@corenel/harness 0.22.0 → 0.24.0

package/dist/sidecar/server.js

@@ -1,4 +1,4 @@
-import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, FS_CHANGED_FEATURE, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
+import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, FLEET_ITEMS_FEATURE, FLEET_USE_FEATURE, KNOWLEDGE_FEATURE, KNOWLEDGE_OFF_FEATURE, KNOWLEDGE_NOT_KEPT, KNOWLEDGE_WRITE_ADMIN_ONLY, KNOWLEDGE_ADMIN_ONLY, KNOWLEDGE_UNREACHABLE, knowledgeConflictSentence, SIDECAR_KNOWLEDGE_TOOLS, SIDECAR_KNOWLEDGE_WRITE, FLEET_USE_LIMITS, isWorkflowCallInputs, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, FS_CHANGED_FEATURE, ATTENDANCE_LEAVE_FEATURE, ATTENDANCE_JOIN_FEATURE, MCP_ALLOW_FEATURE, MCP_ADMIN_ERROR_CODES, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
 import { SIDECAR_PROTOCOL, errMessage, isLoopbackHost, isLoopbackAddress, parseMcpToolAddress, isWebPushSubscription, MAX_ASSERTION_LEN, isClerkOrgId, MAX_WORKFLOW_PACKAGE_B64, MAX_WORKFLOW_REPLY_ERROR, WORKFLOW_RUNNER_FEATURE, } from '@corenel/protocol';
 import { activityForViewer, askForViewer, withoutViewerClaims } from './askView.js';
 import { capabilityMissingMessage } from './hostCapability.js';
@@ -12,6 +12,57 @@ import { fsChangesFor } from './fsChanges.js';
 function clipReplyError(error) {
     return error.length > MAX_WORKFLOW_REPLY_ERROR ? error.slice(0, MAX_WORKFLOW_REPLY_ERROR) : error;
 }
+/** A folder as a caller who does not manage the folders sees it: no path, and
+ * an error that is a fixed sentence naming the folder by its label only. */
+function knowledgeViewForMember(f) {
+    const view = { id: f.id, label: f.label, writable: f.writable, state: f.state, origin: f.origin };
+    if (f.state === 'conflict') {
+        if (f.conflict)
+            view.conflict = f.conflict;
+        view.error = knowledgeConflictSentence(f.label, f.conflict);
+    }
+    else if (f.state === 'unreachable') {
+        view.error = KNOWLEDGE_UNREACHABLE;
+    }
+    return view;
+}
+/** Only the wire fields of a folder, so nothing else a port holds is sent. */
+function knowledgeViewForManager(f) {
+    return {
+        id: f.id, label: f.label, writable: f.writable, state: f.state, origin: f.origin,
+        ...(f.conflict ? { conflict: f.conflict } : {}),
+        ...(f.error !== undefined ? { error: f.error } : {}),
+        ...(f.path !== undefined ? { path: f.path } : {}),
+    };
+}
+/** A `knowledge-set` `add` as sent, checked field by field; null when its shape is wrong. */
+function knowledgeAddOf(v) {
+    if (typeof v !== 'object' || v === null || Array.isArray(v))
+        return null;
+    const o = v;
+    if (typeof o.path !== 'string')
+        return null;
+    if (o.writable !== undefined && typeof o.writable !== 'boolean')
+        return null;
+    if (o.label !== undefined && typeof o.label !== 'string')
+        return null;
+    return {
+        path: o.path,
+        ...(o.writable === true ? { writable: true } : {}),
+        ...(typeof o.label === 'string' ? { label: o.label } : {}),
+    };
+}
+/** What a knowledge-set with neither or both of add and remove, or a malformed one, answers. */
+export const KNOWLEDGE_SET_SHAPE = 'Give one folder to add or the id of one folder to remove.';
+/** What a knowledge message answers a caller who does not manage the folders when the port throws. */
+export const KNOWLEDGE_FAILED = 'The sidecar could not answer that knowledge request. Its admin can find the reason in its log.';
+/** The refusal for workflow inputs that fail isWorkflowCallInputs. */
+export const FLEET_WORKFLOW_INPUTS_ERROR = `workflow inputs must be an object of at most ${FLEET_USE_LIMITS.inputsBytes / 1024} KiB`;
+/** At most this many fleet workflow calls open at once on one connection (each loads and verifies its archive). */
+export const FLEET_CALLS_OPEN_MAX = 16;
+export const FLEET_CALLS_TOO_MANY = 'too many fleet workflow calls open';
+/** A team connection whose host folder the daemon has not resolved (yet): it cannot be named. */
+export const FLEET_CALLER_NO_FOLDER = 'this connection has no host folder yet; reconnect and try again';
 /** A deliberate refusal from the approvals port, written for the person who
  * asked: its message goes on the wire as is. Recognized by `name`, not by
  * `instanceof`, so a second copy of this module (a test alias, a bundled
@@ -34,6 +85,13 @@ export function isApprovalsRefusal(e) {
 export const WORKFLOWS_VERIFY_FIRST = 'in team mode this machine verifies who you are before it takes workflow packages or hands back results; sign in and reconnect';
 export const WORKFLOWS_FOLDER_UNBOUND = 'in team mode a synced folder belongs to the first verified user that connected as it, and none has yet; its workflow packages and results stay closed until one does';
 export const WORKFLOWS_NOT_FOLDER_OWNER = 'in team mode this synced folder belongs to a different verified user; only that user can send it workflow packages or take its results';
+/* Team mode, everything a connection's host folder speaks for besides workflow-*: its runs (the folder is the
+ * owner root and the `via` a daemon-crew run is recorded under), chat turns and reads, run history, transcripts,
+ * crew memory, fleet workflow calls and host-sync writes into the folder. The same rule as the workflow-* messages (hostFolderStanding): the folder
+ * comes from the hello's clientId, which is not secret, so it speaks only for the verified user it is bound to. */
+export const HOST_FOLDER_VERIFY_FIRST = 'in team mode this machine verifies who you are before it runs agents for this app or shows its runs, chats or memory; sign in and reconnect';
+export const HOST_FOLDER_UNBOUND = 'in team mode a synced folder belongs to the first verified user that connected as it, and none has yet; its runs, chats and memory stay closed until one does';
+export const HOST_FOLDER_NOT_OWNER = 'in team mode this synced folder belongs to a different verified user; only that user can run agents as it or read its runs, chats and memory';
 export const APPROVALS_FAILED = 'Standing approvals could not be read or changed. The daemon log has the reason.';
 export const APPROVALS_NO_USER = 'In team mode standing approvals need a verified user on this connection.';
 export const APPROVALS_NAME_AGENT = 'Name the agent: in team mode standing approvals belong to one agent, and only its owner can revoke them.';
@@ -66,6 +124,11 @@ export const AGENT_CRED_FAILED = 'Agent credentials could not be checked or chan
 export const AGENT_CRED_LOGIN_FAILED = 'The sign-in did not finish. The daemon log has the reason.';
 export const AGENT_CRED_SOLO = 'This daemon does not keep agent access.';
 export const MCP_ADMIN_ONLY = "In team mode only the daemon admin can use or change this machine's MCP servers directly.";
+/** A command runs as the daemon's OS user, outside every root and every
+ * per-member check, so on a team daemon it is the admin's alone. */
+export const COMMANDS_ADMIN_ONLY = 'In team mode only the daemon admin can run commands on this machine directly.';
+/** The tools a connected client could use to run a command or reach a running one. */
+const COMMAND_TOOLS = new Set(['sidecar_shell_exec', 'proc_start', 'proc_stop', 'proc_list']);
 export const SESSION_REFUSED = 'In team mode a session is reachable only by the member who created it, or the daemon admin.';
 export const SNAPSHOT_REFUSED = 'In team mode you can restore only from a snapshot of a session you created.';
 export const SNAPSHOT_NAME_REFUSED = 'In team mode a snapshot name is chosen by the daemon; only the daemon admin can name one.';
@@ -115,6 +178,11 @@ const AGENT_CRED_RESERVED_SERVERS = new Set(['__proto__', 'constructor', 'protot
 function logSafe(s) {
     return s.replace(/[\x00-\x1f\x7f-\x9f]/g, '');
 }
+/** The MCP admin code a thrown refusal carries, when it is one a reply may name. */
+function mcpAdminCodeOf(err) {
+    const code = typeof err === 'object' && err !== null ? err.code : undefined;
+    return typeof code === 'string' && MCP_ADMIN_ERROR_CODES.includes(code) ? code : null;
+}
 /** The code a thrown refusal carries, when it is one a reply may name. */
 function agentCredCodeOf(err) {
     const code = typeof err === 'object' && err !== null ? err.code : undefined;
@@ -787,6 +855,23 @@ export class SidecarServer {
             writable: true,
             value: void 0
         });
+        /** This connection sent `attendance-leave`: it is detached for good and
+         * never attached again, and an answer it sends is dropped. */
+        Object.defineProperty(this, "leftAttendance", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        /** The welcome was sent: the hello is finished. An `attendance-join` is
+         * read only after it, so it cannot attach in the middle of the hello (whose
+         * own attach, or a leave that arrived meanwhile, decides that). */
+        Object.defineProperty(this, "welcomed", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
         /** This connection's seat for chat ask_user (verified connections only),
          * and its leave function, called once on close. */
         Object.defineProperty(this, "askSeat", {
@@ -876,6 +961,14 @@ export class SidecarServer {
             writable: true,
             value: new Set()
         });
+        /** This connection's open fleet workflow calls by request id: aborted by `fleet-workflow-cancel` and,
+         * all of them, when the connection closes. */
+        Object.defineProperty(this, "fleetCalls", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         /** Processes THIS connection is watching. A shared process table means two
          * browsers can be paired to one daemon, and a client that never asked about a
          * process should not be streamed its output - so output is fanned out per
@@ -1142,6 +1235,10 @@ export class SidecarServer {
             for (const detach of this.runDetachers)
                 detach();
             this.runDetachers.clear();
+            // A fleet workflow call has no one left to answer: stop every open one.
+            for (const call of this.fleetCalls.values())
+                call.abort();
+            this.fleetCalls.clear();
             offRoots?.();
             offRooms?.();
             offFsChanges?.();
@@ -1265,7 +1362,7 @@ export class SidecarServer {
                 }
                 // A chat turn (Harness Chat Plan 2) takes its own path: the daemon's chat port, never runner.run.
                 if (m.chat !== undefined) {
-                    this.onChatRun(m);
+                    void this.onChatRun(m);
                     return;
                 }
                 void this.onRun(m);
@@ -1327,6 +1424,10 @@ export class SidecarServer {
                 void this.onAcpStart(m);
                 return;
             case 'acp-set-mode':
+                if (!this.authed) {
+                    this.ch.send({ t: 'acp-error', id: m.id, error: 'not authenticated' });
+                    return;
+                }
                 void this.onAcpSetMode(m);
                 return;
             case 'acp-prompt':
@@ -1348,10 +1449,45 @@ export class SidecarServer {
                 // answer is dropped silently rather than forwarded into the registry.
                 if (!this.authed)
                     return;
+                // A connection that left attendance is shown no asks, so answers none.
+                if (this.leftAttendance)
+                    return;
                 // The note is the client's text: cleaned HERE, at the daemon's edge,
                 // and only a deny carries one.
                 this.opts.attendance?.answer(m.id, m.decision, this.attended, m.decision === 'deny' ? denialNote(m.note) : undefined);
                 return;
+            case 'attendance-leave':
+                /* A client keeping this connection open only for its own calls (a
+                 * browser that selected another machine but still has work running
+                 * on this one). Detached now, so an ask it would never show falls to
+                 * the unattended policy as if it had disconnected, instead of
+                 * waiting on it. Auth-gated like permission-answer; no reply. */
+                if (!this.authed)
+                    return;
+                this.leftAttendance = true;
+                this.attendedDetach?.();
+                this.attendedDetach = undefined;
+                /* Its ask_user seat goes too: a question shown on a connection that
+                 * is not attending would wait on nobody. The seat object stays, for
+                 * a join, and an ask still open is shown to it again then. */
+                this.askSeatLeave?.();
+                this.askSeatLeave = undefined;
+                return;
+            case 'attendance-join':
+                /* The client takes this connection back for the person (a browser
+                 * that switched back to this machine): it attends again, and the
+                 * attach replays what is waiting, as at hello. Only after a leave on
+                 * THIS connection, so an attendance is never held twice, and only
+                 * once the hello is finished (welcomed). A peer daemon never gets
+                 * here (its messages are filtered above) and is never attached
+                 * (attachAttendance). No reply. */
+                if (!this.authed || !this.welcomed || this.closed || !this.leftAttendance)
+                    return;
+                this.leftAttendance = false;
+                this.attachAttendance();
+                if (this.askSeat && !this.askSeatLeave)
+                    this.askSeatLeave = this.askUsers().join(this.askSeat);
+                return;
             case 'roots-browse':
                 // Auth-gated like every other request: directory enumeration must never
                 // precede authentication. Failures answer ok:false rather than throwing
@@ -1381,6 +1517,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-error', id: m.id, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-error', id: m.id, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 void this.onProcSpawn(m);
                 return;
             case 'proc-attach':
@@ -1388,6 +1528,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-attach-result', id: m.id, ok: false, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-attach-result', id: m.id, ok: false, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 this.onProcAttach(m);
                 return;
             case 'proc-input':
@@ -1395,6 +1539,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-input-result', id: m.id, ok: false, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-input-result', id: m.id, ok: false, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 this.onProcSimple(m.id, 'proc-input-result', () => this.requireProcs().write(m.procId, m.text));
                 return;
             case 'proc-kill':
@@ -1402,6 +1550,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-kill-result', id: m.id, ok: false, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-kill-result', id: m.id, ok: false, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 this.onProcSimple(m.id, 'proc-kill-result', () => this.requireProcs().kill(m.procId));
                 return;
             case 'stt-start': {
@@ -1470,7 +1622,8 @@ export class SidecarServer {
                 // An empty list is the honest answer for a daemon without the capability:
                 // it is running nothing, and an error here would make the common "what is
                 // running?" probe noisy on every sidecar that never allowed shell.
-                if (!this.authed) {
+                // A team member is shown none: the table holds other people's commands.
+                if (!this.authed || this.commandRefusal()) {
                     this.ch.send({ t: 'proc-list-result', id: m.id, procs: [] });
                     return;
                 }
@@ -1570,6 +1723,74 @@ export class SidecarServer {
                 }
                 void this.onCrewDeploy(m);
                 return;
+            case 'fleet-items':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-items-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetItems(m);
+                return;
+            case 'knowledge-list':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-list-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                this.onKnowledgeList(m);
+                return;
+            case 'knowledge-set':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-set-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeSet(m);
+                return;
+            case 'knowledge-files':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-files-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeFiles(m);
+                return;
+            case 'knowledge-file':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-file-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeFile(m);
+                return;
+            case 'knowledge-changes':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-changes-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeChanges(m);
+                return;
+            case 'fleet-skill-catalog':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-skill-catalog-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetSkillCatalog(m);
+                return;
+            case 'fleet-workflow-catalog':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-workflow-catalog-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetWorkflowCatalog(m);
+                return;
+            case 'fleet-workflow-call':
+                if (!this.authed) {
+                    this.ch.send({ t: 'fleet-workflow-call-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onFleetWorkflowCall(m);
+                return;
+            case 'fleet-workflow-cancel':
+                // No reply exists; an id this connection has no open call under is ignored.
+                if (typeof m.id === 'number')
+                    this.fleetCalls.get(m.id)?.abort();
+                return;
             case 'workflow-package-put':
             case 'workflow-results-list':
             case 'workflow-results-take':
@@ -1766,6 +1987,7 @@ export class SidecarServer {
             case 'mcp-remove':
             case 'mcp-set-credential':
             case 'mcp-login':
+            case 'mcp-allow-set':
                 if (!this.authed) {
                     this.ch.send({ t: 'mcp-admin-error', id: m.id, error: 'not authenticated' });
                     return;
@@ -2495,48 +2717,13 @@ export class SidecarServer {
                     this.ch.send({ t: 'ask-user-resolved', id, by }); },
             };
             this.askSeat = seat;
-            this.askSeatLeave = this.askUsers().join(seat);
-        }
-        if (this.opts.attendance && !isPeerDaemon) {
-            /* A pending member (Part E) is never a recipient of anything: every
-             * send below checks the status at the moment it is made, so a member
-             * approved later starts receiving without reconnecting. */
-            const attended = {
-                // Shaped for THIS connection (E5.2): the requester's own copy names nobody.
-                send: (ask) => { if (!this.memberPending())
-                    this.ch.send({ t: 'permission-ask', ...askForViewer(ask, this.verifiedUserId) }); },
-                resolved: (id, decision, by, byClientId) => {
-                    if (!this.memberPending())
-                        this.ch.send({ t: 'permission-resolved', id, decision, by, ...(byClientId ? { byClientId } : {}) });
-                },
-                // Team mode: filtered by role (Task 16b). The registry calls this for
-                // the live broadcast AND for the replay at attach, so both are covered.
-                // An active member still gets only what their role allows.
-                runActivity: (activity) => { if (!this.memberPending())
-                    this.sendRunActivity(activity); },
-                registrations: (registrations) => { if (!this.memberPending())
-                    this.ch.send({ t: 'registrations', registrations }); },
-                approvalSuggestion: (s) => { if (!this.memberPending())
-                    this.ch.send({ t: 'approvals-suggest', ...s }); },
-            };
-            // Retained so `permission-answer` can name THIS connection as the
-            // answerer -- the registry identifies an answerer by the object it
-            // attached, not by anything the answer message claims.
-            this.attended = attended;
-            /* The identity is what routes an ask under `--mode team`. `clientId` is
-             * the key this connection was FILED under (mapped through `clientKey`
-             * where the daemon supplies one), i.e. the same value its RunIdentity
-             * carries -- which is what makes a run's owner and its ask's recipient
-             * the same connection. `accounts` are CLAIMED, carried for display, and
-             * widen nothing; only `verifiedUserId` (proven at pairing) widens a
-             * delivery to the same user's other devices. See the registry's
-             * `recipients`. */
-            this.attendedDetach = this.opts.attendance.attach(attended, {
-                clientId: this.clientId ?? '',
-                accounts,
-                ...(this.verifiedUserId ? { verifiedUserId: this.verifiedUserId } : {}),
-            });
+            // Seated only while attending: a leave during the hello holds here too.
+            if (!this.leftAttendance)
+                this.askSeatLeave = this.askUsers().join(seat);
         }
+        // A leave that arrived while this hello was still being checked holds.
+        if (!isPeerDaemon && !this.leftAttendance)
+            this.attachAttendance();
         /* The registry replays in-flight runs at attach, and the client relies on
          * that replay landing BEFORE `welcome` (it prunes the runs it still holds
          * as stale once welcomed; see pruneStaleDaemonRuns). Team mode filters the
@@ -2567,6 +2754,53 @@ export class SidecarServer {
         }
         this.sendWelcome(dirName);
     }
+    /** Attaches THIS connection to the attendance registry, which replays to it
+     * every outstanding ask it may see, the registrations, the live runs and the
+     * task runs that settled recently. Called from `hello`, and again by an
+     * `attendance-join` after an `attendance-leave`. Never twice at once: an
+     * attachment already held is kept as it is. */
+    attachAttendance() {
+        if (!this.opts.attendance || this.peerDaemon || this.attendedDetach)
+            return;
+        /* A pending member (Part E) is never a recipient of anything: every
+         * send below checks the status at the moment it is made, so a member
+         * approved later starts receiving without reconnecting. */
+        const attended = {
+            // Shaped for THIS connection (E5.2): the requester's own copy names nobody.
+            send: (ask) => { if (!this.memberPending())
+                this.ch.send({ t: 'permission-ask', ...askForViewer(ask, this.verifiedUserId) }); },
+            resolved: (id, decision, by, byClientId) => {
+                if (!this.memberPending())
+                    this.ch.send({ t: 'permission-resolved', id, decision, by, ...(byClientId ? { byClientId } : {}) });
+            },
+            // Team mode: filtered by role (Task 16b). The registry calls this for
+            // the live broadcast AND for the replay at attach, so both are covered.
+            // An active member still gets only what their role allows.
+            runActivity: (activity) => { if (!this.memberPending())
+                this.sendRunActivity(activity); },
+            registrations: (registrations) => { if (!this.memberPending())
+                this.ch.send({ t: 'registrations', registrations }); },
+            approvalSuggestion: (s) => { if (!this.memberPending())
+                this.ch.send({ t: 'approvals-suggest', ...s }); },
+        };
+        // Retained so `permission-answer` can name THIS connection as the
+        // answerer -- the registry identifies an answerer by the object it
+        // attached, not by anything the answer message claims.
+        this.attended = attended;
+        /* The identity is what routes an ask under `--mode team`. `clientId` is
+         * the key this connection was FILED under (mapped through `clientKey`
+         * where the daemon supplies one), i.e. the same value its RunIdentity
+         * carries -- which is what makes a run's owner and its ask's recipient
+         * the same connection. `accounts` are CLAIMED, carried for display, and
+         * widen nothing; only `verifiedUserId` (proven at pairing) widens a
+         * delivery to the same user's other devices. See the registry's
+         * `recipients`. */
+        this.attendedDetach = this.opts.attendance.attach(attended, {
+            clientId: this.clientId ?? '',
+            accounts: this.accounts,
+            ...(this.verifiedUserId ? { verifiedUserId: this.verifiedUserId } : {}),
+        });
+    }
     /** Waits for this connection's `identity-assert`, with NO timeout of its
      * own -- the overall bound is `awaitAndVerifyIdentity`'s, covering this wait
      * AND the verify call together, so the whole leg is bounded at
@@ -2677,6 +2911,7 @@ export class SidecarServer {
         }
     }
     sendWelcome(dirName) {
+        this.welcomed = true;
         /* Remembered BEFORE the welcome goes out, because `self` and the
          * forget-your-own-tree refusal are both answered from it. A daemon too old
          * to resolve one, or a client with no identity, leaves it undefined -- and
@@ -2742,6 +2977,8 @@ export class SidecarServer {
             ...(this.opts.runs ? [CHILD_EVENTS_FEATURE] : []),
             // Whether a write another client makes reaches this one as fs-changed.
             ...(this.opts.fsChanges ? [FS_CHANGED_FEATURE] : []),
+            // A connection may stop attending while it stays open (attendance-leave).
+            ...(this.opts.attendance ? [ATTENDANCE_LEAVE_FEATURE, ATTENDANCE_JOIN_FEATURE] : []),
             ...(this.opts.acp ? ['acp'] : []),
             ...(this.opts.roots?.areas.length ? ['add-roots'] : []),
             ...(this.opts.roots?.areas.length && this.opts.roots.create ? ['create-roots'] : []),
@@ -2771,6 +3008,14 @@ export class SidecarServer {
             // Undeploy only where the daemon would record them -- anywhere else a
             // client shows the old read-only view.
             ...(this.opts.crewDeploy ? [CREW_DEPLOY_FEATURE] : []),
+            // Whether this sidecar lists its fleet items. Only with a real port.
+            ...(this.opts.fleetItems ? [FLEET_ITEMS_FEATURE] : []),
+            ...(this.opts.fleetUse ? [FLEET_USE_FEATURE] : []),
+            // Whether this sidecar answers the knowledge tools and the knowledge-*
+            // messages over its own folders. Only with a real port, which cli.ts sets.
+            // While the fleet has turned knowledge off (knowledgeOffNow) it says
+            // KNOWLEDGE_OFF_FEATURE instead, so a client does not read it as an old sidecar.
+            ...(this.opts.knowledge ? [this.knowledgeOffNow(this.opts.knowledge) === null ? KNOWLEDGE_FEATURE : KNOWLEDGE_OFF_FEATURE] : []),
             // Whether this daemon runs deployed workflows. Only with a real port, so
             // a client offers the Sidecar deploy target only where it would run.
             ...(this.opts.workflows ? [WORKFLOW_RUNNER_FEATURE] : []),
@@ -2803,6 +3048,7 @@ export class SidecarServer {
             // gives regardless of this flag.
             ...(this.opts.mcp ? ['mcp'] : []),
             ...(this.opts.mcpAdmin ? ['mcp-admin'] : []),
+            ...(this.opts.mcpAdmin?.setAllow ? [MCP_ALLOW_FEATURE] : []),
             // Whether this daemon serves its own Harness Config. Advertised only with
             // a real (allowlisted) service behind it, so a client never shows a
             // daemon's definitions as an empty workspace when what it actually has is
@@ -3133,6 +3379,41 @@ export class SidecarServer {
             this.ch.send({ t: 'invoke-result', id: m.id, ok: false, error: `unknown tool ${m.name}` });
             return;
         }
+        /* TEAM MODE: COMMANDS ARE THE ADMIN'S (security review 2026-11-12). The
+         * agent-access gate below decides writes into agent folders only; a shell
+         * command is not a path, so it never saw one, and any admitted member could
+         * run one as the daemon's OS user and read the state dir with it. */
+        if (COMMAND_TOOLS.has(m.name)) {
+            const refusal = this.commandRefusal();
+            if (refusal) {
+                this.opts.log?.(`invoke ${m.name} refused: ${refusal}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: false, error: refusal });
+                return;
+            }
+        }
+        /* TEAM MODE: THIS SIDECAR'S KNOWLEDGE IS THE ADMIN'S TO CHANGE (host
+         * knowledge spec, section 3). Refused here, whatever the browser offered,
+         * and shown to the model as the tool result, as the tool's own refusals are. */
+        /* KNOWLEDGE THE FLEET TURNED OFF is refused on every connection, one
+         * opened before the change included (its welcome still lists the feature),
+         * and shown to the model as the tool result. */
+        const knowledgeTools = SIDECAR_KNOWLEDGE_TOOLS;
+        if (knowledgeTools.includes(m.name) && this.opts.knowledge) {
+            const off = this.knowledgeOffNow(this.opts.knowledge);
+            if (off !== null) {
+                this.opts.log?.(`invoke ${m.name} refused: ${off}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: true, result: off });
+                return;
+            }
+        }
+        if (m.name === SIDECAR_KNOWLEDGE_WRITE) {
+            const refusal = this.knowledgeWriteRefusal();
+            if (refusal) {
+                this.opts.log?.(`invoke ${m.name} refused: ${refusal}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: true, result: refusal });
+                return;
+            }
+        }
         /* MUTATIONS ARE LOUD, READS ARE NOT.
          *
          * A single agent run issues hundreds of `fs_read_file` / `fs_list_dir`
@@ -3423,6 +3704,11 @@ export class SidecarServer {
      */
     async onRunHistory(m) {
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'run-history-result', id: m.id, runs: [], error: denied });
+                return;
+            }
             const history = this.opts.runner?.history?.bind(this.opts.runner);
             const crew = runHistoryCrewOf(m.crew);
             const identity = { clientId: this.clientId };
@@ -3445,6 +3731,11 @@ export class SidecarServer {
      * case, and a state the caller renders rather than treats as a failure. */
     async onRunTranscript(m) {
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'run-transcript-result', id: m.id, lines: [], error: denied });
+                return;
+            }
             const transcript = this.opts.runner?.transcript?.bind(this.opts.runner);
             const identity = { clientId: this.clientId };
             const lines = !transcript ? []
@@ -3463,6 +3754,11 @@ export class SidecarServer {
      * a path. */
     async onCrewMemory(m) {
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'crew-memory-result', id: m.id, memories: [], error: denied });
+                return;
+            }
             const runner = this.opts.runner;
             // The viewer is THIS connection's verified user (team agent access).
             const memories = !runner?.memories ? []
@@ -3490,6 +3786,13 @@ export class SidecarServer {
                 return;
             }
         }
+        // The connection's host folder is the run's owner root (and the `via` of a daemon-crew run): it speaks only
+        // for its bound verified user (hostFolderDenial).
+        const folderDenied = await this.hostFolderDenial();
+        if (folderDenied !== null) {
+            this.ch.send({ t: 'run-error', id: m.id, error: folderDenied });
+            return;
+        }
         /* WHERE the run happens, decided once, up front.
          *
          * A `sessionId` is a confinement request. A daemon that cannot honour it
@@ -3603,7 +3906,7 @@ export class SidecarServer {
      * verified user and never a message field; with none it is refused. The
      * events, `run-accepted` (with the conversation id), `run-done` and the hub
      * publishing follow `onRun`. A refused or failed turn sends `run-error`. */
-    onChatRun(m) {
+    async onChatRun(m) {
         const refuse = (error) => { this.ch.send({ t: 'run-error', id: m.id, error }); };
         const port = this.opts.runner?.chat;
         if (!port) {
@@ -3632,6 +3935,15 @@ export class SidecarServer {
             refuse(spec);
             return;
         }
+        // Team mode only: the chat's identity is this connection's host folder (hostFolderDenial). Solo mode reaches
+        // the port without waiting, as before.
+        if (this.opts.teamMode) {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                refuse(denied);
+                return;
+            }
+        }
         const agent = m.agent;
         const hub = this.opts.runs;
         let runId;
@@ -3772,6 +4084,11 @@ export class SidecarServer {
         }
         const { port, ...rest } = q;
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                this.ch.send({ t: 'chat-list-result', id: m.id, ok: false, error: denied });
+                return;
+            }
             const chats = await port.list({ ...rest, identity: { clientId: this.clientId } });
             this.ch.send({ t: 'chat-list-result', id: m.id, ok: true, chats: chats.map(chatSummaryOf) });
         }
@@ -3795,6 +4112,11 @@ export class SidecarServer {
         }
         const { port, ...rest } = q;
         try {
+            const denied = await this.hostFolderDenial();
+            if (denied !== null) {
+                refuse(denied);
+                return;
+            }
             const conversation = await port.get({ ...rest, identity: { clientId: this.clientId }, conversationId: m.conversationId });
             this.ch.send({ t: 'chat-get-result', id: m.id, ok: true, conversation: storedChatOf(conversation) });
         }
@@ -4104,6 +4426,287 @@ export class SidecarServer {
             ...(this.verifiedUserId !== undefined ? { verifiedUserId: this.verifiedUserId } : {}),
         };
     }
+    /** What a knowledge message answers when the port throws. The text of an
+     * unexpected throw may name a path on this machine, so only a caller who
+     * manages the folders (and so sees their paths) gets it; anyone else gets
+     * KNOWLEDGE_FAILED, and the real text goes to the log. */
+    knowledgeThrowText(kind, err) {
+        const text = errMessage(err);
+        if (this.knowledgeCanManage())
+            return text;
+        this.opts.log?.(`${kind} failed: ${text}`);
+        return KNOWLEDGE_FAILED;
+    }
+    /** Why this sidecar's knowledge is off now, or null. A port whose answer
+     * throws is treated as off, with a fixed sentence: fail closed. */
+    knowledgeOffNow(port) {
+        try {
+            return port.off?.() ?? null;
+        }
+        catch (err) {
+            this.opts.log?.(`knowledge: could not tell whether knowledge is on (${err instanceof Error ? err.message : String(err)})`);
+            return KNOWLEDGE_NOT_KEPT;
+        }
+    }
+    knowledgeListReply(port) {
+        const canManage = this.knowledgeCanManage();
+        const folders = port.folders().map((f) => (canManage ? knowledgeViewForManager(f) : knowledgeViewForMember(f)));
+        return { ok: true, folders, canManage };
+    }
+    onKnowledgeList(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-list-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        try {
+            answer(this.knowledgeListReply(port));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-list', err) });
+        }
+    }
+    /** Add or remove one knowledge folder. Refused unless this connection
+     * manages the folders, before anything else in the message is looked at. */
+    async onKnowledgeSet(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-set-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        if (!this.knowledgeCanManage()) {
+            this.opts.log?.(`knowledge-set refused: ${KNOWLEDGE_ADMIN_ONLY}`);
+            answer({ ok: false, error: KNOWLEDGE_ADMIN_ONLY });
+            return;
+        }
+        const add = m.add !== undefined ? knowledgeAddOf(m.add) : undefined;
+        const remove = typeof m.remove === 'string' ? m.remove : undefined;
+        const oneOf = (m.add !== undefined) !== (m.remove !== undefined);
+        if (!oneOf || add === null || (m.remove !== undefined && remove === undefined)) {
+            answer({ ok: false, error: KNOWLEDGE_SET_SHAPE });
+            return;
+        }
+        try {
+            const done = await port.set(add ? { add } : { remove });
+            if (!done.ok) {
+                answer(done);
+                return;
+            }
+            this.opts.log?.(add ? `knowledge folder added: ${add.path}` : `knowledge folder removed: ${remove ?? ''}`);
+            answer(this.knowledgeListReply(port));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-set', err) });
+        }
+    }
+    async onKnowledgeFiles(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-files-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        if (typeof m.folder !== 'string') {
+            answer({ ok: false, error: 'Name a knowledge folder by its id.' });
+            return;
+        }
+        try {
+            answer(await port.files(m.folder));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-files', err) });
+        }
+    }
+    async onKnowledgeFile(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-file-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        if (typeof m.folder !== 'string' || typeof m.path !== 'string' || (m.stat !== undefined && typeof m.stat !== 'boolean')) {
+            answer({ ok: false, error: 'Name a knowledge folder by its id and a file by its path in it.' });
+            return;
+        }
+        try {
+            answer(await port.file(m.folder, m.path, m.stat === true));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-file', err) });
+        }
+    }
+    async onKnowledgeChanges(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-changes-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        try {
+            answer(await port.changes());
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-changes', err) });
+        }
+    }
+    async onFleetItems(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'fleet-items-result', id: m.id, reply });
+        const port = this.opts.fleetItems;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        try {
+            answer(await port.list(this.verifiedUserId ?? undefined));
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+    }
+    /** The caller a fleet workflow call runs as, from THIS connection only, or the refusal. Never the verified user
+     * id (it would reach the workflow's prompts).
+     *
+     * Team mode: `host:<dirName>` only when that folder is bound to this connection's verified user (hostFolderDenial,
+     * the rule the workflow-* messages use): the folder comes from the hello's clientId, which is not secret, so an
+     * unbound name is refused with that check's denial. Solo mode: `host:<dirName>` for a
+     * verified user whose folder was resolved, else `host:owner`. */
+    async fleetCaller() {
+        if (this.opts.teamMode) {
+            if (this.verifiedUserId !== undefined && this.dirName === undefined)
+                return { error: FLEET_CALLER_NO_FOLDER };
+            const denied = await this.hostFolderDenial();
+            if (denied !== null || this.dirName === undefined)
+                return { error: denied ?? FLEET_CALLER_NO_FOLDER };
+            return { caller: { name: `host:${this.dirName}`, trigger: 'host' } };
+        }
+        if (this.verifiedUserId !== undefined && this.dirName !== undefined)
+            return { caller: { name: `host:${this.dirName}`, trigger: 'host' } };
+        return { caller: { name: 'host:owner', trigger: 'host' } };
+    }
+    async onFleetSkillCatalog(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'fleet-skill-catalog-result', id: m.id, reply });
+        const port = this.opts.fleetUse;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        try {
+            answer(await port.skills());
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+    }
+    async onFleetWorkflowCatalog(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'fleet-workflow-catalog-result', id: m.id, reply });
+        const port = this.opts.fleetUse;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        try {
+            answer(await port.workflows());
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+    }
+    async onFleetWorkflowCall(m) {
+        // A frame with no usable correlation id is dropped before the port: nothing runs that its sender could
+        // never match to an answer or cancel.
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const id = m.id;
+        const answer = (reply) => {
+            if (!this.closed)
+                this.ch.send({ t: 'fleet-workflow-call-result', id, reply });
+        };
+        const port = this.opts.fleetUse;
+        if (!port) {
+            answer({ ok: false, error: 'this sidecar is not in a fleet' });
+            return;
+        }
+        // Runtime-typed: the message arrived via JSON.parse(...) as SidecarMsg.
+        const name = m.name;
+        if (typeof name !== 'string' || name.length === 0) {
+            answer({ ok: false, error: 'a fleet workflow call needs a workflow name' });
+            return;
+        }
+        const inputs = m.inputs;
+        if (!isWorkflowCallInputs(inputs)) {
+            answer({ ok: false, error: FLEET_WORKFLOW_INPUTS_ERROR });
+            return;
+        }
+        if (this.fleetCalls.has(id)) {
+            answer({ ok: false, error: 'a fleet workflow call with that id is already open' });
+            return;
+        }
+        if (this.fleetCalls.size >= FLEET_CALLS_OPEN_MAX) {
+            answer({ ok: false, error: FLEET_CALLS_TOO_MANY });
+            return;
+        }
+        // The id is held before the first await, so a second call under it, or a cancel, sees it.
+        const control = new AbortController();
+        this.fleetCalls.set(id, control);
+        try {
+            const named = await this.fleetCaller();
+            if ('error' in named) {
+                answer({ ok: false, error: named.error });
+                return;
+            }
+            answer(await port.call(named.caller, name, inputs, control.signal));
+        }
+        catch (err) {
+            answer({ ok: false, error: errMessage(err) });
+        }
+        finally {
+            if (this.fleetCalls.get(id) === control)
+                this.fleetCalls.delete(id);
+        }
+    }
     async onCrewDeploy(m) {
         // A frame with no usable correlation id is dropped before the port: no
         // change is made that its sender could never match to an answer.
@@ -4145,25 +4748,49 @@ export class SidecarServer {
             answer({ ok: false, error: errMessage(err) });
         }
     }
-    /** Team mode: why this connection may NOT use its synced folder's workflow
-     * packages and results, or null when it may (the caller's verified id equals
-     * the folder's bound owner). A lookup that throws refuses. */
-    async workflowsTeamDenial() {
+    /** THE ONE RULE for whether this connection's synced folder speaks for it: 'bound' only when the folder's
+     * bound owner (the deploy binding, `workflowsFolderOwner`) is this connection's verified user. A folder the
+     * daemon did not resolve, no lookup, no binding, or a lookup that throws is 'unbound'. Every team-mode check of
+     * a host folder (workflowsTeamDenial, hostFolderDenial) reads this and only words it differently. */
+    async hostFolderStanding() {
         if (this.verifiedUserId === undefined)
-            return WORKFLOWS_VERIFY_FIRST;
+            return 'unverified';
         const lookup = this.opts.workflowsFolderOwner;
         if (this.dirName === undefined || !lookup)
-            return WORKFLOWS_FOLDER_UNBOUND;
+            return 'unbound';
         let bound;
         try {
             bound = await lookup(this.dirName);
         }
         catch {
-            return WORKFLOWS_FOLDER_UNBOUND;
+            return 'unbound';
         }
         if (bound === undefined)
-            return WORKFLOWS_FOLDER_UNBOUND;
-        return bound === this.verifiedUserId ? null : WORKFLOWS_NOT_FOLDER_OWNER;
+            return 'unbound';
+        return bound === this.verifiedUserId ? 'bound' : 'not-owner';
+    }
+    /** Team mode: why this connection may NOT use its synced folder's workflow
+     * packages and results, or null when it may (hostFolderStanding). */
+    async workflowsTeamDenial() {
+        switch (await this.hostFolderStanding()) {
+            case 'bound': return null;
+            case 'unverified': return WORKFLOWS_VERIFY_FIRST;
+            case 'unbound': return WORKFLOWS_FOLDER_UNBOUND;
+            case 'not-owner': return WORKFLOWS_NOT_FOLDER_OWNER;
+        }
+    }
+    /** Why this connection's host folder may NOT speak for it in a run, a chat, a history, transcript or memory
+     * read, a fleet workflow call, or a host-sync write, or null when it may. Solo mode: always null (unchanged). Team mode:
+     * hostFolderStanding, the rule the workflow-* messages use. */
+    async hostFolderDenial() {
+        if (!this.opts.teamMode)
+            return null;
+        switch (await this.hostFolderStanding()) {
+            case 'bound': return null;
+            case 'unverified': return HOST_FOLDER_VERIFY_FIRST;
+            case 'unbound': return HOST_FOLDER_UNBOUND;
+            case 'not-owner': return HOST_FOLDER_NOT_OWNER;
+        }
     }
     async onWorkflows(m) {
         // A frame with no usable correlation id is dropped before the port: no
@@ -4933,7 +5560,7 @@ export class SidecarServer {
         if (m.t !== 'mcp-servers-list') {
             const refusal = this.mcpRefusal();
             if (refusal) {
-                this.ch.send({ t: 'mcp-admin-error', id: m.id, error: refusal });
+                this.ch.send({ t: 'mcp-admin-error', id: m.id, error: refusal, code: 'MCP_ADMIN_ONLY' });
                 return;
             }
         }
@@ -4954,8 +5581,9 @@ export class SidecarServer {
              * branch that is not part of it runs setCredential too, with whatever
              * `m.header`/`m.value` happen to be (undefined, for every other message).
              * That is exactly what a stray `if` here did before this comment existed. */
+            let applied;
             if (m.t === 'mcp-add')
-                await admin.addServer(m.name, m.url, m.hosted === true, m.authUrl);
+                applied = await admin.addServer(m.name, m.url, m.hosted === true, m.authUrl);
             else if (m.t === 'mcp-login') {
                 /* The consent URL is pushed the moment it exists, BEFORE the flow
                  * blocks waiting for a human. Holding it until the end would deliver it
@@ -4965,15 +5593,48 @@ export class SidecarServer {
                     this.ch.send({ t: 'mcp-admin-error', id: m.id, error: out.message, reason: out.reason });
                     return;
                 }
+                applied = out.reloadError !== undefined ? { reloadError: out.reloadError } : undefined;
             }
             else if (m.t === 'mcp-remove')
-                await admin.removeServer(m.name);
+                applied = await admin.removeServer(m.name);
+            else if (m.t === 'mcp-allow-set') {
+                if (!admin.setAllow) {
+                    this.ch.send({ t: 'mcp-admin-error', id: m.id, error: 'this daemon cannot switch MCP tools -- update it and reconnect' });
+                    return;
+                }
+                // The shape is checked here, before the port: the message is a
+                // browser's, and a non-string entry must never reach daemon.json.
+                if (typeof m.name !== 'string' || !m.name || !Array.isArray(m.tools) || !m.tools.every((t) => typeof t === 'string')) {
+                    this.ch.send({ t: 'mcp-admin-error', id: m.id, code: 'BAD_REQUEST', error: 'mcp-allow-set needs a server name and a list of tool names.' });
+                    return;
+                }
+                applied = await admin.setAllow(m.name, m.tools);
+            }
             else
-                await admin.setCredential(m.name, m.header, m.value);
-            this.ch.send({ t: 'mcp-admin-ok', id: m.id });
+                applied = await admin.setCredential(m.name, m.header, m.value);
+            const reloadError = applied ? applied.reloadError : undefined;
+            /* A switch answers with the rows as they now stand, so the browser shows
+             * what the daemon allows (a glob may keep a tool on), not what it asked
+             * for. Only the admin reaches here (mcpRefusal above), so the full rows.
+             * Best effort: the write is saved either way. */
+            let servers;
+            if (m.t === 'mcp-allow-set') {
+                try {
+                    servers = await admin.listServers();
+                }
+                catch {
+                    servers = undefined;
+                }
+            }
+            this.ch.send({
+                t: 'mcp-admin-ok', id: m.id,
+                ...(typeof reloadError === 'string' ? { reloadError } : {}),
+                ...(servers ? { servers } : {}),
+            });
         }
         catch (e) {
-            this.ch.send({ t: 'mcp-admin-error', id: m.id, error: e instanceof Error ? e.message : String(e) });
+            const code = mcpAdminCodeOf(e);
+            this.ch.send({ t: 'mcp-admin-error', id: m.id, error: e instanceof Error ? e.message : String(e), ...(code ? { code } : {}) });
         }
     }
     /** Part D credential messages. The caller is this connection's VERIFIED
@@ -5801,6 +6462,41 @@ export class SidecarServer {
             return MCP_ADMIN_ONLY;
         }
     }
+    /** Team mode: running a command on the daemon's machine, or reaching one
+     * that is running, is the admin's. Null when THIS connection may. Unknown
+     * admin and any throw while deciding are refusals. Solo mode: always null. */
+    commandRefusal() {
+        try {
+            const access = this.teamAccess();
+            if (!access)
+                return null;
+            return sameAdmin(this.verifiedUserId, access.adminId()) ? null : COMMANDS_ADMIN_ONLY;
+        }
+        catch {
+            return COMMANDS_ADMIN_ONLY;
+        }
+    }
+    /** Team mode: writing into this sidecar's knowledge folders is the admin's.
+     * Null when THIS connection may. Unknown admin and any throw while deciding
+     * are refusals. Solo mode: always null. */
+    knowledgeWriteRefusal() {
+        return this.knowledgeCanManage() ? null : KNOWLEDGE_WRITE_ADMIN_ONLY;
+    }
+    /** Whether THIS connection manages this sidecar's knowledge folders (sees
+     * their paths, adds and removes them, writes into the writable one): always
+     * on a solo daemon; on a team daemon only its admin. Unknown admin and any
+     * throw while deciding are a no. */
+    knowledgeCanManage() {
+        try {
+            const access = this.teamAccess();
+            if (!access)
+                return true;
+            return sameAdmin(this.verifiedUserId, access.adminId());
+        }
+        catch {
+            return false;
+        }
+    }
     async onRoomFindings(m) {
         if (!this.opts.rooms) {
             // A daemon without the capability hosts no rooms, so it holds no
@@ -5853,8 +6549,12 @@ export class SidecarServer {
                 this.ch.send({ t: 'config-result', id: m.id, ok: false, error: gate.refusal });
                 return;
             }
+            /* WHOSE global memory (`memory/`) this call reaches: the service maps
+             * it, after its own allowlist check, from this scope. Every call passes
+             * it, so no route reaches `memory/` without the decision. */
+            const scope = this.configMemoryScope();
             if (m.t === 'config-list') {
-                const entries = await svc.list(m.path, m.depth);
+                const entries = await svc.list(m.path, m.depth, scope);
                 const shown = await this.visibleConfigEntries(svc, m.path, entries);
                 this.ch.send(shown
                     ? { t: 'config-result', id: m.id, ok: true, entries: shown }
@@ -5862,18 +6562,18 @@ export class SidecarServer {
                 return;
             }
             if (m.t === 'config-read') {
-                this.ch.send({ t: 'config-result', id: m.id, ok: true, content: await svc.read(m.path) });
+                this.ch.send({ t: 'config-result', id: m.id, ok: true, content: await svc.read(m.path, scope) });
                 return;
             }
             if (m.t === 'config-write')
-                await svc.write(m.path, m.content);
+                await svc.write(m.path, m.content, scope);
             else if (m.t === 'config-append') {
                 if (!svc.append)
                     throw new Error('this sidecar cannot append to its harness config');
-                await svc.append(m.path, m.content);
+                await svc.append(m.path, m.content, scope);
             }
             else
-                await svc.remove(m.path);
+                await svc.remove(m.path, scope);
             await this.afterConfigChange(gate);
             this.ch.send({ t: 'config-result', id: m.id, ok: true });
         }
@@ -5881,6 +6581,20 @@ export class SidecarServer {
             this.ch.send({ t: 'config-result', id: m.id, ok: false, error: errMessage(e) });
         }
     }
+    /** Whose global memory a config call on THIS connection reaches. A
+     * personal daemon, and a team daemon's admin: the shared `memory/` itself
+     * (undefined). Any other team connection: its verified user's own partition,
+     * or none at all (null) when no user is verified. Throws only when the
+     * access port throws; the caller then refuses the call. */
+    configMemoryScope() {
+        const access = this.teamAccess();
+        if (!access)
+            return undefined;
+        const user = this.verifiedUserId;
+        if (sameAdmin(user, access.adminId()))
+            return undefined;
+        return { memoryUser: typeof user === 'string' && user !== '' ? user : null };
+    }
     /** The config path as the filesystem would reach it, for classification:
      * separators, `.`, empty and `..` segments resolved; the `crew` segment, the
      * agent folder (to its on-disk name, read from the service's own listing of
@@ -5969,6 +6683,13 @@ export class SidecarServer {
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: 'this sidecar cannot sync host config' });
             return;
         }
+        // Team mode: the clientId names the folder written to, and it is not secret, so it writes only for the
+        // verified user that folder is bound to (hostFolderDenial). Solo mode is unchanged.
+        const denied = await this.hostFolderDenial();
+        if (denied !== null) {
+            this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: denied });
+            return;
+        }
         try {
             await this.opts.hostSync.put(identity.clientId, m.path, m.content);
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: true });
@@ -5987,6 +6708,13 @@ export class SidecarServer {
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: 'this sidecar cannot sync host config' });
             return;
         }
+        // Team mode: the clientId names the folder written to, and it is not secret, so it writes only for the
+        // verified user that folder is bound to (hostFolderDenial). Solo mode is unchanged.
+        const denied = await this.hostFolderDenial();
+        if (denied !== null) {
+            this.ch.send({ t: 'host-sync-result', id: m.id, ok: false, error: denied });
+            return;
+        }
         try {
             await this.opts.hostSync.remove(identity.clientId, m.path);
             this.ch.send({ t: 'host-sync-result', id: m.id, ok: true });