@corenel/sidecar 0.6.1 → 0.7.0

package/dist/cli.js

@@ -14040,7 +14040,7 @@ var require_express_app = __commonJS({
           this.name += this.ext = (this.defaultEngine[0] !== "." ? "." : "") + this.defaultEngine;
         }
       }
-      NunjucksView.prototype.render = function render(opts, cb) {
+      NunjucksView.prototype.render = function render2(opts, cb) {
         env.render(this.name, opts, cb);
       };
       app.set("view", NunjucksView);
@@ -14313,7 +14313,7 @@ var require_environment = __commonJS({
       _proto.express = function express(app) {
         return expressApp(this, app);
       };
-      _proto.render = function render(name, ctx, cb) {
+      _proto.render = function render2(name, ctx, cb) {
         if (lib.isFunction(ctx)) {
           cb = ctx;
           ctx = null;
@@ -14441,7 +14441,7 @@ var require_environment = __commonJS({
           this.compiled = false;
         }
       };
-      _proto3.render = function render(ctx, parentFrame, cb) {
+      _proto3.render = function render2(ctx, parentFrame, cb) {
         var _this6 = this;
         if (typeof ctx === "function") {
           cb = ctx;
@@ -15021,7 +15021,7 @@ var require_nunjucks = __commonJS({
         }
         return new Template(src2, env, path, eagerCompile);
       },
-      render: function render(name, ctx, cb) {
+      render: function render2(name, ctx, cb) {
         if (!e2) {
           configure();
         }
@@ -22488,6 +22488,10 @@ var SidecarServer = class {
        * is the session layer's call, because the operator's permission lives
        * there; this class would have to duplicate that rule to decide, and a
        * duplicated permission rule is one that eventually disagrees. */
+      // NOT from the wire: `allowMutations` is the daemon's own decision,
+      // derived from an agent's `session:` block. A client that could set it
+      // would grant itself mutating tools inside a sandbox. Deliberately
+      // absent -- see session/guestRunner.ts.
       this.opts.sessions.run(m2.sessionId, agent, input, onEvent2, identity, { keepTranscript: m2.keepTranscript === true })
     ) : (agent, input, onEvent2, identity) => this.opts.runner.run(agent, input, onEvent2, identity);
     let runId;
@@ -23279,6 +23283,11 @@ function helpText() {
     "  roots list|add|remove [path]",
     "                    edit the working directories in daemon.json (add stores the",
     "                    resolved, absolute path)",
+    "  add-under list|add|remove [path]",
+    "                    edit the areas a client may add a root under, same way",
+    "  config list|get|set|unset|add|remove [key] [value]",
+    "                    read or change any daemon.json setting, including turning",
+    "                    a capability back off (config set allow-shell false)",
     "  doctor            report what this machine would serve, and what is wrong",
     "                    (exits non-zero on a definite fault -- safe to script)",
     "  login|logout|auth manage the signed-in account",
@@ -28247,6 +28256,9 @@ async function readTranscript(files, crewRoot2, agent, runId) {
 }
 
 // src/session/manager.ts
+function isErrorStopReason(stopReason) {
+  return stopReason === "error" || (stopReason ?? "").startsWith("error:");
+}
 var SessionManager = class {
   constructor(deps) {
     this.deps = deps;
@@ -28332,11 +28344,11 @@ var SessionManager = class {
       }
       this.deps.log?.(`session ${sessionId}: running agent "${agent}" inside the session`);
       const kept2 = this.transcriptOf(onEvent, opts?.keepTranscript === true);
-      return this.recorded(session, agent, identity, () => this.deps.guestRunnerFor(sessionId).run(agent, input, kept2.tee, identity), kept2.buffer);
+      return this.recorded(session, agent, identity, () => this.deps.guestRunnerFor(sessionId, { allowMutations: opts?.allowMutations === true }).run(agent, input, kept2.tee, identity), kept2.buffer, opts?.source);
     }
     this.deps.log?.(`session ${sessionId}: running agent "${agent}" on the host (isolation: none)`);
     const kept = this.transcriptOf(onEvent, opts?.keepTranscript === true);
-    return this.recorded(session, agent, identity, () => this.deps.runner.runFrom ? this.deps.runner.runFrom(session.workdir, agent, input, kept.tee, identity, session.stateDir) : this.deps.runner.run(agent, input, kept.tee, identity), kept.buffer);
+    return this.recorded(session, agent, identity, () => this.deps.runner.runFrom ? this.deps.runner.runFrom(session.workdir, agent, input, kept.tee, identity, session.stateDir) : this.deps.runner.run(agent, input, kept.tee, identity, void 0, opts?.source), kept.buffer, opts?.source);
   }
   /**
    * Run, then write one line about it — whatever happened.
@@ -28374,7 +28386,7 @@ var SessionManager = class {
       }
     };
   }
-  async recorded(session, agent, identity, go, transcript) {
+  async recorded(session, agent, identity, go, transcript, source = "chat") {
     const startedAt = Date.now();
     const keep = (runId) => {
       if (!this.deps.recordTranscript || !transcript || transcript.length === 0) return;
@@ -28392,7 +28404,7 @@ var SessionManager = class {
         sessionId: session.id,
         isolated: this.isolated,
         kind: this.deps.backend.kind,
-        source: "chat",
+        source,
         startedAt,
         endedAt: Date.now(),
         ok,
@@ -28404,7 +28416,7 @@ var SessionManager = class {
       void r2.done.then(
         (d2) => {
           keep(r2.runId);
-          write3(r2.runId, d2.stopReason !== "error", d2.stopReason);
+          write3(r2.runId, !isErrorStopReason(d2.stopReason), d2.stopReason);
         },
         (e2) => {
           keep(r2.runId);
@@ -28726,6 +28738,7 @@ var LABEL_CREATED = "corenel.created";
 var LABEL_REPO_URL = "corenel.repo.url";
 var LABEL_REPO_REF = "corenel.repo.ref";
 var LABEL_REPO_COMMIT = "corenel.repo.commit";
+var LABEL_CREW_SESSION = "corenel.crew.session";
 function idFromSandboxName(name) {
   const m2 = /^corenel-(sess_\d+)$/.exec(name);
   return m2 ? m2[1] : null;
@@ -28845,7 +28858,7 @@ function makeMicrovmBackend(deps) {
       if (!live.length) return;
       const r2 = await deps.run(listArgs());
       if (r2.code !== 0) return;
-      const present2 = new Set(parseSandboxList(r2.stdout).map((row) => row.name));
+      const present2 = new Set(parseSandboxList(r2.stdout).map((row2) => row2.name));
       for (const s2 of live) {
         if (present2.has(sandboxName(s2.id))) continue;
         if (at2 - s2.createdAt < RECONCILE_MS) continue;
@@ -28891,7 +28904,8 @@ function makeMicrovmBackend(deps) {
             [LABEL_REPO_URL]: spec.source.url,
             [LABEL_REPO_COMMIT]: spec.source.commit,
             ...spec.source.ref ? { [LABEL_REPO_REF]: spec.source.ref } : {}
-          } : {}
+          } : {},
+          ...spec.sessionName ? { [LABEL_CREW_SESSION]: spec.sessionName } : {}
         }
       }), `create session ${id}`);
       const handle = {
@@ -28903,7 +28917,8 @@ function makeMicrovmBackend(deps) {
         // Kept so a run in this session looks for the agent where the creator's
         // workspace actually keeps it.
         ...spec.stateDir ? { stateDir: spec.stateDir } : {},
-        ...spec.source ? { source: spec.source } : {}
+        ...spec.source ? { source: spec.source } : {},
+        ...spec.sessionName ? { sessionName: spec.sessionName } : {}
       };
       sessions.set(id, handle);
       deps.log?.(
@@ -29006,9 +29021,28 @@ function makeMicrovmBackend(deps) {
      *
      * CAVEAT, deliberate: the log is the SANDBOX's, not this exec's. Entries
      * carry an `id` per invocation, but it is not known before the exec starts,
-     * so concurrent execs in one sandbox would interleave. That is acceptable
-     * because SessionManager admits one run per session at a time — and it is
-     * written down because it stops being acceptable the moment that changes.
+     * so concurrent execs in one sandbox interleave.
+     *
+     * NOTHING PREVENTS THAT, and no earlier claim here should be believed.
+     * This comment once said SessionManager admits one run per session at a
+     * time; a correction then said a scheduled agent's runs "already chain on
+     * that queue". BOTH ARE FALSE. `manager.ts` checks existence and status
+     * only; `SessionStatus` is 'created' | 'paused' | 'destroyed' (types.ts)
+     * with no 'running'; and `RunQueue` (runnerService.ts) wraps the HOST
+     * executor, which the bound path never reaches -- `dispatcher.startInSession`
+     * goes straight to `sessions.run` -> `crewSessions.ts` -> `manager.run`.
+     * Nothing anywhere serializes two runs into one session.
+     *
+     * What NARROWS the window is weaker than a lock and worth stating exactly:
+     * a bound agent gets its own box (spec D3), and the dispatcher dedupes on
+     * an in-flight key of `owner:agent:trigger`.
+     *
+     * What is STILL OPEN, inside the scheduled path: an agent carrying both a
+     * `schedule` and a `continuous` trigger holds two DISTINCT in-flight keys,
+     * so both fire concurrently by design (dispatcher.ts says so in as many
+     * words), and `resolveCrewSession` keys reuse on (name, workdir) only --
+     * so both land in the same sandbox and interleave in one log. The browser
+     * can likewise send two runs into one session.
      */
     ...deps.stream ? {
       execStream(id, command, onLine, opts) {
@@ -29130,21 +29164,21 @@ function makeMicrovmBackend(deps) {
         deps.log?.(`sessions: could not list existing sandboxes (msb exit ${r2.code}) \u2014 nothing adopted`);
         return { adopted, unmanaged };
       }
-      for (const row of parseSandboxList(r2.stdout)) {
-        const id = idFromSandboxName(row.name);
+      for (const row2 of parseSandboxList(r2.stdout)) {
+        const id = idFromSandboxName(row2.name);
         if (!id) continue;
         seq2 = Math.max(seq2, seqOf(id));
         if (sessions.has(id)) continue;
-        const inspected = await deps.run(inspectArgs(row.name)).catch(() => null);
+        const inspected = await deps.run(inspectArgs(row2.name)).catch(() => null);
         const labels = inspected && inspected.code === 0 ? parseSandboxLabels(inspected.stdout) : {};
         const workdir = labels[LABEL_WORKDIR];
         if (!workdir) {
-          unmanaged.push(row.name);
+          unmanaged.push(row2.name);
           continue;
         }
         if (!within(workdir)) {
-          deps.log?.(`sessions: sandbox "${row.name}" holds ${workdir}, outside this daemon's roots \u2014 not adopted`);
-          unmanaged.push(row.name);
+          deps.log?.(`sessions: sandbox "${row2.name}" holds ${workdir}, outside this daemon's roots \u2014 not adopted`);
+          unmanaged.push(row2.name);
           continue;
         }
         const stamped = Number(labels[LABEL_CREATED]);
@@ -29152,13 +29186,15 @@ function makeMicrovmBackend(deps) {
         const repoUrl = labels[LABEL_REPO_URL];
         const repoCommit = labels[LABEL_REPO_COMMIT];
         const repoRef = labels[LABEL_REPO_REF];
+        const sessionName = labels[LABEL_CREW_SESSION];
         sessions.set(id, {
           id,
-          status: statusFromSandbox(row.status),
+          status: statusFromSandbox(row2.status),
           workdir,
-          createdAt: Number.isFinite(stamped) && stamped > 0 ? stamped : row.createdAt ?? now2(),
+          createdAt: Number.isFinite(stamped) && stamped > 0 ? stamped : row2.createdAt ?? now2(),
           ...owner ? { owner } : {},
           ...repoUrl && repoCommit ? { source: { url: repoUrl, commit: repoCommit, ...repoRef ? { ref: repoRef } : {} } } : {},
+          ...sessionName ? { sessionName } : {},
           /* THE ONLY PLACE THIS IS EVER SET TRUE. `create()` never touches it,
            * so a card can tell "this daemon booted it" from "this daemon
            * found it already running" — procs.ts's own words: a running
@@ -29258,10 +29294,11 @@ function makeMicrovmBackend(deps) {
 }
 
 // src/session/guestRunner.ts
-var DEFAULT_GUEST_COMMAND = (agent, input) => [
+var DEFAULT_GUEST_COMMAND = (agent, input, opts) => [
   "corenel",
   "run-agent",
   agent,
+  ...opts.allowMutations ? ["--allow-mutations"] : [],
   "--input",
   input
 ];
@@ -29306,7 +29343,7 @@ function makeGuestRunner(deps) {
       const exec = deps.backend.exec.bind(deps.backend);
       const runId = `grun_${++seq3}`;
       deps.log?.(`session ${sessionId}: running "${agent}" inside the guest (${runId})`);
-      const command = build(agent, input);
+      const command = build(agent, input, { allowMutations: deps.allowMutations === true });
       const timeout = deps.timeoutMs === void 0 ? void 0 : { timeoutMs: deps.timeoutMs };
       const seen = [];
       let skipped = 0;
@@ -29514,9 +29551,10 @@ async function wireSessions(opts) {
     ...opts.recordTranscript ? { recordTranscript: opts.recordTranscript } : {},
     // One runner per session, built on demand: the manager knows which session a
     // run belongs to, so nothing has to infer it.
-    guestRunnerFor: (sessionId) => makeGuestRunner({
+    guestRunnerFor: (sessionId, guestOpts) => makeGuestRunner({
       backend,
       sessionId: () => sessionId,
+      allowMutations: guestOpts.allowMutations,
       ...opts.log ? { log: opts.log } : {}
     }),
     ...opts.log ? { log: opts.log } : {}
@@ -29528,6 +29566,26 @@ async function wireSessions(opts) {
   return { manager, backend, port: makeSessionsPort({ manager, backend, guestEnv, ...portExtras(opts) }) };
 }
 
+// src/runner/crewSessions.ts
+function makeCrewSessions(src2, opts) {
+  if (!src2?.manager.isolated) return void 0;
+  const { manager, backend } = src2;
+  return {
+    list: () => backend.list(),
+    adopt: () => backend.adopt?.() ?? Promise.resolve(void 0),
+    create: async (spec) => {
+      const env = await opts.guestEnv().catch(() => ({}));
+      return manager.create({
+        workdir: spec.workdir,
+        sessionName: spec.sessionName,
+        stateDir: opts.stateDir,
+        env: { ...env, CORENEL_STATE_DIR: opts.stateDir }
+      });
+    },
+    run: (sessionId, agent, input, onEvent, identity, runOpts) => manager.run(sessionId, agent, input, onEvent, identity, runOpts)
+  };
+}
+
 // src/runner/owners.ts
 import { readdir } from "node:fs/promises";
 import { join as join8 } from "node:path";
@@ -30215,6 +30273,41 @@ var CREW_EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["ask_user", "spawn_agent", "s
 
 // ../crew/store.ts
 var import_yaml3 = __toESM(require_dist(), 1);
+
+// ../crew/sessionBinding.ts
+var SESSION_NAME_RE = /^[a-z0-9_-]{1,32}$/;
+function isValidSessionName(name) {
+  return SESSION_NAME_RE.test(name);
+}
+function parseSessionBinding(meta) {
+  const raw = meta.session;
+  if (raw === void 0) return { kind: "absent" };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { kind: "malformed", reason: "session: must be a block with `name:` and `workdir:`" };
+  }
+  const o2 = raw;
+  const name = typeof o2.name === "string" ? o2.name : "";
+  const workdir = typeof o2.workdir === "string" ? o2.workdir.trim() : "";
+  if (!isValidSessionName(name)) {
+    return {
+      kind: "malformed",
+      reason: `session.name ${JSON.stringify(name)} must be 1-32 characters of a-z, 0-9, "-" or "_"`
+    };
+  }
+  if (!workdir) return { kind: "malformed", reason: "session.workdir is required" };
+  return {
+    kind: "binding",
+    binding: {
+      name,
+      workdir,
+      // Anything but an explicit `false` is true, matching how `enabled` is read
+      // in store.ts — absent means the default, and the default is on.
+      createIfMissing: o2.createIfMissing !== false
+    }
+  };
+}
+
+// ../crew/store.ts
 var TRIGGER_TYPES = [
   "manual",
   "file-change",
@@ -30300,6 +30393,7 @@ async function loadCrewAgentAt(files, root, name, scope = "workspace") {
   if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
   const dir = `${root}/${name}`;
   const { meta, body: body2 } = parseFrontmatter(await readOr(files, `${dir}/AGENT.md`));
+  const session = parseSessionBinding(meta);
   return {
     name,
     jobTitle: typeof meta.jobTitle === "string" ? meta.jobTitle : "",
@@ -30314,7 +30408,9 @@ async function loadCrewAgentAt(files, root, name, scope = "workspace") {
     policy: parsePolicyYaml(await readOr(files, `${dir}/POLICY.yaml`), name),
     settings: parseSettings(await readOr(files, `${dir}/settings.json`, "{}")),
     budget: parseBudget(meta),
-    canCall: parseCanCall(meta)
+    canCall: parseCanCall(meta),
+    ...session.kind === "binding" ? { session: session.binding } : {},
+    ...session.kind === "malformed" ? { sessionError: session.reason } : {}
   };
 }
 async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
@@ -42613,6 +42709,26 @@ function makeTriggerSchedule(opts) {
   return { due, nextWakeAfter, registrations };
 }
 
+// src/session/crewSessionResolve.ts
+function sameDir(a2, b2) {
+  const norm2 = (p2) => p2.split("\\").join("/").replace(/[/]+$/, "").toLowerCase();
+  return norm2(a2) === norm2(b2);
+}
+function resolveCrewSession(binding, handles) {
+  const matches = handles.filter((h2) => h2.status === "created" && h2.sessionName === binding.name && sameDir(h2.workdir, binding.workdir));
+  if (matches.length) {
+    const newest = matches.reduce((a2, b2) => b2.createdAt > a2.createdAt ? b2 : a2);
+    return { kind: "reuse", sessionId: newest.id };
+  }
+  if (!binding.createIfMissing) {
+    return {
+      kind: "refuse",
+      reason: `no live session "${binding.name}" on ${binding.workdir}, and createIfMissing is off`
+    };
+  }
+  return { kind: "create", spec: { workdir: binding.workdir, sessionName: binding.name } };
+}
+
 // src/runner/dispatcher.ts
 function hasBudget2(def) {
   return def.budget?.maxUsd != null || def.budget?.maxTokens != null;
@@ -42636,11 +42752,17 @@ function makeDispatcher(opts) {
     });
     return next;
   }
-  async function recordFailedDispatch(d2, root, startedAt, runId, message) {
+  async function recordFailedDispatch(d2, root, startedAt, runId, message, where) {
     await appendRun(root.files, root.root, {
       runId,
       agent: d2.agent,
-      where: "host",
+      /* PASSED, NOT ASSUMED. This said `where: 'host'` unconditionally, so
+       * every D5 refusal -- no session backend, `createIfMissing: false`, a
+       * `create` that threw, a malformed `session:` block -- told the operator
+       * the run had happened on the host, which is the one thing this feature
+       * guarantees did NOT happen. A bound agent that refuses files a
+       * `where: 'session'` row: nothing ran, and nothing ran THERE. */
+      where,
       source: d2.trigger,
       startedAt,
       endedAt: now2(),
@@ -42648,6 +42770,35 @@ function makeDispatcher(opts) {
       stopReason: message
     }, log);
   }
+  async function startInSession(binding, d2) {
+    const sessions = opts.sessions?.();
+    if (!sessions) {
+      throw new Error(
+        `crew agent "${d2.agent}" is bound to session "${binding.name}", but this daemon has no session backend`
+      );
+    }
+    try {
+      await sessions.adopt?.();
+    } catch {
+    }
+    const decision = resolveCrewSession(binding, sessions.list());
+    if (decision.kind === "refuse") {
+      throw new Error(`crew agent "${d2.agent}": ${decision.reason}`);
+    }
+    const sessionId = decision.kind === "reuse" ? decision.sessionId : (await sessions.create(decision.spec)).id;
+    return sessions.run(
+      sessionId,
+      d2.agent,
+      d2.input,
+      () => {
+      },
+      { owner: d2.owner },
+      // `source` is the trigger, not 'chat': the session's own run record is
+      // the only durable answer to "why did this happen", and it is written by
+      // the session layer, not by this file's failure path.
+      { allowMutations: true, source: d2.trigger }
+    );
+  }
   async function fire(d2) {
     const dispatchedAt = now2();
     const key = `${d2.owner}:${d2.agent}:${d2.trigger}`;
@@ -42656,6 +42807,7 @@ function makeDispatcher(opts) {
       return;
     }
     inFlight.add(key);
+    let where = "host";
     try {
       const roots = await opts.ownerRoots();
       const match = roots.find((r2) => r2.owner === d2.owner);
@@ -42668,12 +42820,17 @@ function makeDispatcher(opts) {
         log(`dispatcher: agent "${d2.agent}" not found (owner "${d2.owner}") -- skipped`);
         return;
       }
+      where = def.session || def.sessionError ? "session" : "host";
       if (d2.trigger === "continuous" && !hasBudget2(def)) {
         log(`refusing continuous run for "${d2.agent}" (owner "${d2.owner}"): a budget (maxUsd or maxTokens) is required`);
         return;
       }
       await withAgentStateLock(`${d2.owner}:${d2.agent}`, () => persistDispatch(d2, match));
-      const started = await runner.run(d2.agent, d2.input, () => {
+      if (def.sessionError) {
+        throw new Error(`crew agent "${d2.agent}" has an unusable session: block -- ${def.sessionError}`);
+      }
+      const binding = def.session;
+      const started = binding ? await startInSession(binding, d2) : await runner.run(d2.agent, d2.input, () => {
       }, { owner: d2.owner }, d2.generation ?? 0, d2.trigger);
       const startedAt = now2();
       const announce = (extra) => {
@@ -42705,7 +42862,7 @@ function makeDispatcher(opts) {
           announce({ endedAt: now2(), ok: false, stopReason: msg });
           log(`dispatcher: run of "${d2.agent}" (${d2.trigger}) failed -- ${msg}`);
           void settleSelfDirected(d2, match);
-          void recordFailedDispatch(d2, match, startedAt, started.runId, msg);
+          void recordFailedDispatch(d2, match, startedAt, started.runId, msg, where);
         }
       );
     } catch (err) {
@@ -42714,7 +42871,7 @@ function makeDispatcher(opts) {
       try {
         const roots = await opts.ownerRoots();
         const root = roots.find((r2) => r2.owner === d2.owner);
-        if (root) await recordFailedDispatch(d2, root, dispatchedAt, `dispatch-${dispatchedAt}`, msg);
+        if (root) await recordFailedDispatch(d2, root, dispatchedAt, `dispatch-${dispatchedAt}`, msg, where);
       } catch {
       }
     } finally {
@@ -43404,6 +43561,9 @@ function startDaemonCore(opts) {
     // it -- the same contract `schedule_self` has. `clock` is declared below
     // and only read when this fires, long after it is initialized.
     onScheduled: () => clock.wake(),
+    // Read per fire(), so a daemon whose session layer comes up after this
+    // core still routes bound agents into it.
+    ...opts.sessions ? { sessions: opts.sessions } : {},
     log
   });
   const roomProgressSubs = /* @__PURE__ */ new Set();
@@ -45398,6 +45558,7 @@ async function resolveEndpoint(args, env = process.env) {
 import { readFile as readFile2, writeFile, mkdir as mkdir3 } from "node:fs/promises";
 import { dirname as dirname7, join as join18 } from "node:path";
 var DAEMON_CONFIG_VERSION = 1;
+var SECRET_KEYS = ["acpAuth", "tunnelToken", "token"];
 var KNOWN_KEYS = [
   "version",
   "port",
@@ -45514,6 +45675,10 @@ function layerConfig(args, explicit, file) {
     from[key] = "file";
     if (key === "endpoint") out.endpointExplicit = true;
   }
+  if (out.allowLan) {
+    if (from.host === "default") out.host = "0.0.0.0";
+    if (from.selfSigned === "default" && !out.tlsCert && !out.tlsKey) out.selfSigned = true;
+  }
   return { args: out, from, warnings };
 }
 
@@ -45576,59 +45741,285 @@ async function runSetup(argv, io) {
   return 0;
 }
 
-// src/config/roots.ts
+// src/config/pathList.ts
 import { resolve as resolve10 } from "node:path";
-async function runRoots(argv, io) {
+function stripStateDir(argv) {
+  const at2 = argv.indexOf("--state-dir");
+  if (at2 < 0) return argv;
+  return [...argv.slice(0, at2), ...argv.slice(at2 + (argv[at2 + 1] === void 0 ? 1 : 2))];
+}
+async function runPathList(raw, io, spec) {
+  const argv = stripStateDir(raw);
   const sub = argv[0];
   const { config, unknown, corrupt } = await readDaemonConfig(io.stateDir);
-  const roots = Array.isArray(config.roots) ? config.roots : [];
+  const stored = config[spec.key];
+  const list = Array.isArray(stored) ? stored : [];
   if (corrupt && (sub === "add" || sub === "remove")) {
     io.err(`daemon.json in ${io.stateDir} is not valid JSON; fix or delete it before writing.`);
     return 2;
   }
   if (sub === "list") {
-    if (roots.length === 0) {
-      io.out("No working directories are configured. Add one with: corenel roots add <path>");
+    if (list.length === 0) {
+      io.out(spec.empty);
       return 0;
     }
-    for (const r2 of roots) io.out(r2);
+    for (const p2 of list) io.out(p2);
     return 0;
   }
   if (sub === "add") {
     const path = argv[1];
     if (!path) {
-      io.err("corenel roots add needs a path.");
+      io.err(`${spec.command} add needs a path.`);
       return 2;
     }
     const full = resolve10(path);
-    if (roots.some((r2) => resolve10(r2) === full)) {
-      io.out(`${full} is already a configured working directory.`);
+    if (list.some((p2) => resolve10(p2) === full)) {
+      io.out(`${full} is already a configured ${spec.noun}.`);
       return 0;
     }
-    await writeDaemonConfig(io.stateDir, { ...config, roots: [...roots, full] }, unknown);
+    await writeDaemonConfig(io.stateDir, { ...config, [spec.key]: [...list, full] }, unknown);
     io.out(`Added ${full} to daemon.json. A running daemon picks this up on restart.`);
     return 0;
   }
   if (sub === "remove") {
     const path = argv[1];
     if (!path) {
-      io.err("corenel roots remove needs a path.");
+      io.err(`${spec.command} remove needs a path.`);
       return 2;
     }
     const full = resolve10(path);
-    if (!roots.some((r2) => resolve10(r2) === full)) {
-      io.err(`${full} is not a configured working directory.`);
+    if (!list.some((p2) => resolve10(p2) === full)) {
+      io.err(`${full} is not a configured ${spec.noun}.`);
       return 2;
     }
     await writeDaemonConfig(
       io.stateDir,
-      { ...config, roots: roots.filter((r2) => resolve10(r2) !== full) },
+      { ...config, [spec.key]: list.filter((p2) => resolve10(p2) !== full) },
       unknown
     );
     io.out(`Removed ${full} from daemon.json. A running daemon keeps it until restart.`);
     return 0;
   }
-  io.err(`Unknown subcommand "${sub ?? ""}". Use: corenel roots list | add <path> | remove <path>`);
+  io.err(`Unknown subcommand "${sub ?? ""}". Use: ${spec.command} list | add <path> | remove <path>`);
+  return 2;
+}
+
+// src/config/roots.ts
+function runRoots(argv, io) {
+  return runPathList(argv, io, {
+    key: "roots",
+    command: "corenel roots",
+    noun: "working directory",
+    empty: "No working directories are configured. Add one with: corenel roots add <path>"
+  });
+}
+
+// src/config/addUnder.ts
+function runAddUnder(argv, io) {
+  return runPathList(argv, io, {
+    key: "addUnder",
+    command: "corenel add-under",
+    noun: "area a client may add a root under",
+    empty: "No areas are configured. Clients cannot add roots. Add one with: corenel add-under add <path>"
+  });
+}
+
+// src/config/keyTypes.ts
+var KEY_TYPES = {
+  port: "number",
+  host: "string",
+  roots: "string[]",
+  addUnder: "string[]",
+  cloneUnder: "string[]",
+  allowLan: "boolean",
+  allowOrigins: "string[]",
+  tlsCert: "string",
+  tlsKey: "string",
+  selfSigned: "boolean",
+  tunnel: "string",
+  tunnelName: "string",
+  tunnelHostname: "string",
+  endpoint: "string",
+  allowShell: "boolean",
+  keepTranscripts: "boolean",
+  isolation: "string",
+  msbBin: "string",
+  guestImage: "string",
+  maxChainDepth: "number",
+  name: "string",
+  appUrl: "string",
+  defaultModel: "string"
+};
+var kebab = (k2) => k2.replace(/[A-Z]/g, (c2) => `-${c2.toLowerCase()}`);
+function resolveKeyName(input) {
+  if (Object.prototype.hasOwnProperty.call(KEY_TYPES, input)) return input;
+  for (const k2 of Object.keys(KEY_TYPES)) if (kebab(k2) === input) return k2;
+  return null;
+}
+function isListKey(key) {
+  return KEY_TYPES[key] === "string[]";
+}
+function coerceValue(key, raw) {
+  const type = KEY_TYPES[key];
+  if (!type) return { ok: false, reason: `"${key}" is not a daemon.json setting.` };
+  if (type === "boolean") {
+    if (raw === "true") return { ok: true, value: true };
+    if (raw === "false") return { ok: true, value: false };
+    return { ok: false, reason: `${key} must be true or false, not ${JSON.stringify(raw)}.` };
+  }
+  if (type === "number") {
+    if (!/^-?\d+$/.test(raw)) return { ok: false, reason: `${key} must be a whole number, not ${JSON.stringify(raw)}.` };
+    return { ok: true, value: Number(raw) };
+  }
+  return { ok: true, value: raw };
+}
+
+// src/config/configCmd.ts
+var USAGE = "Use: corenel config list | get <key> | set <key> <value> | unset <key> | add <key> <value> | remove <key> <value>";
+function render(value) {
+  if (Array.isArray(value)) return value.length ? value.join(", ") : "(none)";
+  if (value === void 0) return "(unset)";
+  return String(value);
+}
+function row(key, value, origin) {
+  return `  ${key.padEnd(18)} ${render(value).padEnd(24)} (${origin})`;
+}
+function keyOrReason(name) {
+  if (SECRET_KEYS.includes(name)) {
+    return { reason: `${name} is a credential and does not belong in daemon.json. It goes in auth.json.` };
+  }
+  const key = resolveKeyName(name);
+  if (!key) return { reason: `"${name}" is not a daemon.json setting. ${USAGE}` };
+  return { key };
+}
+async function runConfig(raw, io) {
+  const argv = stripStateDir(raw);
+  const sub = argv[0];
+  const { config, unknown, corrupt } = await readDaemonConfig(io.stateDir);
+  const isWrite = sub === "set" || sub === "unset" || sub === "add" || sub === "remove";
+  if (corrupt && isWrite) {
+    io.err(`daemon.json in ${io.stateDir} is not valid JSON; fix or delete it before writing.`);
+    return 2;
+  }
+  const read3 = (key) => {
+    const value = config[key];
+    return { value, origin: value === void 0 ? "default" : "file" };
+  };
+  const commit = async (next, said) => {
+    await writeDaemonConfig(io.stateDir, next, unknown);
+    io.out(`${said} A running daemon picks this up on restart.`);
+    return 0;
+  };
+  if (sub === "list") {
+    for (const key of Object.keys(KEY_TYPES).sort()) {
+      const { value, origin } = read3(key);
+      io.out(row(key, value, origin));
+    }
+    const extras = Object.keys(unknown);
+    if (extras.length) {
+      io.out("");
+      io.out("  Keys this version does not manage (kept as they are):");
+      for (const k2 of extras.sort()) io.out(`    ${k2.padEnd(18)} ${render(unknown[k2])}`);
+    }
+    if (corrupt) io.err(`daemon.json in ${io.stateDir} is not valid JSON; these are the defaults, not what the file says.`);
+    return 0;
+  }
+  if (sub === "get") {
+    const name = argv[1];
+    if (!name) {
+      io.err(`corenel config get needs a key. ${USAGE}`);
+      return 2;
+    }
+    const found = keyOrReason(name);
+    if ("reason" in found) {
+      io.err(found.reason);
+      return 2;
+    }
+    const { value, origin } = read3(found.key);
+    io.out(`  ${render(value).padEnd(24)} (${origin})`);
+    return 0;
+  }
+  if (sub === "set") {
+    const name = argv[1];
+    const values = argv.slice(2);
+    if (!name) {
+      io.err(`corenel config set needs a key. ${USAGE}`);
+      return 2;
+    }
+    const found = keyOrReason(name);
+    if ("reason" in found) {
+      io.err(found.reason);
+      return 2;
+    }
+    if (values.length === 0) {
+      io.err(`corenel config set ${name} needs a value.`);
+      return 2;
+    }
+    if (isListKey(found.key)) {
+      await commit({ ...config, [found.key]: values }, `Set ${found.key} to ${values.join(", ")}.`);
+      return 0;
+    }
+    if (values.length > 1) {
+      io.err(`${found.key} holds one value; give just one.`);
+      return 2;
+    }
+    const coerced = coerceValue(found.key, values[0]);
+    if (!coerced.ok) {
+      io.err(coerced.reason);
+      return 2;
+    }
+    return commit({ ...config, [found.key]: coerced.value }, `Set ${found.key} to ${String(coerced.value)}.`);
+  }
+  if (sub === "unset") {
+    const name = argv[1];
+    if (!name) {
+      io.err(`corenel config unset needs a key. ${USAGE}`);
+      return 2;
+    }
+    const found = keyOrReason(name);
+    if ("reason" in found) {
+      io.err(found.reason);
+      return 2;
+    }
+    const next = { ...config };
+    delete next[found.key];
+    return commit(next, `Unset ${found.key}; the default applies again.`);
+  }
+  if (sub === "add" || sub === "remove") {
+    const name = argv[1];
+    const value = argv[2];
+    if (!name || !value) {
+      io.err(`corenel config ${sub} needs a key and a value.`);
+      return 2;
+    }
+    const found = keyOrReason(name);
+    if ("reason" in found) {
+      io.err(found.reason);
+      return 2;
+    }
+    if (!isListKey(found.key)) {
+      io.err(`${found.key} holds one value; change it with: corenel config set ${name} <value>`);
+      return 2;
+    }
+    const raw2 = config[found.key];
+    const list = Array.isArray(raw2) ? raw2 : [];
+    if (sub === "add") {
+      if (list.includes(value)) {
+        io.out(`${value} is already in ${found.key}.`);
+        return 0;
+      }
+      return commit({ ...config, [found.key]: [...list, value] }, `Added ${value} to ${found.key}.`);
+    }
+    if (!list.includes(value)) {
+      io.err(`${value} is not in ${found.key}.`);
+      return 2;
+    }
+    return commit(
+      { ...config, [found.key]: list.filter((v2) => v2 !== value) },
+      `Removed ${value} from ${found.key}.`
+    );
+  }
+  io.err(`Unknown subcommand "${sub ?? ""}". ${USAGE}`);
   return 2;
 }
 
@@ -47253,7 +47644,7 @@ async function main() {
     await runAcpAgent(rawArgv.slice(1));
     return;
   }
-  if (rawArgv[0] === "setup" || rawArgv[0] === "roots" || rawArgv[0] === "doctor") {
+  if (rawArgv[0] === "setup" || rawArgv[0] === "roots" || rawArgv[0] === "add-under" || rawArgv[0] === "config" || rawArgv[0] === "doctor") {
     const sub = rawArgv[0];
     const rest = rawArgv.slice(1);
     try {
@@ -47266,6 +47657,8 @@ async function main() {
       };
       if (sub === "setup") process.exit(await runSetup(rest, io));
       if (sub === "roots") process.exit(await runRoots(rest, io));
+      if (sub === "add-under") process.exit(await runAddUnder(rest, io));
+      if (sub === "config") process.exit(await runConfig(rest, io));
       const { args: flagArgs2, explicit: explicit2 } = parseArgsWithProvenance(rest);
       const { config, corrupt } = await readDaemonConfig(io.stateDir);
       const { args: args2, from, warnings } = layerConfig(flagArgs2, explicit2, config);
@@ -47419,6 +47812,7 @@ async function main() {
   const attendance = makeAttendanceRegistry({ log: slog });
   const runs = makeRunHub({ log: slog });
   let core;
+  let crewSessions;
   const pauses = args.daemon ? await loadPauseStore(args.stateDir) : void 0;
   let controlPlane = null;
   const runner = args.daemon ? new NodeRunnerService({
@@ -47533,6 +47927,9 @@ async function main() {
       // through the attendance registry -- there is no room-progress member on
       // AttendanceRegistry (unlike runActivity/registrations), and adding one
       // is out of this task's scope.
+      // Bound crew agents run in the session layer built below -- read through
+      // the holder, never captured by value, because it does not exist yet.
+      sessions: () => crewSessions,
       onRoomProgress: (room) => slog(`room ${room.roomId}: ${room.turns} turn(s), ${room.participants.length} participant(s)${room.closed ? ` -- closed (${room.closed.reason})` : ""}`)
     });
   }
@@ -47658,6 +48055,7 @@ async function main() {
     git: createGitSource({ areas: args.cloneUnder, run: makeGitRunner(), log: slog }),
     approveCheckout: (dir) => rootsController.addFromClone(dir)
   }) : void 0;
+  crewSessions = makeCrewSessions(sessions, { stateDir: stateDirName(), guestEnv });
   const handle = await startSidecar({
     port: args.port,
     host: args.host,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",
@@ -36,10 +36,10 @@
     "esbuild": "^0.21.5",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "@corenel/protocol": "0.6.1",
-    "@corenel/harness": "0.6.1",
     "@corenel/tools-node": "0.3.1",
-    "@corenel/crew": "0.0.0"
+    "@corenel/protocol": "0.6.1",
+    "@corenel/crew": "0.0.0",
+    "@corenel/harness": "0.6.1"
   },
   "repository": {
     "type": "git",