@corenel/harness 0.23.0 → 0.24.0

package/dist/sidecar/server.js

@@ -1,4 +1,4 @@
-import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, FLEET_ITEMS_FEATURE, FLEET_USE_FEATURE, FLEET_USE_LIMITS, isWorkflowCallInputs, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, FS_CHANGED_FEATURE, ATTENDANCE_LEAVE_FEATURE, MCP_ALLOW_FEATURE, MCP_ADMIN_ERROR_CODES, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
+import { CHAT_FEATURE, CHAT_ID_RE, decodePcm16, FLEET_LOGINS_DENIED, SIGN_IN_PAUSED_DENIED, SPEECH_FEATURE, AGENT_CRED_ERROR_CODES, agentCredHeadersProblem, DEFAULT_STATE_DIR, PEER_DAEMON_FEATURE, TEAM_MEMBERS_FEATURE, RUN_TASK_FEATURE, RUN_PLAN_FEATURE, CREW_DEPLOY_FEATURE, FLEET_ITEMS_FEATURE, FLEET_USE_FEATURE, KNOWLEDGE_FEATURE, KNOWLEDGE_OFF_FEATURE, KNOWLEDGE_NOT_KEPT, KNOWLEDGE_WRITE_ADMIN_ONLY, KNOWLEDGE_ADMIN_ONLY, KNOWLEDGE_UNREACHABLE, knowledgeConflictSentence, SIDECAR_KNOWLEDGE_TOOLS, SIDECAR_KNOWLEDGE_WRITE, FLEET_USE_LIMITS, isWorkflowCallInputs, DEVICES_FEATURE, AGENT_ACCESS_FEATURE, AGENT_RUNS_DEFAULT_LIMIT, AGENT_RUNS_FEATURE, AGENT_RUNS_MAX_LIMIT, PEER_LINKS_FEATURE, CHILD_EVENTS_FEATURE, FS_CHANGED_FEATURE, ATTENDANCE_LEAVE_FEATURE, ATTENDANCE_JOIN_FEATURE, MCP_ALLOW_FEATURE, MCP_ADMIN_ERROR_CODES, CREW_DEFINITION_FILES, crewConfigTarget, denialNote, isRunOrigin, cleanPerson } from '@corenel/protocol';
 import { SIDECAR_PROTOCOL, errMessage, isLoopbackHost, isLoopbackAddress, parseMcpToolAddress, isWebPushSubscription, MAX_ASSERTION_LEN, isClerkOrgId, MAX_WORKFLOW_PACKAGE_B64, MAX_WORKFLOW_REPLY_ERROR, WORKFLOW_RUNNER_FEATURE, } from '@corenel/protocol';
 import { activityForViewer, askForViewer, withoutViewerClaims } from './askView.js';
 import { capabilityMissingMessage } from './hostCapability.js';
@@ -12,6 +12,50 @@ import { fsChangesFor } from './fsChanges.js';
 function clipReplyError(error) {
     return error.length > MAX_WORKFLOW_REPLY_ERROR ? error.slice(0, MAX_WORKFLOW_REPLY_ERROR) : error;
 }
+/** A folder as a caller who does not manage the folders sees it: no path, and
+ * an error that is a fixed sentence naming the folder by its label only. */
+function knowledgeViewForMember(f) {
+    const view = { id: f.id, label: f.label, writable: f.writable, state: f.state, origin: f.origin };
+    if (f.state === 'conflict') {
+        if (f.conflict)
+            view.conflict = f.conflict;
+        view.error = knowledgeConflictSentence(f.label, f.conflict);
+    }
+    else if (f.state === 'unreachable') {
+        view.error = KNOWLEDGE_UNREACHABLE;
+    }
+    return view;
+}
+/** Only the wire fields of a folder, so nothing else a port holds is sent. */
+function knowledgeViewForManager(f) {
+    return {
+        id: f.id, label: f.label, writable: f.writable, state: f.state, origin: f.origin,
+        ...(f.conflict ? { conflict: f.conflict } : {}),
+        ...(f.error !== undefined ? { error: f.error } : {}),
+        ...(f.path !== undefined ? { path: f.path } : {}),
+    };
+}
+/** A `knowledge-set` `add` as sent, checked field by field; null when its shape is wrong. */
+function knowledgeAddOf(v) {
+    if (typeof v !== 'object' || v === null || Array.isArray(v))
+        return null;
+    const o = v;
+    if (typeof o.path !== 'string')
+        return null;
+    if (o.writable !== undefined && typeof o.writable !== 'boolean')
+        return null;
+    if (o.label !== undefined && typeof o.label !== 'string')
+        return null;
+    return {
+        path: o.path,
+        ...(o.writable === true ? { writable: true } : {}),
+        ...(typeof o.label === 'string' ? { label: o.label } : {}),
+    };
+}
+/** What a knowledge-set with neither or both of add and remove, or a malformed one, answers. */
+export const KNOWLEDGE_SET_SHAPE = 'Give one folder to add or the id of one folder to remove.';
+/** What a knowledge message answers a caller who does not manage the folders when the port throws. */
+export const KNOWLEDGE_FAILED = 'The sidecar could not answer that knowledge request. Its admin can find the reason in its log.';
 /** The refusal for workflow inputs that fail isWorkflowCallInputs. */
 export const FLEET_WORKFLOW_INPUTS_ERROR = `workflow inputs must be an object of at most ${FLEET_USE_LIMITS.inputsBytes / 1024} KiB`;
 /** At most this many fleet workflow calls open at once on one connection (each loads and verifies its archive). */
@@ -80,6 +124,11 @@ export const AGENT_CRED_FAILED = 'Agent credentials could not be checked or chan
 export const AGENT_CRED_LOGIN_FAILED = 'The sign-in did not finish. The daemon log has the reason.';
 export const AGENT_CRED_SOLO = 'This daemon does not keep agent access.';
 export const MCP_ADMIN_ONLY = "In team mode only the daemon admin can use or change this machine's MCP servers directly.";
+/** A command runs as the daemon's OS user, outside every root and every
+ * per-member check, so on a team daemon it is the admin's alone. */
+export const COMMANDS_ADMIN_ONLY = 'In team mode only the daemon admin can run commands on this machine directly.';
+/** The tools a connected client could use to run a command or reach a running one. */
+const COMMAND_TOOLS = new Set(['sidecar_shell_exec', 'proc_start', 'proc_stop', 'proc_list']);
 export const SESSION_REFUSED = 'In team mode a session is reachable only by the member who created it, or the daemon admin.';
 export const SNAPSHOT_REFUSED = 'In team mode you can restore only from a snapshot of a session you created.';
 export const SNAPSHOT_NAME_REFUSED = 'In team mode a snapshot name is chosen by the daemon; only the daemon admin can name one.';
@@ -814,6 +863,15 @@ export class SidecarServer {
             writable: true,
             value: false
         });
+        /** The welcome was sent: the hello is finished. An `attendance-join` is
+         * read only after it, so it cannot attach in the middle of the hello (whose
+         * own attach, or a leave that arrived meanwhile, decides that). */
+        Object.defineProperty(this, "welcomed", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
         /** This connection's seat for chat ask_user (verified connections only),
          * and its leave function, called once on close. */
         Object.defineProperty(this, "askSeat", {
@@ -1366,6 +1424,10 @@ export class SidecarServer {
                 void this.onAcpStart(m);
                 return;
             case 'acp-set-mode':
+                if (!this.authed) {
+                    this.ch.send({ t: 'acp-error', id: m.id, error: 'not authenticated' });
+                    return;
+                }
                 void this.onAcpSetMode(m);
                 return;
             case 'acp-prompt':
@@ -1405,6 +1467,26 @@ export class SidecarServer {
                 this.leftAttendance = true;
                 this.attendedDetach?.();
                 this.attendedDetach = undefined;
+                /* Its ask_user seat goes too: a question shown on a connection that
+                 * is not attending would wait on nobody. The seat object stays, for
+                 * a join, and an ask still open is shown to it again then. */
+                this.askSeatLeave?.();
+                this.askSeatLeave = undefined;
+                return;
+            case 'attendance-join':
+                /* The client takes this connection back for the person (a browser
+                 * that switched back to this machine): it attends again, and the
+                 * attach replays what is waiting, as at hello. Only after a leave on
+                 * THIS connection, so an attendance is never held twice, and only
+                 * once the hello is finished (welcomed). A peer daemon never gets
+                 * here (its messages are filtered above) and is never attached
+                 * (attachAttendance). No reply. */
+                if (!this.authed || !this.welcomed || this.closed || !this.leftAttendance)
+                    return;
+                this.leftAttendance = false;
+                this.attachAttendance();
+                if (this.askSeat && !this.askSeatLeave)
+                    this.askSeatLeave = this.askUsers().join(this.askSeat);
                 return;
             case 'roots-browse':
                 // Auth-gated like every other request: directory enumeration must never
@@ -1435,6 +1517,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-error', id: m.id, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-error', id: m.id, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 void this.onProcSpawn(m);
                 return;
             case 'proc-attach':
@@ -1442,6 +1528,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-attach-result', id: m.id, ok: false, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-attach-result', id: m.id, ok: false, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 this.onProcAttach(m);
                 return;
             case 'proc-input':
@@ -1449,6 +1539,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-input-result', id: m.id, ok: false, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-input-result', id: m.id, ok: false, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 this.onProcSimple(m.id, 'proc-input-result', () => this.requireProcs().write(m.procId, m.text));
                 return;
             case 'proc-kill':
@@ -1456,6 +1550,10 @@ export class SidecarServer {
                     this.ch.send({ t: 'proc-kill-result', id: m.id, ok: false, error: 'not authenticated' });
                     return;
                 }
+                if (this.commandRefusal()) {
+                    this.ch.send({ t: 'proc-kill-result', id: m.id, ok: false, error: COMMANDS_ADMIN_ONLY });
+                    return;
+                }
                 this.onProcSimple(m.id, 'proc-kill-result', () => this.requireProcs().kill(m.procId));
                 return;
             case 'stt-start': {
@@ -1524,7 +1622,8 @@ export class SidecarServer {
                 // An empty list is the honest answer for a daemon without the capability:
                 // it is running nothing, and an error here would make the common "what is
                 // running?" probe noisy on every sidecar that never allowed shell.
-                if (!this.authed) {
+                // A team member is shown none: the table holds other people's commands.
+                if (!this.authed || this.commandRefusal()) {
                     this.ch.send({ t: 'proc-list-result', id: m.id, procs: [] });
                     return;
                 }
@@ -1631,6 +1730,41 @@ export class SidecarServer {
                 }
                 void this.onFleetItems(m);
                 return;
+            case 'knowledge-list':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-list-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                this.onKnowledgeList(m);
+                return;
+            case 'knowledge-set':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-set-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeSet(m);
+                return;
+            case 'knowledge-files':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-files-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeFiles(m);
+                return;
+            case 'knowledge-file':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-file-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeFile(m);
+                return;
+            case 'knowledge-changes':
+                if (!this.authed) {
+                    this.ch.send({ t: 'knowledge-changes-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
+                    return;
+                }
+                void this.onKnowledgeChanges(m);
+                return;
             case 'fleet-skill-catalog':
                 if (!this.authed) {
                     this.ch.send({ t: 'fleet-skill-catalog-result', id: m.id, reply: { ok: false, error: 'not authenticated' } });
@@ -2583,49 +2717,13 @@ export class SidecarServer {
                     this.ch.send({ t: 'ask-user-resolved', id, by }); },
             };
             this.askSeat = seat;
-            this.askSeatLeave = this.askUsers().join(seat);
+            // Seated only while attending: a leave during the hello holds here too.
+            if (!this.leftAttendance)
+                this.askSeatLeave = this.askUsers().join(seat);
         }
         // A leave that arrived while this hello was still being checked holds.
-        if (this.opts.attendance && !isPeerDaemon && !this.leftAttendance) {
-            /* A pending member (Part E) is never a recipient of anything: every
-             * send below checks the status at the moment it is made, so a member
-             * approved later starts receiving without reconnecting. */
-            const attended = {
-                // Shaped for THIS connection (E5.2): the requester's own copy names nobody.
-                send: (ask) => { if (!this.memberPending())
-                    this.ch.send({ t: 'permission-ask', ...askForViewer(ask, this.verifiedUserId) }); },
-                resolved: (id, decision, by, byClientId) => {
-                    if (!this.memberPending())
-                        this.ch.send({ t: 'permission-resolved', id, decision, by, ...(byClientId ? { byClientId } : {}) });
-                },
-                // Team mode: filtered by role (Task 16b). The registry calls this for
-                // the live broadcast AND for the replay at attach, so both are covered.
-                // An active member still gets only what their role allows.
-                runActivity: (activity) => { if (!this.memberPending())
-                    this.sendRunActivity(activity); },
-                registrations: (registrations) => { if (!this.memberPending())
-                    this.ch.send({ t: 'registrations', registrations }); },
-                approvalSuggestion: (s) => { if (!this.memberPending())
-                    this.ch.send({ t: 'approvals-suggest', ...s }); },
-            };
-            // Retained so `permission-answer` can name THIS connection as the
-            // answerer -- the registry identifies an answerer by the object it
-            // attached, not by anything the answer message claims.
-            this.attended = attended;
-            /* The identity is what routes an ask under `--mode team`. `clientId` is
-             * the key this connection was FILED under (mapped through `clientKey`
-             * where the daemon supplies one), i.e. the same value its RunIdentity
-             * carries -- which is what makes a run's owner and its ask's recipient
-             * the same connection. `accounts` are CLAIMED, carried for display, and
-             * widen nothing; only `verifiedUserId` (proven at pairing) widens a
-             * delivery to the same user's other devices. See the registry's
-             * `recipients`. */
-            this.attendedDetach = this.opts.attendance.attach(attended, {
-                clientId: this.clientId ?? '',
-                accounts,
-                ...(this.verifiedUserId ? { verifiedUserId: this.verifiedUserId } : {}),
-            });
-        }
+        if (!isPeerDaemon && !this.leftAttendance)
+            this.attachAttendance();
         /* The registry replays in-flight runs at attach, and the client relies on
          * that replay landing BEFORE `welcome` (it prunes the runs it still holds
          * as stale once welcomed; see pruneStaleDaemonRuns). Team mode filters the
@@ -2656,6 +2754,53 @@ export class SidecarServer {
         }
         this.sendWelcome(dirName);
     }
+    /** Attaches THIS connection to the attendance registry, which replays to it
+     * every outstanding ask it may see, the registrations, the live runs and the
+     * task runs that settled recently. Called from `hello`, and again by an
+     * `attendance-join` after an `attendance-leave`. Never twice at once: an
+     * attachment already held is kept as it is. */
+    attachAttendance() {
+        if (!this.opts.attendance || this.peerDaemon || this.attendedDetach)
+            return;
+        /* A pending member (Part E) is never a recipient of anything: every
+         * send below checks the status at the moment it is made, so a member
+         * approved later starts receiving without reconnecting. */
+        const attended = {
+            // Shaped for THIS connection (E5.2): the requester's own copy names nobody.
+            send: (ask) => { if (!this.memberPending())
+                this.ch.send({ t: 'permission-ask', ...askForViewer(ask, this.verifiedUserId) }); },
+            resolved: (id, decision, by, byClientId) => {
+                if (!this.memberPending())
+                    this.ch.send({ t: 'permission-resolved', id, decision, by, ...(byClientId ? { byClientId } : {}) });
+            },
+            // Team mode: filtered by role (Task 16b). The registry calls this for
+            // the live broadcast AND for the replay at attach, so both are covered.
+            // An active member still gets only what their role allows.
+            runActivity: (activity) => { if (!this.memberPending())
+                this.sendRunActivity(activity); },
+            registrations: (registrations) => { if (!this.memberPending())
+                this.ch.send({ t: 'registrations', registrations }); },
+            approvalSuggestion: (s) => { if (!this.memberPending())
+                this.ch.send({ t: 'approvals-suggest', ...s }); },
+        };
+        // Retained so `permission-answer` can name THIS connection as the
+        // answerer -- the registry identifies an answerer by the object it
+        // attached, not by anything the answer message claims.
+        this.attended = attended;
+        /* The identity is what routes an ask under `--mode team`. `clientId` is
+         * the key this connection was FILED under (mapped through `clientKey`
+         * where the daemon supplies one), i.e. the same value its RunIdentity
+         * carries -- which is what makes a run's owner and its ask's recipient
+         * the same connection. `accounts` are CLAIMED, carried for display, and
+         * widen nothing; only `verifiedUserId` (proven at pairing) widens a
+         * delivery to the same user's other devices. See the registry's
+         * `recipients`. */
+        this.attendedDetach = this.opts.attendance.attach(attended, {
+            clientId: this.clientId ?? '',
+            accounts: this.accounts,
+            ...(this.verifiedUserId ? { verifiedUserId: this.verifiedUserId } : {}),
+        });
+    }
     /** Waits for this connection's `identity-assert`, with NO timeout of its
      * own -- the overall bound is `awaitAndVerifyIdentity`'s, covering this wait
      * AND the verify call together, so the whole leg is bounded at
@@ -2766,6 +2911,7 @@ export class SidecarServer {
         }
     }
     sendWelcome(dirName) {
+        this.welcomed = true;
         /* Remembered BEFORE the welcome goes out, because `self` and the
          * forget-your-own-tree refusal are both answered from it. A daemon too old
          * to resolve one, or a client with no identity, leaves it undefined -- and
@@ -2832,7 +2978,7 @@ export class SidecarServer {
             // Whether a write another client makes reaches this one as fs-changed.
             ...(this.opts.fsChanges ? [FS_CHANGED_FEATURE] : []),
             // A connection may stop attending while it stays open (attendance-leave).
-            ...(this.opts.attendance ? [ATTENDANCE_LEAVE_FEATURE] : []),
+            ...(this.opts.attendance ? [ATTENDANCE_LEAVE_FEATURE, ATTENDANCE_JOIN_FEATURE] : []),
             ...(this.opts.acp ? ['acp'] : []),
             ...(this.opts.roots?.areas.length ? ['add-roots'] : []),
             ...(this.opts.roots?.areas.length && this.opts.roots.create ? ['create-roots'] : []),
@@ -2865,6 +3011,11 @@ export class SidecarServer {
             // Whether this sidecar lists its fleet items. Only with a real port.
             ...(this.opts.fleetItems ? [FLEET_ITEMS_FEATURE] : []),
             ...(this.opts.fleetUse ? [FLEET_USE_FEATURE] : []),
+            // Whether this sidecar answers the knowledge tools and the knowledge-*
+            // messages over its own folders. Only with a real port, which cli.ts sets.
+            // While the fleet has turned knowledge off (knowledgeOffNow) it says
+            // KNOWLEDGE_OFF_FEATURE instead, so a client does not read it as an old sidecar.
+            ...(this.opts.knowledge ? [this.knowledgeOffNow(this.opts.knowledge) === null ? KNOWLEDGE_FEATURE : KNOWLEDGE_OFF_FEATURE] : []),
             // Whether this daemon runs deployed workflows. Only with a real port, so
             // a client offers the Sidecar deploy target only where it would run.
             ...(this.opts.workflows ? [WORKFLOW_RUNNER_FEATURE] : []),
@@ -3228,6 +3379,41 @@ export class SidecarServer {
             this.ch.send({ t: 'invoke-result', id: m.id, ok: false, error: `unknown tool ${m.name}` });
             return;
         }
+        /* TEAM MODE: COMMANDS ARE THE ADMIN'S (security review 2026-11-12). The
+         * agent-access gate below decides writes into agent folders only; a shell
+         * command is not a path, so it never saw one, and any admitted member could
+         * run one as the daemon's OS user and read the state dir with it. */
+        if (COMMAND_TOOLS.has(m.name)) {
+            const refusal = this.commandRefusal();
+            if (refusal) {
+                this.opts.log?.(`invoke ${m.name} refused: ${refusal}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: false, error: refusal });
+                return;
+            }
+        }
+        /* TEAM MODE: THIS SIDECAR'S KNOWLEDGE IS THE ADMIN'S TO CHANGE (host
+         * knowledge spec, section 3). Refused here, whatever the browser offered,
+         * and shown to the model as the tool result, as the tool's own refusals are. */
+        /* KNOWLEDGE THE FLEET TURNED OFF is refused on every connection, one
+         * opened before the change included (its welcome still lists the feature),
+         * and shown to the model as the tool result. */
+        const knowledgeTools = SIDECAR_KNOWLEDGE_TOOLS;
+        if (knowledgeTools.includes(m.name) && this.opts.knowledge) {
+            const off = this.knowledgeOffNow(this.opts.knowledge);
+            if (off !== null) {
+                this.opts.log?.(`invoke ${m.name} refused: ${off}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: true, result: off });
+                return;
+            }
+        }
+        if (m.name === SIDECAR_KNOWLEDGE_WRITE) {
+            const refusal = this.knowledgeWriteRefusal();
+            if (refusal) {
+                this.opts.log?.(`invoke ${m.name} refused: ${refusal}`);
+                this.ch.send({ t: 'invoke-result', id: m.id, ok: true, result: refusal });
+                return;
+            }
+        }
         /* MUTATIONS ARE LOUD, READS ARE NOT.
          *
          * A single agent run issues hundreds of `fs_read_file` / `fs_list_dir`
@@ -4240,6 +4426,166 @@ export class SidecarServer {
             ...(this.verifiedUserId !== undefined ? { verifiedUserId: this.verifiedUserId } : {}),
         };
     }
+    /** What a knowledge message answers when the port throws. The text of an
+     * unexpected throw may name a path on this machine, so only a caller who
+     * manages the folders (and so sees their paths) gets it; anyone else gets
+     * KNOWLEDGE_FAILED, and the real text goes to the log. */
+    knowledgeThrowText(kind, err) {
+        const text = errMessage(err);
+        if (this.knowledgeCanManage())
+            return text;
+        this.opts.log?.(`${kind} failed: ${text}`);
+        return KNOWLEDGE_FAILED;
+    }
+    /** Why this sidecar's knowledge is off now, or null. A port whose answer
+     * throws is treated as off, with a fixed sentence: fail closed. */
+    knowledgeOffNow(port) {
+        try {
+            return port.off?.() ?? null;
+        }
+        catch (err) {
+            this.opts.log?.(`knowledge: could not tell whether knowledge is on (${err instanceof Error ? err.message : String(err)})`);
+            return KNOWLEDGE_NOT_KEPT;
+        }
+    }
+    knowledgeListReply(port) {
+        const canManage = this.knowledgeCanManage();
+        const folders = port.folders().map((f) => (canManage ? knowledgeViewForManager(f) : knowledgeViewForMember(f)));
+        return { ok: true, folders, canManage };
+    }
+    onKnowledgeList(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-list-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        try {
+            answer(this.knowledgeListReply(port));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-list', err) });
+        }
+    }
+    /** Add or remove one knowledge folder. Refused unless this connection
+     * manages the folders, before anything else in the message is looked at. */
+    async onKnowledgeSet(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-set-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        if (!this.knowledgeCanManage()) {
+            this.opts.log?.(`knowledge-set refused: ${KNOWLEDGE_ADMIN_ONLY}`);
+            answer({ ok: false, error: KNOWLEDGE_ADMIN_ONLY });
+            return;
+        }
+        const add = m.add !== undefined ? knowledgeAddOf(m.add) : undefined;
+        const remove = typeof m.remove === 'string' ? m.remove : undefined;
+        const oneOf = (m.add !== undefined) !== (m.remove !== undefined);
+        if (!oneOf || add === null || (m.remove !== undefined && remove === undefined)) {
+            answer({ ok: false, error: KNOWLEDGE_SET_SHAPE });
+            return;
+        }
+        try {
+            const done = await port.set(add ? { add } : { remove });
+            if (!done.ok) {
+                answer(done);
+                return;
+            }
+            this.opts.log?.(add ? `knowledge folder added: ${add.path}` : `knowledge folder removed: ${remove ?? ''}`);
+            answer(this.knowledgeListReply(port));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-set', err) });
+        }
+    }
+    async onKnowledgeFiles(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-files-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        if (typeof m.folder !== 'string') {
+            answer({ ok: false, error: 'Name a knowledge folder by its id.' });
+            return;
+        }
+        try {
+            answer(await port.files(m.folder));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-files', err) });
+        }
+    }
+    async onKnowledgeFile(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-file-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        if (typeof m.folder !== 'string' || typeof m.path !== 'string' || (m.stat !== undefined && typeof m.stat !== 'boolean')) {
+            answer({ ok: false, error: 'Name a knowledge folder by its id and a file by its path in it.' });
+            return;
+        }
+        try {
+            answer(await port.file(m.folder, m.path, m.stat === true));
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-file', err) });
+        }
+    }
+    async onKnowledgeChanges(m) {
+        if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
+            return;
+        const answer = (reply) => this.ch.send({ t: 'knowledge-changes-result', id: m.id, reply });
+        const port = this.opts.knowledge;
+        if (!port) {
+            answer({ ok: false, error: KNOWLEDGE_NOT_KEPT });
+            return;
+        }
+        const off = this.knowledgeOffNow(port);
+        if (off !== null) {
+            answer({ ok: false, error: off });
+            return;
+        }
+        try {
+            answer(await port.changes());
+        }
+        catch (err) {
+            answer({ ok: false, error: this.knowledgeThrowText('knowledge-changes', err) });
+        }
+    }
     async onFleetItems(m) {
         if (typeof m.id !== 'number' || !Number.isSafeInteger(m.id))
             return;
@@ -6116,6 +6462,41 @@ export class SidecarServer {
             return MCP_ADMIN_ONLY;
         }
     }
+    /** Team mode: running a command on the daemon's machine, or reaching one
+     * that is running, is the admin's. Null when THIS connection may. Unknown
+     * admin and any throw while deciding are refusals. Solo mode: always null. */
+    commandRefusal() {
+        try {
+            const access = this.teamAccess();
+            if (!access)
+                return null;
+            return sameAdmin(this.verifiedUserId, access.adminId()) ? null : COMMANDS_ADMIN_ONLY;
+        }
+        catch {
+            return COMMANDS_ADMIN_ONLY;
+        }
+    }
+    /** Team mode: writing into this sidecar's knowledge folders is the admin's.
+     * Null when THIS connection may. Unknown admin and any throw while deciding
+     * are refusals. Solo mode: always null. */
+    knowledgeWriteRefusal() {
+        return this.knowledgeCanManage() ? null : KNOWLEDGE_WRITE_ADMIN_ONLY;
+    }
+    /** Whether THIS connection manages this sidecar's knowledge folders (sees
+     * their paths, adds and removes them, writes into the writable one): always
+     * on a solo daemon; on a team daemon only its admin. Unknown admin and any
+     * throw while deciding are a no. */
+    knowledgeCanManage() {
+        try {
+            const access = this.teamAccess();
+            if (!access)
+                return true;
+            return sameAdmin(this.verifiedUserId, access.adminId());
+        }
+        catch {
+            return false;
+        }
+    }
     async onRoomFindings(m) {
         if (!this.opts.rooms) {
             // A daemon without the capability hosts no rooms, so it holds no
@@ -6168,8 +6549,12 @@ export class SidecarServer {
                 this.ch.send({ t: 'config-result', id: m.id, ok: false, error: gate.refusal });
                 return;
             }
+            /* WHOSE global memory (`memory/`) this call reaches: the service maps
+             * it, after its own allowlist check, from this scope. Every call passes
+             * it, so no route reaches `memory/` without the decision. */
+            const scope = this.configMemoryScope();
             if (m.t === 'config-list') {
-                const entries = await svc.list(m.path, m.depth);
+                const entries = await svc.list(m.path, m.depth, scope);
                 const shown = await this.visibleConfigEntries(svc, m.path, entries);
                 this.ch.send(shown
                     ? { t: 'config-result', id: m.id, ok: true, entries: shown }
@@ -6177,18 +6562,18 @@ export class SidecarServer {
                 return;
             }
             if (m.t === 'config-read') {
-                this.ch.send({ t: 'config-result', id: m.id, ok: true, content: await svc.read(m.path) });
+                this.ch.send({ t: 'config-result', id: m.id, ok: true, content: await svc.read(m.path, scope) });
                 return;
             }
             if (m.t === 'config-write')
-                await svc.write(m.path, m.content);
+                await svc.write(m.path, m.content, scope);
             else if (m.t === 'config-append') {
                 if (!svc.append)
                     throw new Error('this sidecar cannot append to its harness config');
-                await svc.append(m.path, m.content);
+                await svc.append(m.path, m.content, scope);
             }
             else
-                await svc.remove(m.path);
+                await svc.remove(m.path, scope);
             await this.afterConfigChange(gate);
             this.ch.send({ t: 'config-result', id: m.id, ok: true });
         }
@@ -6196,6 +6581,20 @@ export class SidecarServer {
             this.ch.send({ t: 'config-result', id: m.id, ok: false, error: errMessage(e) });
         }
     }
+    /** Whose global memory a config call on THIS connection reaches. A
+     * personal daemon, and a team daemon's admin: the shared `memory/` itself
+     * (undefined). Any other team connection: its verified user's own partition,
+     * or none at all (null) when no user is verified. Throws only when the
+     * access port throws; the caller then refuses the call. */
+    configMemoryScope() {
+        const access = this.teamAccess();
+        if (!access)
+            return undefined;
+        const user = this.verifiedUserId;
+        if (sameAdmin(user, access.adminId()))
+            return undefined;
+        return { memoryUser: typeof user === 'string' && user !== '' ? user : null };
+    }
     /** The config path as the filesystem would reach it, for classification:
      * separators, `.`, empty and `..` segments resolved; the `crew` segment, the
      * agent folder (to its on-disk name, read from the service's own listing of