@corenel/harness 0.21.0 → 0.23.0

package/dist/sidecar/server.js

@@ -1,16 +1,24 @@
-import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
+import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, FLEET_ITEMS_FEATURE, FLEET_USE_FEATURE, FLEET_USE_LIMITS, isWorkflowCallInputs, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, FS_CHANGED_FEATURE, ATTENDANCE_LEAVE_FEATURE, MCP_ALLOW_FEATURE, MCP_ADMIN_ERROR_CODES, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
 import { SIDECAR_PROTOCOL, errMessage, isLoopbackHost, isLoopbackAddress, parseMcpToolAddress, isWebPushSubscription, MAX_ASSERTION_LEN, isClerkOrgId, MAX_WORKFLOW_PACKAGE_B64, MAX_WORKFLOW_REPLY_ERROR, WORKFLOW_RUNNER_FEATURE, } from '@corenel/protocol';
 import { activityForViewer, askForViewer, withoutViewerClaims } from './askView.js';
 import { capabilityMissingMessage } from './hostCapability.js';
 import { asEcPublicJwk, jwkThumbprint, verifySignature, randomToken, serverProofPayload, clientProofPayload, bytesToB64url, codeProof, sameB64, B64URL_32, } from './deviceKeys.js';
 import { MEMBER_GATE_ALLOWED, pendingRefusal } from './memberGate.js';
 import { AskUserBroker } from './askUserBroker.js';
+import { fsChangesFor } from './fsChanges.js';
 /** A workflow reply's refusal, cut to the length a host accepts
  * (MAX_WORKFLOW_REPLY_ERROR): a longer one is refused whole by the host's
  * reply check, and the person would lose the reason. */
 function clipReplyError(error) {
     return error.length > MAX_WORKFLOW_REPLY_ERROR ? error.slice(0, MAX_WORKFLOW_REPLY_ERROR) : error;
 }
+/** The refusal for workflow inputs that fail isWorkflowCallInputs. */
+export const FLEET_WORKFLOW_INPUTS_ERROR = `workflow inputs must be an object of at most ${FLEET_USE_LIMITS.inputsBytes / 1024} KiB`;
+/** At most this many fleet workflow calls open at once on one connection (each loads and verifies its archive). */
+export const FLEET_CALLS_OPEN_MAX = 16;
+export const FLEET_CALLS_TOO_MANY = 'too many fleet workflow calls open';
+/** A team connection whose host folder the daemon has not resolved (yet): it cannot be named. */
+export const FLEET_CALLER_NO_FOLDER = 'this connection has no host folder yet; reconnect and try again';
 /** A deliberate refusal from the approvals port, written for the person who
  * asked: its message goes on the wire as is. Recognized by `name`, not by
  * `instanceof`, so a second copy of this module (a test alias, a bundled
@@ -33,6 +41,13 @@ export function isApprovalsRefusal(e) {
 export const WORKFLOWS_VERIFY_FIRST = 'in team mode this machine verifies who you are before it takes workflow packages or hands back results; sign in and reconnect';
 export const WORKFLOWS_FOLDER_UNBOUND = 'in team mode a synced folder belongs to the first verified user that connected as it, and none has yet; its workflow packages and results stay closed until one does';
 export const WORKFLOWS_NOT_FOLDER_OWNER = 'in team mode this synced folder belongs to a different verified user; only that user can send it workflow packages or take its results';
+/* Team mode, everything a connection's host folder speaks for besides workflow-*: its runs (the folder is the
+ * owner root and the `via` a daemon-crew run is recorded under), chat turns and reads, run history, transcripts,
+ * crew memory, fleet workflow calls and host-sync writes into the folder. The same rule as the workflow-* messages (hostFolderStanding): the folder
+ * comes from the hello's clientId, which is not secret, so it speaks only for the verified user it is bound to. */
+export const HOST_FOLDER_VERIFY_FIRST = 'in team mode this machine verifies who you are before it runs agents for this app or shows its runs, chats or memory; sign in and reconnect';
+export const HOST_FOLDER_UNBOUND = 'in team mode a synced folder belongs to the first verified user that connected as it, and none has yet; its runs, chats and memory stay closed until one does';
+export const HOST_FOLDER_NOT_OWNER = 'in team mode this synced folder belongs to a different verified user; only that user can run agents as it or read its runs, chats and memory';
 export const APPROVALS_FAILED = 'Standing approvals could not be read or changed. The daemon log has the reason.';
 export const APPROVALS_NO_USER = 'In team mode standing approvals need a verified user on this connection.';
 export const APPROVALS_NAME_AGENT = 'Name the agent: in team mode standing approvals belong to one agent, and only its owner can revoke them.';
@@ -99,6 +114,13 @@ function providedMcpUrls(v) {
 const PEER_DAEMON_MESSAGES = new Set([
     'hello', 'client-proof', 'identity-assert', 'host-call-result',
 ]);
+/** The file tools whose success is news for the daemon's other clients (the
+ * `fs-changed` broadcast): every tool that writes or removes a file under a
+ * root. The fs tools have no rename or mkdir; a write makes its parents. */
+const FS_CHANGE_TOOLS = new Set(['sidecar_fs_write_file', 'sidecar_fs_write_bytes', 'sidecar_fs_delete']);
+/** Gives each connection the id it publishes file changes under, so the bus
+ * can tell the writer apart from everyone else. Per process, like the bus. */
+let fsConnectionSeq = 0;
 /** Server names a credential message may never carry: auth.json is keyed by
  * server name, and these are Object.prototype's own. */
 const AGENT_CRED_RESERVED_SERVERS = new Set(['__proto__', 'constructor', 'prototype']);
@@ -107,6 +129,11 @@ const AGENT_CRED_RESERVED_SERVERS = new Set(['__proto__', 'constructor', 'protot
 function logSafe(s) {
     return s.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
 }
+/** The MCP admin code a thrown refusal carries, when it is one a reply may name. */
+function mcpAdminCodeOf(err) {
+    const code = typeof err === 'object' && err !== null ? err.code : undefined;
+    return typeof code === 'string' && MCP_ADMIN_ERROR_CODES.includes(code) ? code : null;
+}
 /** The code a thrown refusal carries, when it is one a reply may name. */
 function agentCredCodeOf(err) {
     const code = typeof err === 'object' && err !== null ? err.code : undefined;
@@ -779,6 +806,14 @@ export class SidecarServer {
             writable: true,
             value: void 0
         });
+        /** This connection sent `attendance-leave`: it is detached for good and
+         * never attached again, and an answer it sends is dropped. */
+        Object.defineProperty(this, "leftAttendance", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
         /** This connection's seat for chat ask_user (verified connections only),
          * and its leave function, called once on close. */
         Object.defineProperty(this, "askSeat", {
@@ -868,6 +903,14 @@ export class SidecarServer {
             writable: true,
             value: new Set()
         });
+        /** This connection's open fleet workflow calls by request id: aborted by `fleet-workflow-cancel` and,
+         * all of them, when the connection closes. */
+        Object.defineProperty(this, "fleetCalls", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         /** Processes THIS connection is watching. A shared process table means two
          * browsers can be paired to one daemon, and a client that never asked about a
          * process should not be streamed its output - so output is fanned out per
@@ -885,6 +928,14 @@ export class SidecarServer {
             writable: true,
             value: void 0
         });
+        /** What this connection publishes its file changes under on the shared bus,
+         * and how it recognises its own changes there (never sent back to it). */
+        Object.defineProperty(this, "fsConnectionId", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: `c${++fsConnectionSeq}`
+        });
         /* ---- sessions ---- */
         /** Per-session stream stoppers for THIS connection.
          *
@@ -1031,6 +1082,19 @@ export class SidecarServer {
                 return;
             this.ch.send({ t: 'room-progress', room });
         });
+        /* Same gating as roots and rooms, plus: never the writer itself (it knows
+         * what it wrote, and its own listeners already fired). Only the root and
+         * the path cross, never content. No team rule narrows fs READS for a
+         * member (onInvoke gates writes only, and every active member is served
+         * the same file tools over the same roots), so any connection this would
+         * reach could list the same path itself. */
+        const offFsChanges = opts.fsChanges?.subscribe((c) => {
+            if (c.by === this.fsConnectionId)
+                return;
+            if (!this.authed || this.closed || this.peerDaemon || this.memberPending())
+                return;
+            this.ch.send({ t: 'fs-changed', root: c.root, path: c.path });
+        });
         /* A member approved while connected is told so at once (Part E), so the
          * waiting screen can move on; the gate itself re-reads the status on the
          * next message. Only THIS connection's verified user is ever told.
@@ -1113,8 +1177,13 @@ export class SidecarServer {
             for (const detach of this.runDetachers)
                 detach();
             this.runDetachers.clear();
+            // A fleet workflow call has no one left to answer: stop every open one.
+            for (const call of this.fleetCalls.values())
+                call.abort();
+            this.fleetCalls.clear();
             offRoots?.();
             offRooms?.();
+            offFsChanges?.();
             offMembers?.();
             offAdmission?.();
             // Stop streaming process output into a dead socket. The PROCESSES keep
@@ -1235,7 +1304,7 @@ export class SidecarServer {
                 }
                 // A chat turn (Harness Chat Plan 2) takes its own path: the daemon's chat port, never runner.run.
                 if (m.chat !== undefined) {
-                    this.onChatRun(m);
+                    void this.onChatRun(m);
                     return;
                 }
                 void this.onRun(m);
@@ -1318,10 +1387,25 @@ export class SidecarServer {
                 // answer is dropped silently rather than forwarded into the registry.
                 if (!this.authed)
                     return;
+                // A connection that left attendance is shown no asks, so answers none.
+                if (this.leftAttendance)
+                    return;
                 // The note is the client's text: cleaned HERE, at the daemon's edge,
                 // and only a deny carries one.
                 this.opts.attendance?.answer(m.id, m.decision, this.attended, m.decision === 'deny' ? denialNote(m.note) : undefined);
                 return;
+            case 'attendance-leave':
+                /* A client keeping this connection open only for its own calls (a
+                 * browser that selected another machine but still has work running
+                 * on this one). Detached now, so an ask it would never show falls to
+                 * the unattended policy as if it had disconnected, instead of
+                 * waiting on it. Auth-gated like permission-answer; no reply. */
+                if (!this.authed)
+                    return;
+                this.leftAttendance = true;
+                this.attendedDetach?.();
+                this.attendedDetach = undefined;
+                return;
             case 'roots-browse':
                 // Auth-gated like every other request: directory enumeration must never
                 // precede authentication. Failures answer ok:false rather than throwing
@@ -1540,6 +1624,39 @@ export class SidecarServer {
                 }
                 void this.onCrewDeploy(m);
                 return;
+            case 'fleet-items':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-items-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetItems(m);
+                return;
+            case 'fleet-skill-catalog':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-skill-catalog-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetSkillCatalog(m);
+                return;
+            case 'fleet-workflow-catalog':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-workflow-catalog-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetWorkflowCatalog(m);
+                return;
+            case 'fleet-workflow-call':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-workflow-call-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetWorkflowCall(m);
+                return;
+            case 'fleet-workflow-cancel':
+                // No reply exists; an id this connection has no open call under is ignored.
+                if (typeof m.id === 'number')
+                    this.fleetCalls.get(m.id)?.abort();
+                return;
             case 'workflow-package-put':
             case 'workflow-results-list':
             case 'workflow-results-take':
@@ -1736,6 +1853,7 @@ export class SidecarServer {
             case 'mcp-remove':
             case 'mcp-set-credential':
             case 'mcp-login':
+            case 'mcp-allow-set':
                 if (!this.authed) {
                     this.ch.send({ t: 'mcp-admin-error', id: m.id, error: 'not authenticated' });
                     return;
@@ -2467,7 +2585,8 @@ export class SidecarServer {
             this.askSeat = seat;
             this.askSeatLeave = this.askUsers().join(seat);
         }
-        if (this.opts.attendance && !isPeerDaemon) {
+        // A leave that arrived while this hello was still being checked holds.
+        if (this.opts.attendance && !isPeerDaemon && !this.leftAttendance) {
             /* A pending member (Part E) is never a recipient of anything: every
              * send below checks the status at the moment it is made, so a member
              * approved later starts receiving without reconnecting. */
@@ -2710,6 +2829,10 @@ export class SidecarServer {
             // watchers of the parent run (the running-pills card). Only with a live
             // hub behind it -- there is otherwise nothing to fan out from.
             ...(this.opts.runs ? [CHILD_EVENTS_FEATURE] : []),
+            // Whether a write another client makes reaches this one as fs-changed.
+            ...(this.opts.fsChanges ? [FS_CHANGED_FEATURE] : []),
+            // A connection may stop attending while it stays open (attendance-leave).
+            ...(this.opts.attendance ? [ATTENDANCE_LEAVE_FEATURE] : []),
             ...(this.opts.acp ? ['acp'] : []),
             ...(this.opts.roots?.areas.length ? ['add-roots'] : []),
             ...(this.opts.roots?.areas.length && this.opts.roots.create ? ['create-roots'] : []),
@@ -2739,6 +2862,9 @@ export class SidecarServer {
             // Undeploy only where the daemon would record them -- anywhere else a
             // client shows the old read-only view.
             ...(this.opts.crewDeploy ? [CREW_DEPLOY_FEATURE] : []),
+            // Whether this sidecar lists its fleet items. Only with a real port.
+            ...(this.opts.fleetItems ? [FLEET_ITEMS_FEATURE] : []),
+            ...(this.opts.fleetUse ? [FLEET_USE_FEATURE] : []),
             // Whether this daemon runs deployed workflows. Only with a real port, so
             // a client offers the Sidecar deploy target only where it would run.
             ...(this.opts.workflows ? [WORKFLOW_RUNNER_FEATURE] : []),
@@ -2771,6 +2897,7 @@ export class SidecarServer {
             // gives regardless of this flag.
             ...(this.opts.mcp ? ['mcp'] : []),
             ...(this.opts.mcpAdmin ? ['mcp-admin'] : []),
+            ...(this.opts.mcpAdmin?.setAllow ? [MCP_ALLOW_FEATURE] : []),
             // Whether this daemon serves its own Harness Config. Advertised only with
             // a real (allowlisted) service behind it, so a client never shows a
             // daemon's definitions as an empty workspace when what it actually has is
@@ -3165,6 +3292,9 @@ export class SidecarServer {
                 }
             }
             this.ch.send({ t: 'invoke-result', id: m.id, ok: true, result });
+            // After the answer, and only for a change that happened.
+            if (FS_CHANGE_TOOLS.has(m.name))
+                this.publishFsChange(m.args);
         }
         catch (e) {
             // A read that finds nothing there (ENOENT) answered the question -- the
@@ -3176,6 +3306,31 @@ export class SidecarServer {
             this.ch.send({ t: 'invoke-result', id: m.id, ok: false, error: errMessage(e) });
         }
     }
+    /** Announce a file tool's change to the daemon's other clients. The root is
+     * the one the tool resolved against, spelled as the daemon reports its
+     * roots (that is what every client names it by), and the path is relative
+     * to it, resolved as the tool confined it (fsChangesFor). Never throws:
+     * the change already happened and its caller already has its answer. */
+    publishFsChange(args) {
+        const bus = this.opts.fsChanges;
+        if (!bus)
+            return;
+        try {
+            const path = typeof args.path === 'string' ? args.path : '';
+            if (!path)
+                return;
+            const snap = this.opts.roots?.snapshot();
+            const info = this.opts.info;
+            const roots = snap?.roots ?? info?.roots ?? (info?.root ? [info.root] : []);
+            const primary = snap?.root ?? info?.root ?? roots[0];
+            // Where the tool actually wrote (a `../` or absolute path can land in another root).
+            for (const change of fsChangesFor(roots, primary, args.root, path))
+                bus.publish({ ...change, by: this.fsConnectionId });
+        }
+        catch (err) {
+            this.opts.log?.(`fs change not announced: ${errMessage(err)}`);
+        }
+    }
     /** Runs a crew agent via the configured `runner` and streams its lifecycle back
      * to the host: `run-accepted` (with the daemon-assigned runId) once the runner
      * has started, one `event` per `onEvent` callback, then exactly one of
@@ -3363,6 +3518,11 @@ export class SidecarServer {
      */
     async onRunHistory(m) {
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'run-history-result', id: m.id, runs: [], error: denied });
+                return;
+            }
             const history = this.opts.runner?.history?.bind(this.opts.runner);
             const crew = runHistoryCrewOf(m.crew);
             const identity = { clientId: this.clientId };
@@ -3385,6 +3545,11 @@ export class SidecarServer {
      * case, and a state the caller renders rather than treats as a failure. */
     async onRunTranscript(m) {
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'run-transcript-result', id: m.id, lines: [], error: denied });
+                return;
+            }
             const transcript = this.opts.runner?.transcript?.bind(this.opts.runner);
             const identity = { clientId: this.clientId };
             const lines = !transcript ? []
@@ -3403,6 +3568,11 @@ export class SidecarServer {
      * a path. */
     async onCrewMemory(m) {
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'crew-memory-result', id: m.id, memories: [], error: denied });
+                return;
+            }
             const runner = this.opts.runner;
             // The viewer is THIS connection's verified user (team agent access).
             const memories = !runner?.memories ? []
@@ -3430,6 +3600,13 @@ export class SidecarServer {
                 return;
             }
         }
+        // The connection's host folder is the run's owner root (and the `via` of a daemon-crew run): it speaks only
+        // for its bound verified user (hostFolderDenial).
+        const folderDenied = await this.hostFolderDenial();
+        if (folderDenied !== null) {
+            this.ch.send({ t: 'run-error', id: m.id, error: folderDenied });
+            return;
+        }
         /* WHERE the run happens, decided once, up front.
          *
          * A `sessionId` is a confinement request. A daemon that cannot honour it
@@ -3543,7 +3720,7 @@ export class SidecarServer {
      * verified user and never a message field; with none it is refused. The
      * events, `run-accepted` (with the conversation id), `run-done` and the hub
      * publishing follow `onRun`. A refused or failed turn sends `run-error`. */
-    onChatRun(m) {
+    async onChatRun(m) {
         const refuse = (error) => { this.ch.send({ t: 'run-error', id: m.id, error }); };
         const port = this.opts.runner?.chat;
         if (!port) {
@@ -3572,6 +3749,15 @@ export class SidecarServer {
             refuse(spec);
             return;
         }
+        // Team mode only: the chat's identity is this connection's host folder (hostFolderDenial). Solo mode reaches
+        // the port without waiting, as before.
+        if (this.opts.teamMode) {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                refuse(denied);
+                return;
+            }
+        }
         const agent = m.agent;
         const hub = this.opts.runs;
         let runId;
@@ -3712,6 +3898,11 @@ export class SidecarServer {
         }
         const { port, ...rest } = q;
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'chat-list-result', id: m.id, ok: false, error: denied });
+                return;
+            }
             const chats = await port.list({ ...rest, identity: { clientId: this.clientId } });
             this.ch.send({ t: 'chat-list-result', id: m.id, ok: true, chats: chats.map(chatSummaryOf) });
         }
@@ -3735,6 +3926,11 @@ export class SidecarServer {
         }
         const { port, ...rest } = q;
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                refuse(denied);
+                return;
+            }
             const conversation = await port.get({ ...rest, identity: { clientId: this.clientId }, conversationId: m.conversationId });
             this.ch.send({ t: 'chat-get-result', id: m.id, ok: true, conversation: storedChatOf(conversation) });
         }
@@ -4044,6 +4240,127 @@ export class SidecarServer {
             ...(this.verifiedUserId !== undefined ? { verifiedUserId: this.verifiedUserId } : {}),
         };
     }
+    async onFleetItems(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'fleet-items-result', id: m.id, reply });
+        const port = this.opts.fleetItems;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        try {
+            answer(await port.list(this.verifiedUserId ?? undefined));
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+    }
+    /** The caller a fleet workflow call runs as, from THIS connection only, or the refusal. Never the verified user
+     * id (it would reach the workflow's prompts).
+     *
+     * Team mode: `host:<dirName>` only when that folder is bound to this connection's verified user (hostFolderDenial,
+     * the rule the workflow-* messages use): the folder comes from the hello's clientId, which is not secret, so an
+     * unbound name is refused with that check's denial. Solo mode: `host:<dirName>` for a
+     * verified user whose folder was resolved, else `host:owner`. */
+    async fleetCaller() {
+        if (this.opts.teamMode) {
+            if (this.verifiedUserId !== undefined && this.dirName === undefined)
+                return { error: FLEET_CALLER_NO_FOLDER };
+            const denied = await this.hostFolderDenial();
+            if (denied !== null || this.dirName === undefined)
+                return { error: denied ?? FLEET_CALLER_NO_FOLDER };
+            return { caller: { name: `host:${this.dirName}`, trigger: 'host' } };
+        }
+        if (this.verifiedUserId !== undefined && this.dirName !== undefined)
+            return { caller: { name: `host:${this.dirName}`, trigger: 'host' } };
+        return { caller: { name: 'host:owner', trigger: 'host' } };
+    }
+    async onFleetSkillCatalog(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'fleet-skill-catalog-result', id: m.id, reply });
+        const port = this.opts.fleetUse;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        try {
+            answer(await port.skills());
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+    }
+    async onFleetWorkflowCatalog(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'fleet-workflow-catalog-result', id: m.id, reply });
+        const port = this.opts.fleetUse;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        try {
+            answer(await port.workflows());
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+    }
+    async onFleetWorkflowCall(m) {
+        // A frame with no usable correlation id is dropped before the port: nothing runs that its sender could
+        // never match to an answer or cancel.
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const id = m.id;
+        const answer = (reply) => {
+            if (!this.closed)
+                this.ch.send({ t: 'fleet-workflow-call-result', id, reply });
+        };
+        const port = this.opts.fleetUse;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        // Runtime-typed: the message arrived via JSON.parse(...) as SidecarMsg.
+        const name = m.name;
+        if (typeof name !== 'string' || name.length === 0) {
+            answer({ ok: false, error: 'a fleet workflow call needs a workflow name' });
+            return;
+        }
+        const inputs = m.inputs;
+        if (!isWorkflowCallInputs(inputs)) {
+            answer({ ok: false, error: FLEET_WORKFLOW_INPUTS_ERROR });
+            return;
+        }
+        if (this.fleetCalls.has(id)) {
+            answer({ ok: false, error: 'a fleet workflow call with that id is already open' });
+            return;
+        }
+        if (this.fleetCalls.size >= FLEET_CALLS_OPEN_MAX) {
+            answer({ ok: false, error: FLEET_CALLS_TOO_MANY });
+            return;
+        }
+        // The id is held before the first await, so a second call under it, or a cancel, sees it.
+        const control = new AbortController();
+        this.fleetCalls.set(id, control);
+        try {
+            const named = await this.fleetCaller();
+            if ('error' in named) {
+                answer({ ok: false, error: named.error });
+                return;
+            }
+            answer(await port.call(named.caller, name, inputs, control.signal));
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+        finally {
+            if (this.fleetCalls.get(id) === control)
+                this.fleetCalls.delete(id);
+        }
+    }
     async onCrewDeploy(m) {
         // A frame with no usable correlation id is dropped before the port: no
         // change is made that its sender could never match to an answer.
@@ -4085,25 +4402,49 @@ export class SidecarServer {
             answer({ ok: false, error: errMessage(err) });
         }
     }
-    /** Team mode: why this connection may NOT use its synced folder's workflow
-     * packages and results, or null when it may (the caller's verified id equals
-     * the folder's bound owner). A lookup that throws refuses. */
-    async workflowsTeamDenial() {
+    /** THE ONE RULE for whether this connection's synced folder speaks for it: 'bound' only when the folder's
+     * bound owner (the deploy binding, `workflowsFolderOwner`) is this connection's verified user. A folder the
+     * daemon did not resolve, no lookup, no binding, or a lookup that throws is 'unbound'. Every team-mode check of
+     * a host folder (workflowsTeamDenial, hostFolderDenial) reads this and only words it differently. */
+    async hostFolderStanding() {
         if (this.verifiedUserId === undefined)
-            return WORKFLOWS_VERIFY_FIRST;
+            return 'unverified';
         const lookup = this.opts.workflowsFolderOwner;
         if (this.dirName === undefined || !lookup)
-            return WORKFLOWS_FOLDER_UNBOUND;
+            return 'unbound';
         let bound;
         try {
             bound = await lookup(this.dirName);
         }
         catch {
-            return WORKFLOWS_FOLDER_UNBOUND;
+            return 'unbound';
         }
         if (bound === undefined)
-            return WORKFLOWS_FOLDER_UNBOUND;
-        return bound === this.verifiedUserId ? null : WORKFLOWS_NOT_FOLDER_OWNER;
+            return 'unbound';
+        return bound === this.verifiedUserId ? 'bound' : 'not-owner';
+    }
+    /** Team mode: why this connection may NOT use its synced folder's workflow
+     * packages and results, or null when it may (hostFolderStanding). */
+    async workflowsTeamDenial() {
+        switch (await this.hostFolderStanding()) {
+            case 'bound': return null;
+            case 'unverified': return WORKFLOWS_VERIFY_FIRST;
+            case 'unbound': return WORKFLOWS_FOLDER_UNBOUND;
+            case 'not-owner': return WORKFLOWS_NOT_FOLDER_OWNER;
+        }
+    }
+    /** Why this connection's host folder may NOT speak for it in a run, a chat, a history, transcript or memory
+     * read, a fleet workflow call, or a host-sync write, or null when it may. Solo mode: always null (unchanged). Team mode:
+     * hostFolderStanding, the rule the workflow-* messages use. */
+    async hostFolderDenial() {
+        if (!this.opts.teamMode)
+            return null;
+        switch (await this.hostFolderStanding()) {
+            case 'bound': return null;
+            case 'unverified': return HOST_FOLDER_VERIFY_FIRST;
+            case 'unbound': return HOST_FOLDER_UNBOUND;
+            case 'not-owner': return HOST_FOLDER_NOT_OWNER;
+        }
     }
     async onWorkflows(m) {
         // A frame with no usable correlation id is dropped before the port: no
@@ -4873,7 +5214,7 @@ export class SidecarServer {
         if (m.t !== 'mcp-servers-list') {
             const refusal = this.mcpRefusal();
             if (refusal) {
-                this.ch.send({ t: 'mcp-admin-error', id: m.id, error: refusal });
+                this.ch.send({ t: 'mcp-admin-error', id: m.id, error: refusal, code: 'MCP_ADMIN_ONLY' });
                 return;
             }
         }
@@ -4894,8 +5235,9 @@ export class SidecarServer {
              * branch that is not part of it runs setCredential too, with whatever
              * `m.header`/`m.value` happen to be (undefined, for every other message).
              * That is exactly what a stray `if` here did before this comment existed. */
+            let applied;
             if (m.t === 'mcp-add')
-                await admin.addServer(m.name, m.url, m.hosted === true, m.authUrl);
+                applied = await admin.addServer(m.name, m.url, m.hosted === true, m.authUrl);
             else if (m.t === 'mcp-login') {
                 /* The consent URL is pushed the moment it exists, BEFORE the flow
                  * blocks waiting for a human. Holding it until the end would deliver it
@@ -4905,15 +5247,48 @@ export class SidecarServer {
                     this.ch.send({ t: 'mcp-admin-error', id: m.id, error: out.message, reason: out.reason });
                     return;
                 }
+                applied = out.reloadError !== undefined ? { reloadError: out.reloadError } : undefined;
             }
             else if (m.t === 'mcp-remove')
-                await admin.removeServer(m.name);
+                applied = await admin.removeServer(m.name);
+            else if (m.t === 'mcp-allow-set') {
+                if (!admin.setAllow) {
+                    this.ch.send({ t: 'mcp-admin-error', id: m.id, error: 'this daemon cannot switch MCP tools -- update it and reconnect' });
+                    return;
+                }
+                // The shape is checked here, before the port: the message is a
+                // browser's, and a non-string entry must never reach daemon.json.
+                if (typeof m.name !== 'string' || !m.name || !Array.isArray(m.tools) || !m.tools.every((t) => typeof t === 'string')) {
+                    this.ch.send({ t: 'mcp-admin-error', id: m.id, code: 'BAD_REQUEST', error: 'mcp-allow-set needs a server name and a list of tool names.' });
+                    return;
+                }
+                applied = await admin.setAllow(m.name, m.tools);
+            }
             else
-                await admin.setCredential(m.name, m.header, m.value);
-            this.ch.send({ t: 'mcp-admin-ok', id: m.id });
+                applied = await admin.setCredential(m.name, m.header, m.value);
+            const reloadError = applied ? applied.reloadError : undefined;
+            /* A switch answers with the rows as they now stand, so the browser shows
+             * what the daemon allows (a glob may keep a tool on), not what it asked
+             * for. Only the admin reaches here (mcpRefusal above), so the full rows.
+             * Best effort: the write is saved either way. */
+            let servers;
+            if (m.t === 'mcp-allow-set') {
+                try {
+                    servers = await admin.listServers();
+                }
+                catch {
+                    servers = undefined;
+                }
+            }
+            this.ch.send({
+                t: 'mcp-admin-ok', id: m.id,
+                ...(typeof reloadError === 'string' ? { reloadError } : {}),
+                ...(servers ? { servers } : {}),
+            });
         }
         catch (e) {
-            this.ch.send({ t: 'mcp-admin-error', id: m.id, error: e instanceof Error ? e.message : String(e) });
+            const code = mcpAdminCodeOf(e);
+            this.ch.send({ t: 'mcp-admin-error', id: m.id, error: e instanceof Error ? e.message : String(e), ...(code ? { code } : {}) });
         }
     }
     /** Part D credential messages. The caller is this connection's VERIFIED
@@ -5909,6 +6284,13 @@ export class SidecarServer {
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: 'this sidecar cannot sync host config' });
             return;
         }
+        // Team mode: the clientId names the folder written to, and it is not secret, so it writes only for the
+        // verified user that folder is bound to (hostFolderDenial). Solo mode is unchanged.
+        const denied = await this.hostFolderDenial();
+        if (denied !== null) {
+            this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: denied });
+            return;
+        }
         try {
             await this.opts.hostSync.put(identity.clientId, m.path, m.content);
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: true });
@@ -5927,6 +6309,13 @@ export class SidecarServer {
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: 'this sidecar cannot sync host config' });
             return;
         }
+        // Team mode: the clientId names the folder written to, and it is not secret, so it writes only for the
+        // verified user that folder is bound to (hostFolderDenial). Solo mode is unchanged.
+        const denied = await this.hostFolderDenial();
+        if (denied !== null) {
+            this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: denied });
+            return;
+        }
         try {
             await this.opts.hostSync.remove(identity.clientId, m.path);
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: true });