@corenel/harness 0.13.0 → 0.15.0

package/dist/sidecar/server.js

@@ -1,7 +1,220 @@
-import { DEFAULT_STATE_DIR, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, denialNote } from '@corenel/protocol';
+import { decodePcm16, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
 import { SIDECAR_PROTOCOL, errMessage, isLoopbackHost, isLoopbackAddress, parseMcpToolAddress, isWebPushSubscription, MAX_ASSERTION_LEN, isClerkOrgId, } from '@corenel/protocol';
+import { activityForViewer, askForViewer, withoutViewerClaims } from './askView.js';
+import { capabilityMissingMessage } from './hostCapability.js';
 import { asEcPublicJwk, jwkThumbprint, verifySignature, randomToken, serverProofPayload, clientProofPayload, bytesToB64url, codeProof, sameB64, B64URL_32, } from './deviceKeys.js';
+import { MEMBER_GATE_ALLOWED, pendingRefusal } from './memberGate.js';
+/** A deliberate refusal from the approvals port, written for the person who
+ * asked: its message goes on the wire as is. Recognized by `name`, not by
+ * `instanceof`, so a second copy of this module (a test alias, a bundled
+ * build) cannot turn a refusal into APPROVALS_FAILED. */
+export class ApprovalsRefusal extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ApprovalsRefusal';
+    }
+}
+export function isApprovalsRefusal(e) {
+    return e instanceof Error && e.name === 'ApprovalsRefusal';
+}
+/** Team-mode approvals refusals and the fixed text for an unexpected error
+ * (Part C). Exported for the tests. */
+export const APPROVALS_FAILED = 'Standing approvals could not be read or changed. The daemon log has the reason.';
+export const APPROVALS_NO_USER = 'In team mode standing approvals need a verified user on this connection.';
+export const APPROVALS_NAME_AGENT = 'Name the agent: in team mode standing approvals belong to one agent, and only its owner can revoke them.';
 const NO_CHECKS = 'this sidecar does not run checks (start it with --allow-shell)';
+/** Team agent access refusals (Part B). Exported for the tests. */
+export const WATCH_REFUSED = 'You can watch only runs you started, or unattended runs of an agent you own.';
+export const ACCESS_NO_ROLE = 'NO_ACCESS: you have no role on this agent, or too low a role for this.';
+export const ACCESS_NOT_OWNER = "NOT_OWNER: only this agent's owner or the daemon admin can change it.";
+export const ACCESS_ADMIN_ONLY = 'NOT_OWNER: only the daemon admin can change the crew folder itself.';
+export const ACCESS_STORE_REFUSED = 'The access store is never writable.';
+export const ACCESS_CHECK_FAILED = 'NOT_OWNER: could not check access.';
+export const ACCESS_FAILED = 'Access could not be checked or changed. The daemon log has the reason.';
+/** An uncoded peer-* failure; the detail goes to the log. One source: the peer admin port reuses it. */
+export const PEER_FAILED = 'Your team daemon links could not be read or changed. The daemon log has the reason.';
+/** Team run history (spec 2026-10-01 E5.6): an uncoded failure. Fixed text; the daemon log has the detail. */
+export const AGENT_RUNS_FAILED = 'Team runs could not be read. The daemon log has the reason.';
+/** A ref the request carried that names no agent this daemon could hold. */
+const AGENT_RUNS_BAD_REF = 'That agent reference is not valid.';
+/** Part E: a member request the member list could not answer. Fixed text; the
+ * daemon log has the detail. */
+export const MEMBER_FAILED = 'The member request could not be answered. The daemon log has the reason.';
+/** A device store failure. Fixed text; the daemon log has the detail. */
+export const DEVICES_FAILED = 'The paired devices could not be read or changed. The daemon log has the reason.';
+/** Part D credential refusals (exported for the tests). A refusal with no
+ * reply code of its own goes out as fixed text; the daemon log has the detail. */
+export const AGENT_CRED_FAILED = 'Agent credentials could not be checked or changed. The daemon log has the reason.';
+export const AGENT_CRED_LOGIN_FAILED = 'The sign-in did not finish. The daemon log has the reason.';
+export const AGENT_CRED_SOLO = 'This daemon does not keep agent access.';
+export const MCP_ADMIN_ONLY = "In team mode only the daemon admin can use or change this machine's MCP servers directly.";
+export const SESSION_REFUSED = 'In team mode a session is reachable only by the member who created it, or the daemon admin.';
+export const SNAPSHOT_REFUSED = 'In team mode you can restore only from a snapshot of a session you created.';
+export const SNAPSHOT_NAME_REFUSED = 'In team mode a snapshot name is chosen by the daemon; only the daemon admin can name one.';
+export const SNAPSHOT_USAGE_ADMIN_ONLY = "In team mode only the daemon admin can see this machine's snapshot usage.";
+/** An agent in the daemon's own crew, as a ref: `crew/<agent>` on the config channel. */
+const daemonAgent = (agent) => ({ owner: { kind: 'daemon' }, agent });
+const sameConfigName = (a, b) => a.toLowerCase() === b.toLowerCase();
+/** Team mode: a room runs its agents for the person who opens or drives it. */
+export const ROOM_RUN_REFUSED = 'You need contributor or higher on every agent in this room to open or drive it.';
+export const OUTPUT_REFUSED = 'You can see the output only of runs you started, or of unattended runs of an agent you own.';
+/** Bounds on a hello's `provides.mcp.urls`. A list outside them is carried as
+ * NOTHING (not truncated): the fail-safe reading is "serves nothing". */
+const MAX_PROVIDED_URLS = 32;
+const MAX_PROVIDED_URL_LEN = 2048;
+function providedMcpUrls(v) {
+    if (typeof v !== 'object' || v === null)
+        return [];
+    const mcp = v.mcp;
+    if (typeof mcp !== 'object' || mcp === null)
+        return [];
+    const urls = mcp.urls;
+    if (!Array.isArray(urls) || urls.length > MAX_PROVIDED_URLS)
+        return [];
+    const list = urls;
+    return list.every((u) => typeof u === 'string' && u.length > 0 && u.length <= MAX_PROVIDED_URL_LEN) ? list : [];
+}
+/** The only messages a peer daemon's connection is served (spec 2026-10-01
+ * Part D): the handshake, and the answers to this daemon's own host-calls. A
+ * peer is a VERIFIED connection of its member but not that member's app, so
+ * nothing a person's app may ask for (runs, run events, approvals, access,
+ * permission answers, crew deploys, config, files) reaches it. */
+const PEER_DAEMON_MESSAGES = new Set([
+    'hello', 'client-proof', 'identity-assert', 'host-call-result',
+]);
+/** Server names a credential message may never carry: auth.json is keyed by
+ * server name, and these are Object.prototype's own. */
+const AGENT_CRED_RESERVED_SERVERS = new Set(['__proto__', 'constructor', 'prototype']);
+/** A message field made safe to put in a log line: control characters
+ * (C0, DEL, C1) removed, so it cannot forge or split a line. */
+function logSafe(s) {
+    return s.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
+}
+/** The code a thrown refusal carries, when it is one a reply may name. */
+function agentCredCodeOf(err) {
+    const code = typeof err === 'object' && err !== null ? err.code : undefined;
+    return typeof code === 'string' && AGENT_CRED_ERROR_CODES.includes(code) ? code : null;
+}
+const ACCESS_ERROR_CODES = new Set([
+    'NOT_TEAM_AGENT', 'NOT_OWNER', 'NO_ACCESS', 'UNKNOWN_AGENT', 'UNKNOWN_USER',
+    'OWNER_NOT_GRANTABLE', 'BAD_ROLE', 'STORE_SEALED_BAD', 'MEMBER_PENDING',
+]);
+/** A crew agent ref rebuilt from its own fields. Throws on anything else, so a
+ * malformed port row becomes the handler's fixed-text failure. */
+function crewAgentRefOf(ref) {
+    const o = ref.owner;
+    const owner = o.kind === 'daemon' ? { kind: 'daemon' }
+        : o.kind === 'host' ? { kind: 'host', dirName: String(o.dirName) }
+            : o.kind === 'workspace' ? { kind: 'workspace', dirName: String(o.dirName), workspaceId: String(o.workspaceId) }
+                : o.kind === 'workdir' ? { kind: 'workdir', root: String(o.root), ...(o.project !== undefined ? { project: String(o.project) } : {}) }
+                    : (() => { throw new Error('access overview: a row has an unknown owner kind'); })();
+    return { owner, agent: String(ref.agent) };
+}
+/** One overview row rebuilt from named fields only (Part E, E2): whatever
+ * else a port's row, grant or binding map carries never reaches the wire. */
+function accessOverviewRowOf(r) {
+    const mcp = Object.create(null);
+    for (const [server, binding] of Object.entries(r.mcp)) {
+        if (server === '__proto__')
+            continue;
+        if (binding === 'asker' || binding === 'agent')
+            mcp[server] = binding;
+    }
+    return {
+        ref: crewAgentRefOf(r.ref),
+        owner: String(r.owner),
+        you: r.you,
+        grants: r.grants.map((g) => ({ userId: String(g.userId), role: g.role, grantedBy: String(g.grantedBy), at: String(g.at) })),
+        mcp,
+        agentCredMissing: r.agentCredMissing.map(String),
+        ownerInactive: r.ownerInactive === true,
+    };
+}
+/** One team run row rebuilt from its own fields, each held to its type
+ * whatever the runner handed back: strings stay strings (capped), numbers
+ * finite, `canOpen` and `mine` true only when exactly true. Nothing else
+ * the runner returned reaches the wire. */
+function agentRunRowOf(r) {
+    const str = (v, max) => (typeof v === 'string' ? v.slice(0, max) : '');
+    const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+    const origin = isRunOrigin(r.origin) ? r.origin : 'user';
+    return {
+        runId: str(r.runId, 200),
+        // Opaque paging cursor, passed back as `before` (clamped to 200 there too).
+        cursor: str(r.cursor, 200),
+        ...(typeof r.requesterLabel === 'string' ? { requesterLabel: r.requesterLabel.slice(0, 200) } : {}),
+        origin, startedAt: num(r.startedAt), outcome: str(r.outcome, 40), durationMs: Math.max(0, num(r.durationMs)),
+        canOpen: r.canOpen === true,
+        ...(r.mine === true ? { mine: true } : {}),
+    };
+}
+/** An inactive deployment rebuilt from its one field: a display name, never a
+ * user id or a path, whatever the port handed back. */
+function inactiveDeploymentOf(e) {
+    return { agent: String(e.agent) };
+}
+const AGENT_RUNS_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+const AGENT_RUNS_DIR_RE = /^[a-z0-9_-]{1,32}$/;
+function hasControlChar(s) {
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c < 0x20 || c === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Same shape rules as @corenel/crew's validateRef, which this package cannot
+ * import (it depends on protocol only). The runner validates and canonicalizes
+ * again; this only keeps a malformed ref away from the access port. Returns a
+ * ref rebuilt from its own fields, or null. */
+function agentRunsRefOf(x) {
+    if (typeof x !== 'object' || x === null || Array.isArray(x))
+        return null;
+    const r = x;
+    if (typeof r.agent !== 'string' || !AGENT_RUNS_NAME_RE.test(r.agent))
+        return null;
+    const o = r.owner;
+    if (typeof o !== 'object' || o === null || Array.isArray(o))
+        return null;
+    const f = o;
+    switch (f.kind) {
+        case 'daemon': return { owner: { kind: 'daemon' }, agent: r.agent };
+        case 'host':
+            return typeof f.dirName === 'string' && AGENT_RUNS_DIR_RE.test(f.dirName)
+                ? { owner: { kind: 'host', dirName: f.dirName }, agent: r.agent } : null;
+        case 'workspace':
+            return typeof f.dirName === 'string' && AGENT_RUNS_DIR_RE.test(f.dirName)
+                && typeof f.workspaceId === 'string' && AGENT_RUNS_DIR_RE.test(f.workspaceId)
+                ? { owner: { kind: 'workspace', dirName: f.dirName, workspaceId: f.workspaceId }, agent: r.agent } : null;
+        case 'workdir': {
+            if (typeof f.root !== 'string' || !f.root || f.root.length > 4096 || hasControlChar(f.root))
+                return null;
+            if (f.project === undefined)
+                return { owner: { kind: 'workdir', root: f.root }, agent: r.agent };
+            if (typeof f.project !== 'string' || !f.project || f.project.length > 4096 || hasControlChar(f.project))
+                return null;
+            return { owner: { kind: 'workdir', root: f.root, project: f.project }, agent: r.agent };
+        }
+        default: return null;
+    }
+}
+/** The access code a thrown refusal carries, when it is one a reply may name. */
+function accessCodeOf(err) {
+    const code = typeof err === 'object' && err !== null ? err.code : undefined;
+    return typeof code === 'string' && ACCESS_ERROR_CODES.has(code) ? code : null;
+}
+/** How long one run-activity item may take to be decided for one team-mode
+ * connection (Task 16b fix round 1). A store that hangs must not leave a
+ * client unwelcomed or stall every later item: a timed-out item is dropped
+ * for that connection (fail closed). */
+export const RUN_ACTIVITY_DECIDE_MS = 3000;
+/** How many per-item deadlines (RUN_ACTIVITY_DECIDE_MS, or its test
+ * override) the whole pre-welcome replay may hold the welcome in team mode
+ * (final review F14). A replay of many items that each hang would otherwise
+ * hold it for one deadline per item. What is not decided by then is dropped
+ * for this connection (fail closed). */
+export const WELCOME_REPLAY_DEADLINES = 3;
+export const WELCOME_REPLAY_MAX_MS = RUN_ACTIVITY_DECIDE_MS * WELCOME_REPLAY_DEADLINES;
 /** Default pre-pairing deadline: a real client sends `hello` immediately.
  * It covers the proof exchange AND the identity exchange (IDENTITY_TIMEOUT_MS),
  * which now happens before a connection counts as authenticated. */
@@ -31,6 +244,33 @@ export const RECHECK_TIMEOUT_MS = 30000;
 function isThenable(v) {
     return typeof v === 'object' && v !== null && typeof v.then === 'function';
 }
+export class HostCallError extends Error {
+    constructor(kind, message) {
+        super(message);
+        Object.defineProperty(this, "kind", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = 'HostCallError';
+        this.kind = kind;
+    }
+}
+/** The kind of a host-call rejection, or null for any other error. Structural
+ * rather than `instanceof`, so a caller in another package does not depend on
+ * sharing this module's copy of the class. */
+export function hostCallFailure(e) {
+    if (typeof e !== 'object' || e === null)
+        return null;
+    const k = e.kind;
+    return k === 'undelivered' || k === 'timeout' || k === 'closed' || k === 'remote' ? k : null;
+}
+/** Default deadline for one host-call (daemon.json `peerCallTimeoutMs`). */
+export const DEFAULT_HOST_CALL_TIMEOUT_MS = 60000;
+/** Host-calls that wait on a PERSON. The deadline does not apply to them: a
+ * slow human is not a dead host. A dropped connection still settles them. */
+const HUMAN_WAIT_PROVIDERS = new Set(['confirm', 'ask']);
 /** Cap on `clientId`/`clientName` before they are forwarded to `onClient` (and,
  * downstream, used as a manifest key / dirName seed) — the wire message is
  * declared `string` but arrives via `JSON.parse(...) as SidecarMsg` with no
@@ -118,6 +358,7 @@ function normalizeVerdict(got) {
             const userId = r.identity?.userId;
             const issuer = r.identity?.issuer;
             const orgId = r.identity?.orgId;
+            const raw = r.identity;
             if (typeof userId === 'string' && userId && userId.length <= MAX_IDENTITY_FIELD_LEN) {
                 return {
                     ok: true,
@@ -126,6 +367,9 @@ function normalizeVerdict(got) {
                         // Carried only in a usable shape; a malformed org is no org, which
                         // the team policy then refuses.
                         ...(isClerkOrgId(orgId) ? { orgId } : {}),
+                        // The person is re-cleaned here: the harness does not trust the
+                        // verifier to have bounded or typed them.
+                        ...cleanPerson({ name: raw?.name, email: raw?.email }),
                     },
                 };
             }
@@ -137,6 +381,8 @@ function normalizeVerdict(got) {
     }
     return { ok: false, reason: 'malformed verdict' };
 }
+/** A dictation stream id: 1-64 of [A-Za-z0-9_-]. Anything else is ignored. */
+const STT_SID = /^[A-Za-z0-9_-]{1,64}$/;
 export class SidecarServer {
     constructor(opts) {
         Object.defineProperty(this, "ch", {
@@ -163,6 +409,13 @@ export class SidecarServer {
             writable: true,
             value: false
         });
+        /** This connection's one live dictation stream, if any. */
+        Object.defineProperty(this, "stt", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
         /** Denied hellos on this connection (see MAX_FAILED_HELLOS). */
         Object.defineProperty(this, "failedHellos", {
             enumerable: true,
@@ -300,6 +553,13 @@ export class SidecarServer {
             writable: true,
             value: undefined
         });
+        /** The verified person's display name/email, set with verifiedUserId. */
+        Object.defineProperty(this, "verifiedPerson", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {}
+        });
         /** The verdict echoed on the welcome, when a verifier is wired. Dead by the
          * time a welcome is ever sent -- `onHello`'s identity block always
          * overwrites it with a real reason ('not requested', 'no daemon id', or the
@@ -355,6 +615,49 @@ export class SidecarServer {
             writable: true,
             value: void 0
         });
+        /** Detach from the peer routes, when this connection serves MCP. */
+        Object.defineProperty(this, "peersDetach", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** This connection's hello announced PEER_DAEMON_FEATURE. Set from the
+         * claim, before anything is verified: it only ever TAKES privileges away
+         * (no attendance, no broadcasts, only PEER_DAEMON_MESSAGES served, and a
+         * welcome with no tools and no root/roots), so a client that claims it
+         * falsely only loses its own. It never lifts the member gate's welcome
+         * strip (Part E): a pending user who claims it is still told nothing. */
+        Object.defineProperty(this, "peerDaemon", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        /** One log line per peer connection for refused messages, not one each. */
+        Object.defineProperty(this, "peerRefusalLogged", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        /** The tail of this connection's run-activity filter (team agent access,
+         * Task 16b). Items are decided one at a time so a run's start, updates and
+         * settle reach the client in the order the daemon sent them, however long
+         * each one's access check takes. */
+        Object.defineProperty(this, "runActivityChain", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: Promise.resolve()
+        });
+        /** Bumped when the pre-welcome replay is cut off: items queued before it are dropped. */
+        Object.defineProperty(this, "runActivityEpoch", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
         /** The synced directory THIS connection belongs to, once resolved -- the same
          * value echoed in `welcome.dirName`. Retained so `hosts-list` can stamp
          * `self` and `hosts-forget` can refuse the caller's own tree from the
@@ -476,11 +779,15 @@ export class SidecarServer {
                 onChange: () => () => { },
             }
         });
+        /* A host that ANSWERED that it has no confirm capability keeps the old
+         * default, allow: the host gated the call before dispatch. Every other
+         * failure denies: a timeout, a dropped connection, a send that never left,
+         * and a host whose confirm threw or refused. Nobody approved it. */
         Object.defineProperty(this, "confirm", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: (req) => this.hostCall('confirm', 'confirm', [req]).then((v) => v, () => true)
+            value: (req) => this.hostCall('confirm', 'confirm', [req]).then((v) => v === true, (e) => hostCallFailure(e) === 'remote' && errMessage(e) === capabilityMissingMessage('confirm'))
         });
         Object.defineProperty(this, "ask", {
             enumerable: true,
@@ -515,7 +822,8 @@ export class SidecarServer {
          * reasons. The subscription itself is kept (not deferred to the hello) so
          * there is exactly one place it is set up and torn down. */
         const offRoots = opts.roots?.subscribe((s) => {
-            if (!this.authed)
+            // A pending member (Part E) is told nothing about this machine.
+            if (!this.authed || this.peerDaemon || this.memberPending())
                 return;
             this.ch.send({ t: 'roots', root: s.root, roots: s.roots });
         });
@@ -523,12 +831,45 @@ export class SidecarServer {
         // not just the one that started it -- ONE room service is shared across
         // every per-connection SidecarServer.
         const offRooms = opts.rooms?.subscribe((room) => {
-            if (!this.authed)
+            if (!this.authed || this.peerDaemon || this.memberPending())
                 return;
             this.ch.send({ t: 'room-progress', room });
         });
-        this.ch.onClose?.(() => {
+        /* A member approved while connected is told so at once (Part E), so the
+         * waiting screen can move on; the gate itself re-reads the status on the
+         * next message. Only THIS connection's verified user is ever told.
+         * A member REMOVED while connected is disconnected at once, peer daemon
+         * connections of theirs included: every stream this connection holds
+         * (run events, session logs, process output, broadcasts) stops here, not
+         * whenever the transport gets round to reporting the close. */
+        const offMembers = opts.members?.subscribe((userId, event) => {
+            if (!this.authed || this.closed || userId !== this.verifiedUserId)
+                return;
+            if (event === 'removed') {
+                this.opts.log?.('member removed; closing their connection');
+                teardown();
+                this.ch.close();
+                return;
+            }
+            if (event === 'active' && !this.peerDaemon)
+                this.ch.send({ t: 'member-status-changed', status: 'active' });
+        });
+        /* Runs once, from the transport's close or from a member removal above. */
+        let tornDown = false;
+        const teardown = () => {
+            if (tornDown)
+                return;
+            tornDown = true;
             this.closed = true;
+            // Every host-call still waiting on this connection settles now: nothing
+            // will ever answer it (spec 2026-10-01 Part D). `closed`, not
+            // `undelivered`: these were sent, and may have run on the other end.
+            for (const p of this.hostPending.values()) {
+                if (p.timer !== undefined)
+                    clearTimeout(p.timer);
+                p.reject(new HostCallError('closed', `host call ${p.label} failed: the connection closed`));
+            }
+            this.hostPending.clear();
             this.clearHelloDeadline();
             this.unwatchRevocation();
             if (this.recheckTimer !== undefined)
@@ -544,6 +885,8 @@ export class SidecarServer {
             this.identityAssertResolve = undefined;
             this.attendedDetach?.();
             this.attendedDetach = undefined;
+            this.peersDetach?.();
+            this.peersDetach = undefined;
             // Leave the live set, or this directory reads as connected for ever and
             // could never be reclaimed -- the refusal would outlive the connection.
             this.hostsDetach?.();
@@ -555,20 +898,52 @@ export class SidecarServer {
             this.runDetachers.clear();
             offRoots?.();
             offRooms?.();
+            offMembers?.();
             // Stop streaming process output into a dead socket. The PROCESSES keep
             // running - that is the point of the table living on the daemon - but this
             // connection stops hearing about them until something re-attaches.
             this.procUnsub?.();
             this.procUnsub = undefined;
             this.attachedProcs.clear();
+            // Dictation audio dies with the connection: drop the buffer, never keep it.
+            if (this.stt) {
+                const { stream } = this.stt;
+                this.stt = null;
+                stream.cancel();
+            }
             // Same reasoning for sessions: the SESSIONS keep running — that is what
             // makes resume cheap — but this connection stops being sent their
             // metrics and logs.
             for (const sid of [...this.sessionWatch.keys()])
                 this.stopWatching(sid);
-        });
+        };
+        this.ch.onClose?.(teardown);
     }
     onMessage(m) {
+        /* A PEER DAEMON IS NOT A PERSON (spec 2026-10-01 Part D). Its connection
+         * is verified as its member, so every per-user gate below would pass it as
+         * that member; it is refused here instead, before any of them. Dropped
+         * without a reply: a peer never sends these, and every reply shape here is
+         * a browser user's. */
+        if (this.peerDaemon && !PEER_DAEMON_MESSAGES.has(m.t)) {
+            if (!this.peerRefusalLogged) {
+                this.peerRefusalLogged = true;
+                this.opts.log?.(`peer daemon sent ${logSafe(String(m.t)).slice(0, 64)}, which a peer is never served; ignoring it and the rest`);
+            }
+            return;
+        }
+        /* THE MEMBER GATE (spec 2026-10-01 Part E, E1). After authentication,
+         * after the peer block above (a peer daemon is never a member and never
+         * gated), and before anything is served: on a team daemon a connection
+         * whose verified user is not an active member is refused every message but
+         * the allowlist, each with its own reply shape (memberGate.ts). Before
+         * authentication every case below refuses on its own, unchanged. */
+        if (this.authed && !this.peerDaemon && !MEMBER_GATE_ALLOWED.has(m.t) && this.memberPending()) {
+            const refusal = pendingRefusal(m);
+            if (refusal)
+                this.ch.send(refusal);
+            return;
+        }
         switch (m.t) {
             case 'hello':
                 /* Identity is fixed at first hello; a second must not re-own the
@@ -620,10 +995,12 @@ export class SidecarServer {
                 if (!p)
                     return;
                 this.hostPending.delete(m.id);
+                if (p.timer !== undefined)
+                    clearTimeout(p.timer);
                 if (m.ok)
                     p.resolve(m.result);
                 else
-                    p.reject(new Error(m.error || 'host call failed'));
+                    p.reject(new HostCallError('remote', typeof m.error === 'string' && m.error ? m.error : 'host call failed'));
                 return;
             }
             case 'http-req':
@@ -740,6 +1117,68 @@ export class SidecarServer {
                 }
                 this.onProcSimple(m.id, 'proc-kill-result', () => this.requireProcs().kill(m.procId));
                 return;
+            case 'stt-start': {
+                if (typeof m.sid !== 'string' || !STT_SID.test(m.sid))
+                    return;
+                const sid = m.sid;
+                const say = (msg) => this.ch.send({ t: 'stt', sid, msg });
+                if (!this.authed) {
+                    say({ kind: 'error', message: 'not authenticated' });
+                    return;
+                }
+                if (!this.opts.speech) {
+                    say({ kind: 'error', message: 'this sidecar does not offer dictation' });
+                    return;
+                }
+                if (this.stt) {
+                    say({ kind: 'error', message: 'one dictation at a time on this connection' });
+                    return;
+                }
+                const stream = this.opts.speech.open((msg) => {
+                    this.ch.send({ t: 'stt', sid, msg });
+                    if ((msg.kind === 'final' || msg.kind === 'error') && this.stt?.sid === sid)
+                        this.stt = null;
+                });
+                this.stt = { sid, stream };
+                return;
+            }
+            case 'stt-audio': {
+                if (typeof m.sid !== 'string' || !STT_SID.test(m.sid))
+                    return;
+                if (!this.authed || this.stt?.sid !== m.sid)
+                    return;
+                let pcm;
+                try {
+                    pcm = decodePcm16(m.pcm);
+                }
+                catch {
+                    const { stream } = this.stt;
+                    this.stt = null;
+                    stream.cancel();
+                    this.ch.send({ t: 'stt', sid: m.sid, msg: { kind: 'error', message: 'unreadable audio' } });
+                    return;
+                }
+                this.stt.stream.audio(pcm);
+                return;
+            }
+            case 'stt-flush':
+                if (typeof m.sid !== 'string' || !STT_SID.test(m.sid))
+                    return;
+                if (!this.authed || this.stt?.sid !== m.sid)
+                    return;
+                this.stt.stream.flush();
+                return;
+            case 'stt-cancel':
+                if (typeof m.sid !== 'string' || !STT_SID.test(m.sid))
+                    return;
+                if (!this.authed || this.stt?.sid !== m.sid)
+                    return;
+                {
+                    const { stream } = this.stt;
+                    this.stt = null;
+                    stream.cancel();
+                }
+                return;
             case 'proc-list':
                 // An empty list is the honest answer for a daemon without the capability:
                 // it is running nothing, and an error here would make the common "what is
@@ -758,7 +1197,7 @@ export class SidecarServer {
                     this.ch.send({ t: 'session-list-result', id: m.id, sessions: [] });
                     return;
                 }
-                this.ch.send({ t: 'session-list-result', id: m.id, sessions: this.opts.sessions?.list() ?? [] });
+                this.ch.send({ t: 'session-list-result', id: m.id, sessions: this.visibleSessions() });
                 return;
             case 'session-create':
             case 'session-pause':
@@ -1011,7 +1450,9 @@ export class SidecarServer {
                     this.ch.send({ t: 'mcp-tools', id: m.id, tools: [] });
                     return;
                 }
-                this.ch.send({ t: 'mcp-tools', id: m.id, tools: this.opts.mcp?.tools() ?? [] });
+                // Team mode: a direct call uses the daemon's own credentials, which
+                // are the admin's (Part B); a member is offered none.
+                this.ch.send({ t: 'mcp-tools', id: m.id, tools: this.mcpRefusal() === null ? this.opts.mcp?.tools() ?? [] : [] });
                 return;
             case 'mcp-call':
                 if (!this.authed) {
@@ -1035,6 +1476,68 @@ export class SidecarServer {
                 }
                 void this.onMcpAdmin(m);
                 return;
+            case 'access-get':
+            case 'access-grant':
+            case 'access-revoke':
+            case 'access-transfer':
+            case 'access-members':
+                if (!this.authed) {
+                    this.ch.send({ t: 'access-result', id: m.id, ok: false, code: 'NO_ACCESS', error: 'not authenticated' });
+                    return;
+                }
+                void this.onAccess(m);
+                return;
+            case 'access-bind':
+            case 'agent-cred-set':
+            case 'agent-mcp-login':
+            case 'agent-cred-clear':
+                if (!this.authed) {
+                    this.ch.send({ t: 'agent-cred-result', id: m.id, ok: false, code: 'NOT_OWNER', error: 'not authenticated' });
+                    return;
+                }
+                void this.onAgentCred(m);
+                return;
+            case 'member-status':
+            case 'members-list':
+            case 'member-approve':
+            case 'member-remove':
+                if (!this.authed) {
+                    this.ch.send({ t: 'member-result', id: m.id, ok: false, code: 'MEMBER_PENDING', error: 'not authenticated' });
+                    return;
+                }
+                void this.onMember(m);
+                return;
+            case 'access-overview':
+                if (!this.authed) {
+                    this.ch.send({ t: 'access-overview-result', id: m.id, ok: false, code: 'NO_ACCESS', error: 'not authenticated' });
+                    return;
+                }
+                void this.onAccessOverview(m);
+                return;
+            case 'agent-cred-status':
+                if (!this.authed) {
+                    this.ch.send({ t: 'agent-cred-status-result', id: m.id, ok: false, code: 'NOT_OWNER', error: 'not authenticated' });
+                    return;
+                }
+                void this.onAgentCredStatus(m);
+                return;
+            case 'agent-runs':
+                if (!this.authed) {
+                    this.ch.send({ t: 'agent-runs-result', id: m.id, ok: false, code: 'NO_ACCESS', error: 'not authenticated' });
+                    return;
+                }
+                void this.onAgentRuns(m);
+                return;
+            case 'peer-list':
+            case 'peer-add':
+            case 'peer-remove':
+            case 'peer-allow-set':
+                if (!this.authed) {
+                    this.ch.send({ t: 'peer-result', id: m.id, ok: false, code: 'NOT_ADMIN', error: 'not authenticated' });
+                    return;
+                }
+                void this.onPeer(m);
+                return;
             default:
                 // welcome / denied / invoke-result / host-call / event / run-accepted /
                 // run-done / permission-ask / permission-resolved are host-side.
@@ -1125,6 +1628,8 @@ export class SidecarServer {
             return false;
         }
         this.verifiedUserId = verdict.identity.userId;
+        const { name, email } = verdict.identity;
+        this.verifiedPerson = { ...(name ? { name } : {}), ...(email ? { email } : {}) };
         this.identityResult = { verified: true };
         this.opts.log?.('identity: verified');
         return true;
@@ -1381,9 +1886,14 @@ export class SidecarServer {
             this.countFailedHello();
             return;
         }
+        /* Decided from the hello itself, synchronously, before the first await:
+         * see `peerDaemon`. */
+        this.peerDaemon = announcedCapabilities(m.capabilities).includes(PEER_DAEMON_FEATURE);
         const deviceName = typeof m.clientName === 'string' && m.clientName
             ? m.clientName.slice(0, MAX_IDENTITY_FIELD_LEN)
-            : 'unnamed device';
+            // A peer daemon's hello carries no clientName by design (host.ts), so
+            // its device is named by what it is.
+            : this.peerDaemon ? 'Peer daemon' : 'unnamed device';
         /* NO CREDENTIAL, NO CONNECTION. There is no shared pairing token: a hello
          * that names neither a device nor an enrollment is refused like any other
          * failure (a token sent by an older client included). */
@@ -1406,6 +1916,18 @@ export class SidecarServer {
             this.unwatchRevocation();
             return;
         }
+        /* A PEER DAEMON SERVES ITS VERIFIED USER, and in team mode there is no
+         * other kind: one with no verified identity is refused before it is
+         * authenticated. (The node daemon always wires a verifier, so this is the
+         * harness's own backstop.) */
+        if (this.peerDaemon && this.opts.teamMode && !this.verifiedUserId) {
+            this.opts.log?.('denied: a peer daemon with no verified identity');
+            this.ch.send({ t: 'denied', reason: 'a peer daemon needs a verified identity' });
+            this.noteOutcome('denied');
+            this.unwatchRevocation();
+            this.ch.close();
+            return;
+        }
         /** What every pairing assertion on this connection binds: the thumbprint
          * of the device key it proved. */
         this.deviceJkt = cred.deviceJkt;
@@ -1553,17 +2075,70 @@ export class SidecarServer {
                 this.opts.log?.(`noteOlderClient threw: ${errMessage(err)}`);
             }
         }
+        /* WHO THEY ARE (spec 2026-10-07). Before first sight, so the admin's
+         * waiting push can already carry the name. Display only; never fails the
+         * handshake. A peer daemon is not a person. */
+        if (this.opts.people && this.verifiedUserId && !this.peerDaemon && (this.verifiedPerson.name || this.verifiedPerson.email)) {
+            try {
+                await this.opts.people.note(this.verifiedUserId, this.verifiedPerson);
+            }
+            catch (err) {
+                this.opts.log?.(`recording who ${this.verifiedUserId} is failed: ${errMessage(err)}`);
+            }
+        }
+        /* FIRST SIGHT (Part E, E1). A verified user with no member record is
+         * recorded as pending and the admin is told, once per user. Awaited so
+         * the record exists before the welcome; never fails the handshake. A peer
+         * daemon is not a person: it never creates a record or pushes the admin. */
+        if (this.opts.members && this.verifiedUserId && !this.peerDaemon) {
+            try {
+                await this.opts.members.noteAdmitted(this.verifiedUserId, deviceName);
+            }
+            catch (err) {
+                this.opts.log?.(`member first sight failed: ${errMessage(err)}`);
+            }
+        }
         // Dropped while verifying: attaching now would leave a dead client in the
         // registry that the (already-run) close handler can never detach.
         if (this.closed)
             return;
-        if (this.opts.attendance) {
+        /* PEER DAEMON (spec 2026-10-01 Part D). Never attended: attached, it would
+         * count as its user being present and receive their permission asks, which
+         * it cannot answer, so an ask would neither reach a person nor be pushed. */
+        const isPeerDaemon = announcedCapabilities(m.capabilities).includes(PEER_DAEMON_FEATURE);
+        /* What it serves joins the peer routes under the VERIFIED user only. An
+         * unverified connection serves nobody, and neither does one that did not
+         * announce PEER_DAEMON_FEATURE: a person's app is never a route, whatever
+         * `provides` it sends. */
+        const provided = providedMcpUrls(m.provides);
+        if (this.opts.peers && isPeerDaemon && this.verifiedUserId && provided.length) {
+            this.peersDetach = this.opts.peers.attach({
+                userId: this.verifiedUserId,
+                urls: provided,
+                call: (method, args) => this.hostCall('mcp', method, args),
+            });
+        }
+        if (this.opts.attendance && !isPeerDaemon) {
+            /* A pending member (Part E) is never a recipient of anything: every
+             * send below checks the status at the moment it is made, so a member
+             * approved later starts receiving without reconnecting. */
             const attended = {
-                send: (ask) => this.ch.send({ t: 'permission-ask', ...ask }),
-                resolved: (id, decision, by, byClientId) => this.ch.send({ t: 'permission-resolved', id, decision, by, ...(byClientId ? { byClientId } : {}) }),
-                runActivity: (activity) => this.ch.send({ t: 'run-activity', activity }),
-                registrations: (registrations) => this.ch.send({ t: 'registrations', registrations }),
-                approvalSuggestion: (s) => this.ch.send({ t: 'approvals-suggest', ...s }),
+                // Shaped for THIS connection (E5.2): the requester's own copy names nobody.
+                send: (ask) => { if (!this.memberPending())
+                    this.ch.send({ t: 'permission-ask', ...askForViewer(ask, this.verifiedUserId) }); },
+                resolved: (id, decision, by, byClientId) => {
+                    if (!this.memberPending())
+                        this.ch.send({ t: 'permission-resolved', id, decision, by, ...(byClientId ? { byClientId } : {}) });
+                },
+                // Team mode: filtered by role (Task 16b). The registry calls this for
+                // the live broadcast AND for the replay at attach, so both are covered.
+                // An active member still gets only what their role allows.
+                runActivity: (activity) => { if (!this.memberPending())
+                    this.sendRunActivity(activity); },
+                registrations: (registrations) => { if (!this.memberPending())
+                    this.ch.send({ t: 'registrations', registrations }); },
+                approvalSuggestion: (s) => { if (!this.memberPending())
+                    this.ch.send({ t: 'approvals-suggest', ...s }); },
             };
             // Retained so `permission-answer` can name THIS connection as the
             // answerer -- the registry identifies an answerer by the object it
@@ -1583,6 +2158,13 @@ export class SidecarServer {
                 ...(this.verifiedUserId ? { verifiedUserId: this.verifiedUserId } : {}),
             });
         }
+        /* The registry replays in-flight runs at attach, and the client relies on
+         * that replay landing BEFORE `welcome` (it prunes the runs it still holds
+         * as stale once welcomed; see pruneStaleDaemonRuns). Team mode filters the
+         * replay asynchronously, so let it drain first. The chain never rejects. */
+        await this.replayDrained();
+        if (this.closed)
+            return;
         this.opts.log?.(`paired — ${this.tools.size} ${this.tools.size === 1 ? 'tool' : 'tools'} advertised (host dir: ${this.hostStateDir})`);
         if (!dirNamePending) {
             this.sendWelcome(null);
@@ -1729,7 +2311,19 @@ export class SidecarServer {
             // has no claim to.
             this.hostsDetach = this.opts.hosts?.attach(dirName);
         }
-        const tools = [...this.tools.values()].map(({ run: _run, ...decl }) => decl);
+        /* A PENDING member (Part E) learns who to wait for and nothing else: no
+         * tools, and of `info` only the daemon's id and name (an ALLOWLIST, so a
+         * field added later is not told either). Decided from member status
+         * alone; claiming PEER_DAEMON_FEATURE does not lift it. A peer daemon is
+         * served only host-call, so it gets no tools and no root/roots either.
+         * The browser re-pairs once approved. */
+        const pending = this.memberPending();
+        const tools = pending || this.peerDaemon ? [] : [...this.tools.values()].map(({ run: _run, ...decl }) => decl);
+        const full = this.opts.info;
+        const info = !full ? undefined
+            : pending ? { ...(full.id !== undefined ? { id: full.id } : {}), ...(full.name !== undefined ? { name: full.name } : {}) }
+                : this.peerDaemon ? (({ root: _root, roots: _roots, ...rest }) => rest)(full)
+                    : full;
         // Advertise the loopback HTTP proxy so the host can route local-LLM calls
         // through us (server-side fetch, no browser CORS) instead of failing, and
         // 'runner' only when a crew runner is actually wired — that's what lets the
@@ -1754,11 +2348,16 @@ export class SidecarServer {
             ...(this.opts.runner?.supportsTasks ? [RUN_TASK_FEATURE] : []),
             // Whether this daemon answers run-plan-get (a runner that reads run records).
             ...(this.opts.runner?.runPlan ? [RUN_PLAN_FEATURE] : []),
+            // Whether this daemon fans a delegated callee's own node events out to
+            // watchers of the parent run (the running-pills card). Only with a live
+            // hub behind it -- there is otherwise nothing to fan out from.
+            ...(this.opts.runs ? [CHILD_EVENTS_FEATURE] : []),
             ...(this.opts.acp ? ['acp'] : []),
             ...(this.opts.roots?.areas.length ? ['add-roots'] : []),
             ...(this.opts.roots?.areas.length && this.opts.roots.create ? ['create-roots'] : []),
             ...(this.opts.rooms ? ['rooms'] : []),
             ...(this.opts.procs ? ['procs'] : []),
+            ...(this.opts.speech ? [SPEECH_FEATURE] : []),
             ...(this.opts.sessions ? ['sessions'] : []),
             // The operator's transcript CEILING, advertised so a client offers the
             // per-run choice only where it could be honoured. Withheld means every
@@ -1786,6 +2385,17 @@ export class SidecarServer {
             // service behind it, so a client shows the "This machine" group only
             // where there is something to list and revoke.
             ...(this.opts.approvals ? ['approvals'] : []),
+            // Whether this daemon keeps per-agent access (team agent access, Part B),
+            // so a client shows owner, role and the members panel only where they exist.
+            ...(this.opts.access?.teamMode ? [AGENT_ACCESS_FEATURE] : []),
+            // Team run history (spec 2026-10-01 E5.6): team mode only.
+            ...(this.opts.access?.teamMode && this.opts.runner?.agentRuns ? [AGENT_RUNS_FEATURE] : []),
+            // A team daemon that keeps a member list (Part E), so a client shows the
+            // Team page and, for a pending member, the waiting screen.
+            ...(this.opts.members ? [TEAM_MEMBERS_FEATURE] : []),
+            // Peer links from Settings (spec 2026-10-01 E5.5): whenever the port is
+            // wired, solo mode included, since a member's own daemon is normally solo.
+            ...(this.opts.peerAdmin ? [PEER_LINKS_FEATURE] : []),
             // Whether this daemon runs confirmed checks and holds the orchestrator's
             // workspace lock. Only with a real service behind it (--allow-shell) that
             // is not switched off right now (see SidecarChecks.unavailable).
@@ -1826,7 +2436,7 @@ export class SidecarServer {
         ];
         this.ch.send({
             t: 'welcome', tools, features,
-            ...(this.opts.info ? { info: this.opts.info } : {}),
+            ...(info ? { info } : {}),
             ...(dirName ? { dirName } : {}),
             ...(this.opts.push ? { vapidPublicKey: this.opts.push.publicKey } : {}),
             ...(this.opts.identity ? { identity: this.identityResult } : {}),
@@ -1894,6 +2504,16 @@ export class SidecarServer {
         const id = m.id;
         try {
             const sessions = this.requireSessions();
+            /* TEAM AGENT ACCESS (Part B, Task 16c): in team mode a session is its
+             * verified creator's and the admin's. Decided before anything is
+             * touched; `session-list` is filtered where it is answered. */
+            if (this.teamAccess()) {
+                const refusal = await this.sessionRefusal(sessions, m);
+                if (refusal) {
+                    this.ch.send({ t: 'session-error', id, error: refusal });
+                    return;
+                }
+            }
             switch (m.t) {
                 case 'session-create':
                     this.ch.send({
@@ -1912,6 +2532,9 @@ export class SidecarServer {
                             // else's. `m.owner` is ignored; a connection that sent no
                             // clientId files the session under nobody.
                             ...(this.clientId ? { owner: this.clientId } : {}),
+                            // The VERIFIED user, from the connection (Task 16c): what team
+                            // mode decides on. `owner` above is the claimed client id.
+                            ...(this.verifiedUserId ? { verifiedOwner: this.verifiedUserId } : {}),
                             ...(m.fromSnapshot ? { fromSnapshot: m.fromSnapshot } : {}),
                             // From the HANDSHAKE, never from this message: the dot-dir is a
                             // property of the client's workspace, and taking it from the
@@ -1949,7 +2572,11 @@ export class SidecarServer {
                     // question "what could I restore from?" has an answer there, and it
                     // is "nothing". The client uses it to decide whether to offer the
                     // choice at all, and an error would make it look broken instead.
-                    const snapshots = sessions.snapshots ? await sessions.snapshots() : [];
+                    const listed = sessions.snapshots ? await sessions.snapshots() : [];
+                    // Team mode (Task 16c): a member sees only snapshots of sessions
+                    // they created; the admin sees every one.
+                    const own = this.teamAccess() && !this.isSessionAdmin() ? this.ownSessionIds(sessions) : null;
+                    const snapshots = own ? listed.filter((s) => s.sessionId !== undefined && own.has(s.sessionId)) : listed;
                     this.ch.send({ t: 'session-snapshots-result', id, snapshots });
                     return;
                 }
@@ -2135,8 +2762,47 @@ export class SidecarServer {
          * exactly the line someone is scrolling back to find. */
         if (tool.mutates === true)
             this.opts.log?.(`invoke ${m.name}`);
+        /* TEAM AGENT ACCESS (Part B): a mutating tool never touches the access
+         * store; a folder holding a crew is the admin's; a team agent's folder is
+         * its owner's or the admin's, except the first write into a NEW agent,
+         * which claims it for the writer. Reads are not gated here. Anything that
+         * cannot be decided, and any port throw, is a refusal. */
+        const access = tool.mutates === true ? this.teamAccess() : null;
+        let target = null;
+        if (access) {
+            let refusal;
+            try {
+                target = await access.invokeTarget(m.name, m.args);
+                refusal = target ? await this.invokeRefusal(access, target, m.name) : null;
+            }
+            catch (e) {
+                // The detail (a path, an errno) stays in the log, never on the wire.
+                this.opts.log?.(`invoke ${m.name}: access check threw: ${errMessage(e)}`);
+                refusal = ACCESS_CHECK_FAILED;
+            }
+            if (refusal) {
+                this.opts.log?.(`invoke ${m.name} refused: ${refusal}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: false, error: refusal });
+                return;
+            }
+        }
         try {
             const result = await tool.run(m.args, this.makeContext());
+            if (access && target?.kind === 'agent') {
+                const t = target;
+                try {
+                    if (m.name === 'sidecar_fs_delete') {
+                        if (t.whole)
+                            await access.onAgentDeleted(t.ref);
+                    }
+                    else if (t.isNew) {
+                        await access.onAgentCreated(t.ref, this.verifiedUserId);
+                    }
+                }
+                catch (err) {
+                    this.opts.log?.(`access: could not record an agent change: ${errMessage(err)}`);
+                }
+            }
             this.ch.send({ t: 'invoke-result', id: m.id, ok: true, result });
         }
         catch (e) {
@@ -2229,6 +2895,22 @@ export class SidecarServer {
             this.ch.send({ t: 'run-error', id: m.id, error: 'this sidecar does not support watching runs' });
             return;
         }
+        /* TEAM AGENT ACCESS (Part B): the run's requester, or, for a run nobody
+         * asked for, its agent's owner or the admin. Never another member's
+         * attended run, whoever the caller is (decision D5). */
+        if (this.teamAccess()) {
+            const refuse = () => this.ch.send({ t: 'run-error', id: m.id, error: WATCH_REFUSED });
+            void this.mayReadRun(m.runId).then((ok) => {
+                if (this.closed)
+                    return;
+                if (!ok) {
+                    refuse();
+                    return;
+                }
+                this.watchRun(m, hub);
+            }, refuse);
+            return;
+        }
         /* TEAM MODE: A RUN IS ITS STARTER'S TO WATCH. Watching streams the run's
          * events and its final text, which is its content, so it follows the same
          * rule as a run's output: only the verified user who started it. A run
@@ -2240,6 +2922,10 @@ export class SidecarServer {
                 return;
             }
         }
+        this.watchRun(m, hub);
+    }
+    /** Attach THIS connection to `hub` as a viewer of `m.runId`, replay first. */
+    watchRun(m, hub) {
         const attached = hub.subscribe(m.runId, {
             event: (event) => this.ch.send({ t: 'event', id: m.id, runId: m.runId, event }),
             done: (r) => {
@@ -2250,6 +2936,7 @@ export class SidecarServer {
                 this.ch.send({ t: 'run-error', id: m.id, error: message });
                 detachOnce();
             },
+            child: (event) => this.ch.send({ t: 'child-event', id: m.id, runId: m.runId, event }),
         });
         if (!attached) {
             this.ch.send({ t: 'run-error', id: m.id, error: `no such run: ${m.runId}` });
@@ -2281,18 +2968,27 @@ export class SidecarServer {
             detachOnce();
         }
     }
-    /** Stop a run, whoever started it. Same trust as `run`: a connection that may
-     * start runs on this daemon may stop them. */
+    /** Stop a run. Solo mode: same trust as `run`, a connection that may start
+     * runs on this daemon may stop them. Team mode with per-agent access
+     * (Part B): the run's requester, or its agent's owner or the admin. */
     onCancelRun(m) {
         const cancel = this.opts.runner?.cancel;
         if (!cancel) {
             this.ch.send({ t: 'cancel-run-result', id: m.id, runId: m.runId, ok: false, reason: 'unsupported' });
             return;
         }
-        const out = cancel.call(this.opts.runner, m.runId);
-        this.ch.send(out === 'cancelled'
-            ? { t: 'cancel-run-result', id: m.id, runId: m.runId, ok: true }
-            : { t: 'cancel-run-result', id: m.id, runId: m.runId, ok: false, reason: 'no-such-run' });
+        const doCancel = () => {
+            const out = cancel.call(this.opts.runner, m.runId);
+            this.ch.send(out === 'cancelled'
+                ? { t: 'cancel-run-result', id: m.id, runId: m.runId, ok: true }
+                : { t: 'cancel-run-result', id: m.id, runId: m.runId, ok: false, reason: 'no-such-run' });
+        };
+        if (this.teamAccess()) {
+            const refuse = () => this.ch.send({ t: 'cancel-run-result', id: m.id, runId: m.runId, ok: false, reason: 'not-allowed' });
+            void this.mayCancelRun(m.runId).then((ok) => (this.closed ? undefined : ok ? doCancel() : refuse()), refuse);
+            return;
+        }
+        doCancel();
     }
     /**
      * What this caller's agent has actually done.
@@ -2309,10 +3005,13 @@ export class SidecarServer {
             const history = this.opts.runner?.history?.bind(this.opts.runner);
             const crew = runHistoryCrewOf(m.crew);
             const identity = { clientId: this.clientId };
-            // No crew: asked exactly as an older client asks.
-            const runs = !history ? [] : crew
-                ? await history(identity, m.agent, m.limit, crew)
-                : await history(identity, m.agent, m.limit);
+            // The viewer is THIS connection's verified user (team agent access).
+            // No verified user and no crew: asked exactly as an older client asks.
+            const viewer = this.verifiedUserId;
+            const runs = !history ? []
+                : viewer !== undefined ? await history(identity, m.agent, m.limit, crew, viewer)
+                    : crew ? await history(identity, m.agent, m.limit, crew)
+                        : await history(identity, m.agent, m.limit);
             this.ch.send({ t: 'run-history-result', id: m.id, runs });
         }
         catch {
@@ -2325,9 +3024,11 @@ export class SidecarServer {
      * case, and a state the caller renders rather than treats as a failure. */
     async onRunTranscript(m) {
         try {
-            const lines = this.opts.runner?.transcript
-                ? await this.opts.runner.transcript({ clientId: this.clientId }, m.agent, m.runId)
-                : [];
+            const transcript = this.opts.runner?.transcript?.bind(this.opts.runner);
+            const identity = { clientId: this.clientId };
+            const lines = !transcript ? []
+                : this.verifiedUserId !== undefined ? await transcript(identity, m.agent, m.runId, this.verifiedUserId)
+                    : await transcript(identity, m.agent, m.runId);
             this.ch.send({ t: 'run-transcript-result', id: m.id, lines });
         }
         catch {
@@ -2341,9 +3042,11 @@ export class SidecarServer {
      * a path. */
     async onCrewMemory(m) {
         try {
-            const memories = this.opts.runner?.memories
-                ? await this.opts.runner.memories({ clientId: this.clientId }, m.agent)
-                : [];
+            const runner = this.opts.runner;
+            // The viewer is THIS connection's verified user (team agent access).
+            const memories = !runner?.memories ? []
+                : this.verifiedUserId !== undefined ? await runner.memories({ clientId: this.clientId }, m.agent, this.verifiedUserId)
+                    : await runner.memories({ clientId: this.clientId }, m.agent);
             this.ch.send({ t: 'crew-memory-result', id: m.id, memories });
         }
         catch {
@@ -2354,6 +3057,18 @@ export class SidecarServer {
         }
     }
     async onRun(m) {
+        /* TEAM AGENT ACCESS (Part B, Task 16c): running an agent inside a session
+         * writes into that session's workdir and guest, so it takes the same
+         * ownership as every other session operation: the recorded verified
+         * creator, or the admin. Before anything else, and on top of the per-agent
+         * run gate. */
+        if (m.sessionId !== undefined && this.teamAccess()) {
+            const sessions = this.opts.sessions;
+            if (!sessions || !this.maySession(sessions, m.sessionId)) {
+                this.ch.send({ t: 'run-error', id: m.id, error: SESSION_REFUSED });
+                return;
+            }
+        }
         /* WHERE the run happens, decided once, up front.
          *
          * A `sessionId` is a confinement request. A daemon that cannot honour it
@@ -2389,7 +3104,14 @@ export class SidecarServer {
             // derived from an agent's `session:` block. A client that could set it
             // would grant itself mutating tools inside a sandbox. Deliberately
             // absent -- see session/guestRunner.ts.
-            this.opts.sessions.run(m.sessionId, agent, input, onEvent, identity, { keepTranscript: m.keepTranscript === true })
+            this.opts.sessions.run(m.sessionId, agent, input, onEvent, identity, {
+                keepTranscript: m.keepTranscript === true,
+                // Who asked and why, for the run's audit lines: from THIS
+                // connection's verified identity, never the message, and a run a
+                // connection asked for is a person's run whatever the message says.
+                ...(this.verifiedUserId ? { startedBy: this.verifiedUserId } : {}),
+                origin: 'user',
+            })
             : (agent, input, onEvent, identity) => 
             // Task and autonomy are forwarded as asked; the runner, not this
             // class, decides whether the agent may run that way.
@@ -2397,6 +3119,9 @@ export class SidecarServer {
                 task: m.task, autonomy: m.autonomy,
                 // From THIS connection's verified identity, never the message.
                 ...(this.verifiedUserId ? { startedBy: this.verifiedUserId } : {}),
+                // A run a connection asked for is a person's run (audit `origin`);
+                // only the daemon's own dispatcher says otherwise.
+                origin: 'user',
             });
         let runId;
         const pending = [];
@@ -2503,7 +3228,15 @@ export class SidecarServer {
         const devices = this.opts.devices;
         if (!devices)
             return [];
-        return (await devices.list()).map((d) => ({
+        /* A PENDING member (Part E, preflight B2) sees only their own devices:
+         * the store lists every device and its verified user, and devices-list is
+         * on the member gate's allowlist only because of this filter. Matched on
+         * THIS connection's verified user; none, no devices. */
+        const pending = this.memberPending();
+        const own = this.verifiedUserId;
+        const listed = await devices.list();
+        const shown = pending ? listed.filter((d) => own !== undefined && d.verifiedUserId === own) : listed;
+        return shown.map((d) => ({
             id: d.id,
             name: d.name,
             jkt: d.jkt,
@@ -2523,7 +3256,8 @@ export class SidecarServer {
             this.ch.send({ t: 'devices-list-result', id: m.id, ok: true, devices: await this.deviceSummaries() });
         }
         catch (err) {
-            this.ch.send({ t: 'devices-list-result', id: m.id, ok: false, error: errMessage(err) });
+            this.opts.log?.(`devices-list failed: ${errMessage(err)}`);
+            this.ch.send({ t: 'devices-list-result', id: m.id, ok: false, error: DEVICES_FAILED });
         }
     }
     /**
@@ -2557,13 +3291,17 @@ export class SidecarServer {
          * connection's VERIFIED user (never anything the message claims). A
          * connection with no verified user revokes nothing. The operator's local
          * `devices revoke` verb keeps full power; it does not come through here. */
-        if (this.opts.admission?.ownDevicesOnly) {
+        // A pending member (Part E) is held to the same rule, whatever the
+        // admission says: devices-revoke is on the member gate's allowlist only
+        // as an own-devices message.
+        if (this.opts.admission?.ownDevicesOnly || this.memberPending()) {
             let owner;
             try {
                 owner = (await devices.get(m.deviceId))?.verifiedUserId;
             }
             catch (err) {
-                this.ch.send({ t: 'devices-revoke-result', id: m.id, ok: false, error: errMessage(err) });
+                this.opts.log?.(`devices-revoke failed: ${errMessage(err)}`);
+                this.ch.send({ t: 'devices-revoke-result', id: m.id, ok: false, error: DEVICES_FAILED });
                 return;
             }
             if (!this.verifiedUserId || owner !== this.verifiedUserId) {
@@ -2584,7 +3322,8 @@ export class SidecarServer {
             this.ch.send({ t: 'devices-revoke-result', id: m.id, ok: true, devices: await this.deviceSummaries() });
         }
         catch (err) {
-            this.ch.send({ t: 'devices-revoke-result', id: m.id, ok: false, error: errMessage(err) });
+            this.opts.log?.(`devices-revoke failed: ${errMessage(err)}`);
+            this.ch.send({ t: 'devices-revoke-result', id: m.id, ok: false, error: DEVICES_FAILED });
         }
     }
     /** Every synced host directory, with `self` stamped from THIS connection's
@@ -2773,6 +3512,11 @@ export class SidecarServer {
             this.ch.send({ t: 'approvals-accept-result', id: m.id, ok: false, error: 'suggestionId must be a non-empty string and choice one of global, not-now, never' });
             return;
         }
+        const noUser = this.approvalsNoUser();
+        if (noUser !== null) {
+            this.ch.send({ t: 'approvals-accept-result', id: m.id, ok: false, error: noUser });
+            return;
+        }
         // A connection that never attached to attendance was never offered
         // anything, and has no identity to accept with.
         if (this.attended === undefined) {
@@ -2782,12 +3526,13 @@ export class SidecarServer {
         try {
             // `this.attended` -- the object THIS connection attached -- is the only
             // accepter identity; the daemon compares it with the client it offered
-            // to. Nothing in the message can name another connection.
-            await port.accept(this.attended, m.suggestionId, m.choice);
+            // to. Nothing in the message can name another connection, or another
+            // user: `verifiedUserId` is the one this connection proved.
+            await port.accept(this.attended, m.suggestionId, m.choice, this.verifiedUserId);
             this.ch.send({ t: 'approvals-accept-result', id: m.id, ok: true });
         }
         catch (err) {
-            this.ch.send({ t: 'approvals-accept-result', id: m.id, ok: false, error: errMessage(err) });
+            this.ch.send({ t: 'approvals-accept-result', id: m.id, ok: false, error: this.approvalsError(m.t, err) });
         }
     }
     async onApprovalsList(m) {
@@ -2796,11 +3541,16 @@ export class SidecarServer {
             this.ch.send({ t: 'approvals-list-result', id: m.id, ok: false, error: 'this daemon does not keep standing approvals' });
             return;
         }
+        const noUser = this.approvalsNoUser();
+        if (noUser !== null) {
+            this.ch.send({ t: 'approvals-list-result', id: m.id, ok: false, error: noUser });
+            return;
+        }
         try {
-            this.ch.send({ t: 'approvals-list-result', id: m.id, ok: true, state: await port.state() });
+            this.ch.send({ t: 'approvals-list-result', id: m.id, ok: true, state: await port.state(m.ref, this.verifiedUserId) });
         }
         catch (err) {
-            this.ch.send({ t: 'approvals-list-result', id: m.id, ok: false, error: errMessage(err) });
+            this.ch.send({ t: 'approvals-list-result', id: m.id, ok: false, error: this.approvalsError(m.t, err) });
         }
     }
     async onApprovalsRevoke(m) {
@@ -2813,13 +3563,40 @@ export class SidecarServer {
             this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: false, error: 'tool must be a non-empty string' });
             return;
         }
+        const noUser = this.approvalsNoUser();
+        if (noUser !== null) {
+            this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: false, error: noUser });
+            return;
+        }
+        // Team mode has no machine-wide rules to revoke: a revoke names its agent.
+        // The port refuses this too; refused here first so it never reaches it.
+        if (this.opts.teamMode && (m.ref === undefined || m.ref === null)) {
+            this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: false, error: APPROVALS_NAME_AGENT });
+            return;
+        }
         try {
-            this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: true, state: await port.revoke(m.tool) });
+            this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: true, state: await port.revoke(m.tool, m.ref, this.verifiedUserId) });
         }
         catch (err) {
-            this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: false, error: errMessage(err) });
+            this.ch.send({ t: 'approvals-revoke-result', id: m.id, ok: false, error: this.approvalsError(m.t, err) });
         }
     }
+    /** Team mode: every approvals message needs the user this connection
+     * proved, since a team agent's rules are its owner's to change and its
+     * members' to see. Null when the message may go on to the port. Solo mode
+     * never refuses here. */
+    approvalsNoUser() {
+        return this.opts.teamMode && !this.verifiedUserId ? APPROVALS_NO_USER : null;
+    }
+    /** What an approvals port error puts on the wire. Solo mode: its message,
+     * as always. Team mode: an ApprovalsRefusal's reason, and for anything else
+     * (a path, an errno) fixed text, the detail kept in the daemon log. */
+    approvalsError(op, err) {
+        if (!this.opts.teamMode || isApprovalsRefusal(err))
+            return errMessage(err);
+        this.opts.log?.(`approvals: ${op} threw: ${errMessage(err)}`);
+        return APPROVALS_FAILED;
+    }
     /** Why the checks port cannot answer right now, or null when it can. */
     checksRefusal() {
         if (!this.opts.checks)
@@ -2905,7 +3682,16 @@ export class SidecarServer {
              * run (recorded with it, restarts included). A run with no recorded
              * starter (the daemon's own clock, or an unverified start) is refused
              * too: fail closed. The plan alone is not gated. */
-            if (output && this.opts.admission?.ownRunsOnly) {
+            /* TEAM AGENT ACCESS (Part B): a run's plan and its output are its
+             * requester's, or, for a run nobody asked for, its agent owner's and the
+             * admin's (D5). The plan is the run's content too: the same rule. */
+            if (this.teamAccess()) {
+                if (!(await this.mayReadRun(m.runId))) {
+                    this.ch.send({ t: 'run-plan-get-result', id: m.id, ok: false, error: OUTPUT_REFUSED });
+                    return;
+                }
+            }
+            else if (output && this.opts.admission?.ownRunsOnly) {
                 const starter = runner.runStartedBy ? await runner.runStartedBy(m.runId) : null;
                 if (!this.verifiedUserId || starter !== this.verifiedUserId) {
                     this.ch.send({ t: 'run-plan-get-result', id: m.id, ok: false, error: 'You can see the output only of runs you started.' });
@@ -3032,6 +3818,11 @@ export class SidecarServer {
             });
             return;
         }
+        const runRefusal = await this.roomRunRefusal(m.req.participants);
+        if (runRefusal !== null) {
+            this.ch.send({ t: 'room-open-result', id: m.id, ok: false, problems: [runRefusal] });
+            return;
+        }
         const clientId = this.roomIdentity();
         const owner = clientId === undefined
             ? undefined
@@ -3143,6 +3934,11 @@ export class SidecarServer {
             return;
         }
         try {
+            const refusal = await this.roomDriveRefusal(m.roomId);
+            if (refusal !== null) {
+                this.ch.send({ t: 'room-resume-result', id: m.id, ok: false, error: refusal });
+                return;
+            }
             const room = await this.opts.rooms.resume(m.roomId);
             this.ch.send({ t: 'room-resume-result', id: m.id, ok: true, room });
         }
@@ -3152,6 +3948,42 @@ export class SidecarServer {
             this.ch.send({ t: 'room-resume-result', id: m.id, ok: false, error: errMessage(err) });
         }
     }
+    /** Team agent access (Part B, final review F1): a room runs every agent in
+     * it as the person who opens or drives it, so each one needs `run` for THIS
+     * connection's verified user, decided by the room service where the daemon
+     * actually finds the agent. Null when allowed. Solo mode (or no access
+     * port): null, unchanged. No verified user, no gate on the room service, or
+     * a throw: refused. */
+    async roomRunRefusal(participants) {
+        if (!this.teamAccess())
+            return null;
+        try {
+            const rooms = this.opts.rooms;
+            const user = this.verifiedUserId;
+            if (!rooms?.mayRun || !user)
+                return ROOM_RUN_REFUSED;
+            return (await rooms.mayRun(participants, user)) ? null : ROOM_RUN_REFUSED;
+        }
+        catch {
+            return ROOM_RUN_REFUSED;
+        }
+    }
+    /** `roomRunRefusal` for a room that already exists, by its recorded
+     * participants: the verbs that drive its agents (resume, answer, interject). A room
+     * that is not there is left to the room service's own "No room" answer. */
+    async roomDriveRefusal(roomId) {
+        if (!this.teamAccess())
+            return null;
+        try {
+            const found = await this.opts.rooms?.read(roomId);
+            if (!found)
+                return null;
+            return await this.roomRunRefusal(found.room.participants);
+        }
+        catch {
+            return ROOM_RUN_REFUSED;
+        }
+    }
     /** WHO THIS CONNECTION IS, INSIDE A ROOM.
      *
      * The user its pairing JWT proved (`verifiedUserId`: API-signed, aud = this
@@ -3208,6 +4040,11 @@ export class SidecarServer {
                 this.ch.send({ t: 'room-answer-result', id: m.id, ok: false, error: actor.error });
                 return;
             }
+            const refusal = await this.roomDriveRefusal(m.roomId);
+            if (refusal !== null) {
+                this.ch.send({ t: 'room-answer-result', id: m.id, ok: false, error: refusal });
+                return;
+            }
             const room = await this.opts.rooms.answer(m.roomId, actor.id, m.text, m.addressed);
             this.ch.send({ t: 'room-answer-result', id: m.id, ok: true, room });
         }
@@ -3228,6 +4065,14 @@ export class SidecarServer {
                 this.ch.send({ t: 'room-interject-result', id: m.id, ok: false, error: actor.error });
                 return;
             }
+            /* In a conversation-mode room an interjection wakes the loop and runs
+             * every agent (roomService.interject), so it takes the same run gate as
+             * resume and answer. Gated in every mode: simplest, and fails closed. */
+            const refusal = await this.roomDriveRefusal(m.roomId);
+            if (refusal !== null) {
+                this.ch.send({ t: 'room-interject-result', id: m.id, ok: false, error: refusal });
+                return;
+            }
             const room = await this.opts.rooms.interject(m.roomId, actor.id, m.text);
             this.ch.send({ t: 'room-interject-result', id: m.id, ok: true, room });
         }
@@ -3290,9 +4135,22 @@ export class SidecarServer {
             this.ch.send({ t: 'mcp-admin-error', id: m.id, error: 'this daemon cannot manage MCP servers -- update it and reconnect' });
             return;
         }
+        if (m.t !== 'mcp-servers-list') {
+            const refusal = this.mcpRefusal();
+            if (refusal) {
+                this.ch.send({ t: 'mcp-admin-error', id: m.id, error: refusal });
+                return;
+            }
+        }
         try {
             if (m.t === 'mcp-servers-list') {
-                this.ch.send({ t: 'mcp-servers', id: m.id, servers: await admin.listServers() });
+                const servers = await admin.listServers();
+                /* Team mode: a member who is not the admin learns which servers exist,
+                 * never where they are (a hosted URL can carry a secret in its path). */
+                this.ch.send({
+                    t: 'mcp-servers', id: m.id,
+                    servers: this.mcpRefusal() === null ? servers : servers.map(({ name, hosted, hasCredential }) => ({ name, hosted, hasCredential })),
+                });
                 return;
             }
             // `=== true`, not truthy: this decides whether the daemon attaches the
@@ -3323,11 +4181,111 @@ export class SidecarServer {
             this.ch.send({ t: 'mcp-admin-error', id: m.id, error: e instanceof Error ? e.message : String(e) });
         }
     }
+    /** Part D credential messages. The caller is this connection's VERIFIED
+     * user and nothing the message says; the port decides whether that user is
+     * the agent's owner or the admin. Solo mode refuses, as `onAccess` does. The
+     * secret in `agent-cred-set` goes to the port and is never logged or echoed.
+     * A refusal with no reply code goes out as fixed text (Part B's
+     * ACCESS_FAILED rule) and its detail goes to the log. */
+    async onAgentCred(m) {
+        const fail = (code, error, reason) => {
+            this.ch.send({ t: 'agent-cred-result', id: m.id, ok: false, code, error, ...(reason ? { reason } : {}) });
+        };
+        const port = this.opts.agentCreds;
+        if (!port) {
+            fail('UNAVAILABLE', 'this daemon does not manage agent credentials');
+            return;
+        }
+        if (!this.teamAccess()) {
+            fail('NOT_TEAM_AGENT', AGENT_CRED_SOLO);
+            return;
+        }
+        const caller = this.verifiedUserId;
+        if (!caller) {
+            fail('NOT_OWNER', 'this connection has no verified identity');
+            return;
+        }
+        if (typeof m.server !== 'string' || !m.server || m.server.length > MAX_IDENTITY_FIELD_LEN || AGENT_CRED_RESERVED_SERVERS.has(m.server)) {
+            fail('BAD_REQUEST', 'server must name an MCP server');
+            return;
+        }
+        /* Every shape check runs here, BEFORE the port: a malformed request never
+         * reaches the code that writes auth.json. */
+        if (m.t === 'access-bind' && m.binding !== null && m.binding !== 'asker' && m.binding !== 'agent') {
+            fail('BAD_REQUEST', 'binding must be asker, agent or null');
+            return;
+        }
+        if (m.t === 'agent-cred-set') {
+            const bad = agentCredHeadersProblem(m.headers);
+            if (bad) {
+                fail('BAD_REQUEST', bad);
+                return;
+            }
+        }
+        const server = logSafe(m.server);
+        /* The outcome is decided inside the try and sent after it, so a `send`
+         * that throws cannot be caught here and answered a second time. */
+        let outcome;
+        try {
+            if (m.t === 'access-bind') {
+                await port.bind(m.ref, caller, m.server, m.binding);
+                outcome = { ok: true };
+            }
+            else if (m.t === 'agent-cred-set') {
+                await port.setHeaders(m.ref, caller, m.server, m.headers);
+                outcome = { ok: true };
+            }
+            else if (m.t === 'agent-mcp-login') {
+                const out = await port.login(m.ref, caller, m.server, (url) => this.ch.send({ t: 'mcp-login-url', id: m.id, url }));
+                if (out.ok)
+                    outcome = { ok: true };
+                /* no-oauth and no-dcr carry an authored sentence. 'failed' carries
+                 * whatever broke mid-flow (an errno, a host), which stays in the log. */
+                else if (out.reason === 'failed') {
+                    this.opts.log?.(`agent credentials: ${m.t} for "${server}" failed: ${out.message}`);
+                    outcome = { ok: false, code: 'LOGIN_FAILED', error: AGENT_CRED_LOGIN_FAILED, reason: out.reason };
+                }
+                else {
+                    outcome = { ok: false, code: 'LOGIN_FAILED', error: out.message, reason: out.reason };
+                }
+            }
+            else {
+                await port.clear(m.ref, caller, m.server);
+                outcome = { ok: true };
+            }
+        }
+        catch (err) {
+            const code = agentCredCodeOf(err);
+            if (code) {
+                outcome = { ok: false, code, error: errMessage(err) };
+            }
+            else {
+                // The detail (a path, an errno) stays in the log, never on the wire.
+                this.opts.log?.(`agent credentials: ${m.t} for "${server}" threw: ${errMessage(err)}`);
+                outcome = { ok: false, code: 'UNAVAILABLE', error: AGENT_CRED_FAILED };
+            }
+        }
+        try {
+            if (outcome.ok)
+                this.ch.send({ t: 'agent-cred-result', id: m.id, ok: true });
+            else
+                fail(outcome.code, outcome.error, outcome.reason);
+        }
+        catch (err) {
+            // One reply per request: a channel that cannot carry it is logged, not answered again.
+            this.opts.log?.(`agent credentials: could not send the ${m.t} reply: ${errMessage(err)}`);
+        }
+    }
     async onMcpCall(m) {
         if (!this.opts.mcp) {
             this.ch.send({ t: 'mcp-error', id: m.id, error: 'this daemon serves no MCP tools' });
             return;
         }
+        const refusal = this.mcpRefusal();
+        if (refusal) {
+            this.ch.send({ t: 'mcp-error', id: m.id, error: refusal });
+            return;
+        }
         const parsed = parseMcpToolAddress(m.address);
         if (!parsed) {
             this.ch.send({ t: 'mcp-error', id: m.id, error: `"${m.address}" is not a valid MCP tool address` });
@@ -3346,6 +4304,675 @@ export class SidecarServer {
             this.ch.send({ t: 'mcp-error', id: m.id, error: errMessage(err) });
         }
     }
+    /** One access-* request, answered for THIS connection's verified user. Solo
+     * mode (or no port) refuses without asking. A port that throws becomes a
+     * refusal: it must never kill the connection or leave the request unanswered. */
+    async onAccess(m) {
+        const port = this.opts.access;
+        if (!port || !port.teamMode) {
+            this.ch.send({ t: 'access-result', id: m.id, ok: false, code: 'NOT_TEAM_AGENT', error: 'this daemon does not keep agent access' });
+            return;
+        }
+        let reply;
+        try {
+            reply = await port.handle(this.verifiedUserId, m);
+        }
+        catch (err) {
+            // The detail (a path, an errno) stays in the log, never on the wire.
+            this.opts.log?.(`access: ${m.t} threw: ${errMessage(err)}`);
+            reply = { ok: false, code: 'NO_ACCESS', error: ACCESS_FAILED };
+        }
+        this.ch.send(reply.ok
+            ? { t: 'access-result', id: m.id, ok: true, ...(reply.access ? { access: reply.access } : {}), ...(reply.members ? { members: reply.members } : {}) }
+            : { t: 'access-result', id: m.id, ok: false, code: reply.code, error: reply.error });
+    }
+    /** Team mode with a member list, and this connection's verified user is not
+     * an active member right now. Read fresh on every call. Member status
+     * ALONE: a peer daemon connection is exempted from the request gate in
+     * onMessage (it is served only PEER_DAEMON_MESSAGES there), never here, so
+     * a claimed peer cannot lift the welcome strip. A port that throws reads as
+     * pending (fail closed): it runs inside onMessage and every broadcast. */
+    memberPending() {
+        const members = this.opts.members;
+        if (members === undefined)
+            return false;
+        try {
+            return members.statusOf(this.verifiedUserId) !== 'active';
+        }
+        catch {
+            return true;
+        }
+    }
+    /** One member-* request, answered for THIS connection's verified user. A
+     * port that throws becomes a refusal with fixed text (the detail is
+     * logged), never a dropped connection. */
+    async onMember(m) {
+        const port = this.opts.members;
+        let reply;
+        if (!port) {
+            reply = { ok: false, code: 'UNAVAILABLE', error: 'this daemon keeps no member list (it is not in team mode)' };
+        }
+        else {
+            try {
+                reply = await port.handle(this.verifiedUserId, m);
+            }
+            catch (err) {
+                this.opts.log?.(`members: ${m.t} threw: ${errMessage(err)}`);
+                reply = { ok: false, code: 'UNAVAILABLE', error: MEMBER_FAILED };
+            }
+        }
+        /* Rebuilt from named fields (like onAccess), never spread: whatever else
+         * a port's reply carries does not reach the wire. */
+        this.ch.send(reply.ok
+            ? {
+                t: 'member-result', id: m.id, ok: true,
+                ...(reply.status !== undefined ? { status: reply.status } : {}),
+                ...(reply.daemonName !== undefined ? { daemonName: reply.daemonName } : {}),
+                ...(reply.adminLabel !== undefined ? { adminLabel: reply.adminLabel } : {}),
+                ...(reply.adminId !== undefined ? { adminId: reply.adminId } : {}),
+                ...(reply.admin !== undefined ? { admin: reply.admin } : {}),
+                ...(reply.members ? {
+                    members: reply.members.map((r) => ({
+                        userId: r.userId, status: r.status, firstSeen: r.firstSeen, label: r.label,
+                        ...(r.approvedBy !== undefined ? { approvedBy: r.approvedBy } : {}),
+                        ...(r.approvedAt !== undefined ? { approvedAt: r.approvedAt } : {}),
+                    })),
+                } : {}),
+            }
+            : { t: 'member-result', id: m.id, ok: false, code: reply.code, error: reply.error });
+    }
+    /** Team access overview (Part E, E2), for THIS connection's verified user.
+     * Solo mode (or no port) refuses without asking, like onAccess. A coded
+     * refusal passes its code and authored text through; any other failure goes
+     * out as fixed text, with the detail in the log. */
+    async onAccessOverview(m) {
+        const port = this.opts.access;
+        if (!port || !port.teamMode || !port.overview) {
+            this.ch.send({ t: 'access-overview-result', id: m.id, ok: false, code: 'NOT_TEAM_AGENT', error: 'this daemon does not keep agent access' });
+            return;
+        }
+        /* The rows are rebuilt INSIDE the try, so a malformed port result (no
+         * array, a null row) is the fixed-text failure. The reply is sent after
+         * it, so a `send` that throws is logged, never answered a second time. */
+        let reply;
+        try {
+            const rows = await port.overview(this.verifiedUserId);
+            /* The admin-only notice must never fail the rows (owner ruling
+             * 2026-10-06): a throw here is logged and the list goes out empty. */
+            let inactive = [];
+            if (port.inactiveDeployments) {
+                try {
+                    inactive = (await port.inactiveDeployments(this.verifiedUserId)).map(inactiveDeploymentOf);
+                }
+                catch (err) {
+                    this.opts.log?.(`access: the inactive-deployment list threw; sent empty: ${errMessage(err)}`);
+                }
+            }
+            reply = {
+                t: 'access-overview-result', id: m.id, ok: true,
+                rows: rows.map(accessOverviewRowOf),
+                inactiveDeployments: inactive,
+            };
+        }
+        catch (err) {
+            const code = accessCodeOf(err);
+            if (code) {
+                reply = { t: 'access-overview-result', id: m.id, ok: false, code, error: errMessage(err) };
+            }
+            else {
+                // The detail (a path, an errno) stays in the log, never on the wire.
+                this.opts.log?.(`access: access-overview threw: ${errMessage(err)}`);
+                reply = { t: 'access-overview-result', id: m.id, ok: false, code: 'NO_ACCESS', error: ACCESS_FAILED };
+            }
+        }
+        try {
+            this.ch.send(reply);
+        }
+        catch (err) {
+            this.opts.log?.(`access: could not send the access-overview reply: ${errMessage(err)}`);
+        }
+    }
+    /** Each MCP server's binding and credential PRESENCE for one agent (Part E,
+     * E2). The owner or admin only, decided by the port from the verified user.
+     * Solo mode refuses without asking, like onAgentCred. Every row is rebuilt
+     * from its three fields here, so a port that returned more (a header, a
+     * token) could never put it on the wire. */
+    async onAgentCredStatus(m) {
+        const fail = (code, error) => {
+            this.ch.send({ t: 'agent-cred-status-result', id: m.id, ok: false, code, error });
+        };
+        const port = this.opts.agentCreds;
+        if (!port?.status) {
+            fail('UNAVAILABLE', 'this daemon does not manage agent credentials');
+            return;
+        }
+        if (!this.teamAccess()) {
+            fail('NOT_TEAM_AGENT', AGENT_CRED_SOLO);
+            return;
+        }
+        const caller = this.verifiedUserId;
+        if (!caller) {
+            fail('NOT_OWNER', 'this connection has no verified identity');
+            return;
+        }
+        /* Rows rebuilt INSIDE the try (a malformed port result is the fixed-text
+         * failure); the reply sent after it, once. */
+        let reply;
+        try {
+            const rows = await port.status(m.ref, caller);
+            reply = {
+                t: 'agent-cred-status-result', id: m.id, ok: true,
+                servers: rows.map((r) => ({
+                    server: String(r.server),
+                    binding: r.binding === 'asker' || r.binding === 'agent' ? r.binding : null,
+                    hasAgentCredential: r.hasAgentCredential === true,
+                })),
+            };
+        }
+        catch (err) {
+            const code = agentCredCodeOf(err);
+            if (code) {
+                reply = { t: 'agent-cred-status-result', id: m.id, ok: false, code, error: errMessage(err) };
+            }
+            else {
+                // The detail (a path, an errno) stays in the log, never on the wire.
+                this.opts.log?.(`agent credentials: agent-cred-status threw: ${errMessage(err)}`);
+                reply = { t: 'agent-cred-status-result', id: m.id, ok: false, code: 'UNAVAILABLE', error: AGENT_CRED_FAILED };
+            }
+        }
+        try {
+            this.ch.send(reply);
+        }
+        catch (err) {
+            this.opts.log?.(`agent credentials: could not send the agent-cred-status reply: ${errMessage(err)}`);
+        }
+    }
+    /** Team run history (spec 2026-10-01 E5.6): viewer or higher on the agent,
+     * for THIS connection's verified user. The ref is validated before the
+     * access port sees it. Each row is rebuilt from its own fields here
+     * (agentRunRowOf), so a runner that returned more (a message, a
+     * transcript) could never put it on the wire. An uncoded failure is fixed text; the detail stays in the log. */
+    async onAgentRuns(m) {
+        const fail = (code, error) => {
+            this.ch.send({ t: 'agent-runs-result', id: m.id, ok: false, code, error });
+        };
+        const access = this.teamAccess();
+        const list = this.opts.runner?.agentRuns?.bind(this.opts.runner);
+        if (!access || !list) {
+            fail('NOT_TEAM_AGENT', 'this daemon keeps no team run history');
+            return;
+        }
+        const user = this.verifiedUserId;
+        if (!user) {
+            fail('NO_ACCESS', ACCESS_NO_ROLE);
+            return;
+        }
+        const ref = agentRunsRefOf(m.ref);
+        if (!ref) {
+            fail('UNKNOWN_AGENT', AGENT_RUNS_BAD_REF);
+            return;
+        }
+        let reply;
+        try {
+            if (!(await access.can(ref, user, 'run-list'))) {
+                fail('NO_ACCESS', ACCESS_NO_ROLE);
+                return;
+            }
+            const limit = typeof m.limit === 'number' && Number.isInteger(m.limit) && m.limit > 0
+                ? Math.min(m.limit, AGENT_RUNS_MAX_LIMIT) : AGENT_RUNS_DEFAULT_LIMIT;
+            const before = typeof m.before === 'string' && m.before.length > 0 && m.before.length <= 200 ? m.before : undefined;
+            const rows = await list(ref, user, { limit, ...(before ? { before } : {}) });
+            reply = {
+                t: 'agent-runs-result', id: m.id, ok: true,
+                runs: rows.map(agentRunRowOf),
+            };
+        }
+        catch (err) {
+            const code = accessCodeOf(err);
+            if (code) {
+                reply = { t: 'agent-runs-result', id: m.id, ok: false, code, error: errMessage(err) };
+            }
+            else {
+                // The detail (a path, an errno) stays in the log, never on the wire.
+                this.opts.log?.(`access: agent-runs threw: ${errMessage(err)}`);
+                reply = { t: 'agent-runs-result', id: m.id, ok: false, code: 'NO_ACCESS', error: AGENT_RUNS_FAILED };
+            }
+        }
+        try {
+            this.ch.send(reply);
+        }
+        catch (err) {
+            this.opts.log?.(`access: could not send the agent-runs reply: ${errMessage(err)}`);
+        }
+    }
+    /** peer-* (spec 2026-10-01 E5.5), for THIS connection's verified user. A
+     * link is rebuilt from its five fields, so a port that returned more (a
+     * device key) could never put it on the wire. An uncoded throw is fixed
+     * text; the detail stays in the log. */
+    async onPeer(m) {
+        const port = this.opts.peerAdmin;
+        let reply;
+        if (!port) {
+            reply = { t: 'peer-result', id: m.id, ok: false, code: 'UNAVAILABLE', error: 'this daemon does not link to team daemons' };
+        }
+        else {
+            try {
+                const r = await port.handle(this.verifiedUserId, m);
+                reply = !r.ok
+                    ? { t: 'peer-result', id: m.id, ok: false, code: r.code, error: r.error }
+                    : {
+                        t: 'peer-result', id: m.id, ok: true,
+                        ...(r.peers ? {
+                            peers: r.peers.map((p) => ({
+                                sidecarId: p.sidecarId, url: p.url, ...(typeof p.name === 'string' ? { name: p.name } : {}),
+                                connected: p.connected === true, mcpAllow: [...p.mcpAllow],
+                            })),
+                        } : {}),
+                    };
+            }
+            catch (err) {
+                this.opts.log?.(`peer links: ${m.t} threw: ${errMessage(err)}`);
+                reply = { t: 'peer-result', id: m.id, ok: false, code: 'UNAVAILABLE', error: PEER_FAILED };
+            }
+        }
+        try {
+            this.ch.send(reply);
+        }
+        catch (err) {
+            this.opts.log?.(`peer links: could not send the ${m.t} reply: ${errMessage(err)}`);
+        }
+    }
+    /** Team mode with per-agent access wired. Every Part B gate keys on this,
+     * so solo mode takes none of the new paths. */
+    teamAccess() {
+        const a = this.opts.access;
+        return a !== undefined && a.teamMode ? a : null;
+    }
+    /** Who asked for a run: this process's hub record, the runner's facts, or
+     * the run's stored record (restarts included). */
+    async runRequester(runId, facts) {
+        return this.opts.runs?.startedBy?.(runId) ?? facts?.requester ?? (await this.opts.runner?.runStartedBy?.(runId)) ?? undefined;
+    }
+    /** May THIS connection read run `runId`'s content (watch it, read its
+     * output)? Decision D5, in this order: a run somebody asked for is theirs
+     * alone, the owner and the admin included; a run nobody asked for (a
+     * schedule, a trigger) is its agent owner's and the admin's. Anything
+     * unknown, and anything that throws, is refused. */
+    async mayReadRun(runId) {
+        try {
+            const access = this.teamAccess();
+            const user = this.verifiedUserId;
+            if (!access || !user || typeof runId !== 'string')
+                return false;
+            const facts = (await this.opts.runner?.runFacts?.(runId)) ?? null;
+            const requester = await this.runRequester(runId, facts);
+            if (requester !== undefined)
+                return requester === user;
+            if (!facts || facts.origin === 'user')
+                return false;
+            return await access.can(facts.ref, user, 'unattended-content');
+        }
+        catch {
+            return false;
+        }
+    }
+    /** One run-activity item to THIS connection. Solo mode: as is, at once.
+     * Team mode with per-agent access: only what `runActivityFor` lets
+     * through, decided in arrival order. */
+    sendRunActivity(activity) {
+        if (!this.teamAccess()) {
+            // No team: nothing is anyone's, so no report claims mine or attended.
+            this.ch.send({ t: 'run-activity', activity: withoutViewerClaims(activity) });
+            return;
+        }
+        // Items queued before a cut-off replay (see replayDrained) are dropped
+        // however they are decided later.
+        const epoch = this.runActivityEpoch;
+        this.runActivityChain = this.runActivityChain
+            .then(() => this.runActivityDecided(activity))
+            .then((item) => {
+            // Re-read at the send: a member removed or made pending while the
+            // item was being decided hears nothing (Part E).
+            if (item && !this.closed && epoch === this.runActivityEpoch && !this.memberPending())
+                this.ch.send({ t: 'run-activity', activity: item });
+        })
+            .catch(() => undefined);
+    }
+    /** The pre-welcome replay drained, or cut off at its total cap (F14): past
+     * the cap every item still undecided is dropped for this connection, and
+     * the welcome goes out. Never rejects. */
+    async replayDrained() {
+        if (!this.teamAccess()) {
+            await this.runActivityChain;
+            return;
+        }
+        const cap = this.opts.runActivityDecideMs !== undefined ? this.opts.runActivityDecideMs * WELCOME_REPLAY_DEADLINES : WELCOME_REPLAY_MAX_MS;
+        let timer;
+        const capped = new Promise((res) => { timer = setTimeout(() => res('cap'), cap); });
+        const drained = this.runActivityChain.then(() => 'drained');
+        const outcome = await Promise.race([drained, capped]).finally(() => clearTimeout(timer));
+        if (outcome === 'cap') {
+            this.runActivityEpoch++;
+            this.opts.log?.('run activity: the replay at connect took too long; what was left of it was not sent to this connection');
+        }
+    }
+    /** `runActivityFor` under a deadline: past it the item is dropped. */
+    runActivityDecided(activity) {
+        let timer;
+        const timed = new Promise((res) => {
+            timer = setTimeout(() => res(null), this.opts.runActivityDecideMs ?? RUN_ACTIVITY_DECIDE_MS);
+        });
+        return Promise.race([this.runActivityFor(activity), timed]).finally(() => clearTimeout(timer));
+    }
+    /** What THIS connection may hear of one run (team agent access, Part B,
+     * Task 16b). Nothing unless it may list the agent's runs (viewer or higher)
+     * or asked for the run itself. The failure message and the task only when
+     * it may read the run's content (`mayReadRun`, decision D5: the requester,
+     * or for an unattended run the agent's owner or the admin). The agent is
+     * the run's own recorded facts, never the names the item carries. No facts,
+     * facts for a different agent, or any throw: nothing. What gets through says
+     * `mine` on the requester's own connection and `attended` when a person
+     * asked for the run (E5.1); whatever the item claimed of either is dropped,
+     * and no user id is added. */
+    async runActivityFor(activity) {
+        try {
+            const access = this.teamAccess();
+            const user = this.verifiedUserId;
+            if (!access || !user || typeof activity.runId !== 'string')
+                return null;
+            const clean = withoutViewerClaims(activity);
+            const facts = (await this.opts.runner?.runFacts?.(clean.runId)) ?? null;
+            if (!facts || facts.ref.agent !== clean.agent)
+                return null;
+            const full = await this.mayReadRun(clean.runId);
+            if (!full && !(await access.can(facts.ref, user, 'run-list')))
+                return null;
+            const item = { ...clean };
+            if (!full) {
+                delete item.message;
+                delete item.task;
+            }
+            // Mine and attended for THIS connection (E5.1), from the run's own
+            // facts, after the role decision.
+            const requester = await this.runRequester(clean.runId, facts);
+            return activityForViewer(item, { requester, origin: facts.origin }, user);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Team mode: THIS connection's verified user is the daemon admin. A throw
+     * is "no". */
+    isSessionAdmin() {
+        try {
+            const access = this.teamAccess();
+            const user = this.verifiedUserId;
+            return access !== null && sameAdmin(user, access.adminId());
+        }
+        catch {
+            return false;
+        }
+    }
+    /** The ids of the sessions whose recorded VERIFIED creator is THIS
+     * connection's verified user. Never the claimed `owner`. A session with no
+     * recorded creator is nobody's here. May throw (the caller refuses). */
+    ownSessionIds(sessions) {
+        const user = this.verifiedUserId;
+        if (!user)
+            return new Set();
+        return new Set(sessions.list().filter((s) => s.verifiedOwner !== undefined && s.verifiedOwner === user).map((s) => s.id));
+    }
+    /** May THIS connection act on session `sessionId` (pause, resume, destroy,
+     * capture, watch, run)? Team mode (Task 16c): the admin, or the session's
+     * recorded verified creator. A session with no recorded creator is the
+     * admin's alone. A throw refuses. */
+    maySession(sessions, sessionId) {
+        try {
+            if (this.isSessionAdmin())
+                return true;
+            return typeof sessionId === 'string' && this.ownSessionIds(sessions).has(sessionId);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** The sessions THIS connection is shown. Solo mode: every one, as before.
+     * Team mode (Task 16c): the admin sees every one, anyone else only their
+     * own. A throw shows none. */
+    visibleSessions() {
+        const sessions = this.opts.sessions;
+        if (!sessions)
+            return [];
+        if (!this.teamAccess())
+            return sessions.list();
+        try {
+            if (this.isSessionAdmin())
+                return sessions.list();
+            const own = this.ownSessionIds(sessions);
+            return sessions.list().filter((s) => own.has(s.id));
+        }
+        catch {
+            return [];
+        }
+    }
+    /** Team mode (Task 16c): why THIS connection may not send `m`, or null.
+     * `session-unwatch` stops only this connection's own watch and is never
+     * refused; `session-snapshots` is filtered where it is answered. */
+    async sessionRefusal(sessions, m) {
+        switch (m.t) {
+            case 'session-commit':
+                // A client-chosen name is how a snapshot is attributed and a repeated
+                // one overwrites: only the admin may pick one.
+                if (m.name !== undefined && !this.isSessionAdmin())
+                    return SNAPSHOT_NAME_REFUSED;
+                return this.maySession(sessions, m.sessionId) ? null : SESSION_REFUSED;
+            case 'session-pause':
+            case 'session-resume':
+            case 'session-destroy':
+            case 'session-watch':
+                return this.maySession(sessions, m.sessionId) ? null : SESSION_REFUSED;
+            case 'session-snapshot-usage':
+                return this.isSessionAdmin() ? null : SNAPSHOT_USAGE_ADMIN_ONLY;
+            case 'session-create': {
+                if (!m.fromSnapshot || this.isSessionAdmin())
+                    return null;
+                try {
+                    const snapshot = (sessions.snapshots ? await sessions.snapshots() : []).find((s) => s.name === m.fromSnapshot);
+                    const own = this.ownSessionIds(sessions);
+                    return snapshot?.sessionId !== undefined && own.has(snapshot.sessionId) ? null : SNAPSHOT_REFUSED;
+                }
+                catch {
+                    return SNAPSHOT_REFUSED;
+                }
+            }
+            default:
+                return null;
+        }
+    }
+    /** May THIS connection stop run `runId`? Its requester may, and so may the
+     * agent's owner or the admin, for any run of that agent. A throw refuses. */
+    async mayCancelRun(runId) {
+        try {
+            const access = this.teamAccess();
+            const user = this.verifiedUserId;
+            if (!access || !user || typeof runId !== 'string')
+                return false;
+            const facts = (await this.opts.runner?.runFacts?.(runId)) ?? null;
+            if ((await this.runRequester(runId, facts)) === user)
+                return true;
+            return facts !== null && (await access.can(facts.ref, user, 'cancel-any'));
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Who may do this config call on the daemon's own crew (team mode):
+     * - read a definition (or list an agent): any role; read anything else in
+     *   an agent's folder (its runs' memory, sessions, logs): owner or admin;
+     * - write, append or delete in an agent's folder: owner or admin, except the
+     *   first write into a NEW agent, which claims it for the writer;
+     * - change the crew folder itself or a crew-level file: the admin.
+     * Answers a refusal, or what to record once the call has succeeded. Anything
+     * that cannot be decided, or throws, is a refusal. */
+    async configGate(svc, m) {
+        const reading = m.t === 'config-list' || m.t === 'config-read';
+        const refusal = reading ? ACCESS_NO_ROLE : ACCESS_NOT_OWNER;
+        try {
+            const access = this.teamAccess();
+            if (!access)
+                return {};
+            const user = this.verifiedUserId;
+            if (typeof m.path !== 'string')
+                return { refusal };
+            const canonical = await this.canonicalConfigPath(svc, m.path);
+            if (canonical === null)
+                return { refusal };
+            const target = crewConfigTarget(canonical);
+            if (!target)
+                return {};
+            if (reading) {
+                if (target.kind === 'crew')
+                    return {};
+                /* A run's words (a kept transcript, a run's session log) are decided
+                 * per run, exactly as run-transcript decides them (decision D5: a
+                 * member's attended run is theirs alone, the owner and admin
+                 * included; an unattended run is the owner's and the admin's). A role
+                 * on the agent is neither needed nor enough. The folder itself may be
+                 * listed with any role, and the listing keeps only the runs this user
+                 * may read (visibleConfigEntries); anything else in it is refused. */
+                const run = runContentOf(canonical);
+                if (run !== null) {
+                    if (run.id === null) {
+                        return m.t === 'config-list' && run.folder && (await access.can(daemonAgent(target.agent), user, 'see')) ? {} : { refusal };
+                    }
+                    return (await this.mayReadRunContent(target.agent, run.id, user)) ? {} : { refusal };
+                }
+                const action = m.t === 'config-list' || target.whole || target.definition ? 'see' : 'unattended-content';
+                if (!(await access.can(daemonAgent(target.agent), user, action)))
+                    return { refusal };
+                return {};
+            }
+            if (target.kind === 'crew')
+                return sameAdmin(user, access.adminId()) ? {} : { refusal: ACCESS_ADMIN_ONLY };
+            const ref = daemonAgent(target.agent);
+            /* Decided BEFORE the write: an agent that already exists is never claimed. */
+            if (m.t !== 'config-delete' && (await access.isNewAgent(ref)))
+                return user !== undefined ? { claim: ref } : { refusal };
+            if (!(await access.can(ref, user, 'write-definition')))
+                return { refusal };
+            return m.t === 'config-delete' && target.whole ? { deleted: ref } : {};
+        }
+        catch {
+            return { refusal };
+        }
+    }
+    /** The runner's per-run decision (D5) for one run's kept words on the
+     * daemon crew. No runner decision available, or a throw: no. */
+    async mayReadRunContent(agent, runId, user) {
+        try {
+            const mayRead = this.opts.runner?.mayReadTranscript;
+            return mayRead !== undefined && (await mayRead.call(this.opts.runner, agent, runId, user));
+        }
+        catch {
+            return false;
+        }
+    }
+    /** A listing without the agents this connection has no role on (team mode),
+     * or null when that cannot be decided. Only whole agents are left out:
+     * dropping individual entries would read as deletions to a syncing client.
+     * The one exception is a run's session folder (`sessions/<runId>`), which
+     * is run content: only the runs this user may read are listed (D5). */
+    async visibleConfigEntries(svc, path, entries) {
+        const access = this.teamAccess();
+        if (!access)
+            return entries;
+        try {
+            const base = await this.canonicalConfigPath(svc, path);
+            if (base === null)
+                return null;
+            const visible = new Map();
+            const runs = new Map();
+            const out = [];
+            const isAdmin = sameAdmin(this.verifiedUserId, access.adminId());
+            for (const e of entries) {
+                const full = base ? `${base}/${e.path}` : e.path;
+                const target = crewConfigTarget(full);
+                if (target?.kind === 'crew' && !isAdmin && full.split('/').length >= 2 && (e.dir === true || full.split('/').length >= 3))
+                    continue;
+                if (target?.kind !== 'agent') {
+                    out.push(e);
+                    continue;
+                }
+                let shown = visible.get(target.agent);
+                if (shown === undefined) {
+                    shown = await access.can(daemonAgent(target.agent), this.verifiedUserId, 'see');
+                    visible.set(target.agent, shown);
+                }
+                if (!shown)
+                    continue;
+                const run = runContentOf(full);
+                if (run?.kind === 'sessions' && run.id !== null) {
+                    const key = `${target.agent}/${run.id}`;
+                    let readable = runs.get(key);
+                    if (readable === undefined) {
+                        readable = await this.mayReadRunContent(target.agent, run.id, this.verifiedUserId);
+                        runs.set(key, readable);
+                    }
+                    if (!readable)
+                        continue;
+                }
+                out.push(e);
+            }
+            return out;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** After a config write or delete went through: record a new agent's owner,
+     * or drop a deleted agent's record. Never fails the call that succeeded. */
+    async afterConfigChange(gate) {
+        const access = this.teamAccess();
+        if (!access)
+            return;
+        try {
+            if (gate.claim)
+                await access.onAgentCreated(gate.claim, this.verifiedUserId);
+            if (gate.deleted)
+                await access.onAgentDeleted(gate.deleted);
+        }
+        catch (err) {
+            this.opts.log?.(`access: could not record an agent change: ${errMessage(err)}`);
+        }
+    }
+    /** Why THIS connection may not run a mutating tool on `target`, or null.
+     * The first write into a new agent claims it, which needs a verified user;
+     * a delete never claims, so it goes through the ordinary check. */
+    async invokeRefusal(access, target, tool) {
+        if (target.kind === 'access-store')
+            return ACCESS_STORE_REFUSED;
+        const user = this.verifiedUserId;
+        if (target.kind === 'crew-parent')
+            return sameAdmin(user, access.adminId()) ? null : ACCESS_ADMIN_ONLY;
+        if (target.isNew && tool !== 'sidecar_fs_delete')
+            return user !== undefined ? null : ACCESS_NOT_OWNER;
+        return (await access.can(target.ref, user, 'write-definition')) ? null : ACCESS_NOT_OWNER;
+    }
+    /** Team mode: the daemon's MCP servers and credentials are the admin's
+     * (Part B). Null when THIS connection may use or change them. Unknown admin
+     * and any throw while deciding are refusals. */
+    mcpRefusal() {
+        try {
+            const access = this.teamAccess();
+            if (!access)
+                return null;
+            const user = this.verifiedUserId;
+            return sameAdmin(user, access.adminId()) ? null : MCP_ADMIN_ONLY;
+        }
+        catch {
+            return MCP_ADMIN_ONLY;
+        }
+    }
     async onRoomFindings(m) {
         if (!this.opts.rooms) {
             // A daemon without the capability hosts no rooms, so it holds no
@@ -3391,8 +5018,19 @@ export class SidecarServer {
             return;
         }
         try {
+            /* TEAM AGENT ACCESS (Part B) on the daemon's own crew (`crew/...`). The
+             * allowlist is still the service's; this only decides WHO, per agent. */
+            const gate = this.teamAccess() ? await this.configGate(svc, m) : {};
+            if ('refusal' in gate) {
+                this.ch.send({ t: 'config-result', id: m.id, ok: false, error: gate.refusal });
+                return;
+            }
             if (m.t === 'config-list') {
-                this.ch.send({ t: 'config-result', id: m.id, ok: true, entries: await svc.list(m.path, m.depth) });
+                const entries = await svc.list(m.path, m.depth);
+                const shown = await this.visibleConfigEntries(svc, m.path, entries);
+                this.ch.send(shown
+                    ? { t: 'config-result', id: m.id, ok: true, entries: shown }
+                    : { t: 'config-result', id: m.id, ok: false, error: ACCESS_NO_ROLE });
                 return;
             }
             if (m.t === 'config-read') {
@@ -3408,12 +5046,91 @@ export class SidecarServer {
             }
             else
                 await svc.remove(m.path);
+            await this.afterConfigChange(gate);
             this.ch.send({ t: 'config-result', id: m.id, ok: true });
         }
         catch (e) {
             this.ch.send({ t: 'config-result', id: m.id, ok: false, error: errMessage(e) });
         }
     }
+    /** The config path as the filesystem would reach it, for classification:
+     * separators, `.`, empty and `..` segments resolved; the `crew` segment, the
+     * agent folder (to its on-disk name, read from the service's own listing of
+     * `crew`) and a definition file name matched case-insensitively, since the
+     * filesystem under the state dir may be case-insensitive. Null means "cannot
+     * be told" (two case variants exist and none is exact): the caller refuses.
+     * A listing that throws propagates, and the caller refuses. A path outside
+     * the crew comes back as is. */
+    async canonicalConfigPath(svc, path) {
+        const segs = [];
+        for (const seg of path.split(/[\\/]/)) {
+            if (seg === '' || seg === '.')
+                continue;
+            if (seg === '..')
+                segs.pop();
+            else
+                segs.push(seg);
+        }
+        /* A `:` is an NTFS alternate-stream / `::$INDEX_ALLOCATION` spelling of a
+         * folder: it reaches the real folder under a name no check here would
+         * recognise. Never legitimate in a config path. */
+        if (segs.some((seg) => seg.includes(':')))
+            return null;
+        if (segs.length === 0 || !sameConfigName(segs[0], 'crew'))
+            return segs.join('/');
+        const out = ['crew'];
+        if (segs.length >= 2) {
+            let agent = segs[1];
+            const entries = await svc.list('crew', 1);
+            if (/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(agent)) {
+                const dirs = entries
+                    .filter((e) => e.dir === true && !e.path.includes('/') && sameConfigName(e.path, agent))
+                    .map((e) => e.path);
+                if (dirs.length === 1)
+                    agent = dirs[0];
+                else if (dirs.length > 1 && !dirs.includes(agent))
+                    return null;
+            }
+            else {
+                /* Not an agent name. Inside it (3+ segments) is never a legitimate
+                 * location. A crew-level entry (2 segments) is fine only as a FILE the
+                 * listing shows, or a new file whose name is no 8.3 short name; a
+                 * short name or a plain folder is how an agent's folder hides. */
+                if (segs.length >= 3)
+                    return null;
+                const hit = entries.find((e) => !e.path.includes('/') && sameConfigName(e.path, agent));
+                if (hit ? hit.dir === true : agent.includes('~'))
+                    return null;
+                if (hit)
+                    agent = hit.path;
+            }
+            out.push(agent);
+        }
+        /* Every segment below the agent folder, at every depth: no short-name
+         * (`<base>~<digit>`), trailing-dot or trailing-space spelling (the filesystem drops
+         * those, so they reach a real name this classification never sees), and
+         * each one canonicalized to its on-disk name by listing its parent, so a
+         * case variant of `transcripts` is classified as `transcripts`. */
+        for (let i = 2; i < segs.length; i++) {
+            const seg = segs[i];
+            if (/~\d/.test(seg) || seg.endsWith('.') || seg.endsWith(' '))
+                return null;
+            const def = i === 2 && segs.length === 3 ? CREW_DEFINITION_FILES.find((d) => sameConfigName(d, seg)) : undefined;
+            if (def !== undefined) {
+                out.push(def);
+                continue;
+            }
+            const siblings = await svc.list(out.join('/'), 1);
+            const names = siblings.filter((e) => !e.path.includes('/') && sameConfigName(e.path, seg)).map((e) => e.path);
+            if (names.length === 1)
+                out.push(names[0]);
+            else if (names.length > 1 && !names.includes(seg))
+                return null;
+            else
+                out.push(seg);
+        }
+        return out.join('/');
+    }
     async onHostSyncPut(m) {
         const identity = this.requireHostSyncIdentity();
         if ('error' in identity) {
@@ -3469,12 +5186,62 @@ export class SidecarServer {
     }
     hostCall(provider, method, args) {
         const id = ++this.hostSeq;
+        const label = `${provider}.${method}`;
         return new Promise((resolve, reject) => {
-            this.hostPending.set(id, { resolve, reject });
-            this.ch.send({ t: 'host-call', id, provider, method, args });
+            if (this.closed) {
+                reject(new HostCallError('undelivered', `host call ${label} not sent: the connection is closed`));
+                return;
+            }
+            const pending = { resolve, reject, label };
+            if (!HUMAN_WAIT_PROVIDERS.has(provider)) {
+                const ms = this.opts.hostCallTimeoutMs ?? DEFAULT_HOST_CALL_TIMEOUT_MS;
+                pending.timer = setTimeout(() => {
+                    if (this.hostPending.get(id) !== pending)
+                        return;
+                    this.hostPending.delete(id);
+                    reject(new HostCallError('timeout', `host call ${label} timed out after ${ms}ms`));
+                }, ms);
+                // Never keep a node process alive for this timer alone.
+                pending.timer.unref?.();
+            }
+            this.hostPending.set(id, pending);
+            try {
+                this.ch.send({ t: 'host-call', id, provider, method, args });
+            }
+            catch (err) {
+                this.hostPending.delete(id);
+                if (pending.timer !== undefined)
+                    clearTimeout(pending.timer);
+                reject(new HostCallError('undelivered', `host call ${label} not sent: ${errMessage(err)}`));
+            }
         });
     }
 }
+/** Whether `user` is the daemon admin `admin`. Both must be non-empty
+ * strings: an unknown admin, or an empty id on either side, is never a match. */
+export function sameAdmin(user, admin) {
+    return typeof user === 'string' && user !== '' && typeof admin === 'string' && admin !== '' && user === admin;
+}
+/** Where a daemon-crew config path is inside a run's kept words: an agent's
+ * `transcripts/<runId>.jsonl` or anything under `sessions/<runId>/` (a
+ * daemon run's session log, whose session id is its run id). `id` null is
+ * the folder itself (`folder`) or a spelling inside it that names no run.
+ * Null for any other path. Segment names compare case-insensitively; the
+ * caller hands in the canonical path. */
+function runContentOf(path) {
+    const segs = path.split('/');
+    if (segs.length < 3 || segs[0].toLowerCase() !== 'crew')
+        return null;
+    const kind = segs[2].toLowerCase();
+    if (kind !== 'transcripts' && kind !== 'sessions')
+        return null;
+    if (segs.length === 3)
+        return { kind, id: null, folder: true };
+    if (kind === 'sessions')
+        return { kind, id: segs[3] || null, folder: false };
+    const file = segs.length === 4 ? /^(.+)\.jsonl$/i.exec(segs[3]) : null;
+    return { kind, id: file ? file[1] : null, folder: false };
+}
 /** `run-history`'s `crew`, off the wire: anything but the two known shapes is
  * treated as absent (the global crew, as an older client meant). The id is
  * only a selector among the CALLER's own roots -- the runner matches it