@corenel/sidecar 0.8.8 → 0.10.0

package/dist/cli.js

@@ -17291,8 +17291,8 @@ ${yamlContent}` : yamlContent;
           processedContent = content;
         }
         if (this.verbose) {
-          const preview = processedContent.substring(0, 50).replace(/\n/g, "\\n");
-          console.log(`[include] Loaded ${ext} file: ${filePath} (${preview}...)`);
+          const preview2 = processedContent.substring(0, 50).replace(/\n/g, "\\n");
+          console.log(`[include] Loaded ${ext} file: ${filePath} (${preview2}...)`);
         }
         return {
           src: processedContent,
@@ -17914,8 +17914,8 @@ ${content}` : parentData.content;
           }
           removedCount++;
           if (verbose) {
-            const preview = blockContent.substring(0, 50).replace(/\n/g, "\\n");
-            console.log(`  - Removing \`\`\`${lang} block: "${preview}..."`);
+            const preview2 = blockContent.substring(0, 50).replace(/\n/g, "\\n");
+            console.log(`  - Removing \`\`\`${lang} block: "${preview2}..."`);
           }
           return "";
         });
@@ -18765,6 +18765,25 @@ ${firstUserMsg.content}`;
   }
 });
 
+// ../tools-node/toolGuidance.ts
+function nodeToolGuidance(toolNames) {
+  const has3 = new Set(toolNames);
+  const parts = [];
+  if (has3.has(SHELL_TOOL)) parts.push(SHELL);
+  if (PROC_TOOLS.some((t2) => has3.has(t2))) parts.push(PROCS);
+  return parts.join("\n\n");
+}
+var SHELL_TOOL, PROC_TOOLS, SHELL, PROCS;
+var init_toolGuidance = __esm({
+  "../tools-node/toolGuidance.ts"() {
+    "use strict";
+    SHELL_TOOL = "shell";
+    PROC_TOOLS = ["proc_start", "proc_stop", "proc_list"];
+    SHELL = `Running a command is often the shortest correct answer: use \`${SHELL_TOOL}\` for anything a command already does well -- listing, searching, git, package managers, build and test runners -- instead of reconstructing it from file reads. It waits for the command to finish and returns its output, so it is the wrong tool for anything that does not exit on its own.`;
+    PROCS = `A command that keeps running (a dev server, a watcher, a queue worker) belongs to \`${PROC_TOOLS[0]}\`, not \`${SHELL_TOOL}\` -- starting one with \`${SHELL_TOOL}\` hangs the turn until it is killed. Use \`${PROC_TOOLS[2]}\` to see what is already running before starting anything, and \`${PROC_TOOLS[1]}\` to stop what you started. Do not stop a process you did not start.`;
+  }
+});
+
 // ../tools-node/promptHost.ts
 function backend(svc) {
   return {
@@ -18822,8 +18841,22 @@ function nodePromptHost(workspace, project) {
       sources[p2] = liveSrc;
       return compile("", values, new HybridFileSystem(sources, backend(workspace)), "/" + p2);
     },
-    siteIndex: () => ""
+    siteIndex: () => "",
     // no site index in node (the help chat is browser-only)
+    /* Who the agent says it IS. Without this, `composeAgentSystem` falls back
+     * to its `'Prompd'` default and the `corenel` binary's agent introduced
+     * itself as "the Prompd assistant" -- the same leak already fixed for the
+     * browser help chat (composeHelpSystem) and missed here, because the node
+     * host is the one PromptHost that never implemented the hook.
+     *
+     * Constant, not a parameter: every node consumer of this host (the CLI and
+     * the sidecar) IS Corenel. A host that is not should implement its own. */
+    appName: () => "Corenel",
+    /* The product's guidance for the tools this run actually has -- the shell,
+     * long-running processes, and deferred MCP tools. Gated per tool inside
+     * nodeToolGuidance, because this same host serves the sidecar, whose shell
+     * is behind --allow-shell. */
+    toolGuidance: (names) => nodeToolGuidance(names)
   };
 }
 var parser, compiler;
@@ -18832,6 +18865,7 @@ var init_promptHost = __esm({
     "use strict";
     init_dist();
     init_protocol();
+    init_toolGuidance();
     parser = new PrompdParser();
     compiler = new PrompdCompiler();
   }
@@ -25434,6 +25468,11 @@ var SidecarServer = class {
   /** The friendly label from the same `hello`, kept beside `clientId` so the
    * dirName resolver is handed the identity the manifest keys on. */
   clientName;
+  /** This connection's attended-client object, retained so an answer it sends
+   * can be attributed to it. Typed `unknown` because its only consumer is the
+   * registry's own identity lookup, which takes `unknown` for the
+   * dependency-direction reason on `SidecarAttendanceRegistry.answer`. */
+  attended;
   /** Detach function for this connection's attendance attachment, set on a
    * successful `hello` when `opts.attendance` is wired. Called once, on channel
    * close, so a dead connection stops receiving/counting toward asks. */
@@ -25545,7 +25584,7 @@ var SidecarServer = class {
         return;
       case "permission-answer":
         if (!this.authed) return;
-        this.opts.attendance?.answer(m2.id, m2.decision);
+        this.opts.attendance?.answer(m2.id, m2.decision, this.attended);
         return;
       case "roots-browse":
         if (!this.authed) {
@@ -25795,10 +25834,11 @@ var SidecarServer = class {
     }
     this.authed = true;
     this.hostStateDir = m2.stateDir ?? ".corenel";
+    let accounts = [];
     if (typeof m2.clientId === "string" && m2.clientId) {
       const wireId = m2.clientId.slice(0, MAX_IDENTITY_FIELD_LEN);
       const claimed = Array.isArray(m2.accounts) ? m2.accounts : [];
-      const accounts = claimed.length > MAX_CLAIMED_ACCOUNTS ? [] : claimed.filter((a2) => typeof a2 === "string" && a2.length <= MAX_IDENTITY_FIELD_LEN);
+      accounts = claimed.length > MAX_CLAIMED_ACCOUNTS ? [] : claimed.filter((a2) => typeof a2 === "string" && a2.length <= MAX_IDENTITY_FIELD_LEN);
       let clientId = wireId;
       if (this.opts.clientKey) {
         try {
@@ -25827,11 +25867,16 @@ var SidecarServer = class {
       }
     }
     if (this.opts.attendance) {
-      this.attendedDetach = this.opts.attendance.attach({
+      const attended = {
         send: (ask) => this.ch.send({ t: "permission-ask", ...ask }),
-        resolved: (id, decision, by) => this.ch.send({ t: "permission-resolved", id, decision, by }),
+        resolved: (id, decision, by, byClientId) => this.ch.send({ t: "permission-resolved", id, decision, by, ...byClientId ? { byClientId } : {} }),
         runActivity: (activity) => this.ch.send({ t: "run-activity", activity }),
         registrations: (registrations) => this.ch.send({ t: "registrations", registrations })
+      };
+      this.attended = attended;
+      this.attendedDetach = this.opts.attendance.attach(attended, {
+        clientId: this.clientId ?? "",
+        accounts
       });
     }
     this.opts.log?.(`paired \u2014 ${this.tools.size} ${this.tools.size === 1 ? "tool" : "tools"} advertised (host dir: ${this.hostStateDir})`);
@@ -26509,8 +26554,20 @@ var SidecarServer = class {
       this.ch.send({ t: "room-open-result", id: m2.id, ok: false, problems: ["this sidecar does not host rooms"] });
       return;
     }
+    if (this.opts.teamMode && this.clientId === void 0) {
+      this.ch.send({
+        t: "room-open-result",
+        id: m2.id,
+        ok: false,
+        problems: ["This connection has no verified identity (no clientId from hello), so it cannot open a room."]
+      });
+      return;
+    }
+    const clientId = this.clientId;
+    const owner = clientId === void 0 ? void 0 : m2.req.participants.find((p2) => p2.kind === "human" && p2.role === "owner");
+    const req = owner && clientId !== void 0 ? { ...m2.req, participants: m2.req.participants.map((p2) => p2 === owner ? { ...p2, id: clientId } : p2) } : m2.req;
     try {
-      const r2 = await this.opts.rooms.open(m2.req);
+      const r2 = await this.opts.rooms.open(req);
       this.ch.send(r2.ok ? { t: "room-open-result", id: m2.id, ok: true, room: r2.room } : { t: "room-open-result", id: m2.id, ok: false, problems: r2.problems });
     } catch (err) {
       this.ch.send({ t: "room-open-result", id: m2.id, ok: false, problems: [errMessage(err)] });
@@ -26522,7 +26579,9 @@ var SidecarServer = class {
       return;
     }
     try {
-      this.ch.send({ t: "room-list-result", id: m2.id, ok: true, rooms: await this.opts.rooms.list() });
+      const rooms = await this.opts.rooms.list();
+      const mine = !this.opts.teamMode ? rooms : this.clientId === void 0 ? [] : rooms.filter((r2) => r2.participants.some((p2) => p2.id === this.clientId));
+      this.ch.send({ t: "room-list-result", id: m2.id, ok: true, rooms: mine });
     } catch (err) {
       this.ch.send({ t: "room-list-result", id: m2.id, ok: false, error: errMessage(err) });
     }
@@ -26534,6 +26593,26 @@ var SidecarServer = class {
     }
     try {
       const found = await this.opts.rooms.read(m2.roomId);
+      if (found && this.opts.teamMode) {
+        if (this.clientId === void 0) {
+          this.ch.send({
+            t: "room-read-result",
+            id: m2.id,
+            ok: false,
+            error: "This connection has no verified identity, so membership in this room cannot be proven."
+          });
+          return;
+        }
+        if (!found.room.participants.some((p2) => p2.id === this.clientId)) {
+          this.ch.send({
+            t: "room-read-result",
+            id: m2.id,
+            ok: false,
+            error: `"${this.clientId}" is not a member of room "${m2.roomId}".`
+          });
+          return;
+        }
+      }
       this.ch.send(found ? { t: "room-read-result", id: m2.id, ok: true, room: found.room, messages: found.messages, turnCosts: found.turnCosts } : { t: "room-read-result", id: m2.id, ok: true, room: null, messages: [], turnCosts: [] });
     } catch (err) {
       this.ch.send({ t: "room-read-result", id: m2.id, ok: false, error: errMessage(err) });
@@ -26551,13 +26630,45 @@ var SidecarServer = class {
       this.ch.send({ t: "room-resume-result", id: m2.id, ok: false, error: errMessage(err) });
     }
   }
+  /* ONE identity rule for every room verb.
+   *
+   * `room-read` judges membership on `this.clientId` -- the identity this
+   * connection PROVED at `hello`. The mutating verbs used to hand
+   * `m.participantId` straight off the wire to `requireRole`/`mayAct`, so one
+   * branch enforced while another trusted the caller: a viewer could send the
+   * owner's participantId and close the room. Under team mode every verb now
+   * judges the caller the same way `room-read` does, and a connection with no
+   * proven identity is refused rather than attributed to whatever it claimed.
+   *
+   * KNOWN, DELIBERATE CONSEQUENCE (R9): the observed `clientId` and the
+   * participant ids a room is opened with are currently DIFFERENT NAMESPACES
+   * for everyone but the owner (whose id `onRoomOpen` overwrites with the
+   * observed one). Until those namespaces are reconciled, these verbs will
+   * REFUSE non-owner participants under `--mode team`. That refusal is the
+   * intended outcome -- fail closed, consistently -- and must NOT be "fixed"
+   * by falling back to the wire id, which is the hole this closes.
+   *
+   * With `--mode team` OFF this is the pre-existing behaviour, untouched: the
+   * wire id is attribution only, exactly as the spec knowingly accepted. */
+  actingId(claimed) {
+    if (!this.opts.teamMode) return { ok: true, id: claimed };
+    if (this.clientId === void 0) {
+      return { ok: false, error: "This connection has no verified identity (no clientId from hello), so it cannot act on a room." };
+    }
+    return { ok: true, id: this.clientId };
+  }
   async onRoomAnswer(m2) {
     if (!this.opts.rooms) {
       this.ch.send({ t: "room-answer-result", id: m2.id, ok: false, error: "this sidecar does not host rooms" });
       return;
     }
     try {
-      const room = await this.opts.rooms.answer(m2.roomId, m2.participantId, m2.text, m2.addressed);
+      const actor = this.actingId(m2.participantId);
+      if (!actor.ok) {
+        this.ch.send({ t: "room-answer-result", id: m2.id, ok: false, error: actor.error });
+        return;
+      }
+      const room = await this.opts.rooms.answer(m2.roomId, actor.id, m2.text, m2.addressed);
       this.ch.send({ t: "room-answer-result", id: m2.id, ok: true, room });
     } catch (err) {
       this.ch.send({ t: "room-answer-result", id: m2.id, ok: false, error: errMessage(err) });
@@ -26569,7 +26680,12 @@ var SidecarServer = class {
       return;
     }
     try {
-      const room = await this.opts.rooms.interject(m2.roomId, m2.participantId, m2.text);
+      const actor = this.actingId(m2.participantId);
+      if (!actor.ok) {
+        this.ch.send({ t: "room-interject-result", id: m2.id, ok: false, error: actor.error });
+        return;
+      }
+      const room = await this.opts.rooms.interject(m2.roomId, actor.id, m2.text);
       this.ch.send({ t: "room-interject-result", id: m2.id, ok: true, room });
     } catch (err) {
       this.ch.send({ t: "room-interject-result", id: m2.id, ok: false, error: errMessage(err) });
@@ -26581,7 +26697,12 @@ var SidecarServer = class {
       return;
     }
     try {
-      const room = await this.opts.rooms.close(m2.roomId, m2.participantId, m2.reason);
+      const actor = this.actingId(m2.participantId);
+      if (!actor.ok) {
+        this.ch.send({ t: "room-close-result", id: m2.id, ok: false, error: actor.error });
+        return;
+      }
+      const room = await this.opts.rooms.close(m2.roomId, actor.id, m2.reason);
       this.ch.send({ t: "room-close-result", id: m2.id, ok: true, room });
     } catch (err) {
       this.ch.send({ t: "room-close-result", id: m2.id, ok: false, error: errMessage(err) });
@@ -26680,7 +26801,12 @@ var SidecarServer = class {
       return;
     }
     try {
-      const findings = await this.opts.rooms.editFinding(m2.roomId, m2.participantId, m2.edit);
+      const actor = this.actingId(m2.participantId);
+      if (!actor.ok) {
+        this.ch.send({ t: "room-finding-edit-result", id: m2.id, ok: false, error: actor.error });
+        return;
+      }
+      const findings = await this.opts.rooms.editFinding(m2.roomId, actor.id, m2.edit);
       this.ch.send({ t: "room-finding-edit-result", id: m2.id, ok: true, findings });
     } catch (err) {
       this.ch.send({ t: "room-finding-edit-result", id: m2.id, ok: false, error: errMessage(err) });
@@ -26983,6 +27109,7 @@ function startSidecar(opts) {
     procs: opts.procs,
     sessions: opts.sessions,
     rooms: opts.rooms,
+    teamMode: opts.teamMode,
     pauses: opts.pauses,
     clientDirName: opts.clientDirName,
     hosts: opts.hosts,
@@ -27167,6 +27294,7 @@ var FLAGS = [
   { flag: "--allow-origin", arg: "<url>", help: "Allow a browser origin to connect. Repeatable." },
   { flag: "--allow-shell", help: "Enable the shell tool. Off by default." },
   { flag: "--allow-lan", help: "Serve the local network, not just this machine: binds all interfaces and serves wss with a self-signed cert. --host / --tls-cert override each half." },
+  { flag: "--mode", arg: "team", help: "Route a permission ask to the connection whose run raised it, plus the other devices that owner is signed in on, rather than to everyone attached. The identity a client sends is CLAIMED and this daemon cannot verify it: attribution, not authorization. An ask is never diverted away from its owner, so a false claim can join a prompt but never steal one." },
   { flag: "--tls-cert", arg: "<file>", help: "TLS certificate for wss://." },
   { flag: "--tls-key", arg: "<file>", help: "TLS private key for wss://." },
   { flag: "--self-signed", help: "Generate a self-signed certificate instead of supplying one." },
@@ -28130,6 +28258,7 @@ var KNOWN_KEYS = [
   "maxChainDepth",
   "name",
   "appUrl",
+  "mode",
   "defaultModel",
   "mcpServers",
   "mcpAllow"
@@ -29290,7 +29419,11 @@ var STANDARD_POLICY = {
   name: "standard",
   description: "Read-only tools run automatically; writes ask for approval.",
   onViolation: "stop",
-  maxTurns: 8,
+  // maxTurns counts iterations WITHIN one user message (one model call plus
+  // its tool round-trip), not messages across a conversation -- 8 was
+  // exhausted inside a single tool-heavy reply. 0 means unlimited (see
+  // core/loop.ts); this default stays a finite backstop.
+  maxTurns: 40,
   permissions: {
     "prompd:propose_edit": "allow",
     // proposals are reviewed in the diff UI, not applied directly
@@ -29304,7 +29437,8 @@ var READ_ONLY_POLICY = {
   name: "read-only",
   description: "Inspection only \u2014 all writes and side effects are refused.",
   onViolation: "stop",
-  maxTurns: 8,
+  maxTurns: 40,
+  // see STANDARD_POLICY: counts iterations within one reply, not conversation turns
   tools: {
     deny: [
       "fs:write_file",
@@ -29347,7 +29481,9 @@ var AUTONOMOUS_POLICY = {
   name: "autonomous",
   description: "Everything runs automatically \u2014 no approval prompts (system config still asks).",
   onViolation: "warn",
-  maxTurns: 16,
+  // Higher than the other builtins: nobody is watching an autonomous run turn
+  // by turn, so it gets more headroom before the backstop kicks in.
+  maxTurns: 80,
   permissions: {
     "system:*": "ask"
     // even unattended, never silently reconfigure the harness
@@ -30080,6 +30216,10 @@ var forgetMemoryTool = {
     return `Forgot memory "${name}".`;
   }
 };
+function preview(v2, max = 200) {
+  if (v2.length <= max) return JSON.stringify(v2);
+  return `${JSON.stringify(v2.slice(0, max))}... (${v2.length} chars total)`;
+}
 var kvGetTool = {
   name: "kv_get",
   description: "Read a value you previously saved with kv_set, by key, from the local key/value store. This is a general note store \u2014 NOT a filesystem, working directory, or settings: use list_files/read_file for files.",
@@ -30099,10 +30239,42 @@ var kvSetTool = {
     required: ["key", "value"]
   },
   // Permission is gated centrally by the loop's policy/permission layer.
+  /*
+   * THE RESULT STATES WHAT WAS STORED, AND WHAT IT REPLACED.
+   *
+   * This used to return `Set ${key}.` -- nothing else. Two consequences, both
+   * observed in a real run:
+   *
+   * 1. "set bread=true" and "set bread=false" produced BYTE-IDENTICAL tool
+   *    results. An agent had no feedback that could distinguish a correct
+   *    write from a wrong one, so a mistaken value was indistinguishable from
+   *    a correct one for the rest of the conversation.
+   *
+   * 2. A LOST UPDATE was invisible. The common shape here is a list kept as
+   *    one blob under one key, updated read-modify-write: a later write
+   *    carrying a stale copy silently reverts an earlier one, and every
+   *    result still says "Set". A run marked two items done and only one
+   *    stayed done, with nothing anywhere to show the second had been undone.
+   *
+   * So: report the value, and name the value being replaced. An agent that
+   * overwrites "apples done, bread done" with "apples done, bread pending"
+   * now reads back, in the tool result it already has to process, exactly
+   * what it just destroyed. The read-back is what makes this a check rather
+   * than an echo of the argument -- a store that transformed, truncated or
+   * dropped the write is caught here instead of at the summary.
+   */
   async run(args, ctx) {
     const key = str4(args, "key");
-    await ctx.kv.set(key, str4(args, "value"));
-    return `Set ${key}.`;
+    const value = str4(args, "value");
+    const before = await ctx.kv.get(key);
+    await ctx.kv.set(key, value);
+    const after = await ctx.kv.get(key);
+    if (after !== value) {
+      return `WRITE DID NOT TAKE. "${key}" was set to ${preview(value)} but reads back as ${after == null ? "(not set)" : preview(after)}. Do not rely on this key; do not report it as saved.`;
+    }
+    if (before == null) return `Set "${key}" = ${preview(value)} (new key).`;
+    if (before === value) return `Set "${key}" = ${preview(value)} (unchanged).`;
+    return `Set "${key}" = ${preview(value)}, REPLACING ${preview(before)}. If that previous value held anything you did not mean to discard, it is gone.`;
   }
 };
 var recallResultTool = {
@@ -30604,6 +30776,18 @@ parameters:
     type: string
     description: The editor file / selection / compiled-output context block.
     default: ""
+  - name: skills
+    type: string
+    description: Instructions contributed by the skills enabled for this run.
+    default: ""
+  - name: memory
+    type: string
+    description: The index of notes saved to this run's memory plane.
+    default: ""
+  - name: run_context
+    type: string
+    description: Facts about THIS run the model cannot otherwise know \u2014 the date, and whatever the host adds (working directory, platform).
+    default: ""
   - name: app
     type: string
     description: Product name of the host application, used for the agent's own identity.
@@ -30611,13 +30795,22 @@ parameters:
 ---
 {% if persona %}{{ persona }}
 
-{% endif %}You are the {{ app }} assistant. You help the user do real work in {{ app }}: reading and changing files, composing and running prompts and workflows, and building software. What is in front of you differs by surface \u2014 an open file, a workflow canvas, a workspace, or nothing but this conversation \u2014 so work from the context you were actually given rather than assuming a particular screen.
+{% endif %}You are the {{ app }} assistant. You help the user do real work: reading and changing files, composing and running prompts and workflows, and building software. Work from the context you were given below rather than assuming a particular screen.
 
-To read or change files in the workspace, use the file tools; writes ask the user for permission first. Use compile_prompd to preview rendered output and search_packages to find registry packages. For any multi-step job, maintain a visible task list with todo_write: lay out the steps, keep one task in_progress, and mark each completed as you go. Prefer calling a tool over guessing, and be concise.
+Verify before you claim. Do not say something is done, fixed, passing or ready unless you checked it in this conversation and can point at what you checked. If you did not run it, say you did not run it. If a check failed, say so plainly and show what failed. A wrong claim of success costs the user far more than the check would have.
 
 Say what you assumed and what you did not do. A request that leaves room for interpretation gets its decisions named, one line each, so the user can correct one without unpicking the rest. How much you decide for yourself versus ask about is the mode's call, below.
 
-## Tools available this run
+A tool call that comes back denied, blocked or unavailable is a decision, not a failure to route around. Do not retry it, do not reach for another tool to accomplish the same thing, and never describe the change as made. Say what you wanted to do and stop.
+
+Prefer calling a tool over guessing: read the file rather than recalling it, run the command rather than predicting its output. Use the file tools to read and change files, and compile_prompd to preview rendered output. For a job with several steps, keep a visible task list with todo_write and mark each step as you finish it.
+
+Be brief. Lead with the answer, then only what the user needs to act on or check it. Use headings, lists and tables where they carry something prose would not, and prose everywhere else. Do not restate the request back, do not narrate what you are about to do, and do not end by summarizing what the user has just read.
+
+{% if run_context %}## This run
+{{ run_context }}
+
+{% endif %}## Tools available this run
 {{ tools }}
 {% if tool_guidance %}
 
@@ -30628,6 +30821,14 @@ Say what you assumed and what you did not do. A request that leaves room for int
 ## Mode
 {{ mode_hint }}
 {% endif %}
+{% if skills %}
+
+{{ skills }}
+{% endif %}
+{% if memory %}
+
+{{ memory }}
+{% endif %}
 {% if file_context %}
 
 {{ file_context }}
@@ -31890,26 +32091,39 @@ function makeAgentMemoryProvider(getFiles, memoryRoot) {
   };
 }
 
+// ../crew/room/types.ts
+function roleOf(p2) {
+  return p2.kind === "agent" ? null : p2.role ?? "contributor";
+}
+
 // ../crew/room/order.ts
 var ID_RE = /^[A-Za-z0-9_-]+$/;
 function isValidParticipantId(id) {
   return ID_RE.test(id);
 }
+function rotating(state) {
+  return state.mode === "conversation" ? state.participants.filter((p2) => p2.kind === "agent") : state.participants;
+}
 function currentSpeaker(state) {
   if (state.closed) return null;
-  if (state.jump) return state.participants.find((p2) => p2.id === state.jump) ?? null;
-  return state.participants[state.floor] ?? null;
+  const roster = rotating(state);
+  if (state.jump) {
+    const jumped = roster.find((p2) => p2.id === state.jump);
+    if (jumped) return jumped;
+  }
+  return roster[state.floor] ?? null;
 }
 function advance(state, addressed) {
   if (state.closed) return state;
+  const roster = rotating(state);
   const speaker = currentSpeaker(state);
   const spokeViaJump = state.jump != null;
   const turns = state.turns + 1;
   const mayAddress = !spokeViaJump;
-  const target = mayAddress && addressed && addressed !== speaker?.id && state.participants.some((p2) => p2.id === addressed) ? addressed : null;
-  let floor = spokeViaJump ? state.floor : (state.floor + 1) % state.participants.length;
-  if (target != null && state.participants[floor]?.id === target) {
-    floor = (floor + 1) % state.participants.length;
+  const target = mayAddress && addressed && addressed !== speaker?.id && roster.some((p2) => p2.id === addressed) ? addressed : null;
+  let floor = spokeViaJump ? state.floor : (state.floor + 1) % roster.length;
+  if (target != null && roster[floor]?.id === target) {
+    floor = (floor + 1) % roster.length;
   }
   const closed = turns >= state.maxTurns ? { by: "room", reason: `Turn cap reached (${state.maxTurns}).`, at: (/* @__PURE__ */ new Date()).toISOString() } : null;
   return { ...state, floor, jump: target, jumpBy: target ? speaker?.id ?? null : null, turns, closed };
@@ -31957,6 +32171,9 @@ function foldRoom(text) {
         maxUsd: typeof line.maxUsd === "number" ? line.maxUsd : null,
         spentUsd: 0,
         closed: null,
+        // Absent means a room written before conversation mode existed, and
+        // every one of those is a rotation room.
+        mode: line.mode ?? "rotation",
         // Absent, rather than 0, on a line whose `at` is missing or not a
         // number: "the log does not say" is not a date at the epoch.
         ...typeof line.at === "number" ? { openedAt: line.at } : {}
@@ -32036,6 +32253,7 @@ function foldSession(text) {
   const turns = [];
   let title = "";
   let titleLocked;
+  let movedTo;
   let updatedAt = 0;
   for (const raw of text.split("\n")) {
     const s2 = raw.trim();
@@ -32057,6 +32275,9 @@ function foldSession(text) {
     } else if (line.k === "turn" && Number.isInteger(line.i) && line.i >= 0 && typeof line.at === "number") {
       turns[line.i] = line.m;
       updatedAt = Math.max(updatedAt, line.at);
+    } else if (line.k === "moved" && typeof line.roomId === "string" && typeof line.at === "number") {
+      movedTo = { movedToRoom: line.roomId, at: line.at };
+      updatedAt = Math.max(updatedAt, line.at);
     }
   }
   if (!meta) return null;
@@ -32067,7 +32288,12 @@ function foldSession(text) {
     updatedAt: updatedAt || meta.createdAt,
     messages: turns.filter((t2) => t2 !== void 0),
     ...meta.surface ? { surface: meta.surface } : {},
-    ...titleLocked !== void 0 ? { titleLocked } : {}
+    // Only a STRING owner survives the fold: the line came from disk (or a
+    // sidecar), so its declared type guarantees nothing, and a non-string here
+    // would reach a comparison that decides how a row is drawn.
+    ...typeof meta.owner === "string" && meta.owner ? { owner: meta.owner } : {},
+    ...titleLocked !== void 0 ? { titleLocked } : {},
+    ...movedTo !== void 0 ? { movedTo } : {}
   };
 }
 
@@ -32477,9 +32703,37 @@ function validateRoomRequest(req) {
       "A browser cannot host a room: the messages and outcome a turn produces never leave the browser tab's worker, so the room would rotate blindly with every hand-over and close silently lost. Choose the daemon runtime instead."
     );
   }
+  if (req.mode === "conversation") {
+    if (!req.participants.some((p2) => p2.kind === "agent")) {
+      problems.push(
+        "A conversation room needs at least one agent: humans never hold the floor in this mode, so a room without one has nobody who can ever take a turn."
+      );
+    }
+    if (req.presence === "wait") {
+      problems.push(
+        'presence "wait" means waiting for a person to take their turn, and in a conversation room nobody does. Use "carry-on".'
+      );
+    }
+  }
   if (!Number.isInteger(req.maxTurns) || req.maxTurns < 1) {
     problems.push("The turn cap must be a positive whole number.");
   }
+  const ROLES = ["owner", "contributor", "viewer"];
+  const owners = req.participants.filter((p2) => p2.kind === "human" && p2.role === "owner");
+  if (owners.length > 1) {
+    problems.push(
+      `A room has one owner; this request names ${owners.length}: ${owners.map((p2) => p2.name).join(", ")}.`
+    );
+  }
+  for (const p2 of req.participants) {
+    const role = p2.role;
+    if (role === void 0) continue;
+    if (p2.kind === "agent") {
+      problems.push(`"${p2.name}" is an agent and cannot hold a role: agents are the work, not participants who are granted access.`);
+    } else if (!ROLES.includes(role)) {
+      problems.push(`"${role}" is not a role. Known roles: ${ROLES.join(", ")}.`);
+    }
+  }
   return problems;
 }
 async function planOpen(req, reach, at2) {
@@ -32511,7 +32765,8 @@ async function planOpen(req, reach, at2) {
       brief: (req.brief ?? "").trim(),
       ...req.maxUsd !== void 0 ? { maxUsd: req.maxUsd } : {},
       runtime: req.runtime,
-      presence: req.presence
+      presence: req.presence,
+      ...req.mode !== void 0 ? { mode: req.mode } : {}
     }
   };
 }
@@ -42367,6 +42622,44 @@ function formatOffloadRef(ref) {
 ${ref.preview}${ref.bytes > ref.preview.length ? "\n\u2026(truncated)" : ""}` : head;
 }
 
+// ../harness/core/contextPressure.ts
+var CONTEXT_MARKER = "[context] ";
+var PRESSURE_BANDS = [0.6, 0.8, 0.9];
+var PRESSURE_HYSTERESIS = 0.05;
+var initialPressureGate = { crossed: 0 };
+function highestBandAtOrBelow(fill, slack = 0) {
+  let best = 0;
+  for (const b2 of PRESSURE_BANDS) if (fill >= b2 - slack) best = b2;
+  return best;
+}
+function pressureDecision(fill, gate) {
+  const current2 = highestBandAtOrBelow(fill);
+  if (current2 > gate.crossed) return { band: current2, next: { crossed: current2 } };
+  const held = highestBandAtOrBelow(fill, PRESSURE_HYSTERESIS);
+  return { band: null, next: { crossed: Math.min(gate.crossed, held) } };
+}
+function pressureMessage(band, fill) {
+  const pct = Math.round(fill * 100);
+  switch (band) {
+    case 0.6:
+      return `${CONTEXT_MARKER}Context is ${pct}% full. Read files in ranges rather than whole, summarize tool output rather than quoting it back, and stop re-reading things already in this conversation.`;
+    case 0.8:
+      return `${CONTEXT_MARKER}Context is ${pct}% full. Finish the task in progress and report it; start no new exploration, and open nothing large. If the work does not fit, say what is left rather than beginning it.`;
+    case 0.9:
+      return `${CONTEXT_MARKER}Context is ${pct}% full. Stop gathering and answer now with what you already have, naming what you did not get to. Further reading will be lost.`;
+  }
+}
+function contextWindowLine(contextWindow) {
+  if (!contextWindow || contextWindow <= 0) return "";
+  return `Your context window is ${contextWindow.toLocaleString("en-US")} tokens. You will be told when it is filling up.`;
+}
+function isContextNote(m2) {
+  return m2.role === "assistant" && typeof m2.content === "string" && m2.content.startsWith(CONTEXT_MARKER);
+}
+function contextNote(band, fill) {
+  return { role: "assistant", content: pressureMessage(band, fill) };
+}
+
 // ../harness/core/compactHistory.ts
 var CHECKPOINT_MARKER = "[checkpoint] ";
 var ANCHOR_MARKER = "[anchor] ";
@@ -42416,11 +42709,11 @@ async function compactHistory(messages, opts) {
   const pending = tail3 && isUnansweredToolCall(tail3) ? tail3 : null;
   const body2 = pending ? messages.slice(0, -1) : messages;
   const system = body2.filter((m2) => m2.role === "system");
-  const collapsed = body2.filter((m2) => m2.role !== "system" && m2.role !== "user");
+  const collapsed = body2.filter((m2) => m2.role !== "system" && m2.role !== "user" && !isContextNote(m2));
   const kept = [];
   let answered = null;
   for (const m2 of body2) {
-    if (isOwnMarker(m2)) continue;
+    if (isOwnMarker(m2) || isContextNote(m2)) continue;
     if (m2.role === "assistant" && typeof m2.content === "string") answered = m2;
     if (m2.role !== "user") continue;
     if (opts.anchor) {
@@ -42574,9 +42867,11 @@ async function runAgent(args) {
   const ctxWindow = compression?.contextWindow;
   const compressionStrategy = compression?.strategy ?? "eager";
   let fill = 0;
+  let pressureGate = initialPressureGate;
   let compactGate = { armed: true, floor: null };
   const deferredOffloads = [];
-  const maxTurns = policy.maxTurns ?? args.maxTurns ?? 8;
+  const maxTurns = policy.maxTurns !== void 0 ? policy.maxTurns : args.maxTurns !== void 0 ? args.maxTurns : 40;
+  const unlimitedTurns = maxTurns === 0;
   const signal = args.signal ?? new AbortController().signal;
   const emit = (e2) => args.onEvent?.(e2);
   const gstate = initialState();
@@ -42608,9 +42903,8 @@ async function runAgent(args) {
   const capped = (list) => list.length > MAX_PROVIDER_TOOLS ? list.slice(0, MAX_PROVIDER_TOOLS) : list;
   const activeTools = () => capped(loader ? [...eager, ...loader.loaded()] : eager);
   let sent = activeTools();
-  const indexedSystem = loader ? system ? `${system}
-
-${serverIndex(deferred)}` : serverIndex(deferred) : system;
+  const systemParts = [system, loader ? serverIndex(deferred) : "", contextWindowLine(ctxWindow)].filter(Boolean);
+  const indexedSystem = systemParts.length ? systemParts.join("\n\n") : system;
   const filledSystem = indexedSystem ? fillToolsMarker(indexedSystem, sent) : indexedSystem;
   if (filledSystem && !messages.some((m2) => m2.role === "system")) {
     messages.unshift({ role: "system", content: filledSystem });
@@ -42630,7 +42924,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
   let stopReason = "stop";
   let lastToolSig = null;
   let lastStreamErr = "";
-  for (let turn = 1; turn <= maxTurns; turn++) {
+  for (let turn = 1; unlimitedTurns || turn <= maxTurns; turn++) {
     if (signal.aborted) {
       stopReason = "aborted";
       break;
@@ -42668,13 +42962,28 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
         alog("compaction failed", e2 instanceof Error ? e2.message : String(e2));
       }
     }
-    gstate.turn = turn - 1;
-    const turnGate = evaluateTurnStart(policy, gstate);
-    if (!turnGate.ok) {
-      emit({ type: "policy-violation", kind: turnGate.violation.kind, message: turnGate.violation.message, action: turnGate.action, tool: turnGate.violation.tool });
-      if (turnGate.action === "stop") {
-        stopReason = "policy";
-        break;
+    const pressureFill = fill || estimateFill(messages, ctxWindow);
+    const pressure = pressureDecision(pressureFill, pressureGate);
+    pressureGate = pressure.next;
+    if (pressure.band !== null && ctxWindow) {
+      messages.push(contextNote(pressure.band, pressureFill));
+      emit({
+        type: "context-pressure",
+        band: pressure.band,
+        fill: pressureFill,
+        contextWindow: ctxWindow,
+        promptTokens: Math.round(pressureFill * ctxWindow)
+      });
+    }
+    if (!unlimitedTurns) {
+      gstate.turn = turn - 1;
+      const turnGate = evaluateTurnStart(policy, gstate);
+      if (!turnGate.ok) {
+        emit({ type: "policy-violation", kind: turnGate.violation.kind, message: turnGate.violation.message, action: turnGate.action, tool: turnGate.violation.tool });
+        if (turnGate.action === "stop") {
+          stopReason = "policy";
+          break;
+        }
       }
     }
     if (loader) {
@@ -42892,7 +43201,7 @@ ${serverIndex(deferred)}` : serverIndex(deferred) : system;
       stopReason = "policy";
       break;
     }
-    if (turn === maxTurns) stopReason = "max_turns";
+    if (!unlimitedTurns && turn === maxTurns) stopReason = "max_turns";
   }
   reconcileDanglingToolCalls(messages);
   for (const v2 of evaluateCompletion(policy, gstate)) {
@@ -42976,9 +43285,10 @@ function now() {
   return lastTs;
 }
 var JsonlSessionStore = class _JsonlSessionStore {
-  constructor(getFiles, root = sessionsRoot) {
+  constructor(getFiles, root = sessionsRoot, owner = () => void 0) {
     this.getFiles = getFiles;
     this.root = root;
+    this.owner = owner;
   }
   cursors = /* @__PURE__ */ new Map();
   async files() {
@@ -43013,11 +43323,13 @@ var JsonlSessionStore = class _JsonlSessionStore {
   async create(title, surface) {
     const createdAt = now();
     const id = uid("ses");
-    const meta = { k: "meta", id, title, createdAt, ...surface ? { surface } : {} };
+    const owner = this.owner();
+    const own = owner ? { owner } : {};
+    const meta = { k: "meta", id, title, createdAt, ...surface ? { surface } : {}, ...own };
     const text = encodeLine(meta);
     await (await this.files()).write(this.path(id), text);
     this.cursors.set(id, { text, turnJson: [], title });
-    return { id, title, createdAt, updatedAt: createdAt, messages: [], ...surface ? { surface } : {} };
+    return { id, title, createdAt, updatedAt: createdAt, messages: [], ...surface ? { surface } : {}, ...own };
   }
   async get(id) {
     const text = await (await this.files()).read(this.path(id)).catch(() => null);
@@ -43160,7 +43472,8 @@ var JsonlSessionStore = class _JsonlSessionStore {
       id: session.id,
       title: session.title,
       createdAt: session.createdAt,
-      ...session.surface ? { surface: session.surface } : {}
+      ...session.surface ? { surface: session.surface } : {},
+      ...session.owner ? { owner: session.owner } : {}
     });
     return { text: meta, turnJson: [], title: session.title, titleLocked: void 0 };
   }
@@ -43347,30 +43660,43 @@ function pricedForUsd(rates) {
   if (!rates) return false;
   return rates.inPrice > 0 || rates.outPrice > 0;
 }
-async function hydratePrices(endpoint, getToken, fetchImpl = fetch) {
-  const table = /* @__PURE__ */ new Map();
+async function fetchAvailableModels(endpoint, getToken, fetchImpl) {
   let token = null;
   try {
     token = await getToken();
   } catch {
     token = null;
   }
-  if (!token) return table;
+  if (!token) return [];
   try {
     const res = await fetchImpl(`${endpoint.replace(/\/$/, "")}/llm-providers/available`, {
       headers: { Authorization: `Bearer ${token}` }
     });
-    if (!res.ok) return table;
+    if (!res.ok) return [];
     const json = await res.json();
-    for (const p2 of json.providers ?? []) {
-      for (const m2 of p2.models ?? []) {
-        if (m2.inputPrice == null || m2.outputPrice == null) continue;
-        table.set(m2.model, { inPrice: m2.inputPrice, outPrice: m2.outputPrice });
-      }
-    }
+    const out = [];
+    for (const p2 of json.providers ?? []) out.push(...p2.models ?? []);
+    return out;
   } catch {
+    return [];
+  }
+}
+async function hydrateCatalog(endpoint, getToken, fetchImpl = fetch) {
+  const prices = /* @__PURE__ */ new Map();
+  const windows = /* @__PURE__ */ new Map();
+  const models = await fetchAvailableModels(endpoint, getToken, fetchImpl);
+  for (const m2 of models) {
+    if (m2.inputPrice != null && m2.outputPrice != null) {
+      prices.set(m2.model, { inPrice: m2.inputPrice, outPrice: m2.outputPrice });
+    }
+    if (typeof m2.contextWindow === "number" && m2.contextWindow > 0) {
+      windows.set(m2.model, m2.contextWindow);
+    }
   }
-  return table;
+  return { prices, windows };
+}
+async function hydratePrices(endpoint, getToken, fetchImpl = fetch) {
+  return (await hydrateCatalog(endpoint, getToken, fetchImpl)).prices;
 }
 
 // src/runner/permissionMessage.ts
@@ -43665,7 +43991,7 @@ function makeUnattendedPrompt(deps) {
     for (; ; ) {
       if (remaining <= 0) return { by: "timeout" };
       const tickMs = Math.min(remaining, PARK_POLL_MS);
-      if (deps.registry.isAttended()) {
+      if (deps.registry.isAttended(deps.owner)) {
         const ctrl2 = new AbortController();
         const answered = deps.registry.broadcastAsk(ask, ctrl2.signal);
         const ticked = sleep2(tickMs, ctrl2.signal).then(() => "tick");
@@ -43703,7 +44029,11 @@ function makeUnattendedPrompt(deps) {
         agent: deps.agent,
         tool: req.tool,
         input: req.input,
-        deadline: now2() + bound
+        deadline: now2() + bound,
+        // Spread-when-present rather than `owner: deps.owner`, so an ownerless
+        // ask has no `owner` KEY at all -- the registry's `!ask.owner` test
+        // stays unambiguous and a serialised ask does not carry a null.
+        ...deps.owner ? { owner: deps.owner } : {}
       };
       if (deps.unattended === "park") {
         deps.onParkChange?.(true);
@@ -43723,7 +44053,7 @@ function makeUnattendedPrompt(deps) {
         }
       }
       const fallthrough = deps.unattended === "allow" ? "allow" : "deny";
-      if (deps.registry.isAttended()) {
+      if (deps.registry.isAttended(deps.owner)) {
         deps.onParkChange?.(true);
         deps.onAskWait?.(ask);
         try {
@@ -44125,6 +44455,21 @@ var NodeRunnerService = class {
       registry: registry2,
       runId: sessionId,
       agent,
+      /* WHOSE RUN THIS IS, for `--mode team`'s ask routing.
+       *
+       * Only the `{ clientId }` variant names a connection. `{ owner }` is
+       * a dirName the daemon's own trigger dispatcher resolved from
+       * filesystem enumeration -- there is no socket behind it, so an ask
+       * it raises has nobody to route to and correctly falls back to
+       * fan-out. Same for a `{ clientId }` of `undefined` (an older peer).
+       *
+       * Deliberately the RAW clientId rather than `owner` (the resolved
+       * dirName computed above): this value is only ever compared against
+       * the identity a connection ATTACHED with, which is the same
+       * authenticated clientId the harness filed it under. It is never
+       * used as a path, so the manifest resolution that `owner` needs
+       * would not make it safer -- it would just make it fail to match. */
+      ..."owner" in identity || identity.clientId === void 0 ? {} : { owner: identity.clientId },
       unattended: def.policy.unattended ?? "deny",
       ...def.policy.parkTimeoutMs != null ? { parkTimeoutMs: def.policy.parkTimeoutMs } : {},
       remainingMs,
@@ -44906,6 +45251,20 @@ function evaluateRunComplete(completion, agents, maxChainDepth, log) {
 }
 
 // src/runner/roomService.ts
+function hasRecordedOwner(state) {
+  return state.participants.some((p2) => p2.kind === "human" && p2.role === "owner");
+}
+function mayAct(state, participantId, verb) {
+  const member = state.participants.find((p2) => p2.id === participantId);
+  if (!member) return `"${participantId}" is not a member of this room.`;
+  const role = roleOf(member);
+  if (role === null) return `"${participantId}" is an agent, not a participant who acts on the room.`;
+  if (verb === "close") {
+    if (!hasRecordedOwner(state)) return null;
+    return role === "owner" ? null : `Only the owner can ${verb} this room; you are a ${role}.`;
+  }
+  return role === "viewer" ? `You are a viewer in this room and cannot ${verb}.` : null;
+}
 function isDepsFactory(d2) {
   return typeof d2 === "function";
 }
@@ -45027,6 +45386,11 @@ function makeRoomService(opts) {
   }
   async function open(req) {
     return enqueue(req.roomId, async () => {
+      if (req.fromSession && req.fromSession.messages.length !== req.fromSession.turns) {
+        const message = `Room "${req.roomId}" was not opened: the promoted thread arrived with ${req.fromSession.messages.length} message(s) but ${req.fromSession.turns} were expected. Refusing to open a room missing part of the conversation.`;
+        log(`room "${req.roomId}" could not be opened: ${message}`);
+        return { ok: false, problems: [message] };
+      }
       let deps;
       try {
         deps = await resolveDeps(req.participants, req.maxUsd ?? null);
@@ -45037,6 +45401,15 @@ function makeRoomService(opts) {
       }
       const opened = await openRoom(req, opts.reachability, deps);
       if (!opened.ok) return opened;
+      if (req.fromSession) {
+        try {
+          await deps.store.appendTurns(req.roomId, 0, req.fromSession.messages, deps.now());
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          log(`room "${req.roomId}" opened but its promoted transcript failed to append: ${message}`);
+          return { ok: false, problems: [`Room "${req.roomId}" opened, but the promoted conversation could not be saved into it: ${message}`] };
+        }
+      }
       depsByRoom.set(req.roomId, deps);
       const room = summaryOf(opened.state, null, null, 0);
       record(room);
@@ -45092,10 +45465,22 @@ function makeRoomService(opts) {
     }
     return fresh;
   }
+  async function requireRole(deps, roomId, participantId, verb) {
+    const state = await deps.store.read(roomId);
+    if (!state || state.closed) return;
+    const refusal = mayAct(state, participantId, verb);
+    if (refusal) throw new Error(refusal);
+  }
   async function interject(roomId, participantId, text) {
     return enqueue(roomId, async () => {
       const deps = await baseDeps();
+      await requireRole(deps, roomId, participantId, "interject");
       await interjectHuman(roomId, participantId, text, deps);
+      const state = await deps.store.read(roomId);
+      if (state && !state.closed && state.mode === "conversation") {
+        const driveDeps = await depsFor(roomId);
+        if (driveDeps) return driveRoom(roomId, driveDeps);
+      }
       const summary = await summaryNow(roomId);
       record(summary);
       return summary;
@@ -45104,6 +45489,7 @@ function makeRoomService(opts) {
   async function closeRoom(roomId, participantId, reason) {
     return enqueue(roomId, async () => {
       const deps = await baseDeps();
+      await requireRole(deps, roomId, participantId, "close");
       await closeRoomByHuman(roomId, participantId, reason, deps);
       const summary = await summaryNow(roomId);
       record(summary);
@@ -45117,6 +45503,7 @@ function makeRoomService(opts) {
   async function editFinding(roomId, participantId, edit) {
     return enqueue(roomId, async () => {
       const deps = await baseDeps();
+      await requireRole(deps, roomId, participantId, "finding-edit");
       const doc = await editFindingByHuman(roomId, participantId, edit, deps);
       record(await summaryNow(roomId));
       return doc;
@@ -45126,6 +45513,7 @@ function makeRoomService(opts) {
     return enqueue(roomId, async () => {
       const deps = await depsFor(roomId);
       if (!deps) throw new Error(`No room "${roomId}".`);
+      await requireRole(deps, roomId, participantId, "answer");
       await answerHumanTurn(roomId, participantId, text, deps, addressed);
       return driveRoom(roomId, deps);
     });
@@ -45692,27 +46080,49 @@ function startDaemonCore(opts) {
 function makeAttendanceRegistry(opts) {
   const log = opts?.log ?? (() => {
   });
+  const teamMode = opts?.teamMode === true;
+  const EMPTY = /* @__PURE__ */ new Set();
   const clients = /* @__PURE__ */ new Set();
+  const identities = /* @__PURE__ */ new Map();
   let lastRegistrations = null;
   const outstanding = /* @__PURE__ */ new Map();
   let idCounter = 0;
-  const notifyResolved = (id, decision, by) => {
+  const recipients = (ask) => {
+    if (!teamMode || !ask.owner) return clients;
+    const owners = [];
+    const ownerAccounts = /* @__PURE__ */ new Set();
+    for (const [client, id] of identities) {
+      if (id.clientId !== ask.owner) continue;
+      owners.push(client);
+      for (const a2 of id.accounts) ownerAccounts.add(a2);
+    }
+    if (owners.length === 0) return EMPTY;
+    const out = new Set(owners);
+    if (ownerAccounts.size > 0) {
+      for (const [client, id] of identities) {
+        if (id.accounts.some((a2) => ownerAccounts.has(a2))) out.add(client);
+      }
+    }
+    return out;
+  };
+  const notifyResolved = (id, decision, by, byClientId) => {
     for (const c2 of clients) {
-      c2.resolved(id, decision, by);
+      c2.resolved(id, decision, by, byClientId);
     }
   };
-  const resolveEntry = (id, decision, by) => {
+  const resolveEntry = (id, decision, by, byClientId) => {
     const entry = outstanding.get(id);
     if (!entry) return;
     outstanding.delete(id);
     entry.resolve(decision);
-    notifyResolved(id, decision, by);
+    notifyResolved(id, decision, by, byClientId);
   };
   return {
-    attach(client) {
+    attach(client, identity) {
       clients.add(client);
+      if (identity) identities.set(client, identity);
       for (const { ask } of outstanding.values()) {
-        client.send(ask);
+        if (recipients(ask).has(client)) client.send(ask);
       }
       if (lastRegistrations) {
         try {
@@ -45725,6 +46135,7 @@ function makeAttendanceRegistry(opts) {
         if (detached) return;
         detached = true;
         clients.delete(client);
+        identities.delete(client);
         if (clients.size === 0 && outstanding.size > 0) {
           log(`attendance: last client detached with ${outstanding.size} ask(s) outstanding; resolving null`);
           for (const [id, entry] of Array.from(outstanding.entries())) {
@@ -45734,14 +46145,22 @@ function makeAttendanceRegistry(opts) {
         }
       };
     },
-    isAttended() {
-      return clients.size > 0;
+    attachedIdentities() {
+      return Array.from(identities.values());
+    },
+    isAttended(owner) {
+      if (!teamMode || !owner) return clients.size > 0;
+      for (const id of identities.values()) {
+        if (id.clientId === owner) return true;
+      }
+      return false;
     },
     outstanding() {
       return Array.from(outstanding.values()).map((e2) => e2.ask);
     },
     broadcastAsk(ask, signal) {
-      if (clients.size === 0) {
+      const to = recipients(ask);
+      if (to.size === 0) {
         return Promise.resolve(null);
       }
       return new Promise((resolve14) => {
@@ -45759,7 +46178,7 @@ function makeAttendanceRegistry(opts) {
             resolve14(decision);
           }
         });
-        for (const c2 of clients) {
+        for (const c2 of to) {
           c2.send(ask);
         }
         if (signal) {
@@ -45789,8 +46208,9 @@ function makeAttendanceRegistry(opts) {
         }
       }
     },
-    answer(id, decision) {
-      resolveEntry(id, decision, "client");
+    answer(id, decision, by) {
+      const named = by ? identities.get(by)?.clientId : void 0;
+      resolveEntry(id, decision, "client", named);
     },
     settle(id, decision, by) {
       resolveEntry(id, decision, by);
@@ -47188,6 +47608,7 @@ var FLAG_TO_KEY = {
   "--clone-under": "cloneUnder",
   "--allow-origin": "allowOrigins",
   "--allow-lan": "allowLan",
+  "--mode": "teamMode",
   "--allow-shell": "allowShell",
   "--keep-transcripts": "keepTranscripts",
   "--isolation": "isolation",
@@ -47206,7 +47627,7 @@ var FLAG_TO_KEY = {
   "--default-model": "defaultModel",
   "--name": "name"
 };
-var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.8.8";
+var DEFAULT_GUEST_IMAGE2 = "prompd/corenel-sandbox:0.10.0";
 function parseArgsWithProvenance(argv) {
   const explicit = /* @__PURE__ */ new Set();
   for (const a2 of argv) {
@@ -47223,6 +47644,7 @@ function parseArgs(argv) {
     allowOrigins: [],
     allowShell: false,
     allowLan: false,
+    teamMode: false,
     keepTranscripts: false,
     isolation: "none",
     msbBin: process.env.MSB_BIN ?? "msb",
@@ -47277,7 +47699,11 @@ function parseArgs(argv) {
         throw new Error(`--snapshot-budget: ${e2 instanceof Error ? e2.message : String(e2)}`);
       }
     } else if (a2 === "--allow-lan") out.allowLan = true;
-    else if (a2 === "--tls-cert") out.tlsCert = resolve10(argv[++i2]);
+    else if (a2 === "--mode") {
+      const mode = argv[++i2];
+      if (mode !== "team") throw new Error(`unknown --mode "${mode}". Known modes: team`);
+      out.teamMode = true;
+    } else if (a2 === "--tls-cert") out.tlsCert = resolve10(argv[++i2]);
     else if (a2 === "--tls-key") out.tlsKey = resolve10(argv[++i2]);
     else if (a2 === "--self-signed") out.selfSigned = true;
     else if (a2 === "--tunnel") out.tunnel = argv[++i2];
@@ -47399,6 +47825,17 @@ function layerConfig(args, explicit, file) {
     from[key] = "file";
     if (key === "endpoint") out.endpointExplicit = true;
   }
+  if (explicit.has("teamMode")) {
+    from.teamMode = "flag";
+  } else if (file.mode === void 0) {
+    from.teamMode = "default";
+  } else if (file.mode === "team") {
+    out.teamMode = true;
+    from.teamMode = "file";
+  } else {
+    warnings.push(`daemon.json: "mode" must be "team", got ${JSON.stringify(file.mode)} -- ignoring it, using the default`);
+    from.teamMode = "default";
+  }
   if (out.allowLan) {
     if (from.host === "default") out.host = "0.0.0.0";
     if (from.selfSigned === "default" && !out.tlsCert && !out.tlsKey) out.selfSigned = true;
@@ -47580,6 +48017,11 @@ var KEY_TYPES = {
   allowShell: "boolean",
   keepTranscripts: "boolean",
   isolation: "string",
+  // A string, not a boolean, so the file spells it the way the flag does
+  // (`--mode team`) and a second mode needs no second key. layer.ts refuses
+  // any value but 'team', with a warning -- typed loosely here, validated
+  // strictly there, the same split `isolation` has.
+  mode: "string",
   msbBin: "string",
   guestImage: "string",
   maxChainDepth: "number",
@@ -51071,7 +51513,7 @@ async function main() {
     // schedule looks broken for a quarter of an hour.
     onWrite: () => core?.wake()
   });
-  const attendance = makeAttendanceRegistry({ log: slog });
+  const attendance = makeAttendanceRegistry({ log: slog, teamMode: args.teamMode });
   const runs = makeRunHub({ log: slog });
   let core;
   let crewSessions;
@@ -51387,6 +51829,10 @@ async function main() {
     // (roomCtx above) -- absent otherwise, so `welcome.features` omits
     // 'rooms' exactly like every other optional daemon capability here.
     rooms: core?.rooms,
+    // Same operator flag `attendance.ts` already reads for ask routing --
+    // `room-list` applies the identical private-by-default narrowing to
+    // rooms once this is on (see `onRoomList`'s R7 comment).
+    teamMode: args.teamMode,
     // The pause control plane. Absent without --daemon, so 'agent-pause' is not
     // advertised and a client correctly reports that this daemon holds none.
     ...pauses ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.8.8",
+  "version": "0.10.0",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",
@@ -36,11 +36,11 @@
     "esbuild": "^0.21.5",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "@corenel/config": "0.1.0",
-    "@corenel/mcp": "0.1.0",
-    "@corenel/protocol": "0.7.3",
-    "@corenel/tools-node": "0.4.0",
-    "@corenel/harness": "0.8.0",
+    "@corenel/config": "0.3.0",
+    "@corenel/mcp": "0.2.0",
+    "@corenel/protocol": "0.9.0",
+    "@corenel/harness": "0.10.0",
+    "@corenel/tools-node": "0.5.0",
     "@corenel/crew": "0.0.0"
   },
   "repository": {