@corenel/harness 0.14.0 → 0.16.0

package/dist/sidecar/server.d.ts

@@ -1,4 +1,5 @@
-import type { AgentTool, AgentEvent, PermissionDecision, SidecarRoots, DaemonRunActivity, DaemonRegistration, AgentPause, HostSummary, SidecarProcs, SidecarSessions, RoomOpenRequest, RoomSummary, RoomFinding, RoomFindingEdit, ChecksState, WorkspaceLockRef, DaemonApprovalChoice, DaemonApprovalOffer, DaemonApprovalsState, CrewDeployCaller, CrewDeployReply, EcPublicJwk } from '@corenel/protocol';
+import type { AgentTool, AgentEvent, PermissionDecision, SidecarRoots, DaemonRunActivity, DaemonRegistration, AgentPause, HostSummary, SidecarProcs, SidecarSessions, SidecarSpeech, RoomOpenRequest, RoomSummary, RoomFinding, RoomFindingEdit, ChecksState, WorkspaceLockRef, DaemonApprovalChoice, DaemonApprovalOffer, DaemonApprovalsState, CrewDeployCaller, CrewDeployReply, EcPublicJwk, CrewAgentRef, AccessReply, AccessRequestMsg, NodeEvent, McpBinding, MemberReply, MemberRequestMsg, MemberStatus, AccessOverviewRow, AgentCredStatusRow, InactiveDeployment, PersonInfo } from '@corenel/protocol';
+import type { PeerReply, PeerRequestMsg } from '@corenel/protocol';
 import { type SidecarChannel, type SidecarMsg, type SidecarInfo, type SidecarRunner, type SidecarHostSync, type SidecarConfig, type SidecarAcp, type WebPushSubscription } from '@corenel/protocol';
 import type { ExplainingIdentityVerifier, SidecarAdmission } from './identity';
 import { type KeySigner } from './deviceKeys';
@@ -70,6 +71,7 @@ export interface SidecarRunHub {
             stopReason: string;
         }): void;
         error(message: string): void;
+        child?(e: NodeEvent): void;
     }): {
         replay: {
             events: AgentEvent[];
@@ -132,6 +134,14 @@ export interface SidecarRooms {
      * caller renders the reason. */
     editFinding(roomId: string, participantId: string, edit: RoomFindingEdit): Promise<RoomFinding[]>;
     subscribe(cb: (room: RoomSummary) => void): () => void;
+    /** Team agent access (Part B): may verified user `userId` run EVERY agent
+     * participant here, each judged where the daemon actually finds it (the
+     * same lookup a room turn runs)? An agent it cannot find is a no. Absent: a
+     * team-mode daemon with access wired refuses to open or drive any room. */
+    mayRun?(participants: readonly {
+        kind: 'agent' | 'human';
+        name: string;
+    }[], userId: string): Promise<boolean>;
 }
 /** The daemon's pause overrides, behind the `agent-pause-*` messages.
  *
@@ -241,21 +251,38 @@ export interface SidecarDevices {
     revoke(id: string, now: number): Promise<boolean>;
     onRevoked(cb: (id: string) => void): () => void;
 }
-/** The daemon's "This machine" standing approvals (plan 3), behind the
- * `approvals-*` messages.
+/** The daemon's standing approvals (plan 3), behind the `approvals-*`
+ * messages.
  *
  * Declared HERE for the same dependency-direction reason as `SidecarPauses`:
  * packages/sidecar implements it (src/approvals/daemonApprovals.ts).
  *
  * `accept`'s `by` is the object THIS connection attached to the attendance
- * registry -- the daemon compares it with the client it made the offer to. It
- * is never taken from the message, and there is no method that adds a rule
- * directly. `accept` throws for a refusal; the reason is sent back. */
+ * registry. `userId` on every method is THIS connection's verified user id
+ * (spec 2026-10-01 Part C: a team agent's owner accepts and revokes its
+ * rules). Neither is ever taken from the message. `ref` is the message's
+ * agent reference, validated by the port. There is no method that adds a
+ * rule directly. Every method throws for a refusal; the reason is sent back.
+ * On a team daemon only an `ApprovalsRefusal`'s reason is: anything else is
+ * unexpected, is logged, and goes on the wire as APPROVALS_FAILED. */
 export interface SidecarApprovals {
-    accept(by: unknown, suggestionId: string, choice: DaemonApprovalChoice): Promise<void>;
-    state(): Promise<DaemonApprovalsState>;
-    revoke(tool: string): Promise<DaemonApprovalsState>;
+    accept(by: unknown, suggestionId: string, choice: DaemonApprovalChoice, userId?: string): Promise<void>;
+    state(ref?: unknown, userId?: string): Promise<DaemonApprovalsState>;
+    revoke(tool: string, ref?: unknown, userId?: string): Promise<DaemonApprovalsState>;
+}
+/** A deliberate refusal from the approvals port, written for the person who
+ * asked: its message goes on the wire as is. Recognized by `name`, not by
+ * `instanceof`, so a second copy of this module (a test alias, a bundled
+ * build) cannot turn a refusal into APPROVALS_FAILED. */
+export declare class ApprovalsRefusal extends Error {
+    constructor(message: string);
 }
+export declare function isApprovalsRefusal(e: unknown): e is ApprovalsRefusal;
+/** Team-mode approvals refusals and the fixed text for an unexpected error
+ * (Part C). Exported for the tests. */
+export declare const APPROVALS_FAILED = "Standing approvals could not be read or changed. The daemon log has the reason.";
+export declare const APPROVALS_NO_USER = "In team mode standing approvals need a verified user on this connection.";
+export declare const APPROVALS_NAME_AGENT = "Name the agent: in team mode standing approvals belong to one agent, and only its owner can revoke them.";
 /** The daemon's orchestrator checks and workspace lock, behind `checks-get`,
  * `checks-pin` and `workspace-release`. Declared HERE for the same
  * dependency-direction reason as `SidecarPauses`: packages/sidecar implements
@@ -276,6 +303,36 @@ export interface SidecarChecks {
     release(ref: WorkspaceLockRef): Promise<boolean>;
     unavailable?(): string | null;
 }
+/** Team agent access refusals (Part B). Exported for the tests. */
+export declare const WATCH_REFUSED = "You can watch only runs you started, or unattended runs of an agent you own.";
+export declare const ACCESS_NO_ROLE = "NO_ACCESS: you have no role on this agent, or too low a role for this.";
+export declare const ACCESS_NOT_OWNER = "NOT_OWNER: only this agent's owner or the daemon admin can change it.";
+export declare const ACCESS_ADMIN_ONLY = "NOT_OWNER: only the daemon admin can change the crew folder itself.";
+export declare const ACCESS_STORE_REFUSED = "The access store is never writable.";
+export declare const ACCESS_CHECK_FAILED = "NOT_OWNER: could not check access.";
+export declare const ACCESS_FAILED = "Access could not be checked or changed. The daemon log has the reason.";
+/** An uncoded peer-* failure; the detail goes to the log. One source: the peer admin port reuses it. */
+export declare const PEER_FAILED = "Your team daemon links could not be read or changed. The daemon log has the reason.";
+/** Team run history (spec 2026-10-01 E5.6): an uncoded failure. Fixed text; the daemon log has the detail. */
+export declare const AGENT_RUNS_FAILED = "Team runs could not be read. The daemon log has the reason.";
+/** Part E: a member request the member list could not answer. Fixed text; the
+ * daemon log has the detail. */
+export declare const MEMBER_FAILED = "The member request could not be answered. The daemon log has the reason.";
+/** A device store failure. Fixed text; the daemon log has the detail. */
+export declare const DEVICES_FAILED = "The paired devices could not be read or changed. The daemon log has the reason.";
+/** Part D credential refusals (exported for the tests). A refusal with no
+ * reply code of its own goes out as fixed text; the daemon log has the detail. */
+export declare const AGENT_CRED_FAILED = "Agent credentials could not be checked or changed. The daemon log has the reason.";
+export declare const AGENT_CRED_LOGIN_FAILED = "The sign-in did not finish. The daemon log has the reason.";
+export declare const AGENT_CRED_SOLO = "This daemon does not keep agent access.";
+export declare const MCP_ADMIN_ONLY = "In team mode only the daemon admin can use or change this machine's MCP servers directly.";
+export declare const SESSION_REFUSED = "In team mode a session is reachable only by the member who created it, or the daemon admin.";
+export declare const SNAPSHOT_REFUSED = "In team mode you can restore only from a snapshot of a session you created.";
+export declare const SNAPSHOT_NAME_REFUSED = "In team mode a snapshot name is chosen by the daemon; only the daemon admin can name one.";
+export declare const SNAPSHOT_USAGE_ADMIN_ONLY = "In team mode only the daemon admin can see this machine's snapshot usage.";
+/** Team mode: a room runs its agents for the person who opens or drives it. */
+export declare const ROOM_RUN_REFUSED = "You need contributor or higher on every agent in this room to open or drive it.";
+export declare const OUTPUT_REFUSED = "You can see the output only of runs you started, or of unattended runs of an agent you own.";
 /** The daemon's web-push notifier, behind `push-subscribe`/`push-unsubscribe`
  * (spec 2026-09-24-web-push-design). Declared HERE (harness-side), not
  * imported from `@corenel/sidecar`, for the same dependency-direction reason
@@ -371,6 +428,43 @@ export interface SidecarMcpAdmin {
     removeServer(name: string): Promise<void>;
     setCredential(name: string, header: string, value: string): Promise<void>;
 }
+/** A team agent's MCP bindings and its own credentials (spec 2026-10-01 Part
+ * D), behind `access-bind` and the `agent-cred-*` messages. Declared here for
+ * the dependency-direction reason above; packages/sidecar implements it
+ * (mcp/agentCreds.ts). `caller` is ALWAYS the connection's verified user.
+ * `ref` crosses unvalidated: the implementation validates it, and decides
+ * whether `caller` is the agent's owner or the daemon admin. A refusal is a
+ * thrown error carrying one of AGENT_CRED_ERROR_CODES as `code`. */
+export interface SidecarAgentCreds {
+    bind(ref: unknown, caller: string, server: string, binding: McpBinding | null): Promise<void>;
+    setHeaders(ref: unknown, caller: string, server: string, headers: readonly unknown[]): Promise<void>;
+    login(ref: unknown, caller: string, server: string, onAuthUrl: (url: string) => void): Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        reason: 'no-oauth' | 'no-dcr' | 'failed';
+        message: string;
+    }>;
+    clear(ref: unknown, caller: string, server: string): Promise<void>;
+    /** Each MCP server's binding and whether an agent credential is SET (Part E,
+     * E2). Presence only. Optional: absent, `agent-cred-status` is UNAVAILABLE. */
+    status?(ref: unknown, caller: string): Promise<AgentCredStatusRow[]>;
+}
+/** A member's daemon connected to this (team) daemon, serving its own MCP
+ * servers (spec 2026-10-01 Part D). `userId` is the connection's VERIFIED
+ * user, never a claim; `urls` are as advertised (the implementation
+ * normalizes them). `call` is one `mcp` host-call on that connection and
+ * rejects with a HostCallError. */
+export interface SidecarPeerConn {
+    userId: string;
+    urls: readonly string[];
+    call(method: 'list' | 'call', args: unknown[]): Promise<unknown>;
+}
+/** The team daemon's peer routes (packages/sidecar peer/routes.ts). ONE
+ * instance for the process, shared by every connection. */
+export interface SidecarPeers {
+    attach(conn: SidecarPeerConn): () => void;
+}
 export interface SidecarMcp {
     /** Every connected tool, address-ready. Empty when no server is configured
      *  -- that is a normal state, not an error (mirrors `SidecarProcs.list`'s /
@@ -398,7 +492,98 @@ export interface SidecarMcp {
         isError: boolean;
     }>;
 }
+/** What an access check is about. The same members as packages/sidecar's
+ * access/service.ts AgentAction, restated with no import for the same
+ * dependency-direction reason as `SidecarCrewDeploy`. */
+export type SidecarAgentAction = 'see' | 'run' | 'own-runs' | 'run-list' | 'unattended-content' | 'cancel-any' | 'write-definition' | 'manage-access' | 'manage-credentials' | 'approvals' | 'deploy';
+/** Where a mutating fs tool call lands, when that matters to access: inside
+ * one team agent's folder (`isNew`: it has no definition and no access record
+ * yet; `whole`: the target IS the agent's folder), on a folder that contains a
+ * crew folder, or in the access store itself. */
+export type SidecarInvokeTarget = {
+    kind: 'agent';
+    ref: CrewAgentRef;
+    isNew: boolean;
+    whole: boolean;
+} | {
+    kind: 'crew-parent';
+} | {
+    kind: 'access-store';
+};
+/** The daemon's per-agent access (team agent access, spec 2026-10-01 Part B),
+ * behind the `access-*` messages and every access gate in this class.
+ *
+ * Declared HERE with protocol types only; packages/sidecar implements it
+ * (access/port.ts) over its access service, which this package must never
+ * import. Every `caller` / `userId` handed to it is THIS connection's verified
+ * user, never a message field. */
+export interface SidecarAccess {
+    /** --mode team. The gates in this class apply only when true. */
+    readonly teamMode: boolean;
+    /** The verified user this daemon is signed in as, now; undefined when unknown. */
+    adminId(): string | undefined;
+    can(ref: CrewAgentRef, userId: string | undefined, action: SidecarAgentAction): Promise<boolean>;
+    /** Answer one access-* request. Its ref and fields arrive unvalidated. */
+    handle(caller: string | undefined, msg: AccessRequestMsg): Promise<AccessReply>;
+    /** The agent has no definition and no access record yet: a write may claim it. */
+    isNewAgent(ref: CrewAgentRef): Promise<boolean>;
+    onAgentCreated(ref: CrewAgentRef, creator: string | undefined): Promise<void>;
+    onAgentDeleted(ref: CrewAgentRef): Promise<void>;
+    /** For a mutating fs tool invoked over the wire: what its target touches, or null. */
+    invokeTarget(tool: string, args: unknown): Promise<SidecarInvokeTarget | null>;
+    /** Team access overview (Part E, E2): one row per team agent `caller` may
+     * see. Optional: absent, `access-overview` is refused as NOT_TEAM_AGENT. */
+    overview?(caller: string | undefined): Promise<AccessOverviewRow[]>;
+    /** Admin only (owner decision 2026-10-06): deployed agents still firing from
+     * a removed member's folder. Optional: absent, the reply carries []. */
+    inactiveDeployments?(caller: string | undefined): Promise<InactiveDeployment[]>;
+}
+/** Linking this daemon to team daemons (spec 2026-10-01 E5.5). The port
+ * decides who may (the daemon's own signed-in account) from the caller the
+ * harness hands it, the connection's verified user. */
+export interface SidecarPeerAdmin {
+    handle(caller: string | undefined, msg: PeerRequestMsg): Promise<PeerReply>;
+}
+/** Team member status (spec 2026-10-01 Part E, E1), behind the member gate,
+ * first sight and the `member-*` messages.
+ *
+ * Declared HERE with protocol types only; packages/sidecar implements it
+ * (members/port.ts). `statusOf` is SYNCHRONOUS because the gate runs on every
+ * message: the implementation answers from memory. Every userId handed to it
+ * is THIS connection's verified user, never a message field. */
+export interface SidecarMembers {
+    /** 'active' or 'pending'. The admin is always active; an unknown or missing
+     * user reads as pending (fail closed). */
+    statusOf(userId: string | undefined): MemberStatus;
+    /** First sight: record a verified user with no record as pending and tell
+     * the admin, once per user. Never throws for a known user. */
+    noteAdmitted(userId: string, label: string): Promise<void>;
+    /** Answer one member-* request. Fields arrive unvalidated. */
+    handle(caller: string | undefined, msg: MemberRequestMsg): Promise<MemberReply>;
+    /** Status changes: a user approved ('active') or removed ('removed'). */
+    subscribe(cb: (userId: string, event: MemberStatus | 'removed') => void): () => void;
+}
+/** Who a verified user IS, for display (spec 2026-10-07 member names). Told
+ * the assertion's cleaned name/email once per connection, before first sight.
+ * DISPLAY ONLY: the implementation stores it; nothing here decides on it. */
+export interface SidecarPeople {
+    note(userId: string, person: PersonInfo): Promise<void>;
+}
+/** How long one run-activity item may take to be decided for one team-mode
+ * connection (Task 16b fix round 1). A store that hangs must not leave a
+ * client unwelcomed or stall every later item: a timed-out item is dropped
+ * for that connection (fail closed). */
+export declare const RUN_ACTIVITY_DECIDE_MS = 3000;
+/** How many per-item deadlines (RUN_ACTIVITY_DECIDE_MS, or its test
+ * override) the whole pre-welcome replay may hold the welcome in team mode
+ * (final review F14). A replay of many items that each hang would otherwise
+ * hold it for one deadline per item. What is not decided by then is dropped
+ * for this connection (fail closed). */
+export declare const WELCOME_REPLAY_DEADLINES = 3;
+export declare const WELCOME_REPLAY_MAX_MS: number;
 export interface SidecarServerOptions {
+    /** Overrides RUN_ACTIVITY_DECIDE_MS (tests shorten it). */
+    runActivityDecideMs?: number;
     channel: SidecarChannel;
     /** The daemon's device store (spec 2026-09-29-device-enrollment-design).
      * With `sidecarKey`, the ONLY way a connection authenticates: there is no
@@ -459,6 +644,10 @@ export interface SidecarServerOptions {
      * operator declined shell. Absent means no 'procs' feature is advertised and
      * every proc message is answered with an error rather than ignored. */
     procs?: SidecarProcs;
+    /** The daemon's local speech model, behind `stt-*`. Present only on a daemon
+     * (solo or team) whose speech runtime loaded (packages/sidecar/src/speech). Absent:
+     * no 'speech' feature, and `stt-start` is answered with an error. */
+    speech?: SidecarSpeech;
     /** The session layer behind `session-*`. Absent means the daemon runs no
      * sessions: it advertises no 'sessions' feature and answers every session
      * message with an error that says so, rather than ignoring them. */
@@ -524,6 +713,25 @@ export interface SidecarServerOptions {
      *  operator who never configured any), and `mcp-call` is refused. */
     mcp?: SidecarMcp;
     mcpAdmin?: SidecarMcpAdmin;
+    /** Team agents' bindings and credentials (spec 2026-10-01 Part D). Absent:
+     * every credential message is refused as UNAVAILABLE. Not in team mode
+     * (`access` absent or solo): refused as NOT_TEAM_AGENT. */
+    agentCreds?: SidecarAgentCreds;
+    /** Peer routes (team side of peer mode, spec 2026-10-01 Part D). */
+    peers?: SidecarPeers;
+    /** Per-agent access (team agent access, Part B). Absent, or not in team mode:
+     * no 'agent-access' feature, every access-* message is refused, and no access
+     * gate applies. */
+    access?: SidecarAccess;
+    /** Team member status (Part E). Wired only in team mode. Absent: no
+     * 'team-members' feature, no gate, and member-* is refused as UNAVAILABLE. */
+    members?: SidecarMembers;
+    /** The people directory (spec 2026-10-07). Absent: names are not recorded
+     * and labels stay on device names. Wired in solo and team mode alike. */
+    people?: SidecarPeople;
+    /** Peer links (spec 2026-10-01 E5.5). Absent: no 'peer-links' feature and
+     * every peer-* request is refused. */
+    peerAdmin?: SidecarPeerAdmin;
     /**
      * Map an authenticated connection to the DURABLE KEY it is filed under.
      *
@@ -612,6 +820,10 @@ export interface SidecarServerOptions {
      *  (default HELLO_DEADLINE_MS). A socket that never pairs holds daemon
      *  resources for nothing. */
     helloDeadlineMs?: number;
+    /** Deadline for one host-call, in ms (daemon.json `peerCallTimeoutMs`,
+     * default DEFAULT_HOST_CALL_TIMEOUT_MS). Not applied to `confirm`/`ask`,
+     * which wait on a person. */
+    hostCallTimeoutMs?: number;
 }
 /** Default pre-pairing deadline: a real client sends `hello` immediately.
  * It covers the proof exchange AND the identity exchange (IDENTITY_TIMEOUT_MS),
@@ -630,6 +842,22 @@ export declare const IDENTITY_TIMEOUT_MS = 10000;
  * (`SidecarAdmission.recheckMs`) before it is closed. Generous: the client is
  * mid-session, and a slow answer is not a refusal. */
 export declare const RECHECK_TIMEOUT_MS = 30000;
+/** How a host-call failed to produce the host's answer.
+ *  - `undelivered`: never sent (the connection was already closed, or the send
+ *    threw). Safe to try on another route.
+ *  - `timeout` / `closed`: sent, then no answer. The call may have run.
+ *  - `remote`: the host answered with a refusal; the message is its words. */
+export type HostCallFailure = 'undelivered' | 'timeout' | 'closed' | 'remote';
+export declare class HostCallError extends Error {
+    readonly kind: HostCallFailure;
+    constructor(kind: HostCallFailure, message: string);
+}
+/** The kind of a host-call rejection, or null for any other error. Structural
+ * rather than `instanceof`, so a caller in another package does not depend on
+ * sharing this module's copy of the class. */
+export declare function hostCallFailure(e: unknown): HostCallFailure | null;
+/** Default deadline for one host-call (daemon.json `peerCallTimeoutMs`). */
+export declare const DEFAULT_HOST_CALL_TIMEOUT_MS = 60000;
 /** How long the daemon waits for `client-proof` after its `server-proof`.
  * The hello deadline closes an unauthenticated socket anyway; this bounds the
  * wait inside it. */
@@ -639,6 +867,8 @@ export declare class SidecarServer {
     private readonly opts;
     private readonly tools;
     private authed;
+    /** This connection's one live dictation stream, if any. */
+    private stt;
     /** Denied hellos on this connection (see MAX_FAILED_HELLOS). */
     private failedHellos;
     /** A hello's credential is being checked (the check awaits the device
@@ -691,6 +921,8 @@ export declare class SidecarServer {
      * connection on a daemon with no `identity` verifier. The token itself is
      * never kept. */
     private verifiedUserId;
+    /** The verified person's display name/email, set with verifiedUserId. */
+    private verifiedPerson;
     /** The verdict echoed on the welcome, when a verifier is wired. Dead by the
      * time a welcome is ever sent -- `onHello`'s identity block always
      * overwrites it with a real reason ('not requested', 'no daemon id', or the
@@ -721,6 +953,24 @@ export declare class SidecarServer {
      * successful `hello` when `opts.attendance` is wired. Called once, on channel
      * close, so a dead connection stops receiving/counting toward asks. */
     private attendedDetach?;
+    /** Detach from the peer routes, when this connection serves MCP. */
+    private peersDetach?;
+    /** This connection's hello announced PEER_DAEMON_FEATURE. Set from the
+     * claim, before anything is verified: it only ever TAKES privileges away
+     * (no attendance, no broadcasts, only PEER_DAEMON_MESSAGES served, and a
+     * welcome with no tools and no root/roots), so a client that claims it
+     * falsely only loses its own. It never lifts the member gate's welcome
+     * strip (Part E): a pending user who claims it is still told nothing. */
+    private peerDaemon;
+    /** One log line per peer connection for refused messages, not one each. */
+    private peerRefusalLogged;
+    /** The tail of this connection's run-activity filter (team agent access,
+     * Task 16b). Items are decided one at a time so a run's start, updates and
+     * settle reach the client in the order the daemon sent them, however long
+     * each one's access check takes. */
+    private runActivityChain;
+    /** Bumped when the pre-welcome replay is cut off: items queued before it are dropped. */
+    private runActivityEpoch;
     /** The synced directory THIS connection belongs to, once resolved -- the same
      * value echoed in `welcome.dirName`. Retained so `hosts-list` can stamp
      * `self` and `hosts-forget` can refuse the caller's own tree from the
@@ -873,8 +1123,11 @@ export declare class SidecarServer {
      * message id, so a client correlating by id sees its own stream.
      */
     private onSubscribe;
-    /** Stop a run, whoever started it. Same trust as `run`: a connection that may
-     * start runs on this daemon may stop them. */
+    /** Attach THIS connection to `hub` as a viewer of `m.runId`, replay first. */
+    private watchRun;
+    /** Stop a run. Solo mode: same trust as `run`, a connection that may start
+     * runs on this daemon may stop them. Team mode with per-agent access
+     * (Part B): the run's requester, or its agent's owner or the admin. */
     private onCancelRun;
     /**
      * What this caller's agent has actually done.
@@ -947,6 +1200,15 @@ export declare class SidecarServer {
     private onApprovalsAccept;
     private onApprovalsList;
     private onApprovalsRevoke;
+    /** Team mode: every approvals message needs the user this connection
+     * proved, since a team agent's rules are its owner's to change and its
+     * members' to see. Null when the message may go on to the port. Solo mode
+     * never refuses here. */
+    private approvalsNoUser;
+    /** What an approvals port error puts on the wire. Solo mode: its message,
+     * as always. Team mode: an ApprovalsRefusal's reason, and for anything else
+     * (a path, an errno) fixed text, the detail kept in the daemon log. */
+    private approvalsError;
     /** Why the checks port cannot answer right now, or null when it can. */
     private checksRefusal;
     private onChecksGet;
@@ -965,6 +1227,17 @@ export declare class SidecarServer {
     private onRoomList;
     private onRoomRead;
     private onRoomResume;
+    /** Team agent access (Part B, final review F1): a room runs every agent in
+     * it as the person who opens or drives it, so each one needs `run` for THIS
+     * connection's verified user, decided by the room service where the daemon
+     * actually finds the agent. Null when allowed. Solo mode (or no access
+     * port): null, unchanged. No verified user, no gate on the room service, or
+     * a throw: refused. */
+    private roomRunRefusal;
+    /** `roomRunRefusal` for a room that already exists, by its recorded
+     * participants: the verbs that drive its agents (resume, answer, interject). A room
+     * that is not there is left to the room service's own "No room" answer. */
+    private roomDriveRefusal;
     /** WHO THIS CONNECTION IS, INSIDE A ROOM.
      *
      * The user its pairing JWT proved (`verifiedUserId`: API-signed, aud = this
@@ -1001,13 +1274,151 @@ export declare class SidecarServer {
      * would have produced for the identical address.
      */
     private onMcpAdmin;
+    /** Part D credential messages. The caller is this connection's VERIFIED
+     * user and nothing the message says; the port decides whether that user is
+     * the agent's owner or the admin. Solo mode refuses, as `onAccess` does. The
+     * secret in `agent-cred-set` goes to the port and is never logged or echoed.
+     * A refusal with no reply code goes out as fixed text (Part B's
+     * ACCESS_FAILED rule) and its detail goes to the log. */
+    private onAgentCred;
     private onMcpCall;
+    /** One access-* request, answered for THIS connection's verified user. Solo
+     * mode (or no port) refuses without asking. A port that throws becomes a
+     * refusal: it must never kill the connection or leave the request unanswered. */
+    private onAccess;
+    /** Team mode with a member list, and this connection's verified user is not
+     * an active member right now. Read fresh on every call. Member status
+     * ALONE: a peer daemon connection is exempted from the request gate in
+     * onMessage (it is served only PEER_DAEMON_MESSAGES there), never here, so
+     * a claimed peer cannot lift the welcome strip. A port that throws reads as
+     * pending (fail closed): it runs inside onMessage and every broadcast. */
+    private memberPending;
+    /** One member-* request, answered for THIS connection's verified user. A
+     * port that throws becomes a refusal with fixed text (the detail is
+     * logged), never a dropped connection. */
+    private onMember;
+    /** Team access overview (Part E, E2), for THIS connection's verified user.
+     * Solo mode (or no port) refuses without asking, like onAccess. A coded
+     * refusal passes its code and authored text through; any other failure goes
+     * out as fixed text, with the detail in the log. */
+    private onAccessOverview;
+    /** Each MCP server's binding and credential PRESENCE for one agent (Part E,
+     * E2). The owner or admin only, decided by the port from the verified user.
+     * Solo mode refuses without asking, like onAgentCred. Every row is rebuilt
+     * from its three fields here, so a port that returned more (a header, a
+     * token) could never put it on the wire. */
+    private onAgentCredStatus;
+    /** Team run history (spec 2026-10-01 E5.6): viewer or higher on the agent,
+     * for THIS connection's verified user. The ref is validated before the
+     * access port sees it. Each row is rebuilt from its own fields here
+     * (agentRunRowOf), so a runner that returned more (a message, a
+     * transcript) could never put it on the wire. An uncoded failure is fixed text; the detail stays in the log. */
+    private onAgentRuns;
+    /** peer-* (spec 2026-10-01 E5.5), for THIS connection's verified user. A
+     * link is rebuilt from its five fields, so a port that returned more (a
+     * device key) could never put it on the wire. An uncoded throw is fixed
+     * text; the detail stays in the log. */
+    private onPeer;
+    /** Team mode with per-agent access wired. Every Part B gate keys on this,
+     * so solo mode takes none of the new paths. */
+    private teamAccess;
+    /** Who asked for a run: this process's hub record, the runner's facts, or
+     * the run's stored record (restarts included). */
+    private runRequester;
+    /** May THIS connection read run `runId`'s content (watch it, read its
+     * output)? Decision D5, in this order: a run somebody asked for is theirs
+     * alone, the owner and the admin included; a run nobody asked for (a
+     * schedule, a trigger) is its agent owner's and the admin's. Anything
+     * unknown, and anything that throws, is refused. */
+    private mayReadRun;
+    /** One run-activity item to THIS connection. Solo mode: as is, at once.
+     * Team mode with per-agent access: only what `runActivityFor` lets
+     * through, decided in arrival order. */
+    private sendRunActivity;
+    /** The pre-welcome replay drained, or cut off at its total cap (F14): past
+     * the cap every item still undecided is dropped for this connection, and
+     * the welcome goes out. Never rejects. */
+    private replayDrained;
+    /** `runActivityFor` under a deadline: past it the item is dropped. */
+    private runActivityDecided;
+    /** What THIS connection may hear of one run (team agent access, Part B,
+     * Task 16b). Nothing unless it may list the agent's runs (viewer or higher)
+     * or asked for the run itself. The failure message and the task only when
+     * it may read the run's content (`mayReadRun`, decision D5: the requester,
+     * or for an unattended run the agent's owner or the admin). The agent is
+     * the run's own recorded facts, never the names the item carries. No facts,
+     * facts for a different agent, or any throw: nothing. What gets through says
+     * `mine` on the requester's own connection and `attended` when a person
+     * asked for the run (E5.1); whatever the item claimed of either is dropped,
+     * and no user id is added. */
+    private runActivityFor;
+    /** Team mode: THIS connection's verified user is the daemon admin. A throw
+     * is "no". */
+    private isSessionAdmin;
+    /** The ids of the sessions whose recorded VERIFIED creator is THIS
+     * connection's verified user. Never the claimed `owner`. A session with no
+     * recorded creator is nobody's here. May throw (the caller refuses). */
+    private ownSessionIds;
+    /** May THIS connection act on session `sessionId` (pause, resume, destroy,
+     * capture, watch, run)? Team mode (Task 16c): the admin, or the session's
+     * recorded verified creator. A session with no recorded creator is the
+     * admin's alone. A throw refuses. */
+    private maySession;
+    /** The sessions THIS connection is shown. Solo mode: every one, as before.
+     * Team mode (Task 16c): the admin sees every one, anyone else only their
+     * own. A throw shows none. */
+    private visibleSessions;
+    /** Team mode (Task 16c): why THIS connection may not send `m`, or null.
+     * `session-unwatch` stops only this connection's own watch and is never
+     * refused; `session-snapshots` is filtered where it is answered. */
+    private sessionRefusal;
+    /** May THIS connection stop run `runId`? Its requester may, and so may the
+     * agent's owner or the admin, for any run of that agent. A throw refuses. */
+    private mayCancelRun;
+    /** Who may do this config call on the daemon's own crew (team mode):
+     * - read a definition (or list an agent): any role; read anything else in
+     *   an agent's folder (its runs' memory, sessions, logs): owner or admin;
+     * - write, append or delete in an agent's folder: owner or admin, except the
+     *   first write into a NEW agent, which claims it for the writer;
+     * - change the crew folder itself or a crew-level file: the admin.
+     * Answers a refusal, or what to record once the call has succeeded. Anything
+     * that cannot be decided, or throws, is a refusal. */
+    private configGate;
+    /** The runner's per-run decision (D5) for one run's kept words on the
+     * daemon crew. No runner decision available, or a throw: no. */
+    private mayReadRunContent;
+    /** A listing without the agents this connection has no role on (team mode),
+     * or null when that cannot be decided. Only whole agents are left out:
+     * dropping individual entries would read as deletions to a syncing client.
+     * The one exception is a run's session folder (`sessions/<runId>`), which
+     * is run content: only the runs this user may read are listed (D5). */
+    private visibleConfigEntries;
+    /** After a config write or delete went through: record a new agent's owner,
+     * or drop a deleted agent's record. Never fails the call that succeeded. */
+    private afterConfigChange;
+    /** Why THIS connection may not run a mutating tool on `target`, or null.
+     * The first write into a new agent claims it, which needs a verified user;
+     * a delete never claims, so it goes through the ordinary check. */
+    private invokeRefusal;
+    /** Team mode: the daemon's MCP servers and credentials are the admin's
+     * (Part B). Null when THIS connection may use or change them. Unknown admin
+     * and any throw while deciding are refusals. */
+    private mcpRefusal;
     private onRoomFindings;
     private onRoomFindingEdit;
     /** One config-channel call. The allowlist is NOT applied here -- it is the
      * service's, daemon-side, where the filesystem is -- so this stays a router
      * and there is exactly one place a path is checked. */
     private onConfig;
+    /** The config path as the filesystem would reach it, for classification:
+     * separators, `.`, empty and `..` segments resolved; the `crew` segment, the
+     * agent folder (to its on-disk name, read from the service's own listing of
+     * `crew`) and a definition file name matched case-insensitively, since the
+     * filesystem under the state dir may be case-insensitive. Null means "cannot
+     * be told" (two case variants exist and none is exact): the caller refuses.
+     * A listing that throws propagates, and the caller refuses. A path outside
+     * the crew comes back as is. */
+    private canonicalConfigPath;
     private onHostSyncPut;
     private onHostSyncDelete;
     /** A ToolContext whose capabilities proxy back to the host (persist-nothing).
@@ -1027,4 +1438,7 @@ export declare class SidecarServer {
     private readonly confirm;
     private readonly ask;
 }
+/** Whether `user` is the daemon admin `admin`. Both must be non-empty
+ * strings: an unknown admin, or an empty id on either side, is never a match. */
+export declare function sameAdmin(user: string | undefined, admin: string | undefined): boolean;
 //# sourceMappingURL=server.d.ts.map