@corenel/harness 0.19.0 → 0.21.0

package/dist/sidecar/server.js

@@ -1,9 +1,10 @@
-import { decodePcm16, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
+import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
 import { SIDECAR_PROTOCOL, errMessage, isLoopbackHost, isLoopbackAddress, parseMcpToolAddress, isWebPushSubscription, MAX_ASSERTION_LEN, isClerkOrgId, MAX_WORKFLOW_PACKAGE_B64, MAX_WORKFLOW_REPLY_ERROR, WORKFLOW_RUNNER_FEATURE, } from '@corenel/protocol';
 import { activityForViewer, askForViewer, withoutViewerClaims } from './askView.js';
 import { capabilityMissingMessage } from './hostCapability.js';
 import { asEcPublicJwk, jwkThumbprint, verifySignature, randomToken, serverProofPayload, clientProofPayload, bytesToB64url, codeProof, sameB64, B64URL_32, } from './deviceKeys.js';
 import { MEMBER_GATE_ALLOWED, pendingRefusal } from './memberGate.js';
+import { AskUserBroker } from './askUserBroker.js';
 /** A workflow reply's refusal, cut to the length a host accepts
  * (MAX_WORKFLOW_REPLY_ERROR): a longer one is refused whole by the host's
  * reply check, and the person would lose the reason. */
@@ -41,6 +42,9 @@ export const WATCH_REFUSED = 'You can watch only runs you started, or unattended
 export const ACCESS_NO_ROLE = 'NO_ACCESS: you have no role on this agent, or too low a role for this.';
 export const ACCESS_NOT_OWNER = "NOT_OWNER: only this agent's owner or the daemon admin can change it.";
 export const ACCESS_ADMIN_ONLY = 'NOT_OWNER: only the daemon admin can change the crew folder itself.';
+/** A team agent's chats (`crew/<agent>/chats/**`) are written only by the
+ * daemon's chat store; no client may write or delete them over the config channel. */
+export const ACCESS_CHAT_FILES = 'NOT_OWNER: chats are kept by the daemon and cannot be changed or deleted here.';
 export const ACCESS_STORE_REFUSED = 'The access store is never writable.';
 export const ACCESS_CHECK_FAILED = 'NOT_OWNER: could not check access.';
 export const ACCESS_FAILED = 'Access could not be checked or changed. The daemon log has the reason.';
@@ -211,6 +215,146 @@ function agentRunsRefOf(x) {
         default: return null;
     }
 }
+/* DAEMON CHAT INPUT (Harness Chat Plan 2). Validated here like the
+ * neighbouring messages, before the chat port sees any of it; the port checks
+ * ids again before a file is touched. */
+/** A chat turn's text and one injected message: at most this many characters. */
+const CHAT_MAX_TEXT = 200000;
+const CHAT_MAX_AGENT_LEN = 128;
+/** Messages in one run-inject. */
+const CHAT_MAX_INJECT = 20;
+const CHAT_MAX_RUN_ID_LEN = 200;
+const CHAT_MAX_MESSAGE_ID_LEN = 128;
+const CHAT_MAX_REASON_LEN = 500;
+/** An ask_user answer: questions, choices per question, and their lengths. */
+const CHAT_MAX_ANSWER_KEYS = 32;
+const CHAT_MAX_ANSWER_CHOICES = 32;
+const CHAT_MAX_ANSWER_LEN = 2000;
+/** The ask-user deadline shown when the runner gave none: its default park
+ * timeout (PARK_TIMEOUT_MS in packages/sidecar, which this package cannot
+ * import). The runner's own bound still decides; this is only what is shown. */
+const CHAT_ASK_FALLBACK_MS = 30 * 60 * 1000;
+/** The runner's RUN_NO_ACCESS text: a chat needs a verified person. */
+const CHAT_NO_ACCESS = 'You do not have access to run this agent.';
+const CHAT_UNAVAILABLE = 'this sidecar does not hold chats';
+const CHAT_NOT_ALONE = 'A chat turn runs on its own; it cannot take a session or a task.';
+const CHAT_BAD_AGENT = 'That is not a crew agent name.';
+const CHAT_BAD_TEXT = `A chat turn needs text of at most ${CHAT_MAX_TEXT} characters.`;
+const CHAT_BAD_SPEC = 'chat must be an object.';
+const CHAT_BAD_ID = 'CHAT_BAD_ID: that is not a chat id';
+const CHAT_BAD_MEMBER = 'CHAT_BAD_ID: that is not a member id';
+const CHAT_BAD_LIMIT = 'A chat limit must be a positive number of dollars.';
+const CHAT_BAD_RUN = 'That is not a run id.';
+const CHAT_BAD_INJECT = `Send 1 to ${CHAT_MAX_INJECT} messages, each with an id and text.`;
+const CHAT_INJECT_FAILED = 'Could not deliver the messages.';
+const CHAT_READ_FAILED = 'Could not read the chats.';
+function chatAgentOk(a) {
+    return typeof a === 'string' && a.length <= CHAT_MAX_AGENT_LEN && AGENT_RUNS_NAME_RE.test(a);
+}
+function chatIdOk(x) {
+    return typeof x === 'string' && CHAT_ID_RE.test(x);
+}
+function plainObject(x) {
+    return typeof x === 'object' && x !== null && !Array.isArray(x);
+}
+/** A chat message's `ref`: absent, or a valid ref naming the same agent.
+ * Null is a refusal. */
+function chatRefOf(x, agent) {
+    if (x === undefined)
+        return {};
+    const ref = agentRunsRefOf(x);
+    return ref !== null && ref.agent === agent ? { ref } : null;
+}
+/** `run.chat` rebuilt from its own fields, or the refusal to send. */
+function chatSpecOf(x, agent) {
+    if (!plainObject(x))
+        return CHAT_BAD_SPEC;
+    if (x.conversationId !== undefined && !chatIdOk(x.conversationId))
+        return CHAT_BAD_ID;
+    const maxUsd = x.maxUsd;
+    if (maxUsd !== undefined && !(typeof maxUsd === 'number' && Number.isFinite(maxUsd) && maxUsd > 0))
+        return CHAT_BAD_LIMIT;
+    const ref = chatRefOf(x.ref, agent);
+    if (ref === null)
+        return AGENT_RUNS_BAD_REF;
+    return {
+        conversationId: typeof x.conversationId === 'string' ? x.conversationId : null,
+        ...(typeof maxUsd === 'number' ? { maxUsd } : {}),
+        ...ref,
+    };
+}
+/** run-inject's messages rebuilt, or null when any is malformed. */
+function injectMessagesOf(x) {
+    if (!Array.isArray(x) || x.length === 0 || x.length > CHAT_MAX_INJECT)
+        return null;
+    const out = [];
+    for (const m of x) {
+        if (!plainObject(m))
+            return null;
+        const { id, text } = m;
+        if (typeof id !== 'string' || !id || id.length > CHAT_MAX_MESSAGE_ID_LEN || hasControlChar(id))
+            return null;
+        if (typeof text !== 'string' || !text.trim() || text.length > CHAT_MAX_TEXT)
+            return null;
+        out.push({ id, text });
+    }
+    return out;
+}
+/** An ask-user answer rebuilt: null (declined), the answers, or undefined
+ * when it is malformed (then it is ignored, and the ask stays open). */
+function askAnswersOf(x) {
+    if (x === null)
+        return null;
+    if (!plainObject(x))
+        return undefined;
+    const entries = Object.entries(x);
+    if (entries.length > CHAT_MAX_ANSWER_KEYS)
+        return undefined;
+    const out = [];
+    for (const [key, choices] of entries) {
+        if (key.length > CHAT_MAX_ANSWER_LEN || !Array.isArray(choices) || choices.length > CHAT_MAX_ANSWER_CHOICES)
+            return undefined;
+        const kept = [];
+        for (const c of choices) {
+            if (typeof c !== 'string' || c.length > CHAT_MAX_ANSWER_LEN)
+                return undefined;
+            kept.push(c);
+        }
+        out.push([key, kept]);
+    }
+    return Object.fromEntries(out);
+}
+/** A summary rebuilt from its own fields, so a port that returned more could
+ * never put it on the wire. */
+function chatSummaryOf(c) {
+    return {
+        conversationId: String(c.conversationId), agent: String(c.agent), title: String(c.title),
+        updatedAt: Number(c.updatedAt), turns: Number(c.turns), usd: Number(c.usd),
+    };
+}
+function storedChatOf(c) {
+    return {
+        id: String(c.id), agent: String(c.agent), requester: String(c.requester), title: String(c.title),
+        messages: Array.isArray(c.messages) ? c.messages : [], updatedAt: Number(c.updatedAt),
+        ...(c.titleLocked !== undefined ? { titleLocked: c.titleLocked === true } : {}),
+        ...(typeof c.model === 'string' ? { model: c.model } : {}),
+        ...(typeof c.system === 'string' ? { system: c.system } : {}),
+        ...(typeof c.maxUsd === 'number' ? { maxUsd: c.maxUsd } : {}),
+    };
+}
+/** The text of a chat read failure a reply may carry: a coded refusal, or the
+ * runner's own wording about the agent. Anything else (a path, an errno) is
+ * null, and the caller logs it and sends fixed text. */
+function chatErrorOf(err) {
+    const msg = errMessage(err);
+    if (msg.length > CHAT_MAX_REASON_LEN)
+        return null;
+    if (/^CHAT_[A-Z_]+: /.test(msg) || msg === CHAT_NO_ACCESS)
+        return msg;
+    if (/^(crew agent not found|invalid crew agent name): [A-Za-z0-9_-]*$/.test(msg))
+        return msg;
+    return null;
+}
 /** The access code a thrown refusal carries, when it is one a reply may name. */
 function accessCodeOf(err) {
     const code = typeof err === 'object' && err !== null ? err.code : undefined;
@@ -566,6 +710,13 @@ export class SidecarServer {
             writable: true,
             value: undefined
         });
+        /** The identity this connection verified as, for re-asking admission when it changes. */
+        Object.defineProperty(this, "verifiedIdentity", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: undefined
+        });
         /** The verified person's display name/email, set with verifiedUserId. */
         Object.defineProperty(this, "verifiedPerson", {
             enumerable: true,
@@ -628,6 +779,27 @@ export class SidecarServer {
             writable: true,
             value: void 0
         });
+        /** This connection's seat for chat ask_user (verified connections only),
+         * and its leave function, called once on close. */
+        Object.defineProperty(this, "askSeat", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "askSeatLeave", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Used when the daemon wired no shared broker: this connection only. */
+        Object.defineProperty(this, "ownAskUsers", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /** Detach from the peer routes, when this connection serves MCP. */
         Object.defineProperty(this, "peersDetach", {
             enumerable: true,
@@ -865,12 +1037,18 @@ export class SidecarServer {
          * A member REMOVED while connected is disconnected at once, peer daemon
          * connections of theirs included: every stream this connection holds
          * (run events, session logs, process output, broadcasts) stops here, not
-         * whenever the transport gets round to reporting the close. */
+         * whenever the transport gets round to reporting the close.
+         * A user the fleet policy newly blocks (slice 4) is disconnected the same
+         * way; nothing is revoked. A browser that was connected redials, and its
+         * redial is refused at the handshake with FLEET_LOGINS, which it can
+         * explain. */
         const offMembers = opts.members?.subscribe((userId, event) => {
             if (!this.authed || this.closed || userId !== this.verifiedUserId)
                 return;
-            if (event === 'removed') {
-                this.opts.log?.('member removed; closing their connection');
+            if (event === 'removed' || event === 'blocked') {
+                this.opts.log?.(event === 'removed'
+                    ? 'member removed; closing their connection'
+                    : 'sign-in limited by fleet policy; closing their connection');
                 teardown();
                 this.ch.close();
                 return;
@@ -878,6 +1056,18 @@ export class SidecarServer {
             if (event === 'active' && !this.peerDaemon)
                 this.ch.send({ t: 'member-status-changed', status: 'active' });
         });
+        /* Fleet mode: the admission decision follows the fleet state. A session it
+         * no longer admits (sign-in closed, or another org now named) is closed at
+         * once, not at the next re-check (spec 2026-10-18, section 4). */
+        const offAdmission = opts.admission?.onChange?.(() => {
+            if (!this.authed || this.closed || !this.verifiedIdentity)
+                return;
+            if (this.admits(this.verifiedIdentity))
+                return;
+            this.opts.log?.('sign-in closed by the fleet state; closing the connection');
+            teardown();
+            this.ch.close();
+        });
         /* Runs once, from the transport's close or from a member removal above. */
         let tornDown = false;
         const teardown = () => {
@@ -909,6 +1099,9 @@ export class SidecarServer {
             this.identityAssertResolve = undefined;
             this.attendedDetach?.();
             this.attendedDetach = undefined;
+            this.askSeatLeave?.();
+            this.askSeatLeave = undefined;
+            this.askSeat = undefined;
             this.peersDetach?.();
             this.peersDetach = undefined;
             // Leave the live set, or this directory reads as connected for ever and
@@ -923,6 +1116,7 @@ export class SidecarServer {
             offRoots?.();
             offRooms?.();
             offMembers?.();
+            offAdmission?.();
             // Stop streaming process output into a dead socket. The PROCESSES keep
             // running - that is the point of the table living on the daemon - but this
             // connection stops hearing about them until something re-attaches.
@@ -1039,8 +1233,47 @@ export class SidecarServer {
                     this.ch.send({ t: 'run-error', id: m.id, error: 'not authenticated' });
                     return;
                 }
+                // A chat turn (Harness Chat Plan 2) takes its own path: the daemon's chat port, never runner.run.
+                if (m.chat !== undefined) {
+                    this.onChatRun(m);
+                    return;
+                }
                 void this.onRun(m);
                 return;
+            case 'run-inject':
+                if (!this.authed) {
+                    this.ch.send({ t: 'run-inject-result', id: m.id, ok: false, reason: 'not authenticated' });
+                    return;
+                }
+                void this.onRunInject(m);
+                return;
+            case 'chat-list':
+                if (!this.authed) {
+                    this.ch.send({ t: 'chat-list-result', id: m.id, ok: false, error: 'not authenticated' });
+                    return;
+                }
+                void this.onChatList(m);
+                return;
+            case 'chat-get':
+                if (!this.authed) {
+                    this.ch.send({ t: 'chat-get-result', id: m.id, ok: false, error: 'not authenticated' });
+                    return;
+                }
+                void this.onChatGet(m);
+                return;
+            case 'ask-user-answer': {
+                // No reply channel, like permission-answer: before authentication, or
+                // from a connection with no seat, it is dropped. The broker ignores an
+                // answer from a seat the ask was not shown to, or for a settled id.
+                if (!this.authed)
+                    return;
+                const seat = this.askSeat;
+                const answers = askAnswersOf(m.answers);
+                if (!seat || !Number.isSafeInteger(m.id) || answers === undefined)
+                    return;
+                this.askUsers().answer(m.id, seat, answers);
+                return;
+            }
             case 'subscribe':
                 // Guarded by auth like `run` (auth boundary). Pre-auth: drop silently —
                 // subscribe has no response channel, so no message is the correct
@@ -1597,6 +1830,24 @@ export class SidecarServer {
         this.noteOutcome('denied');
         this.countFailedHello();
     }
+    /** Whether the policy admits nobody for now, for a reason that clears by itself. A throw reads as not paused. */
+    paused() {
+        try {
+            return this.opts.admission?.paused?.() === true;
+        }
+        catch (err) {
+            this.opts.log?.(`admission paused() threw: ${errMessage(err)}`);
+            return false;
+        }
+    }
+    /** Refuse a PROVEN device while sign-in is paused, saying so, and close: a retry is a fresh connection. Not a
+     * failed credential, so it is not counted toward MAX_FAILED_HELLOS or against the address. */
+    denyPaused() {
+        this.opts.log?.('denied: sign-in is paused until the fleet state allows it again');
+        this.ch.send({ t: 'denied', reason: SIGN_IN_PAUSED_DENIED });
+        this.noteOutcome('paused');
+        this.ch.close();
+    }
     /** Tell the daemon's rate limiter how a hello ended. Its failure is never
      * the handshake's. */
     noteOutcome(outcome) {
@@ -1641,23 +1892,27 @@ export class SidecarServer {
      * caller's uniform denial on the wire. */
     async identityGate(jkt, boundUser) {
         if (!this.opts.identity)
-            return true;
+            return 'ok';
         const sidecarId = this.opts.info?.id;
         if (!sidecarId) {
             this.opts.log?.('identity: refused (this daemon has no id for an assertion to name)');
-            return false;
+            return 'refused';
         }
         const nonce = makeNonce();
         const orgId = this.opts.admission?.orgId;
         this.ch.send({ t: 'identity-challenge', nonce, sidecarId, ...(orgId ? { orgId } : {}), ...(this.challengeIssuer() ? { issuer: this.challengeIssuer() } : {}) });
+        /* PAUSED: after the challenge (so an older client still reads an account refusal and keeps its device), and
+         * without waiting for an assertion: nobody would be admitted whatever it said. */
+        if (this.paused())
+            return 'paused';
         const verdict = await this.awaitAndVerifyIdentity(sidecarId, nonce, jkt, IDENTITY_TIMEOUT_MS);
         if (!verdict.ok) {
             this.opts.log?.(`identity: unverified (${verdict.reason})`);
-            return false;
+            return 'refused';
         }
         if (!this.admits(verdict.identity)) {
             this.opts.log?.(orgId ? `identity: verified, but not a member of ${orgId}` : 'identity: verified, but not the account this daemon belongs to');
-            return false;
+            return this.paused() ? 'paused' : 'refused';
         }
         /* TEAM: ONE USER PER DEVICE. A device belongs to the first verified user
          * it connected as; another member signed in on the same browser does not
@@ -1665,14 +1920,15 @@ export class SidecarServer {
          * user). A device recorded with no user yet is taken by this one. */
         if (this.opts.admission?.oneUserPerDevice && boundUser !== undefined && boundUser !== verdict.identity.userId) {
             this.opts.log?.('identity: verified, but this device belongs to another user');
-            return false;
+            return 'refused';
         }
         this.verifiedUserId = verdict.identity.userId;
+        this.verifiedIdentity = verdict.identity;
         const { name, email } = verdict.identity;
         this.verifiedPerson = { ...(name ? { name } : {}), ...(email ? { email } : {}) };
         this.identityResult = { verified: true };
         this.opts.log?.('identity: verified');
-        return true;
+        return 'ok';
     }
     /** Start the periodic re-check of an authenticated connection's identity
      * (`SidecarAdmission.recheckMs`, team mode). */
@@ -1713,6 +1969,9 @@ export class SidecarServer {
                 this.opts.log?.(`identity re-check failed (${reason}); closing the connection`);
                 this.ch.close();
             }
+            else if (verdict.ok) {
+                this.verifiedIdentity = verdict.identity;
+            }
         }
         finally {
             this.recheckInFlight = false;
@@ -1809,9 +2068,13 @@ export class SidecarServer {
                 return null;
             }
             const deviceJkt = await jwkThumbprint(key);
-            if (!(await this.identityGate(deviceJkt, record.verifiedUserId))) {
+            const gate = await this.identityGate(deviceJkt, record.verifiedUserId);
+            if (gate !== 'ok') {
                 this.unwatchRevocation();
-                this.denyCredential('identity');
+                if (gate === 'paused')
+                    this.denyPaused();
+                else
+                    this.denyCredential('identity');
                 return null;
             }
             return { deviceId: id, deviceJkt };
@@ -1866,8 +2129,12 @@ export class SidecarServer {
             }
             /* WHO, before anything is written: an unverified or unadmitted identity
              * is refused here with the code still unburned. */
-            if (!(await this.identityGate(keyJkt))) {
-                this.denyCredential('identity');
+            const gate = await this.identityGate(keyJkt);
+            if (gate !== 'ok') {
+                if (gate === 'paused')
+                    this.denyPaused();
+                else
+                    this.denyCredential('identity');
                 return null;
             }
             const deviceId = makeDeviceId();
@@ -1968,6 +2235,34 @@ export class SidecarServer {
             this.ch.close();
             return;
         }
+        /* BLOCKED BY FLEET POLICY (slice 4). Local approval holds a user back
+         * (they connect and wait at the pending gate); the fleet policy refuses
+         * them outright, before this connection is authenticated and before first
+         * sight would record them as pending. Peer daemon connections of theirs
+         * included. Sent after the identity challenge, so the client reads an
+         * account refusal and keeps its device. */
+        if (this.opts.members && this.verifiedUserId && this.fleetBlocked(this.verifiedUserId)) {
+            this.opts.log?.('denied: sign-in limited by fleet policy');
+            this.ch.send({ t: 'denied', reason: FLEET_LOGINS_DENIED });
+            this.noteOutcome('denied');
+            this.unwatchRevocation();
+            this.ch.close();
+            return;
+        }
+        /* The admission policy may have changed while the credential was being
+         * checked (the change callback ignores a connection that is not yet
+         * authenticated). Ask once more, just before authenticating, so a decision
+         * the fleet already revoked is never acted on. */
+        if (this.verifiedIdentity && !this.admits(this.verifiedIdentity)) {
+            this.opts.log?.('identity: no longer admitted by the fleet state');
+            this.unwatchRevocation();
+            if (this.paused())
+                this.denyPaused();
+            else
+                this.denyCredential('identity');
+            this.helloInFlight = false;
+            return;
+        }
         /** What every pairing assertion on this connection binds: the thumbprint
          * of the device key it proved. */
         this.deviceJkt = cred.deviceJkt;
@@ -2158,6 +2453,20 @@ export class SidecarServer {
                 call: (method, args) => this.hostCall('mcp', method, args),
             });
         }
+        /* Chat ask_user (R8): a verified person's connection takes a seat, so an
+         * ask for them or for the admin reaches it, and one already open is
+         * delivered now. A pending member is shown nothing, checked per send. */
+        if (this.opts.runner?.chat && this.verifiedUserId && !isPeerDaemon) {
+            const seat = {
+                userId: this.verifiedUserId,
+                ask: (p) => { if (!this.memberPending())
+                    this.ch.send({ t: 'ask-user', ...p }); },
+                resolved: (id, by) => { if (!this.memberPending())
+                    this.ch.send({ t: 'ask-user-resolved', id, by }); },
+            };
+            this.askSeat = seat;
+            this.askSeatLeave = this.askUsers().join(seat);
+        }
         if (this.opts.attendance && !isPeerDaemon) {
             /* A pending member (Part E) is never a recipient of anything: every
              * send below checks the status at the moment it is made, so a member
@@ -2390,6 +2699,11 @@ export class SidecarServer {
             // A client starts a task only where the daemon will honour it: an older
             // runner ignores `task`, and a dropped task must never look like a start.
             ...(this.opts.runner?.supportsTasks ? [RUN_TASK_FEATURE] : []),
+            // Daemon chat (Harness Chat Plan 2): run.chat, run-inject, chat-list,
+            // chat-get and ask-user, only with a chat port behind them and a
+            // verified user on this connection: every chat turn and read is refused
+            // without one, so a client must not offer a surface that always refuses.
+            ...(this.opts.runner?.chat && this.verifiedUserId ? [CHAT_FEATURE] : []),
             // Whether this daemon answers run-plan-get (a runner that reads run records).
             ...(this.opts.runner?.runPlan ? [RUN_PLAN_FEATURE] : []),
             // Whether this daemon fans a delegated callee's own node events out to
@@ -3212,6 +3526,225 @@ export class SidecarServer {
             this.ch.send({ t: 'run-error', id: m.id, error: message });
         }
     }
+    /** The daemon's ask_user broker, or this connection's own when none is wired. */
+    askUsers() {
+        return this.opts.askUsers ?? (this.ownAskUsers ?? (this.ownAskUsers = new AskUserBroker()));
+    }
+    /** The sidecar admin's verified user id, now; undefined when unknown. A throw is "none". */
+    chatAdmin() {
+        try {
+            return this.opts.access?.adminId();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** One chat turn (Harness Chat Plan 2). The requester is THIS connection's
+     * verified user and never a message field; with none it is refused. The
+     * events, `run-accepted` (with the conversation id), `run-done` and the hub
+     * publishing follow `onRun`. A refused or failed turn sends `run-error`. */
+    onChatRun(m) {
+        const refuse = (error) => { this.ch.send({ t: 'run-error', id: m.id, error }); };
+        const port = this.opts.runner?.chat;
+        if (!port) {
+            refuse(CHAT_UNAVAILABLE);
+            return;
+        }
+        if (m.sessionId !== undefined || m.task !== undefined || m.autonomy !== undefined) {
+            refuse(CHAT_NOT_ALONE);
+            return;
+        }
+        const user = this.verifiedUserId;
+        if (!user) {
+            refuse(CHAT_NO_ACCESS);
+            return;
+        }
+        if (!chatAgentOk(m.agent)) {
+            refuse(CHAT_BAD_AGENT);
+            return;
+        }
+        if (typeof m.input !== 'string' || m.input.length > CHAT_MAX_TEXT) {
+            refuse(CHAT_BAD_TEXT);
+            return;
+        }
+        const spec = chatSpecOf(m.chat, m.agent);
+        if (typeof spec === 'string') {
+            refuse(spec);
+            return;
+        }
+        const agent = m.agent;
+        const hub = this.opts.runs;
+        let runId;
+        let ended = false;
+        const early = [];
+        const forward = (id, event) => {
+            hub?.publish(id, event);
+            this.ch.send({ t: 'event', id: m.id, runId: id, event });
+        };
+        const done = (r) => {
+            if (ended)
+                return;
+            ended = true;
+            if ((r.outcome === 'done' || r.outcome === 'stopped') && runId !== undefined) {
+                const stopReason = r.stopReason ?? r.outcome;
+                hub?.finish(runId, { text: r.text, stopReason });
+                this.ch.send({ t: 'run-done', id: m.id, runId, text: r.text, stopReason, outcome: r.outcome });
+                return;
+            }
+            const outcome = r.outcome === 'refused' ? 'refused' : 'failed';
+            const error = r.error ?? (r.outcome === 'refused' ? 'The chat turn was refused.'
+                : runId === undefined ? 'The chat turn ended without a run.' : 'The chat turn failed.');
+            // Watchers too: a failed run must not look merely silent to a second viewer.
+            if (runId !== undefined)
+                hub?.fail(runId, error);
+            this.ch.send({ t: 'run-error', id: m.id, error, outcome });
+        };
+        const askers = () => {
+            const admin = this.chatAdmin();
+            return admin && admin !== user ? [user, admin] : [user];
+        };
+        try {
+            port.turn({
+                agent, requester: user, identity: { clientId: this.clientId },
+                conversationId: spec.conversationId, text: m.input,
+                ...(spec.ref ? { ref: spec.ref } : {}),
+                ...(spec.maxUsd !== undefined ? { maxUsd: spec.maxUsd } : {}),
+            }, {
+                onAccepted: (id, conversationId) => {
+                    // One run per turn: a second id is not this turn's.
+                    if (ended || runId !== undefined)
+                        return;
+                    runId = id;
+                    hub?.open(id, user);
+                    this.ch.send({ t: 'run-accepted', id: m.id, runId: id, conversationId });
+                    for (const e of early.splice(0))
+                        if (e.runId === id)
+                            forward(id, e.event);
+                },
+                onEvent: (id, event) => {
+                    if (ended)
+                        return;
+                    // Buffered until the run's id is known, as onRun does.
+                    if (runId === undefined) {
+                        early.push({ runId: id, event });
+                        return;
+                    }
+                    if (id === runId)
+                        forward(id, event);
+                },
+                onDone: done,
+                // R8 / Q2: the requester and the admin, read when the question is asked.
+                askUser: (id, questions, signal, deadline) => this.askUsers().ask({
+                    users: askers(), runId: id, agent, questions,
+                    deadline: typeof deadline === 'number' && Number.isFinite(deadline) ? deadline : this.now() + CHAT_ASK_FALLBACK_MS,
+                }, signal),
+            });
+        }
+        catch (err) {
+            done({ conversationId: spec.conversationId, runId: null, outcome: 'failed', error: errMessage(err), text: '' });
+        }
+    }
+    /** Messages typed while a chat turn runs. The requester is THIS
+     * connection's verified user; the port refuses a run that is not theirs. */
+    async onRunInject(m) {
+        const reply = (ok, reason) => {
+            this.ch.send({ t: 'run-inject-result', id: m.id, ok, ...(reason !== undefined ? { reason } : {}) });
+        };
+        const port = this.opts.runner?.chat;
+        if (!port) {
+            reply(false, CHAT_UNAVAILABLE);
+            return;
+        }
+        const user = this.verifiedUserId;
+        if (!user) {
+            reply(false, CHAT_NO_ACCESS);
+            return;
+        }
+        if (typeof m.runId !== 'string' || !m.runId || m.runId.length > CHAT_MAX_RUN_ID_LEN || hasControlChar(m.runId)) {
+            reply(false, CHAT_BAD_RUN);
+            return;
+        }
+        const messages = injectMessagesOf(m.messages);
+        if (!messages) {
+            reply(false, CHAT_BAD_INJECT);
+            return;
+        }
+        try {
+            const r = await port.inject(m.runId, user, messages, m.hard === true);
+            if (r.ok === true)
+                reply(true);
+            else
+                reply(false, typeof r.reason === 'string' && r.reason ? r.reason.slice(0, CHAT_MAX_REASON_LEN) : CHAT_INJECT_FAILED);
+        }
+        catch (err) {
+            this.opts.log?.(`chat: run-inject threw: ${errMessage(err)}`);
+            reply(false, CHAT_INJECT_FAILED);
+        }
+    }
+    /** The checks chat-list and chat-get share: a port, a verified caller, and
+     * a well-formed agent, ref and member. Answers the request's parts, or the
+     * refusal to send. `isAdmin` is the daemon's own answer, never the message's. */
+    chatReadOf(m) {
+        const port = this.opts.runner?.chat;
+        if (!port)
+            return CHAT_UNAVAILABLE;
+        const caller = this.verifiedUserId;
+        if (!caller)
+            return CHAT_NO_ACCESS;
+        if (!chatAgentOk(m.agent))
+            return CHAT_BAD_AGENT;
+        const ref = chatRefOf(m.ref, m.agent);
+        if (ref === null)
+            return AGENT_RUNS_BAD_REF;
+        if (m.member !== undefined && !chatIdOk(m.member))
+            return CHAT_BAD_MEMBER;
+        return {
+            port, caller, agent: m.agent, ...ref,
+            ...(m.member !== undefined ? { member: m.member } : {}),
+            isAdmin: sameAdmin(caller, this.chatAdmin()),
+        };
+    }
+    async onChatList(m) {
+        const q = this.chatReadOf(m);
+        if (typeof q === 'string') {
+            this.ch.send({ t: 'chat-list-result', id: m.id, ok: false, error: q });
+            return;
+        }
+        const { port, ...rest } = q;
+        try {
+            const chats = await port.list({ ...rest, identity: { clientId: this.clientId } });
+            this.ch.send({ t: 'chat-list-result', id: m.id, ok: true, chats: chats.map(chatSummaryOf) });
+        }
+        catch (err) {
+            const error = chatErrorOf(err);
+            if (error === null)
+                this.opts.log?.(`chat: chat-list threw: ${errMessage(err)}`);
+            this.ch.send({ t: 'chat-list-result', id: m.id, ok: false, error: error ?? CHAT_READ_FAILED });
+        }
+    }
+    async onChatGet(m) {
+        const refuse = (error) => { this.ch.send({ t: 'chat-get-result', id: m.id, ok: false, error }); };
+        const q = this.chatReadOf(m);
+        if (typeof q === 'string') {
+            refuse(q);
+            return;
+        }
+        if (!chatIdOk(m.conversationId)) {
+            refuse(CHAT_BAD_ID);
+            return;
+        }
+        const { port, ...rest } = q;
+        try {
+            const conversation = await port.get({ ...rest, identity: { clientId: this.clientId }, conversationId: m.conversationId });
+            this.ch.send({ t: 'chat-get-result', id: m.id, ok: true, conversation: storedChatOf(conversation) });
+        }
+        catch (err) {
+            const error = chatErrorOf(err);
+            if (error === null)
+                this.opts.log?.(`chat: chat-get threw: ${errMessage(err)}`);
+            refuse(error ?? CHAT_READ_FAILED);
+        }
+    }
     /** The identity to attribute a host-sync write to. Returns either the
      * authenticated `clientId`, or an error string explaining why there is none --
      * either this connection is not authenticated yet, or it authenticated with no
@@ -4528,6 +5061,17 @@ export class SidecarServer {
             ? { t: 'access-result', id: m.id, ok: true, ...(reply.access ? { access: reply.access } : {}), ...(reply.members ? { members: reply.members } : {}) }
             : { t: 'access-result', id: m.id, ok: false, code: reply.code, error: reply.error });
     }
+    /** Does the fleet policy refuse this user outright (slice 4)? A lookup that throws answers no here: the
+     * pending gate, which reads a throwing lookup as pending, still holds them back, and the daemon admin is
+     * never locked out by a broken member list. */
+    fleetBlocked(userId) {
+        try {
+            return this.opts.members?.statusOf(userId) === 'blocked';
+        }
+        catch {
+            return false;
+        }
+    }
     /** Team mode with a member list, and this connection's verified user is not
      * an active member right now. Read fresh on every call. Member status
      * ALONE: a peer daemon connection is exempted from the request gate in
@@ -4579,6 +5123,7 @@ export class SidecarServer {
                         userId: r.userId, status: r.status, firstSeen: r.firstSeen, label: r.label,
                         ...(r.approvedBy !== undefined ? { approvedBy: r.approvedBy } : {}),
                         ...(r.approvedAt !== undefined ? { approvedAt: r.approvedAt } : {}),
+                        ...(r.blockedByFleet === true ? { blockedByFleet: true } : {}),
                     })),
                 } : {}),
             }
@@ -5033,6 +5578,21 @@ export class SidecarServer {
             const target = crewConfigTarget(canonical);
             if (!target)
                 return {};
+            /* A chat (R15/Q6) is its member's and the admin's alone, the agent's
+             * owner included, and only the daemon writes it (Q1: chats are kept).
+             * The chats folder may be listed with any role; the listing keeps only
+             * this user's own requester folder (visibleConfigEntries). */
+            const chat = target.kind === 'agent' ? chatContentOf(canonical) : null;
+            if (target.kind === 'agent' && chat !== null) {
+                if (!reading)
+                    return { refusal: ACCESS_CHAT_FILES };
+                if (chat.requester === null) {
+                    return m.t === 'config-list' && (await access.can(daemonAgent(target.agent), user, 'see')) ? {} : { refusal };
+                }
+                if (sameAdmin(user, access.adminId()))
+                    return {};
+                return user !== undefined && chat.requester === user ? {} : { refusal };
+            }
             if (reading) {
                 if (target.kind === 'crew')
                     return {};
@@ -5084,7 +5644,9 @@ export class SidecarServer {
      * or null when that cannot be decided. Only whole agents are left out:
      * dropping individual entries would read as deletions to a syncing client.
      * The one exception is a run's session folder (`sessions/<runId>`), which
-     * is run content: only the runs this user may read are listed (D5). */
+     * is run content: only the runs this user may read are listed (D5). So is a
+     * chat's requester folder (`chats/<requester>`): only this user's own, or
+     * every one for the admin, is listed (R15/Q6). */
     async visibleConfigEntries(svc, path, entries) {
         const access = this.teamAccess();
         if (!access)
@@ -5113,6 +5675,9 @@ export class SidecarServer {
                 }
                 if (!shown)
                     continue;
+                const chat = chatContentOf(full);
+                if (chat !== null && chat.requester !== null && !isAdmin && (this.verifiedUserId === undefined || chat.requester !== this.verifiedUserId))
+                    continue;
                 const run = runContentOf(full);
                 if (run?.kind === 'sessions' && run.id !== null) {
                     const key = `${target.agent}/${run.id}`;
@@ -5445,6 +6010,18 @@ function runContentOf(path) {
     const file = segs.length === 4 ? /^(.+)\.jsonl$/i.exec(segs[3]) : null;
     return { kind, id: file ? file[1] : null, folder: false };
 }
+/** Where a daemon-crew config path is inside an agent's chats
+ * (`crew/<agent>/chats[/<requester>[/...]]`, the daemon chat store's layout).
+ * `requester` is the folder's requester id (the `<requester>` segment, as the
+ * canonical path spells it), null for the chats folder itself. Null for any
+ * other path. The `chats` segment compares case-insensitively; the caller
+ * hands in the canonical path. */
+function chatContentOf(path) {
+    const segs = path.split('/');
+    if (segs.length < 3 || segs[0].toLowerCase() !== 'crew' || segs[2].toLowerCase() !== 'chats')
+        return null;
+    return { requester: segs.length === 3 ? null : segs[3] || null };
+}
 /** `run-history`'s `crew`, off the wire: anything but the two known shapes is
  * treated as absent (the global crew, as an older client meant). The id is
  * only a selector among the CALLER's own roots -- the runner matches it