/member-context.d.ts",
       "default": "./packages/agent-team/lib/member-context.js"
     },
+    "./member-skills": {
+      "types": "./packages/agent-team/lib/types/member-skills.d.ts",
+      "default": "./packages/agent-team/lib/member-skills.js"
+    },
     "./tools": {
       "types": "./packages/tool-agent-team/lib/types/index.d.ts",
       "default": "./packages/tool-agent-team/lib/index.js"

package/packages/agent-team/README.md

@@ -18,6 +18,12 @@ Every operation record carries a positive global sequence, unique operation and
 
 Member creation commits one stable Member/session/Workspace/preset/private-memory identity before unpublished Agent setup. Setup mounts the selected preset and validates its marked `team_message` plus all five Team tools before publication. Failure leaves only that Member unavailable. Suspend waits for the owned `AgentHandle` to stop; resume and Host remount restore the exact persisted session.
 
+Members optionally carry durable capability intent (`capabilities.tools.allow`, `capabilities.skills.allow`). It flows verbatim through every lifecycle operation, replays unchanged after Host restart, and commits without known-name validation so Harness upgrades can never break old ledgers; divergence from known names surfaces at activation as derived, non-persisted `capabilityWarnings`. `tools.allow` is a deliberate interface reservation (no UI write path today) that future Runtime Revision manifest orchestration depends on. Edits follow absent-clears semantics like `model`: a caller that does not manage capabilities must echo the stored value back or its edit clears the override.
+
+Activation applies `tools.allow` as a scoped restriction over the composed preset surface (mount → restrict → validate) with the five Team tools force-unioned over the configured list; unknown names drop with a warning rather than failing the Member. A live allow-list edit swaps the restriction at a turn boundary in the same Session — idle Members apply immediately, and an edit racing a running turn waits for it while later lifecycle operations queue behind the wait. Restriction failures isolate to that Member's activation diagnostic.
+
+Skills are Member-private: the preset has no shared skill-filesystem row, and the Host registers one provider per Member that scans exactly the plugin's bundled read-only core skills (`packages/agent-team/core-skills/` — the `member-skill-manager` meta skill that owns all skill craft guidance) plus that Member's writable `skills/` directory under its private memory path (default roots excluded). Installing is writing into the Member's own directory — directory form `skills/<name>/SKILL.md` with optional references and scripts, or a flat `.md` — and there is deliberately no upload Remote. The persona itself only states the private-space physical facts; the meta skill's description routes skill-management work to it. `skills.allow` filters the catalog through a live selection ref swapped at the same turn boundary; the filesystem watcher feeds discovery after a self-install.
+
 Every team-managed session records `danger-full-access`. Project cwd remains the Workspace path, while private memory lives under `$DSH_HOME/agent-team/members/<memberId>/`. An untitled Member session is named with its handle through the session-title service, so the ordinary Session list shows the Member identity; an explicit rename or any earlier title always wins. The isolated `team-member` preset also provides coding tools including model-facing web search, Workspace instruction discovery, and Team protocol guidance. The host owns the shared Web service and provider; the preset mounts only the model-facing web tool. Its lowercase `memory.md` is a bounded 8 KiB reference index, injected only for that Member when its content changes; `notes/` stays on-demand through filesystem tools. Over-budget indexes receive a maintenance warning, not silent truncation. Ordinary sessions and forks receive no Team identity or private-memory context. At Host startup the Host prunes `member:`-shaped private-memory directories that the replayed ledger does not reference — leftovers from discarded ledgers, since a version-bumped medium rejects at open and starts empty. Prune failures fail startup; entries outside the `member:` shape are left untouched.
 
 Adding a Member to a Channel grants future read/send/claim authority but injects no historical Messages into the member session. Every top-level Message creates a Thread; new Client/tool starts explicitly choose taskless while released-client omission remains taskful, and a Human can later promote a taskless Thread by atomically adding its Task overlay and a structured `promote` Task activity. Thread Attention starts when a Thread is created, a Claim is created, a member follows, a top-level Message mentions them, or a Human confirms an invitation. Ordinary unread is derived from Attention; structured mentions create durable direct markers, while terminal Task changes retain sparse Activity markers for affected followers after Attention ends. `team_inbox` and Thread reads are Host projections, not Session inbox contents. A direct mention context includes its Message body and source; Task/Claim changes — including promotion — include concise transition facts; ordinary unread carries a body-free Thread-first route. Pending hints are coalesced, ignored hints do not loop, and resume/error recovery derives a new hint from durable unread state. For recoverable service failures, the Host wakes a Member after each of the first two consecutive `agent/error` occurrences, then leaves the third failure for the operator; only a clean turn resets that run.

package/packages/agent-team/README.zh.md

@@ -18,6 +18,12 @@ Service 使用 `ctx.storageDomain`、`ctx.workspaceRegistry`、`ctx.agents`、`c
 
 创建 Member 时，先提交稳定的 Member/session/Workspace/preset/private-memory 身份，再执行 unpublished Agent setup。Setup 挂载指定 preset，并在发布前检查带 marker 的 `team_message` 和全部五个 Team tools。失败只把该 Member 标为 unavailable。Suspend 等待所属 `AgentHandle` 完全停止；resume 和 Host remount 恢复同一个持久 session。
 
+Member 可携带持久能力意图（`capabilities.tools.allow`、`capabilities.skills.allow`）。它随全部 lifecycle operation 原样流转，Host restart 后原样重放，commit 时不做已知名校验（Harness 升级不会破坏旧 ledger）；与已知名的偏差在 activation 时派生为不持久化的 `capabilityWarnings`。`tools.allow` 是有意的接口预留（当前无 UI 写入路径），供后续 Runtime Revision manifest 编排依赖。编辑语义与 `model` 一致（absent 即清除）：不管理 capabilities 的调用方必须回传已存储的值，否则其编辑会清掉该覆盖。
+
+Activation 把 `tools.allow` 作为 scoped restriction 应用在已组合的 preset 面上（mount → restrict → validate），五个 Team tools 在配置之上强制并集；未知名 drop + warning，不使 Member 失败。对 live Member 的 allow-list 编辑在 turn 边界同 Session 换装 restriction——idle 立即生效，与 running turn 竞争的编辑等待其结束，后续 lifecycle 操作在该等待之后排队。restriction 失败只隔离为该 Member 的 activation diagnostic。
+
+Skills 是 Member 私有的：preset 不带共享 skill-filesystem row，Host 为每个 Member 注册一个 provider，只扫插件内置的只读 core skills（`packages/agent-team/core-skills/`——`member-skill-manager` meta skill，全部 skill 写作/安装/credentials 引导都在它里面）加该 Member 可写的私有 `skills/` 目录（排除默认 roots）。安装就是往自己目录写——目录形态 `skills/<name>/SKILL.md` + 可选 references/scripts，或平铺 `.md`——有意不提供上传 Remote。persona 只陈述私有空间物理事实，meta skill 的 description 负责"涉及 skill 管理工作时先读我"。`skills.allow` 通过同一 turn 边界换装的 live selection ref 过滤 catalog；自装后的发现由 filesystem watcher 驱动。
+
 每个 Team 管理的 session 都会持久写入 `danger-full-access`。项目 cwd 仍是 Workspace 路径，私有记忆位于 `$DSH_HOME/agent-team/members/<memberId>/`。没有标题的 Member session 会通过 session-title service 以 handle 命名，普通 Session 列表因此直接显示 Member 身份；显式重命名或任何既有标题始终优先。隔离的 `team-member` preset 还提供 coding 工具、面向模型的 Web 搜索、Workspace instruction discovery 和 Team protocol guidance。共享的 Web service 与 provider 仍由 Host 持有；preset 只挂载面向模型的 Web tool。小写 `memory.md` 是有界的 8 KiB 参考索引，只有该 Member 的内容变化时才注入；`notes/` 只通过 filesystem tools 按需读取。超预算索引只产生维护警告，不静默截断。普通 session 和 fork 不获得 Team 身份或私有记忆上下文。Host 启动时会清理重放 ledger 不再引用的 `member:` 形态私有记忆目录——这些是 ledger 被丢弃后的遗留（版本提升的 medium 在 open 时被拒绝并以空状态重启）。清理失败会使启动失败；非 `member:` 形态的条目保持原样。
 
 把 Member 加入 Channel 只授予之后的 read/send/claim authority，不向 Member session 注入历史 Message。每条顶层 Message 都创建 Thread；新 Client/tool 显式选择 taskless，released Client 省略意图时仍保持 taskful；Human 可之后 promotion taskless Thread，原子附加 Task overlay 与结构化 `promote` Task activity。创建 Thread、创建 Claim、显式 follow、顶层消息 mention 到、或 Human 确认邀请会开始 Thread Attention。普通未读从 Attention 派生，structured mention 形成持久 direct marker；终止 Task 的状态变化会为受影响关注者保留稀疏 Activity marker，即使 Attention 已结束仍可读取。`team_inbox` 和 Thread read 是 Host projection，不是 Session inbox 内容。Direct mention context 包含消息正文和来源，Task/Claim 变化（含 promotion）包含简短状态事实，普通未读提供无正文的 Thread-first 路由。提示会合并，忽略提示不会形成循环，resume/runtime error recovery 会从持久未读状态重新判断是否提示。对于可恢复的服务错误，Host 会在连续 `agent/error` occurrence 的前两次后唤醒 Member；第 3 次错误则交给 operator，只有 clean turn 才会重置这段连续错误。

package/packages/agent-team/core-skills/member-skill-manager/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: member-skill-manager
+description: Create, install, revise, or retire this Member's private skills, including how a skill manages its configuration and credentials. Read this skill before creating, installing, revising, or retiring any skill in this Member's private skills directory, or when repeated or fragile work has produced a reusable method worth preserving as a skill.
+---
+
+# Member Skill Manager
+
+A skill preserves a reusable way of working. It is not a memory, a personal preference, or a record of one event.
+
+## Decide
+
+Create or revise a skill when the method has been demonstrated in real work and will make later work clearer or more reliable. Keep one-off work, changing facts, and personal continuity in this Member's notes and memory index instead.
+
+## Create Or Install
+
+This Member's private skills live in its private skills directory — the absolute path injected into your context (the one ending in `/skills`); it is outside the Workspace cwd, so never use a cwd-relative path for it. A skill is a directory there:
+
+```
+<private-skills>/my-skill/
+  SKILL.md          # required: front matter + instructions
+  references/       # optional: longer material only some uses need
+  scripts/          # optional: runnable helpers the skill calls
+```
+
+Install an offered skill by copying its directory there; no registration command is needed — the catalog discovers the change within its filesystem-watch window, so a later catalog query lists it. A single flat `.md` file also works, but the directory form is the norm for anything that carries references or scripts.
+
+Use a short lowercase hyphenated name. Keep the directory name and the `name` field the same, and do not reuse a name this catalog already lists (built-ins included).
+
+## Write
+
+Describe the method the next Member turn needs, not general advice it already knows. Make the description name the real triggers. Keep the main instructions in `SKILL.md` short. Put substantial scripts, references, or templates beside `SKILL.md` only when they are repeatedly useful. For a substantial new or revised skill, read [Writing Great Skills](references/writing-great-skills.md).
+
+## Review
+
+Read the finished skill once. Check that its name, description, directory, and method agree, and that nothing already in this Member's catalog owns the same method or name.
+
+Writing or changing a skill adds no tools, credentials, permissions, or external services. The current turn keeps its existing skill list; a later turn discovers the change.
+
+## Configuration and credentials
+
+A skill that needs an API key, token, or other secret keeps it in its own `auth.json` (JSON, one file per skill, inside that skill's directory) and reads it from there at run time; it never puts the secret in `SKILL.md`, scripts, messages, notes, or any other persisted text. Non-secret settings live in `config.json` beside it. Document the exact read/use convention in the skill's `SKILL.md` (file names, expected JSON shape, and how scripts consume them). See [Configuration and Credentials for Skills](references/auth-and-config.md) for the operating convention.

package/packages/agent-team/core-skills/member-skill-manager/references/auth-and-config.md

@@ -0,0 +1,30 @@
+# Configuration and Credentials for Skills
+
+A skill may need credentials (API keys, tokens) or non-secret configuration (endpoints, limits, defaults). This is the operating convention for how a Member manages those files when installing an external skill or creating its own.
+
+## File layout
+
+Every skill keeps its own files inside its skill directory:
+
+- `auth.json` — credentials. JSON object; one entry per service or purpose, e.g. `{"weread": "<api-key>"}`.
+- `config.json` — non-secret configuration. JSON object; whatever the skill needs, e.g. `{"baseUrl": "https://...", "maxResults": 5}`.
+
+A skill that needs neither file simply does not have them. Do not scatter credential files elsewhere or share one file across skills.
+
+## Writing a skill's SKILL.md
+
+The skill's `SKILL.md` must document how the skill reads these files:
+
+- the exact file names and expected JSON shape,
+- how scripts consume them (for example `AUTH=$(cat auth.json)` in a shell script, or `json.load(open("auth.json"))` in Python, resolved relative to the skill directory),
+- which config keys exist and what they do.
+
+## What never goes in plain text
+
+Credentials do not appear in `SKILL.md`, in scripts, in messages, in notes, in the Member's memory index, or in any other persisted or shared text. Scripts read them from `auth.json` at run time; they are never echoed into output, logs, or chat. When a Human provides a credential through a DM or attachment, write it into the skill's `auth.json` and reference it only as a file.
+
+## Creating or installing a skill
+
+- Create or copy the skill directory into this Member's private skills directory (the absolute injected path ending in `/skills`).
+- If the skill needs credentials or configuration, create `auth.json` / `config.json` in that directory with the layout above and document the read convention in its `SKILL.md`.
+- When the skill is a copy of an external skill that already has its own layout, keep that layout unless it conflicts with this convention; resolve conflicts by moving credentials into `auth.json` and updating `SKILL.md` accordingly.

package/packages/agent-team/core-skills/member-skill-manager/references/writing-great-skills.md

@@ -0,0 +1,17 @@
+# Writing Great Skills
+
+A skill makes a method more predictable across future work. Keep the process stable; let judgment and output remain appropriate to the situation.
+
+## Description
+
+The description is the skill's index. State what it does and the distinct situations that should cause it to be read. Do not spend it on details that belong in the body.
+
+## Instructions
+
+Put the steps every use needs in `SKILL.md`. Give fragile steps a concrete completion check. Keep definitions, variants, and long examples in a directly linked reference when only some uses need them.
+
+Use the least rigid form that preserves the method: guidance for judgment, a parameterized recipe for a preferred pattern, and a precise script only for work that is fragile or must be repeatable.
+
+## Prune
+
+Keep each rule in one place. Remove duplicated, stale, and obvious advice. A skill should carry only the knowledge that changes how the next turn can work.

package/packages/agent-team/lib/index.js

@@ -41,7 +41,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
 };
 import { randomUUID } from 'node:crypto';
 import { mkdir, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { isDeepStrictEqual } from 'node:util';
 import { Service } from '@deepseek-ai/cordis';
 import { installModelSelection } from '@deepseek-ai/dsh-agent';
@@ -54,6 +55,7 @@ import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { ATTACHMENT_MAX_BYTES, attachmentPayloadPath, attachmentsRoot, copyPathAttachment, newAttachmentId, readAttachment, sanitizeMediaType, sweepAttachmentCache, validatePathAttachment, writeAttachment } from "./attachments.js";
 import { acceptedTaskCompactionMembers, AutoCompactionCoordinator, PRE_COMPACTION_NOTICE_SUMMARY, preCompactionNoticeText } from "./auto-compaction.js";
 import { AGENT_TEAM_HUMAN_MEMBER_ID, AgentTeamLedger, agentTeamHumanActor } from "./ledger.js";
+import * as memberSkills from "./member-skills.js";
 import { classifyRecoverableError, RecoveryCoordinator, RECOVERY_MAX_CONSECUTIVE_ERRORS } from "./recovery.js";
 import { agentTeamDomainSpec } from "./spec.js";
 export { agentTeamDomainSpec, agentTeamOperationSchema } from "./spec.js";
@@ -61,6 +63,13 @@ export { AGENT_TEAM_HUMAN_MEMBER_ID, AGENT_TEAM_INITIALIZE_REQUEST_ID } from "./
 /** Process-stable marker carried by the final Team message tool definition. */
 export const AGENT_TEAM_PRESET_MARKER = Symbol.for('@wowyuarm/dsh-agent-team.preset');
 const AGENT_TEAM_PLUGIN_ID = '@wowyuarm/dsh-agent-team';
+/**
+ * Read-only core skills shipped beside the preset (the meta skill first:
+ * its description routes any skill-management work to itself). Resolved
+ * from this module's emitted location so it follows the installed plugin,
+ * like the preset roster's own root.
+ */
+const BUNDLED_SKILLS_DIRECTORY = resolve(dirname(fileURLToPath(import.meta.url)), '../core-skills');
 const INBOX_NOTICE_SUMMARY = 'Team Inbox has unread work.';
 const RECOVERY_NOTICE_SUMMARY = 'Recovery: continue your interrupted work.';
 const ORPHANED_MEMBER_DIAGNOSTIC = 'Member preset composition was lost after a reload; its tools are unavailable. Resume rebuilds the member in place.';
@@ -73,6 +82,14 @@ function sameChangeScope(left, right) {
         return left.threadRef === right.threadRef;
     return false;
 }
+/** Copy a Remote-supplied capability overlay into owned frozen storage. */
+function deepCopyCapabilities(capabilities) {
+    const copyAllow = (allow) => allow === undefined ? {} : { allow: [...allow] };
+    return {
+        ...(capabilities.tools === undefined ? {} : { tools: copyAllow(capabilities.tools.allow) }),
+        ...(capabilities.skills === undefined ? {} : { skills: copyAllow(capabilities.skills.allow) }),
+    };
+}
 /** Mark the preset's `team_message` definition as an Agent Team consumer. */
 export function markAgentTeamPreset(definition) {
     Object.defineProperty(definition, AGENT_TEAM_PRESET_MARKER, { value: true });
@@ -86,6 +103,22 @@ export const AGENT_TEAM_TOOL_NAMES = Object.freeze([
     'team_claim',
     'team_view',
 ]);
+/**
+ * A DM was durably recorded but its session injection could not run (no live
+ * handle, or the wake itself failed). The recorded DM stays durable; the
+ * sender should not blindly retry — the recipient recovers it through its DM
+ * history once its session is live again.
+ */
+export class AgentTeamDmDeliveryError extends Error {
+    recipientMemberId;
+    recipientHandle;
+    constructor(recipientMemberId, recipientHandle, message) {
+        super(message);
+        this.recipientMemberId = recipientMemberId;
+        this.recipientHandle = recipientHandle;
+        this.name = 'AgentTeamDmDeliveryError';
+    }
+}
 let AgentTeam = (() => {
     let _classSuper = TypertRemoteService;
     let _instanceExtraInitializers = [];
@@ -177,6 +210,10 @@ let AgentTeam = (() => {
         handles = new Map();
         /** Live selection refs let model edits take effect without disposing the Session. */
         modelSelections = new Map();
+        /** Live skill selection refs let capability edits re-filter the catalog without disposing the Session. */
+        skillSelections = new Map();
+        /** Per-Member private skill provider disposers; released with the Member's agent scope. */
+        skillProviderDisposals = new Map();
         /**
          * Why one Member shows error presence, per failure source. Reads prefer
          * activation, then runtime, then compaction; slots clear independently, so
@@ -185,6 +222,20 @@ let AgentTeam = (() => {
          * stale keys.
          */
         memberFailures = new Map();
+        /**
+         * Live per-Member tool restriction disposers, mirroring modelSelections:
+         * activation registers, disposal paths release, edits swap at a turn
+         * boundary. Deliberate interface reservation: the restriction seam is the
+         * primitive future Runtime Revision manifests orchestrate — do not remove
+         * during cleanup.
+         */
+        memberRestrictions = new Map();
+        /**
+         * Runtime-derived capability warnings, recomputed at every activation (like
+         * memberFailures, keyed by Member and never persisted): persisted warnings
+         * would lie after a Host restart or a Harness upgrade renames tools.
+         */
+        capabilityWarnings = new Map();
         autoCompaction;
         /** Agent ids with a turn in flight; restarts must wait for the boundary. */
         runningAgents = new Set();
@@ -281,6 +332,14 @@ let AgentTeam = (() => {
                 await Promise.all([...this.handles.values()].map(handle => handle.dispose()));
                 this.handles.clear();
                 this.modelSelections.clear();
+                this.skillSelections.clear();
+                for (const dispose of this.skillProviderDisposals.values())
+                    dispose();
+                this.skillProviderDisposals.clear();
+                for (const dispose of this.memberRestrictions.values())
+                    dispose();
+                this.memberRestrictions.clear();
+                this.capabilityWarnings.clear();
                 this.runningAgents.clear();
                 await domain.close();
             }, 'agentTeam.dispose');
@@ -413,6 +472,7 @@ let AgentTeam = (() => {
                     description: request.description,
                     presetId: request.presetId,
                     ...(request.model === undefined ? {} : { model: Object.freeze({ ...request.model }) }),
+                    ...(request.capabilities === undefined ? {} : { capabilities: Object.freeze(deepCopyCapabilities(request.capabilities)) }),
                     privateMemoryPath: dshHomePath('agent-team', 'members', memberId),
                     state: 'enabled',
                 });
@@ -526,6 +586,9 @@ let AgentTeam = (() => {
                 await active.dispose();
                 this.handles.delete(request.memberId);
                 this.modelSelections.delete(request.memberId);
+                this.skillSelections.delete(request.memberId);
+                this.releaseMemberToolPolicy(request.memberId);
+                this.releaseMemberSkillProvider(request.memberId);
                 this.clearMemberFailure(request.memberId, 'activation');
                 this.clearMemberNotificationState(request.memberId);
                 // The previous log survives on disk; archiving hides it from every
@@ -616,9 +679,55 @@ let AgentTeam = (() => {
                         throw new Error(`Agent Member '${stored.handle}' has no live model selection`);
                     selection.current = stored.model ?? this.ctx.agentDefaultModel.currentSelection();
                 }
+                if (active !== undefined && !isDeepStrictEqual(previous?.capabilities ?? undefined, stored.capabilities ?? undefined)) {
+                    await this.applyCapabilityEdit(active, stored);
+                }
                 return Object.freeze({ receipt: result.value.receipt, status: this.memberStatus(stored) });
             });
         }
+        /**
+         * Live-apply a capability edit at a turn boundary: while the Agent runs, the
+         * current turn keeps its schemas and catalog; the swap happens once idle,
+         * so the next step recomputes schemas from the new restriction and the
+         * durable replacement skill catalog from the new selection, with the same
+         * Session and history surviving. Suspend/remove during the wait cancels
+         * the swap — the disposed handle released the old restriction already and
+         * no disposer leaks.
+         */
+        async applyCapabilityEdit(active, stored) {
+            const memberId = stored.memberId;
+            if (this.runningAgents.has(active.agent.id)) {
+                await new Promise(resolve => {
+                    const disposers = [];
+                    const settle = () => {
+                        for (const dispose of disposers.splice(0))
+                            dispose();
+                        resolve();
+                    };
+                    disposers.push(this.ctx.on('agent/status', (payload) => {
+                        if (payload.agent !== active.agent)
+                            return;
+                        // A turn that ends — clean idle or error — is the boundary; the
+                        // next step recomputes schemas from the new restriction.
+                        if (payload.status !== 'running')
+                            settle();
+                    }), 
+                    // Disposal (suspend/remove/reactivation) resolves the wait: the old
+                    // restriction went with the disposed scope, so only the ledger
+                    // intent remains to apply at the next activation.
+                    this.ctx.on('session/disposed', (session) => {
+                        if (session.id === active.agent.session.id)
+                            settle();
+                    }));
+                });
+                if (this.handles.get(memberId) !== active)
+                    return;
+            }
+            this.reapplyMemberToolPolicy(stored);
+            const skillSelection = this.skillSelections.get(memberId);
+            if (skillSelection !== undefined)
+                skillSelection.swap(stored.capabilities?.skills?.allow);
+        }
         /** Irreversibly remove one Member, archive its Session, and delete its private namespace. */
         async removeMember(request) {
             return this.enqueueLifecycle(async () => {
@@ -813,6 +922,49 @@ let AgentTeam = (() => {
                 this.emitCommitted(result.value.receipt);
             return result.value;
         }
+        /**
+         * Agent-only direct message: append the audit-only dm-sent operation, then
+         * inject the body into the recipient's live session. The ledger commit is
+         * the durable fact; the injection is a transient runtime effect, so a
+         * missing handle or a failed wake returns a structured delivery error while
+         * the recorded DM stays durable for the recipient's recovery path.
+         */
+        async dmForAgent(agent, request) {
+            const actor = this.memberCall(agent, request.workspaceId);
+            const result = await this.requireLedger().sendDm({ ...request, actor });
+            if (!result.committed)
+                return result.value;
+            this.emitCommitted(result.value.receipt);
+            const recipient = result.value.recipient;
+            const handle = this.handles.get(recipient.memberId);
+            if (handle === undefined) {
+                throw new AgentTeamDmDeliveryError(recipient.memberId, recipient.handle, `DM recorded but not delivered: Agent Member '${recipient.handle}' has no live session; it will find the message in its DM history after recovery`);
+            }
+            try {
+                const message = createUserMessage({
+                    content: [{ type: 'text', text: this.dmRelayText(agent, recipient, request.body.trim(), result.value.receipt.operationId) }],
+                    source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'relay' },
+                });
+                // An idle recipient gets one ordinary turn; a busy one is steered into
+                // its current turn — the same wake split subagent continuations use.
+                if (handle.agent.status === 'idle')
+                    handle.agent.followup(message);
+                else
+                    handle.agent.steer(message);
+            }
+            catch (error) {
+                throw new AgentTeamDmDeliveryError(recipient.memberId, recipient.handle, `DM recorded but not delivered: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            return result.value;
+        }
+        /** Relay body: the DM itself plus one bounded line of adjacent context. */
+        dmRelayText(senderAgent, recipient, body, excluding) {
+            const sender = this.memberForAgent(senderAgent);
+            const prior = this.requireLedger().dmHistoryBetween(senderAgent.id, recipient.memberId, excluding);
+            const header = `Direct message from @${sender?.handle ?? 'a Team Member'}:`;
+            const context = prior === undefined ? '' : `\n\n[most recent prior DM between you: ${prior}]`;
+            return `${header}\n\n${body}${context}`;
+        }
         threadHistoryForAgent(agent, request) {
             const actor = this.memberActor(agent);
             this.requireAgentWorkspace(actor, request.workspaceId);
@@ -925,8 +1077,13 @@ let AgentTeam = (() => {
                 const selection = member.model ?? this.ctx.agentDefaultModel.currentSelection();
                 const agentOptions = { provider: selection.provider, model: selection.model };
                 const selected = { current: selection, assembled: undefined };
+                // Absent skills.allow loads every discovered private skill; a present
+                // allow-list filters the catalog by name through the live ref below.
+                // `swap` is bound by the provider at activation (no-op until then).
+                const skillSelection = { current: member.capabilities?.skills?.allow, swap: () => { } };
                 const setup = async (agentCtx) => {
                     await this.ctx.agentPresets.mount(agentCtx, member.presetId);
+                    this.applyMemberToolPolicy(agentCtx, member);
                     this.validateMemberPreset(agentCtx);
                     installModelSelection(agentCtx, selected);
                     return {
@@ -949,9 +1106,19 @@ let AgentTeam = (() => {
                         agentOptions,
                         setup,
                     });
+                // The Member-private skill provider registers on the created agent's
+                // exact scope layer (the traceable-service seam, like the tool
+                // restriction): bundled read-only core skills plus this Member's own
+                // private directory.
+                this.skillProviderDisposals.set(member.memberId, memberSkills.mountMemberSkillProvider(created.agent.ctx, {
+                    skillsDirectory: join(member.privateMemoryPath, 'skills'),
+                    bundledSkillsDirectory: BUNDLED_SKILLS_DIRECTORY,
+                    selection: skillSelection,
+                }));
                 await workspace.attachSession(member.sessionId);
                 this.handles.set(member.memberId, created);
                 this.modelSelections.set(member.memberId, selected);
+                this.skillSelections.set(member.memberId, skillSelection);
                 this.clearMemberFailure(member.memberId, 'activation');
                 this.nameMemberSession(member, created.agent);
                 this.notifyMember(created.agent);
@@ -960,6 +1127,9 @@ let AgentTeam = (() => {
             catch (error) {
                 await created?.dispose();
                 this.modelSelections.delete(member.memberId);
+                this.skillSelections.delete(member.memberId);
+                this.releaseMemberToolPolicy(member.memberId);
+                this.releaseMemberSkillProvider(member.memberId);
                 this.setMemberFailure(member.memberId, 'activation', error instanceof Error ? error.message : String(error));
             }
             finally {
@@ -986,6 +1156,9 @@ let AgentTeam = (() => {
                 if (stale !== undefined) {
                     this.handles.delete(memberId);
                     this.modelSelections.delete(memberId);
+                    this.skillSelections.delete(memberId);
+                    this.releaseMemberToolPolicy(memberId);
+                    this.releaseMemberSkillProvider(memberId);
                     // The composition-loss diagnostic this heal answers is stale once the
                     // rebuild starts; a later activation must not resurface it.
                     this.clearMemberFailure(memberId, 'compaction');
@@ -1026,8 +1199,79 @@ let AgentTeam = (() => {
             if (missing.length > 0)
                 throw new Error(`team-enabled preset is missing tools: ${missing.join(', ')}`);
         }
+        /**
+         * Apply one Member's persisted tool allow-list as a scoped restriction on
+         * the freshly composed preset surface, and derive activation-time warnings
+         * for entries the current tool surface no longer knows. Runs inside setup
+         * BEFORE validateMemberPreset so the validation observes the restricted
+         * view (the Host always unions the five Team tools over the configured
+         * list). Deliberate interface reservation: this restriction seam is the
+         * primitive future Runtime Revision manifests orchestrate — do not remove
+         * during cleanup.
+         */
+        applyMemberToolPolicy(agentCtx, member) {
+            const scope = scopeOf(agentCtx);
+            const configured = member.capabilities?.tools?.allow;
+            if (configured === undefined) {
+                this.capabilityWarnings.delete(member.memberId);
+                return;
+            }
+            // Drop names the current surface does not know rather than failing the
+            // activation: a Harness upgrade renaming a tool must not make the Member
+            // unavailable. The warning carries the known-name digest so a distant
+            // future reader can diagnose the drift.
+            const known = this.ctx.tools.schemas(scope).map(tool => tool.name);
+            const knownSet = new Set(known);
+            const dropped = configured.filter(name => !knownSet.has(name));
+            this.setCapabilityWarnings(member.memberId, dropped.map(name => ({ name, knownNames: known })));
+            const allow = [...new Set([...configured.filter(name => knownSet.has(name)), ...AGENT_TEAM_TOOL_NAMES])];
+            if (allow.length === 0)
+                return;
+            // tools.restrict() requires a scoped context and rejects names outside
+            // the inherited surface; both errors surface as this Member's activation
+            // failure without touching any other Member.
+            const dispose = agentCtx.tools.restrict({ allow });
+            this.memberRestrictions.set(member.memberId, dispose);
+        }
+        /** Swap a live Member's tool policy at a turn boundary: dispose the old restriction, apply the new. */
+        reapplyMemberToolPolicy(member) {
+            this.releaseMemberToolPolicy(member.memberId);
+            this.applyMemberToolPolicy(this.requireLiveMemberContext(member.memberId), member);
+        }
+        requireLiveMemberContext(memberId) {
+            const handle = this.handles.get(memberId);
+            if (handle === undefined)
+                throw new Error(`Agent Member '${this.memberLabel(memberId)}' has no live session for a tool-policy update`);
+            return handle.agent.ctx;
+        }
+        /** Release one Member's restriction disposer and warning state; safe to call twice. */
+        releaseMemberToolPolicy(memberId) {
+            const dispose = this.memberRestrictions.get(memberId);
+            if (dispose !== undefined) {
+                this.memberRestrictions.delete(memberId);
+                dispose();
+            }
+            this.capabilityWarnings.delete(memberId);
+        }
+        /** Release one Member's private skill provider; safe to call twice. */
+        releaseMemberSkillProvider(memberId) {
+            const dispose = this.skillProviderDisposals.get(memberId);
+            if (dispose === undefined)
+                return;
+            this.skillProviderDisposals.delete(memberId);
+            dispose();
+        }
+        setCapabilityWarnings(memberId, warnings) {
+            if (warnings.length === 0)
+                this.capabilityWarnings.delete(memberId);
+            else
+                this.capabilityWarnings.set(memberId, Object.freeze([...warnings]));
+        }
         async initializePrivateMemory(path) {
             await mkdir(join(path, 'notes'), { recursive: true });
+            // The Member-private skills directory starts empty; the per-Member
+            // provider scans exactly this root (default roots excluded).
+            await mkdir(join(path, 'skills'), { recursive: true });
             try {
                 await writeFile(join(path, 'memory.md'), '# Member memory\n\n## Stable facts\n- Add only verified, durable facts that help future work.\n\n## Notes index\n- Add focused `notes/*.md` entries here when a reusable detail needs on-demand reading.\n', { flag: 'wx' });
             }
@@ -1062,7 +1306,13 @@ let AgentTeam = (() => {
             const runtimeError = failures?.runtime ?? failures?.compaction;
             if (runtimeError !== undefined)
                 return Object.freeze({ member, availability: 'active', presence: 'error', diagnostic: runtimeError });
-            return Object.freeze({ member, availability: 'active', presence: handle.agent.status === 'running' ? 'working' : 'available' });
+            // Capability warnings are runtime-derived at activation (handles-scoped,
+            // like failures): absent while capabilities resolve cleanly.
+            const capabilityWarnings = this.capabilityWarnings.get(member.memberId);
+            return Object.freeze({
+                member, availability: 'active', presence: handle.agent.status === 'running' ? 'working' : 'available',
+                ...(capabilityWarnings === undefined ? {} : { capabilityWarnings }),
+            });
         }
         setMemberFailure(memberId, slot, message) {
             const failures = this.memberFailures.get(memberId) ?? {};
@@ -1247,6 +1497,9 @@ let AgentTeam = (() => {
                 this.handles.delete(memberId);
             }
             this.modelSelections.delete(memberId);
+            this.skillSelections.delete(memberId);
+            this.releaseMemberToolPolicy(memberId);
+            this.releaseMemberSkillProvider(memberId);
             this.clearMemberFailure(memberId, 'activation');
         }
         clearMemberRecoveryState(member) {