@corenel/harness 0.13.0 → 0.15.0

package/dist/sidecar/host.js

@@ -1,5 +1,6 @@
 import { asEcPublicJwk, jwkThumbprint, verifySignature, randomToken, serverProofPayload, clientProofPayload, parseEnrollmentCode, bytesToB64url, codeProof, codeHash, } from './deviceKeys.js';
-import { SIDECAR_PROTOCOL, HOST_METHODS, errMessage, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, isClerkOrgId, } from '@corenel/protocol';
+import { capabilityMissingMessage } from './hostCapability.js';
+import { SIDECAR_PROTOCOL, HOST_METHODS, errMessage, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_FEATURE, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, SPEECH_FEATURE, encodePcm16, isClerkOrgId, } from '@corenel/protocol';
 /** Decode a base64 chunk to bytes (atob is available in the browser and Node 18+). */
 function b64ToBytes(b64) {
     const bin = atob(b64);
@@ -32,6 +33,16 @@ export function isSidecarKeyMismatch(e) {
  * Deliberately a different prefix from 'sidecar denied connection', so no
  * caller that forgets a device on a denial can mistake one for the other. */
 export const SIDECAR_NOT_ADMITTED = 'sidecar did not admit this account';
+/** Prefix of the error `connect()` rejects with when the daemon sent
+ * `denied` before any identity challenge: its reason follows. */
+export const SIDECAR_DENIED = 'sidecar denied connection';
+/** The daemon itself refused the handshake (`denied`, either kind), so the
+ * words after the prefix are that daemon's own answer, as opposed to a
+ * transport failure (DNS, TLS, refused, timeout) on this side. */
+export function isSidecarDenial(e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    return msg.startsWith(`${SIDECAR_DENIED}: `) || msg.startsWith(`${SIDECAR_NOT_ADMITTED}: `);
+}
 export function isSidecarAccountRefusal(e) {
     const msg = e instanceof Error ? e.message : String(e);
     return msg.startsWith(SIDECAR_NOT_ADMITTED);
@@ -215,6 +226,66 @@ export class SidecarHost {
             writable: true,
             value: new Map()
         });
+        Object.defineProperty(this, "accessSeq", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "accessPending", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "memberSeq", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "memberReplies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "overviewReplies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "agentCredReplies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "agentCredStatusReplies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "teamSurfaceSeq", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "agentRunsReplies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "peerReplies", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         Object.defineProperty(this, "approvalsSeq", {
             enumerable: true,
             configurable: true,
@@ -376,6 +447,18 @@ export class SidecarHost {
             writable: true,
             value: []
         });
+        Object.defineProperty(this, "sttSeq", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        Object.defineProperty(this, "sttStreams", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         Object.defineProperty(this, "vapidKey", {
             enumerable: true,
             configurable: true,
@@ -484,6 +567,15 @@ export class SidecarHost {
             writable: true,
             value: false
         });
+        /** Bumped whenever the proven state is reset (each `connect`, each
+         * `disconnect`), so a server-proof still being verified for an EARLIER
+         * connection cannot mark the current one proven. */
+        Object.defineProperty(this, "proofEpoch", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
         /** The credential failed before sending (a malformed code, no key). */
         Object.defineProperty(this, "credentialError", {
             enumerable: true,
@@ -522,11 +614,29 @@ export class SidecarHost {
             writable: true,
             value: null
         });
+        /* A peer daemon serves the team daemon its MCP servers and nothing else
+         * (spec 2026-10-01 Part D): handing it any other store is a wiring
+         * mistake, refused here rather than silently withheld later. */
+        if (opts.peerDaemon) {
+            const extra = Object.keys(opts.providers)
+                .filter((k) => k !== 'mcp' && opts.providers[k] !== undefined);
+            if (extra.length)
+                throw new Error(`a peer daemon serves only mcp, not ${extra.join(', ')}`);
+        }
         this.opts = opts;
         this.ch = opts.channel;
         this.device = opts.device;
         this.ch.onMessage((m) => this.onMessage(m));
     }
+    /** Forget everything this host proved about a daemon: a new or dropped
+     * connection starts unproven, and must prove the pinned key again. */
+    resetProof() {
+        this.proofEpoch++;
+        this.expectProof = false;
+        this.verifiedSidecarJkt = null;
+        this.provenSidecarId = null;
+        this.challengedInHandshake = false;
+    }
     /** The hello's credential: the device if this client has one, else the
      * enrollment code. Exactly one is sent, and no secret. Sets up what the
      * proof exchange will be bound to. Without either (or without a key) there
@@ -564,6 +674,9 @@ export class SidecarHost {
     deviceCredential() { return this.device; }
     /** The sidecar key this connection verified, or null before it has. */
     sidecarKeyJkt() { return this.verifiedSidecarJkt; }
+    /** The id the daemon proved itself as (its server-proof), or null before
+     * it has. A peer daemon keys its per-team-daemon allowlist by it. */
+    sidecarId() { return this.provenSidecarId; }
     /** The daemon's `server-proof`: check it is the PINNED key and that it
      * signed THIS exchange, then prove this client's key. On any
      * failure nothing more is sent: the connection is dropped and `connect()`
@@ -573,6 +686,7 @@ export class SidecarHost {
         if (!this.expectProof || !key || this.verifiedSidecarJkt !== null)
             return;
         this.expectProof = false; // one exchange per connection
+        const epoch = this.proofEpoch;
         const sidecarKey = asEcPublicJwk(m.publicKey);
         const sidecarJkt = sidecarKey ? await jwkThumbprint(sidecarKey) : null;
         const ok = !!sidecarKey && !!sidecarJkt
@@ -581,6 +695,10 @@ export class SidecarHost {
             && await verifySignature(sidecarKey, serverProofPayload({
                 clientNonce: this.clientNonce, serverNonce: m.serverNonce, sidecarId: m.sidecarId, sidecarJkt, subject: this.proofSubject,
             }), m.sig);
+        // The connection this proof belonged to was dropped or replaced while it
+        // was being verified: it proves nothing about the current one.
+        if (epoch !== this.proofEpoch)
+            return;
         if (!ok || !sidecarJkt) {
             this.failKeyMismatch();
             return;
@@ -627,6 +745,7 @@ export class SidecarHost {
                     pending?.reject(new Error(`sidecar handshake timed out after ${timeoutMs}ms waiting for welcome`));
                 }, timeoutMs);
             }
+            this.resetProof();
             const credential = this.credentialFields();
             if (this.credentialError) {
                 const pending = this.welcome;
@@ -637,15 +756,22 @@ export class SidecarHost {
             this.ch.send({
                 t: 'hello', protocol: SIDECAR_PROTOCOL, ...credential,
                 ...(this.opts.stateDir ? { stateDir: this.opts.stateDir } : {}),
-                ...(this.opts.clientId ? { clientId: this.opts.clientId } : {}),
-                ...(this.opts.clientName ? { clientName: this.opts.clientName } : {}),
+                // A peer daemon is not a person's app: it has no client identity to
+                // record, and only it says what it serves.
+                ...(!this.opts.peerDaemon && this.opts.clientId ? { clientId: this.opts.clientId } : {}),
+                ...(!this.opts.peerDaemon && this.opts.clientName ? { clientName: this.opts.clientName } : {}),
                 ...(this.opts.accounts?.length ? { accounts: this.opts.accounts } : {}),
+                ...(this.opts.peerDaemon && this.opts.provides ? { provides: this.opts.provides } : {}),
                 // What THIS client understands, so a daemon can tell an older app
                 // (whose agents sync but never fire until deployed) from this one.
                 // DEVICES_FEATURE only when the caller has somewhere to KEEP an issued
                 // device credential: a daemon issues one only to a client that says
                 // so, since one thrown away is a ghost device on the daemon for ever.
-                capabilities: [CREW_DEPLOY_FEATURE, ...(this.opts.onDeviceIssued && this.opts.deviceKey ? [DEVICES_FEATURE] : [])],
+                capabilities: [
+                    CREW_DEPLOY_FEATURE,
+                    ...(this.opts.onDeviceIssued && this.opts.deviceKey ? [DEVICES_FEATURE] : []),
+                    ...(this.opts.peerDaemon ? [PEER_DAEMON_FEATURE] : []),
+                ],
             });
         });
     }
@@ -671,6 +797,7 @@ export class SidecarHost {
     }
     /** Drop the connection: unregister imported tools and fail anything in flight. */
     disconnect(reason = 'disconnected') {
+        this.resetProof();
         for (const name of this.imported)
             this.opts.unregisterTool?.(name);
         this.imported.length = 0;
@@ -730,6 +857,20 @@ export class SidecarHost {
         for (const p of this.crewDeployPending.values())
             p.reject(new Error(reason));
         this.crewDeployPending.clear();
+        for (const p of this.accessPending.values())
+            p.reject(new Error(reason));
+        this.accessPending.clear();
+        for (const map of [this.memberReplies, this.overviewReplies, this.agentCredReplies, this.agentCredStatusReplies]) {
+            for (const p of map.values())
+                p.reject(new Error(reason));
+            map.clear();
+        }
+        for (const p of this.agentRunsReplies.values())
+            p.reject(new Error(reason));
+        this.agentRunsReplies.clear();
+        for (const p of this.peerReplies.values())
+            p.reject(new Error(reason));
+        this.peerReplies.clear();
         for (const p of this.approvalsPending.values())
             p.reject(new Error(reason));
         this.approvalsPending.clear();
@@ -792,6 +933,9 @@ export class SidecarHost {
         this.mcpLoginUrlWaiters.clear();
         this.welcome?.reject(new Error(reason));
         this.welcome = null;
+        for (const s of this.sttStreams.values())
+            s.onClosed(reason);
+        this.sttStreams.clear();
         this.ch.close();
     }
     onMessage(m) {
@@ -850,7 +994,7 @@ export class SidecarHost {
             case 'denied': {
                 this.welcome?.reject(new Error(this.challengedInHandshake
                     ? `${SIDECAR_NOT_ADMITTED}: ${m.reason}`
-                    : `sidecar denied connection: ${m.reason}`));
+                    : `${SIDECAR_DENIED}: ${m.reason}`));
                 this.welcome = null;
                 return;
             }
@@ -975,6 +1119,10 @@ export class SidecarHost {
                 this.runPending.get(m.id)?.onEvent(m.event);
                 return;
             }
+            case 'child-event': {
+                this.runPending.get(m.id)?.onChild?.(m.event);
+                return;
+            }
             case 'run-done': {
                 const p = this.runPending.get(m.id);
                 if (!p)
@@ -1047,6 +1195,15 @@ export class SidecarHost {
                 this.opts.onOpenUrl?.({ url: m.url, title: m.title, note: m.note, meta: m.meta });
                 return;
             }
+            case 'stt': {
+                const s = this.sttStreams.get(m.sid);
+                if (!s)
+                    return;
+                if (m.msg.kind === 'final' || m.msg.kind === 'error')
+                    this.sttStreams.delete(m.sid);
+                s.onMessage(m.msg);
+                return;
+            }
             case 'proc-started': {
                 const p = this.procPending.get(m.id);
                 if (!p)
@@ -1333,6 +1490,81 @@ export class SidecarHost {
                 p.resolve(m.reply);
                 return;
             }
+            case 'member-result': {
+                const p = this.memberReplies.get(m.id);
+                if (!p)
+                    return;
+                this.memberReplies.delete(m.id);
+                p.resolve(m.ok
+                    ? {
+                        ok: true,
+                        ...(m.status ? { status: m.status } : {}),
+                        ...(m.daemonName !== undefined ? { daemonName: m.daemonName } : {}),
+                        ...(m.adminLabel !== undefined ? { adminLabel: m.adminLabel } : {}),
+                        ...(m.adminId !== undefined ? { adminId: m.adminId } : {}),
+                        ...(m.admin !== undefined ? { admin: m.admin } : {}),
+                        ...(m.members ? { members: m.members } : {}),
+                    }
+                    : { ok: false, code: m.code, error: m.error });
+                return;
+            }
+            case 'member-status-changed':
+                if (m.status === 'active')
+                    this.opts.onMemberStatusChanged?.('active');
+                return;
+            case 'access-overview-result': {
+                const p = this.overviewReplies.get(m.id);
+                if (!p)
+                    return;
+                this.overviewReplies.delete(m.id);
+                // An older daemon sends no inactiveDeployments: read as none.
+                p.resolve(m.ok
+                    ? { ok: true, rows: m.rows, inactiveDeployments: Array.isArray(m.inactiveDeployments) ? m.inactiveDeployments : [] }
+                    : { ok: false, code: m.code, error: m.error });
+                return;
+            }
+            case 'agent-cred-result': {
+                const p = this.agentCredReplies.get(m.id);
+                if (!p)
+                    return;
+                this.agentCredReplies.delete(m.id);
+                p.resolve(m.ok ? { ok: true } : { ok: false, code: m.code, error: m.error, ...(m.reason ? { reason: m.reason } : {}) });
+                return;
+            }
+            case 'agent-runs-result': {
+                const p = this.agentRunsReplies.get(m.id);
+                if (!p)
+                    return;
+                this.agentRunsReplies.delete(m.id);
+                p.resolve(m.ok ? { ok: true, runs: m.runs } : { ok: false, code: m.code, error: m.error });
+                return;
+            }
+            case 'peer-result': {
+                const p = this.peerReplies.get(m.id);
+                if (!p)
+                    return;
+                this.peerReplies.delete(m.id);
+                p.resolve(m.ok ? { ok: true, ...(m.peers ? { peers: m.peers } : {}) } : { ok: false, code: m.code, error: m.error });
+                return;
+            }
+            case 'agent-cred-status-result': {
+                const p = this.agentCredStatusReplies.get(m.id);
+                if (!p)
+                    return;
+                this.agentCredStatusReplies.delete(m.id);
+                p.resolve(m.ok ? { ok: true, servers: m.servers } : { ok: false, code: m.code, error: m.error });
+                return;
+            }
+            case 'access-result': {
+                const p = this.accessPending.get(m.id);
+                if (!p)
+                    return;
+                this.accessPending.delete(m.id);
+                p.resolve(m.ok
+                    ? { ok: true, ...(m.access ? { access: m.access } : {}), ...(m.members ? { members: m.members } : {}) }
+                    : { ok: false, code: m.code, error: m.error });
+                return;
+            }
             case 'checks-get-result':
             case 'checks-pin-result': {
                 // One map for both: each answers with the complete state.
@@ -1449,6 +1681,25 @@ export class SidecarHost {
      * allowed shell. A client MUST check this before offering the surface: a
      * daemon without it answers every proc message with an error. */
     supportsProcs() { return this.features.includes('procs'); }
+    /** True when the daemon transcribes dictation on its own machine. */
+    supportsSpeech() { return this.features.includes(SPEECH_FEATURE); }
+    /** One dictation stream to the daemon's speech model. Replies arrive on
+     * `onMessage` until a final or an error; a dropped connection calls
+     * `onClosed`, which the browser engine turns into a crash so the mic is
+     * released. */
+    openSpeechStream(onMessage, onClosed) {
+        const sid = `s${++this.sttSeq}${Math.random().toString(36).slice(2, 8)}`;
+        this.sttStreams.set(sid, { onMessage, onClosed });
+        this.ch.send({ t: 'stt-start', sid });
+        return {
+            audio: (pcm) => { if (this.sttStreams.has(sid))
+                this.ch.send({ t: 'stt-audio', sid, pcm: encodePcm16(pcm) }); },
+            flush: () => { if (this.sttStreams.has(sid))
+                this.ch.send({ t: 'stt-flush', sid }); },
+            cancel: () => { if (this.sttStreams.delete(sid))
+                this.ch.send({ t: 'stt-cancel', sid }); },
+        };
+    }
     /** Start a long-running command on the sidecar and stream its output.
      *
      * This is the counterpart to the one-shot `sidecar_shell_exec` tool, not a
@@ -1757,7 +2008,7 @@ export class SidecarHost {
     /** WATCH a run this client did not start (a trigger-fired crew run). Rides
      * the same pending map as `run`, so `event`/`run-done`/`run-error` route here
      * unchanged; the server replays what already happened first. */
-    watchRun(runId, onEvent) {
+    watchRun(runId, onEvent, onChild) {
         const id = ++this.runSeq;
         let rejectDone;
         const done = new Promise((resolve, reject) => {
@@ -1766,6 +2017,7 @@ export class SidecarHost {
                 resolve: (r) => resolve({ text: r.text, stopReason: r.stopReason }),
                 reject,
                 onEvent,
+                ...(onChild ? { onChild } : {}),
             });
             this.ch.send({ t: 'subscribe', id, runId });
         });
@@ -1790,6 +2042,10 @@ export class SidecarHost {
     }
     /** True when the connected sidecar's runner supports cancelling a run. */
     supportsRunCancel() { return this.features.includes('run-cancel'); }
+    /** True when the connected daemon fans a delegated callee's own node events
+     * out to a watched run's `onChild` (running pills). An older daemon simply
+     * never sends `child-event`, so a watcher's card shows no callee. */
+    supportsChildEvents() { return this.features.includes(CHILD_EVENTS_FEATURE); }
     /** True when the connected sidecar understands `run`'s `task`/`autonomy`
      * fields. An older sidecar without this feature would silently ignore
      * them, so callers must check this before sending either — never send and
@@ -2113,6 +2369,126 @@ export class SidecarHost {
     crewResume(ref, reason) { return this.crewDeployRequest((id) => ({ t: 'crew-resume', id, ref, ...(reason ? { reason } : {}) })); }
     /** Stop a run AND record who stopped it and why (the plain `cancelRun` records nothing). */
     crewStop(ref, runId, reason) { return this.crewDeployRequest((id) => ({ t: 'crew-stop', id, ref, runId, reason })); }
+    /** True when the connected daemon keeps per-agent access (team mode, Part B). */
+    supportsAgentAccess() { return this.features.includes(AGENT_ACCESS_FEATURE); }
+    /** One access-* request. `ok: false` is the daemon's considered answer and
+     * resolves; only a dropped connection rejects. Nothing is sent to a daemon
+     * without the feature. */
+    accessRequest(build) {
+        if (!this.supportsAgentAccess())
+            return Promise.resolve({ ok: false, code: 'NOT_TEAM_AGENT', error: 'this daemon does not keep agent access' });
+        const id = ++this.accessSeq;
+        return new Promise((resolve, reject) => {
+            this.accessPending.set(id, { resolve, reject });
+            this.ch.send(build(id));
+        });
+    }
+    accessGet(ref) { return this.accessRequest((id) => ({ t: 'access-get', id, ref })); }
+    accessGrant(ref, userId, role) {
+        return this.accessRequest((id) => ({ t: 'access-grant', id, ref, userId, role }));
+    }
+    accessRevoke(ref, userId) { return this.accessRequest((id) => ({ t: 'access-revoke', id, ref, userId })); }
+    accessTransfer(ref, userId) { return this.accessRequest((id) => ({ t: 'access-transfer', id, ref, userId })); }
+    accessMembers() { return this.accessRequest((id) => ({ t: 'access-members', id })); }
+    /** True when the connected daemon is in team mode with a member list (Part E). */
+    supportsTeamMembers() { return this.features.includes(TEAM_MEMBERS_FEATURE); }
+    /** One member-* request. `ok: false` is the daemon's answer and resolves;
+     * only a dropped connection rejects. Nothing is sent without the feature. */
+    memberRequest(build) {
+        if (!this.supportsTeamMembers())
+            return Promise.resolve({ ok: false, code: 'UNAVAILABLE', error: 'this daemon keeps no member list' });
+        const id = ++this.memberSeq;
+        return new Promise((resolve, reject) => {
+            this.memberReplies.set(id, { resolve, reject });
+            this.ch.send(build(id));
+        });
+    }
+    memberStatus() { return this.memberRequest((id) => ({ t: 'member-status', id })); }
+    membersList() { return this.memberRequest((id) => ({ t: 'members-list', id })); }
+    memberApprove(userId) { return this.memberRequest((id) => ({ t: 'member-approve', id, userId })); }
+    memberRemove(userId) { return this.memberRequest((id) => ({ t: 'member-remove', id, userId })); }
+    /** Every team agent this user may see, scoped to their role (Part E, E2). */
+    accessOverview() {
+        if (!this.supportsAgentAccess())
+            return Promise.resolve({ ok: false, code: 'NOT_TEAM_AGENT', error: 'this daemon does not keep agent access' });
+        const id = ++this.memberSeq;
+        return new Promise((resolve, reject) => {
+            this.overviewReplies.set(id, { resolve, reject });
+            this.ch.send({ t: 'access-overview', id });
+        });
+    }
+    /** Each MCP server's binding and credential presence for one agent (owner or admin). */
+    agentCredStatus(ref) {
+        if (!this.supportsAgentAccess())
+            return Promise.resolve({ ok: false, code: 'UNAVAILABLE', error: 'this daemon does not manage agent credentials' });
+        const id = ++this.memberSeq;
+        return new Promise((resolve, reject) => {
+            this.agentCredStatusReplies.set(id, { resolve, reject });
+            this.ch.send({ t: 'agent-cred-status', id, ref });
+        });
+    }
+    /** The connected daemon keeps team run history (spec 2026-10-01 E5.6). */
+    supportsAgentRuns() { return this.features.includes(AGENT_RUNS_FEATURE); }
+    /** Every member's runs of a team agent, newest first, no content. A
+     * refusal resolves; only a dropped connection rejects. */
+    agentRuns(ref, opts = {}) {
+        if (!this.supportsAgentRuns())
+            return Promise.resolve({ ok: false, code: 'NOT_TEAM_AGENT', error: 'this daemon keeps no team run history' });
+        const id = ++this.teamSurfaceSeq;
+        return new Promise((resolve, reject) => {
+            this.agentRunsReplies.set(id, { resolve, reject });
+            this.ch.send({
+                t: 'agent-runs', id, ref,
+                ...(opts.limit !== undefined ? { limit: opts.limit } : {}),
+                ...(opts.before !== undefined ? { before: opts.before } : {}),
+            });
+        });
+    }
+    /** The connected daemon links to team daemons from here (spec 2026-10-01 E5.5). */
+    supportsPeerLinks() { return this.features.includes(PEER_LINKS_FEATURE); }
+    peerRequest(build) {
+        if (!this.supportsPeerLinks())
+            return Promise.resolve({ ok: false, code: 'UNAVAILABLE', error: 'this daemon does not link to team daemons' });
+        const id = ++this.teamSurfaceSeq;
+        return new Promise((resolve, reject) => {
+            this.peerReplies.set(id, { resolve, reject });
+            this.ch.send(build(id));
+        });
+    }
+    peerList() { return this.peerRequest((id) => ({ t: 'peer-list', id })); }
+    peerAdd(url, code) { return this.peerRequest((id) => ({ t: 'peer-add', id, url, code })); }
+    peerRemove(sidecarId) { return this.peerRequest((id) => ({ t: 'peer-remove', id, sidecarId })); }
+    peerAllowSet(sidecarId, tools) { return this.peerRequest((id) => ({ t: 'peer-allow-set', id, sidecarId, tools })); }
+    /** One of Part D's credential messages, answered by `agent-cred-result`.
+     * Ids come from the MCP sequence so an agent login's `mcp-login-url` reaches
+     * the waiter registered here and never collides with a server login. */
+    agentCredRequest(build, onAuthUrl) {
+        if (!this.supportsAgentAccess())
+            return Promise.resolve({ ok: false, code: 'UNAVAILABLE', error: 'this daemon does not manage agent credentials' });
+        const id = ++this.mcpSeq;
+        if (onAuthUrl)
+            this.mcpLoginUrlWaiters.set(id, onAuthUrl);
+        return new Promise((resolve, reject) => {
+            this.agentCredReplies.set(id, {
+                resolve: (r) => { this.mcpLoginUrlWaiters.delete(id); resolve(r); },
+                reject: (e) => { this.mcpLoginUrlWaiters.delete(id); reject(e); },
+            });
+            this.ch.send(build(id));
+        });
+    }
+    accessBind(ref, server, binding) {
+        return this.agentCredRequest((id) => ({ t: 'access-bind', id, ref, server, binding }));
+    }
+    /** The header values go out in this one message; nothing here keeps or returns them. */
+    agentCredSet(ref, server, headers) {
+        return this.agentCredRequest((id) => ({ t: 'agent-cred-set', id, ref, server, headers }));
+    }
+    agentMcpLogin(ref, server, onAuthUrl) {
+        return this.agentCredRequest((id) => ({ t: 'agent-mcp-login', id, ref, server }), onAuthUrl);
+    }
+    agentCredClear(ref, server) {
+        return this.agentCredRequest((id) => ({ t: 'agent-cred-clear', id, ref, server }));
+    }
     /** True when the connected daemon keeps "This machine" standing approvals
      * (plan 3). Feature-detected from the welcome. */
     supportsApprovals() { return this.features.includes('approvals'); }
@@ -2133,13 +2509,15 @@ export class SidecarHost {
         const r = await this.approvalsRequest((id) => ({ t: 'approvals-accept', id, suggestionId, choice }));
         return r.ok ? { ok: true } : r;
     }
-    /** The daemon's standing rules and its (daemon.json) approval settings. */
-    async listDaemonApprovals() {
-        return this.withState(await this.approvalsRequest((id) => ({ t: 'approvals-list', id })));
+    /** The daemon's standing rules and its (daemon.json) approval settings.
+     * With `ref` on a team daemon: that agent's own rules. */
+    async listDaemonApprovals(ref) {
+        return this.withState(await this.approvalsRequest((id) => ({ t: 'approvals-list', id, ...(ref ? { ref } : {}) })));
     }
-    /** Remove one daemon standing rule; resolves with the complete state after. */
-    async revokeDaemonApproval(tool) {
-        return this.withState(await this.approvalsRequest((id) => ({ t: 'approvals-revoke', id, tool })));
+    /** Remove one daemon standing rule; resolves with the complete state after.
+     * With `ref` on a team daemon: that agent's rule (its owner only). */
+    async revokeDaemonApproval(tool, ref) {
+        return this.withState(await this.approvalsRequest((id) => ({ t: 'approvals-revoke', id, tool, ...(ref ? { ref } : {}) })));
     }
     withState(r) {
         if (!r.ok)
@@ -2360,6 +2738,9 @@ export class SidecarHost {
      * (`obj[method](...args)`) is uniform. */
     resolveProvider(p) {
         const pv = this.opts.providers;
+        // A peer daemon answers mcp only, whatever else it may hold.
+        if (this.opts.peerDaemon && p !== 'mcp')
+            throw new Error(capabilityMissingMessage(p));
         let found;
         switch (p) {
             case 'confirm':
@@ -2373,7 +2754,7 @@ export class SidecarHost {
                 break;
         }
         if (!found)
-            throw new Error(`capability ${p} is not available on this host`);
+            throw new Error(capabilityMissingMessage(p));
         return found;
     }
 }