@wowyuarm/dsh-agent-team 0.1.8 → 0.1.10

package/README.md

@@ -17,7 +17,7 @@ An opt-in plugin for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-
 - **Workspaces organize everything.** Different projects live in different Workspaces, each managing its own Agents and Channels.
 - **The Human routes Channels and responsibilities.** You decide who is in which channel and what they own; mentions route work to the right agent.
 - **Task Threads carry one line of progress.** Claims set the direction, Threads hold the context, and multiple session agents advance the same line of work without talking past each other — the facts of the work live in one Thread.
-- **No context babysitting.** Member sessions compact automatically past the threshold, with a pre-compaction hint to persist key conclusions first. Every member keeps its own memory and notes across sessions, so identity and knowledge survive session renewal.
+- **No context babysitting.** Members manage their own context: roll over to a fresh one and stay on duty (`context_rollover`), or return to a past anchor (`context_timeline` / `context_checkpoint`); pending work survives switches and restarts, and memory and notes keep accumulating — a member carries its full memory into every new context.
 
 ## Preview
 
@@ -27,13 +27,13 @@ Agent Team is opt-in: after installation the ordinary DSH page stays as-is, and
 
 Entering Team mode shows Channels, managed Agents, and the collaboration timeline:
 
-![Team mode in the DSH Web UI: Channels and seven online Agents in the sidebar; the Main Channel shows Task references and the composer’s task switch](assets/readme/team-mode.png)
+![Team mode in the DSH Web UI: Channels and online Agent members in the sidebar, with the Main Channel showing Task references](assets/readme/team-mode.png)
 
 ### Task Threads
 
 A Task Thread keeps Claims, Agent handoffs, Human acceptance, and follow-up replies in one durable context.
 
-![Completed Task Thread in the DSH Web UI: a Claim, Agent handoffs, Human acceptance activity, and the reply composer](assets/readme/task-thread.png)
+![Task Thread in the DSH Web UI: Claims, Agent handoffs, Human acceptance activity, and the reply composer](assets/readme/task-thread.png)
 
 If this looks useful, a star on [GitHub](https://github.com/wowyuarm/dsh-agent-team) helps other DSH users find it.
 
@@ -41,7 +41,7 @@ If this looks useful, a star on [GitHub](https://github.com/wowyuarm/dsh-agent-t
 
 ### 1. Check DSH
 
-This release is certified against DSH `0.1.2-rc.1`. If `dsh` is not installed yet, start DSH with the official package:
+This release is certified against DSH `0.1.5-rc.1`. If `dsh` is not installed yet, start DSH with the official package:
 
 ```sh
 npx @deepseek-ai/dsh web
@@ -108,13 +108,6 @@ dsh web
 
 Published packages include built artifacts. A local checkout needs the adjacent Harness repository only for development checks, not for end-user installation.
 
-## Compatibility and limits
-
-- This release is certified against DSH `0.1.2-rc.1`, and requires it: earlier DSH versions are not supported.
-- The bundle is single-host. It does not provide distributed consensus, Team direct messages, nested Threads, or semantic Direction deduplication.
-- The current DSH SQLite Session schema rejects databases from older DSH versions. Delete the old Session database and start fresh when upgrading across that boundary; this bundle does not migrate it.
-- Team-managed Agent Sessions use `danger-full-access`. Use them only in trusted Workspaces.
-
 ## Development
 
 Read [`docs/README.md`](docs/README.md) for the maintained documentation index. The usual checks are:

package/README.zh.md

@@ -17,7 +17,7 @@
 - **Workspace 组织一切。** 不同项目放在不同 Workspace，各自管理自己的 Agents 与 Channels。
 - **Human 管 Channel 与职责。** 你决定谁在哪个频道、负责什么；@提及把工作路由到对的 Agent。
 - **Task Thread 串联推进。** 用 Task 认领方向、Thread 保持上下文，多个 Session Agent 围绕同一条工作线推进而不散乱。工作事实落在同一条 Thread 里，成员之间不会各说各的。
-- **无需操心上下文。** 成员会话超阈值自动压缩，压缩前提示成员先沉淀关键结论。每个成员的 memory 与 notes 跨会话保留，身份与知识不随会话续期丢失。
+- **无需操心上下文。** 上下文由成员自己管理：刷新到新上下文继续待命（`context_rollover`），或回到过去的锚点继续（`context_timeline` / `context_checkpoint`），切换与重启都不丢待决事项；memory 与 notes 持续沉淀，成员带着完整记忆进入新上下文。
 
 ## 预览
 
@@ -27,13 +27,13 @@ Agent Team 是按需启用的：安装后普通 DSH 页面保持原样，Team mo
 
 进入 Team mode 后是频道、受管 Agent 与协作时间线：
 
-![DSH Web UI 中的 Team mode：侧边栏展示频道与 7 位在线 Agent；Main 频道含 Task 引用和 composer 的作为任务开关](assets/readme/team-mode.png)
+![DSH Web UI 中的 Team mode：侧边栏展示频道与在线 Agent 成员；Main Channel 展示 Task 引用](assets/readme/team-mode.png)
 
 ### Task Thread
 
 Task Thread 把 Claim、Agent 交接、Human 验收和后续回复保留在同一条可持续阅读的上下文中。
 
-![DSH Web UI 中已完成的 Task Thread：含 Claim、Agent 交接、Human 验收活动和回复 composer](assets/readme/task-thread.png)
+![DSH Web UI 中的 Task Thread：含 Claim、Agent 交接、Human 验收活动和回复 composer](assets/readme/task-thread.png)
 
 如果觉得有用，欢迎在 [GitHub](https://github.com/wowyuarm/dsh-agent-team) 点个 star，帮更多 DSH 用户发现它。
 
@@ -41,7 +41,7 @@ Task Thread 把 Claim、Agent 交接、Human 验收和后续回复保留在同
 
 ### 1. 检查 DSH
 
-当前版本已针对 DSH `0.1.2-rc.1` 完成认证。如果还没有安装 `dsh`，先使用官方 package 启动 DSH：
+当前版本已针对 DSH `0.1.5-rc.1` 完成认证。如果还没有安装 `dsh`，先使用官方 package 启动 DSH：
 
 ```sh
 npx @deepseek-ai/dsh web
@@ -108,13 +108,6 @@ dsh web
 
 发布包已经包含构建产物。只有开发检查需要相邻的 Harness repository，终端用户安装不需要它。
 
-## 兼容性与限制
-
-- 当前版本已针对 DSH `0.1.2-rc.1` 完成认证，并且要求该版本：更早的 DSH 版本不受支持。
-- Bundle 是单 Host，不提供分布式共识、Team direct message、嵌套 Thread 或 Direction 语义去重。
-- 当前 DSH SQLite Session schema 不接受旧版 DSH 的数据库。跨越该边界升级时，删除旧 Session 数据库并重新开始；本 bundle 不负责迁移。
-- Team 管理的 Agent Session 使用 `danger-full-access`。只在可信 Workspace 中使用。
-
 ## 开发
 
 维护中的文档入口是 [`docs/README.zh.md`](docs/README.zh.md)。常用检查命令：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wowyuarm/dsh-agent-team",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "A persistent agent team for long-running collaboration in DeepSeek Harness",
   "repository": {
     "type": "git",
@@ -8,6 +8,7 @@
   },
   "private": false,
   "type": "module",
+  "packageManager": "pnpm@11.7.0",
   "files": [
     "cordis.patch.yml",
     "packages/agent-team/lib/**/*",
@@ -50,7 +51,7 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/dsh-storage-sqlite": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-storage-sqlite": ">=0.1.5-rc.1 <0.2.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -105,6 +106,14 @@
       "types": "./packages/agent-team/lib/types/member-context.d.ts",
       "default": "./packages/agent-team/lib/member-context.js"
     },
+    "./member-time-context": {
+      "types": "./packages/agent-team/lib/types/member-time-context.d.ts",
+      "default": "./packages/agent-team/lib/member-time-context.js"
+    },
+    "./time-format": {
+      "types": "./packages/agent-team/lib/types/time-format.d.ts",
+      "default": "./packages/agent-team/lib/time-format.js"
+    },
     "./member-skills": {
       "types": "./packages/agent-team/lib/types/member-skills.d.ts",
       "default": "./packages/agent-team/lib/member-skills.js"
@@ -121,48 +130,49 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-agent-default-model": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-agent-presets": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-agent-tool-presentation": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-api-remotes": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-api-session-controller": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-brand": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-settings-general": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-client-ui-workspace": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-command-compact": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-compaction": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-home-paths": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-invariants": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-llm": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-sandbox-policy": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-scope": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-session": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-session-persistence": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-skill": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-storage-domain": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-token-meter": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-bash": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-fs": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-fs-search": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-jobs": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-pwsh": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-skill": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-todo": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tool-web": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-tools": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.2-rc.1 <0.2.0",
-    "@deepseek-ai/dsh-workspace": ">=0.1.2-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-agent": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-agent-default-model": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-agent-presets": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-agent-tool-presentation": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-api-remotes": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-api-session-controller": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-brand": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-settings-general": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-client-ui-workspace": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-command-compact": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-compaction": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-invariants": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-sandbox-policy": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-scope": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-session-format-catalog": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-session-persistence": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-skill": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-storage-domain": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-token-meter": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-bash": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-fs": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-fs-search": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-jobs": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-pwsh": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-skill": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-todo": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tool-web": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-rc.1 <0.2.0",
+    "@deepseek-ai/dsh-workspace": ">=0.1.5-rc.1 <0.2.0",
     "react": "^18.2.0"
   },
   "keywords": [

package/packages/agent-team/README.md

@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-The Host capability for one Agent Team in a dshHome. `ctx.agentTeam` owns the append-only operation ledger, reconstructs the current collaboration projection, and is the lifecycle owner for member Agents managed by the same capability. Thread Attention and the Member Inbox are durable Host projections. When unread state changes, this package sends one bounded, coalesced context notification through the Agent's public safe-boundary API; it never interrupts an active request or acts as a Session delivery worker. The [Agent Team architecture note](../../../.agents/notes/proposed/architecture/2026-08-15-agent-team-operation-ledger.md) owns the persistence and package-topology decisions.
+The Host capability for one Agent Team in a dshHome. `ctx.agentTeam` owns the append-only operation ledger, reconstructs the current collaboration projection, and is the lifecycle owner for member Agents managed by the same capability. Thread Attention and the Member Inbox are durable Host projections. When unread state changes, this package sends one bounded, coalesced context notification through the Agent's public safe-boundary API; it never interrupts an active request or acts as a Session delivery worker. The [Agent Team architecture note](../../.scratch/archive/2026-08/m1/design/agent-notes/2026-08-15-agent-team-operation-ledger.md) owns the persistence and package-topology decisions.
 
 ## Service contract
 
@@ -16,13 +16,13 @@ Every operation record carries a positive global sequence, unique operation and
 
 `storage-domain` validates every record at the durable read boundary and rejects a backend unit stamped with another version. The Team updates its projection only after `KvTable.put()` resolves. Its Fiber owns the Domain handle; disposal rejects new Service calls through Cordis removal, drains accepted Domain writes, and closes the backend unit before the name can reopen.
 
-Member creation commits one stable Member/session/Workspace/preset/private-memory identity before unpublished Agent setup. Setup mounts the selected preset and validates its marked `team_message` plus all five Team tools before publication. Failure leaves only that Member unavailable. Suspend waits for the owned `AgentHandle` to stop; resume and Host remount restore the exact persisted session.
+Member creation commits one stable Member/session/Workspace/preset/private-memory identity before unpublished Agent setup. Setup mounts the selected preset and validates its marked `team_message` plus all eight Team tools before publication. Failure leaves only that Member unavailable. Suspend waits for the owned `AgentHandle` to stop; resume and Host remount restore the exact persisted session.
 
 Archival is the reversible third state between suspend and remove, for Members and Channels alike. `archiveMember` commits `team/member-archived`, disposes the live session while keeping private memory and the Session log on disk, archives the Session from grouping surfaces, and releases the Member's active Claims with public `claims_released` Activities plus Attention/marker cleanup. `archiveChannel` commits `team/channel-archived` with the same release shape across every owner on the Channel's Threads. Memberships survive both forms — hidden state, not departure. Archived entities are gone from every Team API surface: projections, ref resolution (their Task refs stop resolving, so message bodies render plain text), and ref-addressed reads (`readThread`/`threadHistory`/`threadObservations`/`listClaims` reject with an explicit archived error) — while the facts stay complete in the ledger for replay and a future restore; that boundary is the archival-vs-remove divide. Removal from archived stays available as the data hygiene path; there is no restore entry point yet (mirroring archived dsh sessions).
 
 Members optionally carry durable capability intent (`capabilities.tools.allow`, `capabilities.skills.allow`). It flows verbatim through every lifecycle operation, replays unchanged after Host restart, and commits without known-name validation so Harness upgrades can never break old ledgers; divergence from known names surfaces at activation as derived, non-persisted `capabilityWarnings`. `tools.allow` is a deliberate interface reservation (no UI write path today) that future Runtime Revision manifest orchestration depends on. Edits follow absent-clears semantics like `model`: a caller that does not manage capabilities must echo the stored value back or its edit clears the override.
 
-Activation applies `tools.allow` as a scoped restriction over the composed preset surface (mount → restrict → validate) with the five Team tools force-unioned over the configured list; unknown names drop with a warning rather than failing the Member. A live allow-list edit swaps the restriction at a turn boundary in the same Session — idle Members apply immediately, and an edit racing a running turn waits for it while later lifecycle operations queue behind the wait. Restriction failures isolate to that Member's activation diagnostic.
+Activation applies `tools.allow` as a scoped restriction over the composed preset surface (mount → restrict → validate) with the eight Team tools force-unioned over the configured list; unknown names drop with a warning rather than failing the Member. A live allow-list edit swaps the restriction at a turn boundary in the same Session — idle Members apply immediately, and an edit racing a running turn waits for it while later lifecycle operations queue behind the wait. Restriction failures isolate to that Member's activation diagnostic.
 
 Skills are Member-private: the preset has no shared skill-filesystem row, and the Host registers one provider per Member that scans exactly the plugin's bundled read-only core skills (`packages/agent-team/core-skills/` — the `member-skill-manager` meta skill that owns all skill craft guidance) plus that Member's writable `skills/` directory under its private memory path (default roots excluded). Installing is writing into the Member's own directory — directory form `skills/<name>/SKILL.md` with optional references and scripts, or a flat `.md` — and there is deliberately no upload Remote. The persona itself only states the private-space physical facts; the meta skill's description routes skill-management work to it. `skills.allow` filters the catalog through a live selection ref swapped at the same turn boundary; the filesystem watcher feeds discovery after a self-install.
 
@@ -40,7 +40,9 @@ M1 supports one Host writer. The ledger is permanent and has no snapshot or comp
 
 The bundle consumes the Host's existing singleton providers; it does not mount replacements for `agents`, default model selection, `tools`, `fs`, `sandboxPolicy`, Session store/persistence, Workspace registry, or storage. Load those Host services once, then mount this Service and its invariant companion. The Team Web Client is the only Human control surface.
 
-A team-enabled preset registers the five tools in its own agent scope and marks the `team_message` definition with `markAgentTeamPreset()`. Preset rows must resolve `ctx.agentTeam` when executing, not statically inject it: the Host mounts member presets while it restores Members during its own activation, so a row that declares `agentTeam` as a dependency cannot activate and fails every startup restore. Duplicate scoped tool names fail during unpublished setup and make only that Member unavailable. Duplicate Host service providers remain a composition error and should be removed rather than layered.
+A team-enabled preset registers the eight tools in its own agent scope and marks the `team_message` definition with `markAgentTeamPreset()`. Preset rows must resolve `ctx.agentTeam` when executing, not statically inject it: the Host mounts member presets while it restores Members during its own activation, so a row that declares `agentTeam` as a dependency cannot activate and fails every startup restore. Duplicate scoped tool names fail during unpublished setup and make only that Member unavailable. Duplicate Host service providers remain a composition error and should be removed rather than layered.
+
+Member context self-management rides the same lifecycle owner. The `context_rollover` and `context_checkpoint` tools only validate and conclude/anchor the turn; one `ContextManagementCoordinator` watches Member Session events, derives rollover and checkpoint intent from the durable successful `tool/call`+`tool/result` pairs, and executes the swap through the serialized lifecycle queue: wait for true idle, recheck the owned-jobs guard, dispose and archive the old Session (never delete), commit the idempotent `team/member-session-rolled-over` operation (Member actor, self-scoped, no handoff prose), activate a genuinely fresh Session — or a seeded Session for a checkpoint return, with the exact completed-turn prefix — then deliver the handoff and any carried non-Team input. Identity, model, private memory, skills, Claims, and Attention survive; process state is reconstructible from the durable log after a crash, including a handoff reconstructed from the ledger-recorded previous Session when a restart lands between the rollover commit and the new Session's activation. A second Host-owned coordinator (`pressure-policy.ts`) owns context pressure: budget thresholds from the live route's context window, one handoff-budget notice per generation, forced in-place compaction with fail-closed verification at the hard limit, and one bounded compact-and-retry for provider context-overflow; accepted-Task auto compaction is retired. The Human-side clear-context Remote remains a hidden migration escape hatch with no visible Client entry point.
 
 ## Model Experience
 
@@ -63,4 +65,4 @@ The Host ledger and Human status reads do not alter model requests or cache reus
 - **Single Host writer** — concurrent processes over one dshHome are unsupported; operation serialization is process-local.
 - **Permanent ledger** — M1 provides neither snapshots nor compaction, so storage grows with committed collaboration facts.
 - **No remote provider seam** — the package combines the capability definition and its only implementation until a real remote Consumer requires another Provider.
-- **Current DSH SQLite only** — SQLite Session persistence uses the current DSH schema. Delete old Session databases and create new Member sessions; this package provides no migration, compatibility read, or fallback.
+- **No Session migration of its own** — Member Sessions ride the Host's Session persistence and its released-format migration chain; this package provides no Team ledger or Member Session migration, compatibility read, or fallback.

package/packages/agent-team/README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-一个 dshHome 内唯一 Agent Team 的 Host capability。`ctx.agentTeam` 拥有 append-only operation ledger、重建当前协作 projection，并作为同一 capability 内 Member Agent 的 lifecycle owner。Thread Attention 和 Member Inbox 是 Host 的持久 projection。未读状态变化时，本包通过 Agent 的公开安全边界 API 发送一次有界、合并的 context 通知；不会中断正在执行的请求，也不运行 Session delivery worker。[Agent Team 架构 Agent Note](../../../.agents/notes/proposed/architecture/2026-08-15-agent-team-operation-ledger.md)记录持久化和包拓扑决策。
+一个 dshHome 内唯一 Agent Team 的 Host capability。`ctx.agentTeam` 拥有 append-only operation ledger、重建当前协作 projection，并作为同一 capability 内 Member Agent 的 lifecycle owner。Thread Attention 和 Member Inbox 是 Host 的持久 projection。未读状态变化时，本包通过 Agent 的公开安全边界 API 发送一次有界、合并的 context 通知；不会中断正在执行的请求，也不运行 Session delivery worker。[Agent Team 架构 Agent Note](../../.scratch/archive/2026-08/m1/design/agent-notes/2026-08-15-agent-team-operation-ledger.md)记录持久化和包拓扑决策。
 
 ## Service 约定
 
@@ -16,13 +16,13 @@ Service 使用 `ctx.storageDomain`、`ctx.workspaceRegistry`、`ctx.agents`、`c
 
 `storage-domain` 在持久读取处校验每条 record，并拒绝被其他版本标记的 backend unit。Team 只在 `KvTable.put()` 完成后更新 projection。其 Fiber 持有 Domain handle；dispose 通过 Cordis 移除拒绝新的 Service 调用，排空已接受的 Domain write，并在名称可重新打开前关闭 backend unit。
 
-创建 Member 时，先提交稳定的 Member/session/Workspace/preset/private-memory 身份，再执行 unpublished Agent setup。Setup 挂载指定 preset，并在发布前检查带 marker 的 `team_message` 和全部五个 Team tools。失败只把该 Member 标为 unavailable。Suspend 等待所属 `AgentHandle` 完全停止；resume 和 Host remount 恢复同一个持久 session。
+创建 Member 时，先提交稳定的 Member/session/Workspace/preset/private-memory 身份，再执行 unpublished Agent setup。Setup 挂载指定 preset，并在发布前检查带 marker 的 `team_message` 和全部八个 Team tools。失败只把该 Member 标为 unavailable。Suspend 等待所属 `AgentHandle` 完全停止；resume 和 Host remount 恢复同一个持久 session。
 
 归档（archival）是介于 suspend 与 remove 之间的可逆第三态，Member 与 Channel 通用。`archiveMember` 提交 `team/member-archived`，dispose 活跃 session（私有记忆与 Session log 留在磁盘），把 Session 从分组面归档，并释放该 Member 的活跃 Claim（公开 `claims_released` Activity + Attention/marker 清理）。`archiveChannel` 提交 `team/channel-archived`，对该频道全部 Threads 上所有 owner 做同样的释放。两种归档都保留 Memberships——是隐藏而非离开。归档实体在所有 Team API 面上"默认不存在"：投影、ref 解析（其 Task ref 不再解析，消息正文渲染为纯文本）、按 ref 的读取（`readThread`/`threadHistory`/`threadObservations`/`listClaims` 以明确的 archived 错误拒绝）——而事实在 ledger 中完整保留，供重放与未来恢复；这条边界正是归档与 remove 的分界。从归档态 remove 仍可用（数据卫生路径）；本轮有意不提供恢复入口（对齐 dsh session 归档现状）。
 
 Member 可携带持久能力意图（`capabilities.tools.allow`、`capabilities.skills.allow`）。它随全部 lifecycle operation 原样流转，Host restart 后原样重放，commit 时不做已知名校验（Harness 升级不会破坏旧 ledger）；与已知名的偏差在 activation 时派生为不持久化的 `capabilityWarnings`。`tools.allow` 是有意的接口预留（当前无 UI 写入路径），供后续 Runtime Revision manifest 编排依赖。编辑语义与 `model` 一致（absent 即清除）：不管理 capabilities 的调用方必须回传已存储的值，否则其编辑会清掉该覆盖。
 
-Activation 把 `tools.allow` 作为 scoped restriction 应用在已组合的 preset 面上（mount → restrict → validate），五个 Team tools 在配置之上强制并集；未知名 drop + warning，不使 Member 失败。对 live Member 的 allow-list 编辑在 turn 边界同 Session 换装 restriction——idle 立即生效，与 running turn 竞争的编辑等待其结束，后续 lifecycle 操作在该等待之后排队。restriction 失败只隔离为该 Member 的 activation diagnostic。
+Activation 把 `tools.allow` 作为 scoped restriction 应用在已组合的 preset 面上（mount → restrict → validate），八个 Team tools 在配置之上强制并集；未知名 drop + warning，不使 Member 失败。对 live Member 的 allow-list 编辑在 turn 边界同 Session 换装 restriction——idle 立即生效，与 running turn 竞争的编辑等待其结束，后续 lifecycle 操作在该等待之后排队。restriction 失败只隔离为该 Member 的 activation diagnostic。
 
 Skills 是 Member 私有的：preset 不带共享 skill-filesystem row，Host 为每个 Member 注册一个 provider，只扫插件内置的只读 core skills（`packages/agent-team/core-skills/`——`member-skill-manager` meta skill，全部 skill 写作/安装/credentials 引导都在它里面）加该 Member 可写的私有 `skills/` 目录（排除默认 roots）。安装就是往自己目录写——目录形态 `skills/<name>/SKILL.md` + 可选 references/scripts，或平铺 `.md`——有意不提供上传 Remote。persona 只陈述私有空间物理事实，meta skill 的 description 负责"涉及 skill 管理工作时先读我"。`skills.allow` 通过同一 turn 边界换装的 live selection ref 过滤 catalog；自装后的发现由 filesystem watcher 驱动。
 
@@ -40,7 +40,9 @@ M1 支持单个 Host writer。Ledger 永久保留，不提供 snapshot 或 compa
 
 Bundle 使用 Host 已有的 singleton provider，不重复挂载 `agents`、默认模型选择、`tools`、`fs`、`sandboxPolicy`、Session store/persistence、Workspace registry 或 storage 的替代实现。Host services 只挂载一次，再挂载本 Service 及 invariant companion。`/team` 等 Human control 是独立 Consumer。
 
-Team-enabled preset 在自身 Agent scope 注册五个工具，并用 `markAgentTeamPreset()` 标记 `team_message` definition。Preset row 应在执行时读取 `ctx.agentTeam`，不能声明静态 inject：Host 在自身激活期间恢复 Member 时就会挂载成员 preset，声明依赖 `agentTeam` 的 row 无法激活，会让每次启动恢复失败。Scoped tool 重名会在 unpublished setup 阶段失败，只使对应 Member unavailable。Host service provider 重复则仍是 composition error，应删除重复行，不做叠加。
+Team-enabled preset 在自身 Agent scope 注册八个工具，并用 `markAgentTeamPreset()` 标记 `team_message` definition。Preset row 应在执行时读取 `ctx.agentTeam`，不能声明静态 inject：Host 在自身激活期间恢复 Member 时就会挂载成员 preset，声明依赖 `agentTeam` 的 row 无法激活，会让每次启动恢复失败。Scoped tool 重名会在 unpublished setup 阶段失败，只使对应 Member unavailable。Host service provider 重复则仍是 composition error，应删除重复行，不做叠加。
+
+Member 上下文自主管理复用同一 lifecycle owner。`context_rollover` 与 `context_checkpoint` 工具只做校验并结束/锚定 turn；单一 `ContextManagementCoordinator` 监听 Member Session 事件，从 durable 的成功 `tool/call`+`tool/result` 对派生 rollover 与 checkpoint 意图，并经串行 lifecycle queue 执行换窗：等真正 idle、复查 owned-jobs guard、dispose 并归档旧 Session（绝不删除）、提交幂等的 `team/member-session-rolled-over` operation（Member actor、仅限自身、不写 handoff 正文）、激活全新 Session——checkpoint 回返则以精确 completed-turn 前缀作 seed——再送达 handoff 与携带的非 Team 输入。身份、模型、私有记忆、skills、Claims 和 Attention 全部保留；进程内状态在崩溃后可从 durable log 重建，包括重启落在 rollover commit 与新 Session 激活之间时，从 ledger 记录的上一 Session 重建 handoff。第二个 Host 持有的 coordinator（`pressure-policy.ts`）拥有上下文压力：预算阈值从当前 route 的 context window 派生，handoff 预算每 generation 一条通知，硬上限强制原地 compaction 并 fail-closed 验证，provider context-overflow 获得一条有界 compact-and-retry；已接受 Task 的自动 compaction 已退役。Host 侧 clear-context Remote 保留为无可见 Client 入口的迁移逃生门。
 
 ## Model Experience
 
@@ -63,3 +65,4 @@ Host ledger 和 Human status read 不改变模型请求或 cache reuse。
 - **单 Host writer** — 不支持多个进程并发写同一 dshHome；operation serialization 只在进程内生效。
 - **永久 ledger** — M1 不提供 snapshot 或 compaction，storage 会随已提交协作事实增长。
 - **没有 remote provider seam** — 在真实 remote Consumer 需要另一 Provider 前，本包合并 capability definition 和唯一实现。
+- **自身不提供 Session 迁移** — Member Sessions 依赖 Host 的 Session persistence 与其已发布格式迁移链；本包不提供 Team ledger 或 Member Session 迁移、兼容读取或回退。

package/packages/agent-team/lib/attachments.js

@@ -24,15 +24,25 @@ export function attachmentPayloadPath(attachmentId, name) {
 export function newAttachmentId() {
     return randomUUID();
 }
-/** Strip path separators, control characters, and leading dots from one client-supplied name. */
+/** Strip path separators, control characters, Windows-illegal characters, reserved device names, and leading dots from one client-supplied name. */
 export function sanitizeFileName(raw) {
-    // oxlint-disable-next-line no-control-regex -- strip ASCII control characters from client filenames.
-    const cleaned = raw.replaceAll(/[\\/\u0000-\u001f\u007f]/g, '').replaceAll(/^\.+/g, '').trim().slice(0, 180);
+    // oxlint-disable no-control-regex -- strip ASCII control characters, separators, and Windows-reserved characters from client filenames.
+    const cleaned = raw
+        .replaceAll(/[\\/:*?"<>|\u0000-\u001f\u007f]/g, '')
+        .replaceAll(/^\.+/g, '')
+        .trim()
+        .slice(0, 180)
+        .replace(/[\s.]+$/g, '');
+    // oxlint-enable no-control-regex
     if (cleaned === '')
         return 'attachment';
     // The metadata sidecar owns 'meta.json' inside every entry directory; a
     // payload with that name would be clobbered by the sidecar and unreadable.
-    return /^meta\.json$/i.test(cleaned) ? `_${cleaned}` : cleaned;
+    if (/^meta\.json$/i.test(cleaned))
+        return `_${cleaned}`;
+    // Win32 CreateFile resolves these device names (with or without an
+    // extension) as hardware, so the payload write would fail or alias a device.
+    return /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i.test(cleaned) ? `_${cleaned}` : cleaned;
 }
 /** Extension-derived media types for agent-supplied files; unknown types stay generic. */
 const PATH_MEDIA_TYPES = {