@deepseek-ai/dsh-cordis-client-runner 0.2.1-alpha.2 → 0.2.1-alpha.4

package/lib/client.js

@@ -1416,7 +1416,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					},
 					{
 						signature: "setFontSize(role: FontRole, px: number): void",
-						description: "Change one role's font size — the only font-size write entry. Accepted values are written through the settings scope and emit `theme/change`.",
+						description: "Change one role's font size. Accepted values are written through the settings scope and emit `theme/change`.",
 						parameters: [{
 							name: "role",
 							description: "font role."
@@ -1499,15 +1499,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 						}]
 					},
 					{
-						signature: "openWorkspace(workspaceId: WorkspaceId, beforeOpen?: (sessionId: SessionId) => void): Promise<void>",
+						signature: "openWorkspace( workspaceId: WorkspaceId, beforeOpen?: (sessionId: SessionId) => void, options?: Pick<StartSessionOptions, 'agentPreset'>, ): Promise<void>",
 						description: "Connect a Workspace and open its Session unless a later navigation supersedes it.",
-						parameters: [{
-							name: "workspaceId",
-							description: "target Workspace."
-						}, {
-							name: "beforeOpen",
-							description: "optional synchronous preparation for the selected Session, skipped after supersession; a throw aborts the open and releases the retained reference."
-						}],
+						parameters: [
+							{
+								name: "workspaceId",
+								description: "target Workspace."
+							},
+							{
+								name: "beforeOpen",
+								description: "optional synchronous preparation for the selected Session, skipped after supersession; a throw aborts the open and releases the retained reference."
+							},
+							{
+								name: "options",
+								description: "choices for the Session the connection creates or reuses."
+							}
+						],
 						returns: "completion; a superseded request may create a Session but does not open it.",
 						throws: ["on failure; a refused creation is also shown through the Workspace notice unless a later navigation or disposal superseded the request."]
 					},
@@ -1531,11 +1538,14 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 						returns: "the child SessionId after creation and inherited-title increment."
 					},
 					{
-						signature: "connectWorkspace(workspaceId: WorkspaceId): Promise<SessionId>",
-						description: "Resolve the reusable or newly created blank Session for a Workspace.",
+						signature: "connectWorkspace(workspaceId: WorkspaceId, options?: Pick<StartSessionOptions, 'agentPreset'>): Promise<SessionId>",
+						description: "Resolve the Session for a new conversation in a Workspace: the Host reuses the first listed blank member while it is reusable and otherwise creates one, under the requested preset or the Host default.",
 						parameters: [{
 							name: "workspaceId",
 							description: "target Workspace."
+						}, {
+							name: "options",
+							description: "choices for the created or reused Session."
 						}],
 						returns: "a Session already addressable through the Session Controller."
 					},
@@ -1547,7 +1557,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 							description: "explicit target; absent inherits the current or most recent Workspace."
 						}, {
 							name: "options",
-							description: "initial content; existing text or attachments are preserved unless clearPreviousDraft is true."
+							description: "initial content and the reused blank's preset; existing text or attachments are preserved unless clearPreviousDraft is true."
 						}]
 					},
 					{
@@ -1793,12 +1803,16 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 			},
 			{
 				name: "ConnectionHandle",
-				declaration: "export interface ConnectionHandle {\n    readonly isLoopback: boolean;\n    readonly generation: ConnectionGenerationState;\n    readonly state: ConnectionStateSource;\n    readonly rpc: ClientConnectionRpc;\n    reconnect(): void;\n    registerGenerationSource(source: ConnectionGenerationSource): () => void;\n    start(sinks: ConnectionSinks, config?: ConnectionRecoveryConfig): ConnectionLoop;\n}"
+				declaration: "export interface ConnectionHandle {\n    readonly interactions: ConnectionInteractions;\n    readonly isLoopback: boolean;\n    readonly generation: ConnectionGenerationState;\n    readonly state: ConnectionStateSource;\n    readonly rpc: ClientConnectionRpc;\n    openWebSocket(path: string): ConnectionWebSocket;\n    reconnect(): void;\n    registerGenerationSource(source: ConnectionGenerationSource): () => void;\n    start(sinks: ConnectionSinks, config?: ConnectionRecoveryConfig): ConnectionLoop;\n}"
 			},
 			{
 				name: "ConnectionHostInfo",
 				declaration: "export interface ConnectionHostInfo {\n    readonly home: string;\n}"
 			},
+			{
+				name: "ConnectionInteractions",
+				declaration: "export type ConnectionInteractions = 'answer' | 'none';"
+			},
 			{
 				name: "ConnectionLoop",
 				declaration: "export interface ConnectionLoop {\n    stop(): void;\n}"
@@ -1827,6 +1841,14 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				name: "ConnectionStateSource",
 				declaration: "export interface ConnectionStateSource {\n    getSnapshot(): ConnectionState | undefined;\n    subscribe(listener: () => void): () => void;\n}"
 			},
+			{
+				name: "ConnectionWebSocket",
+				declaration: "export interface ConnectionWebSocket {\n    readonly readyState: number;\n    send(data: string): void;\n    close(code?: number, reason?: string): void;\n    addEventListener<Event extends keyof ConnectionWebSocketEventMap>(event: Event, listener: (event: ConnectionWebSocketEventMap[Event]) => void, options?: {\n        readonly once?: boolean;\n    }): void;\n    removeEventListener<Event extends keyof ConnectionWebSocketEventMap>(event: Event, listener: (event: ConnectionWebSocketEventMap[Event]) => void): void;\n}"
+			},
+			{
+				name: "ConnectionWebSocketEventMap",
+				declaration: "export interface ConnectionWebSocketEventMap {\n    readonly open: object;\n    readonly error: object;\n    readonly close: object;\n    readonly message: {\n        readonly data: unknown;\n    };\n}"
+			},
 			{
 				name: "DraftInitializationOptions",
 				declaration: "export interface DraftInitializationOptions {\n    readonly prompt?: string;\n    readonly clearPreviousDraft?: boolean;\n}"
@@ -1897,7 +1919,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 			},
 			{
 				name: "ISessions",
-				declaration: "export interface ISessions {\n    readonly list: ObservableSnapshot<SessionListState>;\n    retain(target: SessionTarget, options: SessionRetainOptions): SessionReference;\n    using<T>(target: SessionTarget, options: SessionRetainOptions, operation: (reference: SessionReference) => T | Promise<T>): Promise<T>;\n    retainInfo(id: SessionId): ObservableSnapshot<SessionRetainInfo>;\n    readonly searchResultLimit: number;\n    create(opts?: {\n        workspaceId?: WorkspaceId;\n        cwd?: string;\n        sessionId?: SessionId;\n    }): Promise<SessionId>;\n    subagentAddress(id: SessionId): SubagentAddress | undefined;\n    refreshProjections(sessionId: SessionId): Promise<void>;\n    refresh(): Promise<void>;\n    search(query: string, signal: AbortSignal): Promise<RemoteResult<{\n        items: SessionSearchResultItem[];\n        hasMore: boolean;\n    }>>;\n    fork(opts: {\n        sessionId: SessionId;\n        atSeq?: number;\n        increaseTitle?: boolean;\n        onCreated?: (childId: SessionId) => void;\n        allowMigration?: boolean;\n    }): Promise<SessionId>;\n    scope(id: SessionId): AgentContext | undefined;\n    scopeOf(ctx: Context): SessionId | undefined;\n    sessionOf(ctx: Context): SessionFace | undefined;\n    binding(id: SessionId): SessionBinding | undefined;\n}"
+				declaration: "export interface ISessions {\n    readonly list: ObservableSnapshot<SessionListState>;\n    retain(target: SessionTarget, options: SessionRetainOptions): SessionReference;\n    using<T>(target: SessionTarget, options: SessionRetainOptions, operation: (reference: SessionReference) => T | Promise<T>): Promise<T>;\n    retainInfo(id: SessionId): ObservableSnapshot<SessionRetainInfo>;\n    readonly searchResultLimit: number;\n    create(opts?: {\n        workspaceId?: WorkspaceId;\n        cwd?: string;\n        sessionId?: SessionId;\n        agentPreset?: string;\n    }): Promise<SessionId>;\n    subagentAddress(id: SessionId): SubagentAddress | undefined;\n    refreshProjections(sessionId: SessionId): Promise<void>;\n    refresh(): Promise<void>;\n    search(query: string, signal: AbortSignal): Promise<RemoteResult<{\n        items: SessionSearchResultItem[];\n        hasMore: boolean;\n    }>>;\n    fork(opts: {\n        sessionId: SessionId;\n        atSeq?: number;\n        increaseTitle?: boolean;\n        onCreated?: (childId: SessionId) => void;\n        allowMigration?: boolean;\n    }): Promise<SessionId>;\n    scope(id: SessionId): AgentContext | undefined;\n    scopeOf(ctx: Context): SessionId | undefined;\n    sessionOf(ctx: Context): SessionFace | undefined;\n    binding(id: SessionId): SessionBinding | undefined;\n}"
 			},
 			{
 				name: "KeyedHooksSources",
@@ -1909,7 +1931,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 			},
 			{
 				name: "KeyedStandardSource",
-				declaration: "export type KeyedStandardSource = (key: string) => HostObservable<unknown> | undefined;"
+				declaration: "export type KeyedStandardSource = (key: string, member?: string) => HostObservable<unknown> | undefined;"
 			},
 			{
 				name: "KeyPropsOf",
@@ -2205,7 +2227,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 			},
 			{
 				name: "SlotEntryDef",
-				declaration: "export interface SlotEntryDef {\n    kind: SlotKind;\n    scope: SlotScope;\n    owner?: object;\n    keyProps?: Record<string, object>;\n    hookContext?: unknown;\n    inject?: object;\n}"
+				declaration: "export interface SlotEntryDef {\n    kind: SlotKind;\n    scope: SlotScope;\n    inline?: true;\n    owner?: object;\n    keyProps?: Record<string, object>;\n    hookContext?: unknown;\n    inject?: object;\n}"
 			},
 			{
 				name: "SlotFactoryMap",
@@ -2241,7 +2263,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 			},
 			{
 				name: "SlotSpec",
-				declaration: "export type SlotSpec<E extends SlotEntryDef> = {\n    kind: E['kind'];\n    scope: E['scope'];\n} & ('inject' extends keyof E ? E extends {\n    inject: infer Injected extends object;\n} ? {\n    inject: Injected;\n} : {\n    inject?: object;\n} : {\n    inject?: never;\n});"
+				declaration: "export type SlotSpec<E extends SlotEntryDef> = {\n    kind: E['kind'];\n    scope: E['scope'];\n    inline?: true;\n} & ('inject' extends keyof E ? E extends {\n    inject: infer Injected extends object;\n} ? {\n    inject: Injected;\n} : {\n    inject?: object;\n} : {\n    inject?: never;\n});"
 			},
 			{
 				name: "SnapshotSelectorHook",
@@ -2249,7 +2271,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 			},
 			{
 				name: "StartSessionOptions",
-				declaration: "export type StartSessionOptions = DraftInitializationOptions;"
+				declaration: "export interface StartSessionOptions extends DraftInitializationOptions {\n    readonly agentPreset?: string;\n}"
 			},
 			{
 				name: "StoreDecl",
@@ -2420,13 +2442,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Stable identity handed to an optional approval-detail renderer. */\nexport interface ApprovalDetailOwnerProps {\n  /** Tool call correlated with the request. */\n  callId: ToolCallId\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2434,6 +2458,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2474,13 +2499,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner currency of finalized-assistant actions. */\nexport interface AssistantActionOwnerProps {\n  messageId: MessageId\n}"],
 				ownerPropsReferences: ["MessageId"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2488,6 +2515,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2497,7 +2525,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-message-feedback MessageFeedbackActions id 'feedback'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.assistant-actions', () => ctx.slots.register(\n      { name: 'conversation.chat.assistant-actions', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:414"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:441"
 			},
 			{
 				key: "conversation.chat.commandview",
@@ -2518,13 +2546,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"CompactionSummaryNode"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2532,6 +2562,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -2541,7 +2572,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.commandview', () => ctx.slots.register(\n      { name: 'conversation.chat.commandview', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:396"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:423"
 			},
 			{
 				key: "conversation.chat.flow",
@@ -2550,20 +2581,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				summary: "Ordered Chat rows and local echoes with viewport-bound visibility hooks.",
 				doc: "Ordered Chat rows and local echoes with viewport-bound visibility hooks.",
 				registerOptions: [],
-				ownerProps: ["/** Ordered rows and reconciled local echoes rendered inside one Chat viewport. */\nexport interface ChatFlowOwnerProps extends Pick<ChatNodeOwnerProps,\n  'cwd' | 'openSkill' | 'openFile' | 'inspectCall' | 'forkAt' | 'loadImage' | 'fileMentions'> {\n  readonly entries: readonly RenderEntry[]\n  readonly pendingInputs: readonly (PendingSubmission | InboxState['next-step'][number])[]\n  readonly lastInputTurn: number | undefined\n  readonly deferCollapse: boolean\n}"],
+				ownerProps: ["/** Ordered rows and reconciled local echoes rendered inside one Chat viewport. */\nexport interface ChatFlowOwnerProps extends Pick<ChatNodeOwnerProps,\n  'cwd' | 'openFile' | 'inspectCall' | 'forkAt' | 'loadImage' | 'fileMentions'> {\n  readonly entries: readonly RenderEntry[]\n  readonly pendingInputs: readonly (PendingSubmission | InboxState['next-step'][number])[]\n  readonly lastInputTurn: number | undefined\n  readonly deferCollapse: boolean\n}"],
 				ownerPropsReferences: [
 					"ChatNodeOwnerProps",
 					"PendingSubmission",
 					"RenderEntry"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2571,6 +2604,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2580,7 +2614,49 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-chat ChatFlow"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.flow', () => ctx.slots.register(\n      { name: 'conversation.chat.flow' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:365"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:390"
+			},
+			{
+				key: "conversation.chat.message.images",
+				kind: "single",
+				scope: "session",
+				summary: "Renderer for one consecutive group of durable message images.",
+				doc: "Renderer for one consecutive group of durable message images. The owner\nsupplies image references, an authorized loader, and alignment. A\nregistration replaces the shipped gallery; without one, images are omitted.",
+				registerOptions: [],
+				ownerProps: ["/** Message image group handed to the optional attachment presentation plugin. */\nexport interface MessageImagesOwnerProps {\n  /** Durable references or submission-echo previews in source order. */\n  images: readonly MessageImageSource[]\n  /** Session-authorized image URL loader for the durable arm. */\n  loadImage: MessageImageLoader\n  /** Horizontal placement inside the owning record. */\n  align: 'start' | 'end'\n  /** Force every image into the compact message-attachment tile size. */\n  compact?: boolean\n  /** Fixed, uncropped thumbnail for an attachment list row. */\n  thumbnail?: boolean\n}"],
+				ownerPropsReferences: [
+					"Message",
+					"MessageImageLoader",
+					"MessageImageSource"
+				],
+				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
+					"useResource: UseResource",
+					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"usePanelInfo: UsePanelInfo",
+					"useSessions: UseSessions",
+					"useSessionStatus: UseSessionStatus",
+					"useSessionRetainInfo: UseSessionRetainInfo",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
+					"useChat: UseChat",
+					"useConversation: UseConversation",
+					"useInput: SnapshotSelectorHook<InputState>",
+					"inputActions: InputActions",
+					"useSession: SessionSnapshotSelector",
+					"sessionId: SessionId",
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
+					"useTrajectory: UseTrajectory"
+				],
+				keyDomain: "",
+				hookContext: "",
+				slotInject: "",
+				declaredBy: "an entry in 'conversation.chat.node' (client-ui-chat), so it exists while that entry is mounted",
+				occupants: ["client-ui-attachment MessageImages"],
+				replaceRisk: "shadows-shipped-ui",
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.message.images', () => ctx.slots.register(\n      { name: 'conversation.chat.message.images' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:415"
 			},
 			{
 				key: "conversation.chat.node",
@@ -2594,23 +2670,24 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					type: "string",
 					doc: "Your cell key: the entry renders where the owner dispatches this exact key. Registering an already-occupied key replaces that occupant."
 				}],
-				ownerProps: ["/** Stable owner currency delivered to a keyed Chat renderer. */\nexport interface ChatNodeOwnerProps {\n  /** Renderer-owned Node portion selected by the grouping Definition. */\n  groupPart?: string\n  cwd?: string | undefined\n  /** Open the current source file of a skill referenced by a sent message. */\n  openSkill: (name: string) => void\n  openFile: (path: string, options?: OpenFileOptions) => void\n  inspectCall: ((callId: ToolCallId) => void) | undefined\n  forkAt: (seq: number) => void\n  /**\n   * Session-authorized image loader, down-threaded from the Chat view so a\n   * chat-node renderer can render the attachment presentation slot directly\n   * with only the durable references plus this loader, instead of receiving a\n   * rendering closure.\n   */\n  loadImage: MessageImageLoader\n  renderMessageImages: RenderMessageImages\n  fileMentions: (owner: TurnTailOwnerProps) => MarkdownFileMentions | undefined\n  /** Turn-process state when this Node belongs to a projected Turn. */\n  turnProcess?: TurnProcessOwnerProps | undefined\n}"],
+				ownerProps: ["/** Stable owner currency delivered to a keyed Chat renderer. */\nexport interface ChatNodeOwnerProps {\n  /** Renderer-owned Node portion selected by the grouping Definition. */\n  groupPart?: string\n  cwd?: string | undefined\n  openFile: (path: string, options?: OpenFileOptions) => void\n  inspectCall: ((callId: ToolCallId) => void) | undefined\n  forkAt: (seq: number) => void\n  /** Session-authorized image loader supplied by the Chat view. */\n  loadImage: MessageImageLoader\n  fileMentions: (owner: TurnTailOwnerProps) => MarkdownFileMentions | undefined\n  /** Turn-process state when this Node belongs to a projected Turn. */\n  turnProcess?: TurnProcessOwnerProps | undefined\n}"],
 				ownerPropsReferences: [
 					"MarkdownFileMentions",
 					"MessageImageLoader",
 					"OpenFileOptions",
-					"RenderMessageImages",
 					"TurnProcessOwnerProps",
 					"TurnTailOwnerProps"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2618,6 +2695,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "fixed by the owner's key table { [Kind in ChatNodeKind]: { node: ChatNode<Kind> } }, already taken: assistant-step, command, command-input, compaction, context, manual-compaction, model-retry, question-reply, steering, system-prompt, tool-call, turn-error, turn-max-tokens, turn-process, turn-tail, turn-trigger, unknown, user, workflow-run",
@@ -2647,7 +2725,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.node', () => ctx.slots.register(\n      { name: 'conversation.chat.node', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:377"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:402"
 			},
 			{
 				key: "conversation.chat.reasoning.body",
@@ -2659,13 +2737,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Original model-provided reasoning offered to the expanded Body Slot. */\nexport interface ReasoningBodyOwnerProps {\n  /** Complete or streaming reasoning text. */\n  readonly text: string\n  /** Whether the reasoning tail is still streaming. */\n  readonly running: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2673,6 +2753,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2682,7 +2763,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-chat DefaultReasoningBody", "experimental-client-ui-cot-translation TranslationBody"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.reasoning.body', () => ctx.slots.register(\n      { name: 'conversation.chat.reasoning.body' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:402"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:429"
 			},
 			{
 				key: "conversation.chat.turnTail",
@@ -2713,13 +2794,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner currency of the completed-Turn extension chain. */\nexport interface TurnTailOwnerProps {\n  turn: TurnLocation\n  seq: number\n  openFile: (path: string) => void\n}"],
 				ownerPropsReferences: ["TurnLocation"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2727,6 +2810,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2740,7 +2824,49 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.turnTail', () => ctx.slots.register(\n      { name: 'conversation.chat.turnTail', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:408"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:435"
+			},
+			{
+				key: "conversation.chat.user.images",
+				kind: "single",
+				scope: "session",
+				summary: "User-message images, including pending and local-echo previews, independently replaceable from output images.",
+				doc: "User-message images, including pending and local-echo previews, independently replaceable from output images.",
+				registerOptions: [],
+				ownerProps: ["/** Message image group handed to the optional attachment presentation plugin. */\nexport interface MessageImagesOwnerProps {\n  /** Durable references or submission-echo previews in source order. */\n  images: readonly MessageImageSource[]\n  /** Session-authorized image URL loader for the durable arm. */\n  loadImage: MessageImageLoader\n  /** Horizontal placement inside the owning record. */\n  align: 'start' | 'end'\n  /** Force every image into the compact message-attachment tile size. */\n  compact?: boolean\n  /** Fixed, uncropped thumbnail for an attachment list row. */\n  thumbnail?: boolean\n}"],
+				ownerPropsReferences: [
+					"Message",
+					"MessageImageLoader",
+					"MessageImageSource"
+				],
+				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
+					"useResource: UseResource",
+					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"usePanelInfo: UsePanelInfo",
+					"useSessions: UseSessions",
+					"useSessionStatus: UseSessionStatus",
+					"useSessionRetainInfo: UseSessionRetainInfo",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
+					"useChat: UseChat",
+					"useConversation: UseConversation",
+					"useInput: SnapshotSelectorHook<InputState>",
+					"inputActions: InputActions",
+					"useSession: SessionSnapshotSelector",
+					"sessionId: SessionId",
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
+					"useTrajectory: UseTrajectory"
+				],
+				keyDomain: "",
+				hookContext: "",
+				slotInject: "",
+				declaredBy: "factory 'conversation.chat.user.content' (client-ui-chat), so it exists while that definition is registered",
+				occupants: ["client-ui-attachment MessageImages"],
+				replaceRisk: "shadows-shipped-ui",
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.chat.user.images', () => ctx.slots.register(\n      { name: 'conversation.chat.user.images' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:417"
 			},
 			{
 				key: "conversation.composer",
@@ -2761,13 +2887,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"SessionSnapshot"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2775,6 +2903,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2788,7 +2917,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.composer', () => ctx.slots.register(\n      { name: 'conversation.composer', select: owner => null },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:187"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:260"
 			},
 			{
 				key: "conversation.composer.bar",
@@ -2800,19 +2929,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the resident composer bar. */\nexport interface ComposerBarOwnerProps {\n  /** Hero uses centered placement; composer uses the active bottom placement. */\n  variant: 'hero' | 'composer'\n  /** A feature-owned reason that makes message input inert while leaving model selection live. */\n  blocked?: { readonly reason: string }\n  /** Lock all message actions while preserving the resident composer surface. */\n  disabled?: boolean\n  /** Whether the shared Workspace picker is expanded. */\n  workspacePickerOpen?: boolean\n  /** Open the Workspace picker from the inert composer surface. */\n  onRequestWorkspace?: () => void\n  placeholder?: string\n  /** Optional content rendered above the composer surface. */\n  accessory?: ReactNode\n}"],
 				ownerPropsReferences: ["Workspace"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useConversation: MaybeSnapshotSelectorHook<ConversationSnapshot>",
 					"useInput: MaybeSnapshotSelectorHook<InputState>",
 					"inputActions: InputActions | undefined",
 					"useSession: MaybeSnapshotSelectorHook<SessionSnapshot>",
 					"sessionId: SessionId | undefined",
-					"useProjection: UseProjection"
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean | undefined"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -2821,7 +2953,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-conversation InputBar"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.composer.bar', () => ctx.slots.register(\n      { name: 'conversation.composer.bar' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:207"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:282"
 			},
 			{
 				key: "conversation.composer.dock",
@@ -2852,13 +2984,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -2866,6 +3000,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -2875,7 +3010,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-chat ActivityPill id 'activity'", "client-ui-chat UsagePill id 'usage'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.composer.dock', () => ctx.slots.register(\n      { name: 'conversation.composer.dock', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:199"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:274"
 			},
 			{
 				key: "conversation.header",
@@ -2887,19 +3022,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useConversation: MaybeSnapshotSelectorHook<ConversationSnapshot>",
 					"useInput: MaybeSnapshotSelectorHook<InputState>",
 					"inputActions: InputActions | undefined",
 					"useSession: MaybeSnapshotSelectorHook<SessionSnapshot>",
 					"sessionId: SessionId | undefined",
-					"useProjection: UseProjection"
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean | undefined"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -2908,7 +3046,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-conversation ConversationHeader"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.header', () => ctx.slots.register(\n      { name: 'conversation.header' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:139"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:212"
 			},
 			{
 				key: "conversation.header.leading",
@@ -2920,13 +3058,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The leading seat exposes global navigation independently of a Session. */\nexport interface ConversationHeaderLeadingOwnerProps {\n  /** Marker field: the occupant receives no owner-specific values. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -2935,7 +3075,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.header.leading', () => ctx.slots.register(\n      { name: 'conversation.header.leading' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:168"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:241"
 			},
 			{
 				key: "conversation.hero.agentPreset",
@@ -2947,19 +3087,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the Hero agent-preset control. */\nexport interface HeroAgentPresetOwnerProps {\n  /** Marker field: the occupant owns its roster and staged selection. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useConversation: MaybeSnapshotSelectorHook<ConversationSnapshot>",
 					"useInput: MaybeSnapshotSelectorHook<InputState>",
 					"inputActions: InputActions | undefined",
 					"useSession: MaybeSnapshotSelectorHook<SessionSnapshot>",
 					"sessionId: SessionId | undefined",
-					"useProjection: UseProjection"
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean | undefined"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -2968,7 +3111,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-agent-preset AgentPresetSeat"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.hero.agentPreset', () => ctx.slots.register(\n      { name: 'conversation.hero.agentPreset' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:193"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:266"
 			},
 			{
 				key: "conversation.hero.brand.mark",
@@ -2980,13 +3123,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Presentation props supplied to the blank-session brand mark. */\nexport interface HeroBrandMarkOwnerProps {\n  /** Requested square edge in pixels. */\n  size: number\n  /** Host class preserving the surrounding mark geometry. */\n  className?: string | undefined\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -2995,7 +3140,64 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.hero.brand.mark', () => ctx.slots.register(\n      { name: 'conversation.hero.brand.mark' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:191"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:264"
+			},
+			{
+				key: "conversation.hero.options",
+				kind: "list",
+				scope: "session",
+				summary: "Compact options right-aligned in the New Session row after the workspace and preset controls; rendered only with a Session.",
+				doc: "Compact options right-aligned in the New Session row after the workspace and preset controls; rendered only with a Session.",
+				registerOptions: [
+					{
+						name: "id",
+						requirement: "required",
+						type: "string",
+						doc: "Your cell key. Use an id of your own: a fresh id is added beside the shipped entries, while reusing a shipped id puts you in THAT cell and replaces it. Owners that filter by id address you by it."
+					},
+					{
+						name: "order",
+						requirement: "optional",
+						type: "number",
+						doc: "Position among the entries, ascending (default 0)."
+					},
+					{
+						name: "label",
+						requirement: "optional",
+						type: "string | (() => string)",
+						doc: "Display text where the owner projects one (nav rows, tabs). A thunk is re-read on every projection, so localized text follows the active locale without re-registering."
+					}
+				],
+				ownerProps: [],
+				ownerPropsReferences: [],
+				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
+					"useResource: UseResource",
+					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"usePanelInfo: UsePanelInfo",
+					"useSessions: UseSessions",
+					"useSessionStatus: UseSessionStatus",
+					"useSessionRetainInfo: UseSessionRetainInfo",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
+					"useChat: UseChat",
+					"useConversation: UseConversation",
+					"useInput: SnapshotSelectorHook<InputState>",
+					"inputActions: InputActions",
+					"useSession: SessionSnapshotSelector",
+					"sessionId: SessionId",
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
+					"useTrajectory: UseTrajectory"
+				],
+				keyDomain: "",
+				hookContext: "",
+				slotInject: "",
+				declaredBy: "factory 'conversation.content' (client-ui-conversation), so it exists while that definition is registered",
+				occupants: [],
+				replaceRisk: "none",
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.hero.options', () => ctx.slots.register(\n      { name: 'conversation.hero.options', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:268"
 			},
 			{
 				key: "conversation.hero.workspace",
@@ -3007,13 +3209,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share common to blank-session Workspace pickers. */\nexport interface EmptyWorkspaceOwnerProps {\n  open: boolean\n  anchorRef?: RefObject<HTMLElement>\n  /** Currently selected Workspace, when available. */\n  selectedId?: WorkspaceId | undefined\n  onPick: (workspaceId: WorkspaceId) => void\n  onClose: () => void\n}"],
 				ownerPropsReferences: ["Workspace"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -3022,7 +3226,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-workspace WorkspacePicker"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.hero.workspace', () => ctx.slots.register(\n      { name: 'conversation.hero.workspace' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:189"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:262"
 			},
 			{
 				key: "conversation.hero.workspace.directoryFlow",
@@ -3034,13 +3238,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of the directory-flow holes: the complete conversation between\n * the trigger surface and the picking interaction. The occupant reads `open`\n * to run/render its interaction and reports exactly one outcome per open.\n */\nexport interface DirectoryFlowOwnerProps {\n  /** True while a picking interaction is requested; flipping back to false withdraws the request. */\n  open: boolean\n  /** True while the owner adopts a picked path (`createWorkspace` in flight); occupants disable their commit affordances. */\n  busy: boolean\n  /** The operator picked a directory (absolute host path); the owner adopts it. */\n  onPicked: (path: string) => void\n  /** The operator dismissed the interaction; the owner just closes the flow. */\n  onCancel: () => void\n  /** The interaction itself failed (chooser missing, listing denied); the owner shows its error surface. */\n  onError: (message: string) => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -3049,7 +3255,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-directory-picker-browse BrowseDirectoryFlow", "client-ui-directory-picker-native NativeDirectoryFlow"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.hero.workspace.directoryFlow', () => ctx.slots.register(\n      { name: 'conversation.hero.workspace.directoryFlow' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-workspace/src/client/contract/slots.ts:118"
+				source: "packages/client/ui-workspace/src/client/contract/slots.ts:119"
 			},
 			{
 				key: "conversation.input.activity",
@@ -3061,13 +3267,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** A toolbar activity hides ordinary accessory controls while expanded; its occupant must release expansion on unmount. */\nexport interface InputActivityOwnerProps extends InputControlOwnerProps {\n  /** @param active - whether the occupant needs the toolbar width before the submit action. */\n  onActiveChange: (active: boolean) => void\n}"],
 				ownerPropsReferences: ["InputControlOwnerProps"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3075,6 +3283,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3084,7 +3293,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["experimental-client-ui-voice-input VoiceInput"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.activity', () => ctx.slots.register(\n      { name: 'conversation.input.activity' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:205"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:280"
 			},
 			{
 				key: "conversation.input.attachments",
@@ -3100,19 +3309,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"DraftFileUploads"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useConversation: MaybeSnapshotSelectorHook<ConversationSnapshot>",
 					"useInput: MaybeSnapshotSelectorHook<InputState>",
 					"inputActions: InputActions | undefined",
 					"useSession: MaybeSnapshotSelectorHook<SessionSnapshot>",
 					"sessionId: SessionId | undefined",
-					"useProjection: UseProjection"
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean | undefined"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -3121,7 +3333,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-attachment ComposerAttachments"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.attachments', () => ctx.slots.register(\n      { name: 'conversation.input.attachments' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:209"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:284"
 			},
 			{
 				key: "conversation.input.dock",
@@ -3152,13 +3364,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Point-in-time owner values for composer extension entries. */\nexport interface InputZone {\n  readonly session: SessionSnapshot\n  readonly input: InputState\n}"],
 				ownerPropsReferences: ["InputState", "SessionSnapshot"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3166,6 +3380,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3180,7 +3395,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.dock', () => ctx.slots.register(\n      { name: 'conversation.input.dock', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:195"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:270"
 			},
 			{
 				key: "conversation.input.left",
@@ -3211,13 +3426,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3225,6 +3442,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3234,7 +3452,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.left', () => ctx.slots.register(\n      { name: 'conversation.input.left', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:201"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:276"
 			},
 			{
 				key: "conversation.input.model",
@@ -3246,13 +3464,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the named plan, permission, and model controls. */\nexport interface InputControlOwnerProps {\n  /** Whether the composer currently refuses interaction. */\n  locked: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3260,6 +3480,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3269,7 +3490,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-model-selection ModelSelect"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.model', () => ctx.slots.register(\n      { name: 'conversation.input.model' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:223"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:298"
 			},
 			{
 				key: "conversation.input.overlay",
@@ -3300,13 +3521,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3314,6 +3537,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3327,7 +3551,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.overlay', () => ctx.slots.register(\n      { name: 'conversation.input.overlay', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:197"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:272"
 			},
 			{
 				key: "conversation.input.permission",
@@ -3339,13 +3563,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the named plan, permission, and model controls. */\nexport interface InputControlOwnerProps {\n  /** Whether the composer currently refuses interaction. */\n  locked: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3353,6 +3579,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3362,7 +3589,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-permission-presets PermissionSelect"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.permission', () => ctx.slots.register(\n      { name: 'conversation.input.permission' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:217"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:292"
 			},
 			{
 				key: "conversation.input.plan",
@@ -3374,13 +3601,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the named plan, permission, and model controls. */\nexport interface InputControlOwnerProps {\n  /** Whether the composer currently refuses interaction. */\n  locked: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3388,6 +3617,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3397,7 +3627,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-plan PlanChip"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.plan', () => ctx.slots.register(\n      { name: 'conversation.input.plan' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:215"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:290"
 			},
 			{
 				key: "conversation.input.right",
@@ -3428,13 +3658,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3442,6 +3674,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3451,46 +3684,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.input.right', () => ctx.slots.register(\n      { name: 'conversation.input.right', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:203"
-			},
-			{
-				key: "conversation.message.images",
-				kind: "single",
-				scope: "session",
-				summary: "Renderer for one consecutive group of durable message images.",
-				doc: "Renderer for one consecutive group of durable message images. The owner\nsupplies image references, an authorized loader, and alignment. A\nregistration replaces the shipped gallery; without one, images are omitted.",
-				registerOptions: [],
-				ownerProps: ["/** Message image group handed to the optional attachment presentation plugin. */\nexport interface MessageImagesOwnerProps {\n  /** Durable references or submission-echo previews in source order. */\n  images: readonly MessageImageSource[]\n  /** Session-authorized image URL loader for the durable arm. */\n  loadImage: MessageImageLoader\n  /** Horizontal placement inside the owning record. */\n  align: 'start' | 'end'\n  /** Force every image into the compact message-attachment tile size. */\n  compact?: boolean\n  /** Fixed, uncropped thumbnail for an attachment list row. */\n  thumbnail?: boolean\n}"],
-				ownerPropsReferences: [
-					"Message",
-					"MessageImageLoader",
-					"MessageImageSource"
-				],
-				standardProps: [
-					"useResource: UseResource",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
-					"usePanelInfo: UsePanelInfo",
-					"useSessions: UseSessions",
-					"useSessionStatus: UseSessionStatus",
-					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
-					"useChat: UseChat",
-					"useConversation: UseConversation",
-					"useInput: SnapshotSelectorHook<InputState>",
-					"inputActions: InputActions",
-					"useSession: SessionSnapshotSelector",
-					"sessionId: SessionId",
-					"useProjection: UseProjection",
-					"useTrajectory: UseTrajectory"
-				],
-				keyDomain: "",
-				hookContext: "",
-				slotInject: "",
-				declaredBy: "an entry in 'conversation.chat.flow' (client-ui-chat), so it exists while that entry is mounted",
-				occupants: ["client-ui-attachment MessageImages"],
-				replaceRisk: "shadows-shipped-ui",
-				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.message.images', () => ctx.slots.register(\n      { name: 'conversation.message.images' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:390"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:278"
 			},
 			{
 				key: "conversation.plan-review.actions",
@@ -3521,13 +3715,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * A request narrowed to the `plan-review` presentation intent: everything the\n * decision card renders and answers with, so the panel never re-reads the\n * request fields. `approve` and `decline` are the asker's own options — an\n * answer must carry one of those labels verbatim — and `plan` is the markdown\n * body under review.\n */\nexport interface PlanReview {\n  /** The reviewed question's id, echoed in the answer. */\n  id: string\n  /** The question text, kept as the card's accessible name. */\n  question: string\n  /** The plan markdown under review. */\n  plan: string\n  /** Logged tool invocation used to reopen this plan. */\n  callId?: ToolCallId\n  /** The option that approves the plan. */\n  approve: QuestionOption\n  /** The option that declines it; absent when the asker offered no other option. */\n  decline?: QuestionOption\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3535,6 +3731,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3556,13 +3753,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3570,6 +3769,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3579,7 +3779,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-conversation ConversationSession"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.session', () => ctx.slots.register(\n      { name: 'conversation.session' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:133"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:206"
 			},
 			{
 				key: "conversation.session.header",
@@ -3591,13 +3791,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3605,6 +3807,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3614,7 +3817,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-conversation ConversationSessionHeader"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.session.header', () => ctx.slots.register(\n      { name: 'conversation.session.header' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:141"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:214"
 			},
 			{
 				key: "conversation.session.header.actions",
@@ -3645,13 +3848,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Header actions derive their state from standard Session props. */\nexport interface ConversationHeaderActionOwnerProps {\n  /** Marker field: entries receive no owner-specific values. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3659,6 +3864,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3673,7 +3879,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.session.header.actions', () => ctx.slots.register(\n      { name: 'conversation.session.header.actions', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:156"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:229"
 			},
 			{
 				key: "conversation.session.header.corner",
@@ -3685,13 +3891,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The header corner's occupant derives its state from standard Session props. */\nexport interface ConversationHeaderCornerOwnerProps {\n  /** Marker field: the occupant receives no owner-specific values. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3699,6 +3907,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3708,7 +3917,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-sidebar-right ExpandButton"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.session.header.corner', () => ctx.slots.register(\n      { name: 'conversation.session.header.corner' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:179"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:252"
 			},
 			{
 				key: "conversation.session.header.lineage",
@@ -3720,13 +3929,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Plain breadcrumb data handed to the optional lineage renderer. */\nexport interface ConversationHeaderLineageOwnerProps {\n  /** Session represented by this breadcrumb title. */\n  lineageSessionId: SessionId\n  /** Display title available to a combined title/control renderer. */\n  displayTitle: string\n  /** Navigate to an ancestor title when present. */\n  openTitle?: () => void\n}"],
 				ownerPropsReferences: ["SessionId"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3734,6 +3945,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3743,7 +3955,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-subagent SubagentHeaderLineage"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.session.header.lineage', () => ctx.slots.register(\n      { name: 'conversation.session.header.lineage' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:150"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:223"
 			},
 			{
 				key: "conversation.session.header.utilities",
@@ -3774,13 +3986,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Header actions derive their state from standard Session props. */\nexport interface ConversationHeaderActionOwnerProps {\n  /** Marker field: entries receive no owner-specific values. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3788,6 +4002,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3801,7 +4016,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.session.header.utilities', () => ctx.slots.register(\n      { name: 'conversation.session.header.utilities', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:162"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:235"
 			},
 			{
 				key: "conversation.trajectory.images",
@@ -3817,13 +4032,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"MessageImageSource"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3831,6 +4048,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3842,6 +4060,57 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.trajectory.images', () => ctx.slots.register(\n      { name: 'conversation.trajectory.images' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
 				source: "packages/client/ui-trajectory/src/client/trajectory-contract.ts:103"
 			},
+			{
+				key: "conversation.user.text.node",
+				kind: "keyed",
+				scope: "session",
+				summary: "One business-owned inline renderer for a pure JSON text node.",
+				doc: "One business-owned inline renderer for a pure JSON text node.",
+				registerOptions: [{
+					name: "key",
+					requirement: "required",
+					type: "string",
+					doc: "Your cell key: the entry renders where the owner dispatches this exact key. Registering an already-occupied key replaces that occupant."
+				}],
+				ownerProps: ["/** JSON-only owner data common to every business text node. */\nexport interface UserTextNodeOwnerProps {\n  readonly raw: string\n  readonly interactive: boolean\n}"],
+				ownerPropsReferences: [],
+				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
+					"useResource: UseResource",
+					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"usePanelInfo: UsePanelInfo",
+					"useSessions: UseSessions",
+					"useSessionStatus: UseSessionStatus",
+					"useSessionRetainInfo: UseSessionRetainInfo",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
+					"useChat: UseChat",
+					"useConversation: UseConversation",
+					"useInput: SnapshotSelectorHook<InputState>",
+					"inputActions: InputActions",
+					"useSession: SessionSnapshotSelector",
+					"sessionId: SessionId",
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
+					"useTrajectory: UseTrajectory"
+				],
+				keyDomain: "fixed by the owner's key table { [Id in UserTextId]: { node: UserTextNode<Id> } }, already taken: command, file, folder, secret, session, skill, text",
+				hookContext: "",
+				slotInject: "",
+				declaredBy: "factory 'conversation.user.text' (client-ui-conversation), so it exists while that definition is registered",
+				occupants: [
+					"client-ui-conversation PlainUserText key 'text'",
+					"client-ui-conversation SessionReference key 'session'",
+					"client-ui-goal GoalCommandReference key 'command'",
+					"client-ui-reference FileReference key 'file'",
+					"client-ui-reference FolderReference key 'folder'",
+					"client-ui-secret-mask SecretText key 'secret'",
+					"client-ui-skill SkillReference key 'skill'"
+				],
+				replaceRisk: "shadows-shipped-ui",
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.user.text.node', () => ctx.slots.register(\n      { name: 'conversation.user.text.node', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:196"
+			},
 			{
 				key: "conversation.view",
 				kind: "list",
@@ -3871,13 +4140,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Conversation View entries obtain their data from registered standard hooks. */\nexport interface ConvViewOwnerProps {\n  /** Open a tool call's inspector when an inspection target is available. */\n  inspectCall: ((callId: string) => void) | undefined\n  /** Focus request addressed to the selected View. */\n  viewRequest: import('./views.ts').ConversationViewRequest | null\n  /** Select a View and address one opaque focus identity to it. */\n  openView: (view: string, focus: string) => void\n  /** Acknowledge the current one-shot focus request. */\n  completeViewRequest: () => void\n}"],
 				ownerPropsReferences: ["ConversationViewRequest"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3885,6 +4156,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3894,7 +4166,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-chat ChatView id 'chat'", "client-ui-trajectory TrajectoryView id 'trajectory'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('conversation.view', () => ctx.slots.register(\n      { name: 'conversation.view', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:185"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:258"
 			},
 			{
 				key: "deliverables.file.actions",
@@ -3925,13 +4197,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Native file action selected by an explicit user gesture. */\nexport type PresentedAction = 'open' | 'reveal'", "/** Failure feedback for the shared native opening control. */\nexport type PresentedOpenFailure = 'openError' | 'revealError' | null"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3939,6 +4213,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -3979,13 +4254,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Slot contract table. Owners extend via declaration merging; entries are {@link SlotEntryDef}. */\nexport interface SlotMap {}"],
 				ownerPropsReferences: ["SlotEntryDef"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -3993,6 +4270,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -4019,13 +4297,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), already taken: conversation",
 				hookContext: "",
@@ -4050,19 +4330,22 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useConversation: MaybeSnapshotSelectorHook<ConversationSnapshot>",
 					"useInput: MaybeSnapshotSelectorHook<InputState>",
 					"inputActions: InputActions | undefined",
 					"useSession: MaybeSnapshotSelectorHook<SessionSnapshot>",
 					"sessionId: SessionId | undefined",
-					"useProjection: UseProjection"
+					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean | undefined"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4071,7 +4354,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-conversation ConversationRoot"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('main.conversation', () => ctx.slots.register(\n      { name: 'main.conversation' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-conversation/src/client/contract/slots.ts:131"
+				source: "packages/client/ui-conversation/src/client/contract/slots.ts:204"
 			},
 			{
 				key: "plugins.add.actions",
@@ -4102,13 +4385,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Add-plugin menu actions, independent of any selected bundle or Session. */\nexport interface PluginAddActionsProps {\n  /** Close the add-plugin menu before starting the contributed action. */\n  readonly onDismiss: () => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4117,7 +4402,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-agent-preset CreatePluginMenuItem id 'create-plugin'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.add.actions', () => ctx.slots.register(\n      { name: 'plugins.add.actions', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:89"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:118"
 			},
 			{
 				key: "plugins.bundle.activation",
@@ -4134,13 +4419,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** One user-requested bundle activation and navigation to its configuration page. */\nexport interface PluginActivationOwnerProps {\n  readonly packageName: string\n  /** Dismiss guidance for this activation. */\n  readonly onDismiss: () => void\n  /** Dismiss guidance and open this bundle's detail page. */\n  readonly onOpenDetails: () => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), already taken: @deepseek-ai/dsh-experimental-voice-input-bundle",
 				hookContext: "",
@@ -4149,7 +4436,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["experimental-client-ui-voice-input VoiceSetupPrompt key '@deepseek-ai/dsh-experimental-voice-input-bundle'"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.bundle.activation', () => ctx.slots.register(\n      { name: 'plugins.bundle.activation', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:91"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:126"
 			},
 			{
 				key: "plugins.bundle.config",
@@ -4166,13 +4453,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: 'summary' | 'page'\n  /** Host-owned configuration values and write actions for this page's entry. */\n  readonly form?: ConfigPageForm | undefined\n}"],
 				ownerPropsReferences: ["ConfigPageForm"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), already taken: @deepseek-ai/dsh-experimental-cot-translation-bundle, @deepseek-ai/dsh-experimental-voice-input-bundle",
 				hookContext: "",
@@ -4181,7 +4470,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["experimental-client-ui-cot-translation TranslationSettings key '@deepseek-ai/dsh-experimental-cot-translation-bundle'", "experimental-client-ui-voice-input VoicePreparation key '@deepseek-ai/dsh-experimental-voice-input-bundle'"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register(\n      { name: 'plugins.bundle.config', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:107"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:142"
 			},
 			{
 				key: "plugins.detail.actions",
@@ -4212,13 +4501,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The owner props every detail contribution is rendered with. */\nexport interface PluginDetailProps {\n  /** The subject of the open page; an entry renders null for a subject it has nothing for. */\n  readonly subject: PluginsSubject\n}"],
 				ownerPropsReferences: ["PluginsSubject"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4227,7 +4518,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.detail.actions', () => ctx.slots.register(\n      { name: 'plugins.detail.actions', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:121"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:156"
 			},
 			{
 				key: "plugins.detail.badge",
@@ -4258,13 +4549,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The owner props every detail contribution is rendered with. */\nexport interface PluginDetailProps {\n  /** The subject of the open page; an entry renders null for a subject it has nothing for. */\n  readonly subject: PluginsSubject\n}"],
 				ownerPropsReferences: ["PluginsSubject"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4273,7 +4566,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.detail.badge', () => ctx.slots.register(\n      { name: 'plugins.detail.badge', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:126"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:161"
 			},
 			{
 				key: "plugins.detail.section",
@@ -4304,13 +4597,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The owner props every detail contribution is rendered with. */\nexport interface PluginDetailProps {\n  /** The subject of the open page; an entry renders null for a subject it has nothing for. */\n  readonly subject: PluginsSubject\n}"],
 				ownerPropsReferences: ["PluginsSubject"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4319,7 +4614,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.detail.section', () => ctx.slots.register(\n      { name: 'plugins.detail.section', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:133"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:168"
 			},
 			{
 				key: "plugins.item",
@@ -4350,13 +4645,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: 'summary' | 'page'\n  /** Host-owned configuration values and write actions for this page's entry. */\n  readonly form?: ConfigPageForm | undefined\n}"],
 				ownerPropsReferences: ["ConfigPageForm"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4370,7 +4667,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.item', () => ctx.slots.register(\n      { name: 'plugins.item', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:101"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:136"
 			},
 			{
 				key: "plugins.row.config",
@@ -4387,13 +4684,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** The view the page asks a configuration entry for. */\nexport interface PluginConfigViewProps {\n  /** `summary` renders the one-liner alone, as text or inline nodes; `page` renders the form with its save control. */\n  readonly view: 'summary' | 'page'\n  /** Host-owned configuration values and write actions for this page's entry. */\n  readonly form?: ConfigPageForm | undefined\n}"],
 				ownerPropsReferences: ["ConfigPageForm"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
 				hookContext: "",
@@ -4402,7 +4701,55 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: [],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.row.config', () => ctx.slots.register(\n      { name: 'plugins.row.config', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:115"
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:150"
+			},
+			{
+				key: "plugins.tab",
+				kind: "list",
+				scope: "root",
+				summary: "Tabs after the page's own Installed tab, such as Discover: `label` names the tab and `order` places it.",
+				doc: "Tabs after the page's own Installed tab, such as Discover: `label` names the tab and `order` places it. The\npage renders the selected entry under its header and tabs; the entry draws its own content and installs\nthrough the owner's `install`.",
+				registerOptions: [
+					{
+						name: "id",
+						requirement: "required",
+						type: "string",
+						doc: "Your cell key. Use an id of your own: a fresh id is added beside the shipped entries, while reusing a shipped id puts you in THAT cell and replaces it. Owners that filter by id address you by it."
+					},
+					{
+						name: "order",
+						requirement: "optional",
+						type: "number",
+						doc: "Position among the entries, ascending (default 0)."
+					},
+					{
+						name: "label",
+						requirement: "optional",
+						type: "string | (() => string)",
+						doc: "Display text where the owner projects one (nav rows, tabs). A thunk is re-read on every projection, so localized text follows the active locale without re-registering."
+					}
+				],
+				ownerProps: ["/** Owner props of a page tab another plugin contributes, such as Discover. */\nexport interface PluginTabProps {\n  /**\n   * Install an exact version the person already confirmed: the page's install dialog opens at its check and progress\n   * screens, without the spec form, and names the plugin and version above the spec.\n   * @param target - the spec, optional registry, and display text.\n   */\n  readonly install: (target: PluginTabInstall) => void\n  /**\n   * Switch to the Installed tab and open a bundle's page.\n   * @param packageName - npm package name of the bundle.\n   */\n  readonly openPackage: (packageName: string) => void\n}"],
+				ownerPropsReferences: ["PluginTabInstall"],
+				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
+					"useResource: UseResource",
+					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"usePanelInfo: UsePanelInfo",
+					"useSessions: UseSessions",
+					"useSessionStatus: UseSessionStatus",
+					"useSessionRetainInfo: UseSessionRetainInfo",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
+				],
+				keyDomain: "",
+				hookContext: "",
+				slotInject: "",
+				declaredBy: "an entry in 'main' (client-ui-plugin-manager), so it exists while that entry is mounted",
+				occupants: ["client-ui-plugin-market DiscoverSection id 'discover'"],
+				replaceRisk: "none",
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('plugins.tab', () => ctx.slots.register(\n      { name: 'plugins.tab', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
+				source: "packages/client/ui-plugin-manager/src/client/slot-contract.ts:124"
 			},
 			{
 				key: "rightbar",
@@ -4414,13 +4761,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Right column owner share: resolved normal geometry and opening eligibility. */\nexport interface RightbarOwnerProps {\n  /** Resolved normal panel width in px, not the saved preference; zero if it cannot fit. */\n  width: number\n  /** Current frame width in px. */\n  viewportWidth: number\n  /**\n   * Whether a normal right panel can retain 300px beside a 400px center.\n   * Before a narrow opening, includes the space from collapsing the left sidebar.\n   */\n  canShow: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4441,13 +4790,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Right column owner share: resolved normal geometry and opening eligibility. */\nexport interface RightbarOwnerProps {\n  /** Resolved normal panel width in px, not the saved preference; zero if it cannot fit. */\n  width: number\n  /** Current frame width in px. */\n  viewportWidth: number\n  /**\n   * Whether a normal right panel can retain 300px beside a 400px center.\n   * Before a narrow opening, includes the space from collapsing the left sidebar.\n   */\n  canShow: boolean\n}", "/** Identity of one open tab; distinct copies of one content share `contentId`, never `TabId`. */\nexport type TabId = Branded<'TabId'>"],
 				ownerPropsReferences: ["Branded"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -4455,6 +4806,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -4476,13 +4828,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Root owner share: the shell supplies nothing — the frame is inject-assembled. */\nexport interface RootOwnerProps { children?: never }"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4522,13 +4876,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the header title seat (the shell supplies nothing). */\nexport interface SettingsHeaderOwnerProps {\n  /** Marker field: header owner props are intentionally empty. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4549,13 +4905,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the header title seat (the shell supplies nothing). */\nexport interface SettingsHeaderOwnerProps {\n  /** Marker field: header owner props are intentionally empty. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4595,13 +4953,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of a General preference row (the section supplies nothing). */\nexport interface SettingsGeneralItemOwnerProps {\n  /** Marker field: item owner props are intentionally empty. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4635,13 +4995,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the header title seat (the shell supplies nothing). */\nexport interface SettingsHeaderOwnerProps {\n  /** Marker field: header owner props are intentionally empty. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4662,13 +5024,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Sidebar launcher geometry and settings navigation. */\nexport interface SettingsLauncherOwnerProps {\n  /** Whether the sidebar shows labels. */\n  wide: boolean\n  /** Whether the settings dialog covers the sidebar; a launcher may treat a false-to-true edge as one Settings entry. */\n  settingsOpen: boolean\n  /** Effective Settings key labels and accessible combination; omitted when unbound. */\n  settingsShortcut?: { readonly keys: readonly string[]; readonly aria?: string | undefined }\n  /** Open the settings panel. */\n  openSettings: () => void\n  /** @param id - registered onboarding editor to open explicitly. */\n  openOnboarding: (id: string) => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4708,13 +5072,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the footer area (the section supplies nothing). */\nexport interface ModelsFooterOwnerProps {\n  /** Marker field: footer owner props are intentionally empty. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4740,13 +5106,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of one provider-card extension occurrence. */\nexport interface ProviderCardExtrasOwnerProps {\n  /** The card's directory row (route id, display name, settings address, live state). */\n  provider: ProviderDirectoryEntry\n  /** Whether any layer configures this provider (its profile resolves); `false` while the add-provider draft edits a dormant row. */\n  configured: boolean\n  /** Whether the row's referenced api-key credential is confirmed configured (the page's credential join). */\n  keyConfigured: boolean\n}"],
 				ownerPropsReferences: ["ProviderDirectoryEntry"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
 				hookContext: "",
@@ -4767,13 +5135,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4813,13 +5183,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the currently active settings-backed onboarding step. */\nexport interface SettingsOnboardingOwnerProps {\n  /** Stable id of the step currently selected by the coordinator. */\n  stepId: string\n  /** User explicitly reopened this step outside first-run onboarding. */\n  explicit?: boolean\n  /** Complete or skip this step and transfer ownership to the next entry. */\n  complete: () => void\n  /** Open the settings panel directly on one registered section. */\n  openSection: (id: string) => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4859,13 +5231,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of a Plugins tab (the section supplies nothing). */\nexport interface SettingsPluginsTabOwnerProps {\n  /** Marker field: tab owner props are intentionally empty. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4905,13 +5279,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of a settings section entry. The shell owns modal visibility\n * and navigation; a section's data arrives through its own inject faces and\n * stores. `close` is the one shell affordance a section receives, for flows\n * that leave settings altogether (starting a session from a section) — the\n * onboarding coordinator's `openSection`/`complete` precedent, inverted.\n */\nexport interface SettingsSectionOwnerProps {\n  /** Close the settings panel (the shell owns the open state). */\n  close: () => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4938,13 +5314,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of the trigger content seat: the sidebar column state. */\nexport interface SettingsTriggerOwnerProps {\n  /** Whether the sidebar renders wide content (false = 56px rail, icon only). */\n  wide: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4965,13 +5343,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -4992,13 +5372,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5038,13 +5420,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5056,6 +5440,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"client-ui-schedule ScheduleDeleteToast id 'schedule.delete-toast'",
 					"client-ui-settings-account DesktopOnboardingEntry id 'desktop-onboarding'",
 					"client-ui-settings-account AccountPlatformHost id 'account.platform-page'",
+					"client-ui-settings-general HostReleasePrompt id 'host-release-change'",
 					"client-ui-settings-session-log UploadToast id 'session-log-upload-toast'",
 					"client-ui-shortcuts ShortcutReference id 'shortcuts'",
 					"client-ui-workspace SessionRenameDialog id 'workspace.session-rename'",
@@ -5081,13 +5466,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner currency of one quota notice offered to the frame-wide chain. */\nexport interface QuotaNoticeOwnerProps {\n  /** Stable failure code retained in the Session log. */\n  code: QuotaNoticeCode\n  /** Provider-neutral notice copy in the active locale. */\n  message: string\n  /** Take the notice down. */\n  dismiss: () => void\n  /**\n   * Prevent later quota failures from replacing this notice. Dismissal clears\n   * all holds; releasing the last hold resumes future notices without replay.\n   * Callers must release on unmount.\n   * @returns idempotent release that cannot clear another hold.\n   */\n  keepOpen: () => () => void\n}"],
 				ownerPropsReferences: ["QuotaNoticeCode"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5096,7 +5483,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-settings-account AccountQuotaNotice"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('shell.quota-notice', () => ctx.slots.register(\n      { name: 'shell.quota-notice', select: owner => null },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-chat/src/client/contract/slots.ts:422"
+				source: "packages/client/ui-chat/src/client/contract/slots.ts:449"
 			},
 			{
 				key: "sidebar",
@@ -5108,13 +5495,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Sidebar owner share: live column state from the frame's concession solve. */\nexport interface SidebarOwnerProps {\n  /** True when the sidebar is closed (the column renders the compact control rail). */\n  collapsed: boolean\n  /** Rendered column width in px (SIDEBAR_COLLAPSED when collapsed). */\n  width: number\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5135,13 +5524,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Geometry supplied to the sidebar brand-mark occupant. */\nexport interface SidebarBrandMarkOwnerProps {\n  /** Requested square edge in pixels. */\n  size: number\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5162,13 +5553,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Empty owner share for the sidebar brand-name occupant. */\nexport interface SidebarBrandNameOwnerProps {\n  /** Marker field: the occupant owns its own content and width. */\n  children?: never\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5189,13 +5582,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5203,6 +5598,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -5243,13 +5639,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of an action rendered beside Settings at the sidebar foot. */\nexport interface SidebarFooterActionOwnerProps {\n  /** Whether the sidebar renders wide content (false = 56px rail). */\n  wide: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5289,13 +5687,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Icon presentation supplied by the global panel row. */\nexport interface SidebarPanelIconOwnerProps {\n  /** Requested square edge in pixels. */\n  size: number\n  /** Whether this panel is selected in the main column. */\n  active: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5321,13 +5721,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5335,6 +5737,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -5372,13 +5775,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5386,6 +5791,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -5420,13 +5826,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Content and viewing inputs shared by document bodies and nested PDF presentation. */\nexport interface DocumentBodyOwner {\n  /** Observe a file read by this renderer. @param address - complete file resource address. */\n  readonly addResource: (address: string) => void\n  /** Replace this renderer's dependencies. @param addresses - complete file resource addresses. */\n  readonly setResources: (addresses: readonly string[]) => void\n  /** Original file address, also readable through the standard useResource hook. */\n  readonly resourceAddress: string\n  /** Ordinary file content or a renderer-owned loading request; text accumulates until eof. */\n  readonly content: DocumentContent\n  /** The document toolbar's current wrapping preference. */\n  readonly wrap: boolean\n  /** Report a renderer-owned scrollport; passing `null` restores the shared body as the owner. */\n  readonly scrollportRef: RefCallback<HTMLElement>\n}"],
 				ownerPropsReferences: ["DocumentContent"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5434,6 +5842,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -5469,13 +5878,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Ordinary file contents, or a request for the selected renderer to load its content.\n * Byte arrays are transient UI input, never persisted layout or Session data.\n */\nexport type DocumentContent =\n  | { readonly kind: 'text'; readonly text: string; readonly pages: readonly DocumentTextPage[]; readonly eof: boolean }\n  | { readonly kind: 'bytes'; readonly data: Uint8Array<ArrayBuffer> }\n  | {\n    readonly kind: 'renderer'\n    /** Changes on reload or implementation replacement; retained contents belong to one revision. */\n    readonly revision: number\n    /** Report the displayed source version; stale revisions cannot update the owner. @param version - loaded source version. */\n    readonly loaded: (version: string) => void\n    /** End a failed load; a later file change can start another revision. */\n    readonly failed: () => void\n    /** Cancel the current load and start a new revision. */\n    readonly reload: () => void\n  }"],
 				ownerPropsReferences: ["DocumentTextPage"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5483,6 +5894,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -5523,13 +5935,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5537,6 +5951,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -5563,13 +5978,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Content and viewing inputs shared by document bodies and nested PDF presentation. */\nexport interface DocumentBodyOwner {\n  /** Observe a file read by this renderer. @param address - complete file resource address. */\n  readonly addResource: (address: string) => void\n  /** Replace this renderer's dependencies. @param addresses - complete file resource addresses. */\n  readonly setResources: (addresses: readonly string[]) => void\n  /** Original file address, also readable through the standard useResource hook. */\n  readonly resourceAddress: string\n  /** Ordinary file content or a renderer-owned loading request; text accumulates until eof. */\n  readonly content: DocumentContent\n  /** The document toolbar's current wrapping preference. */\n  readonly wrap: boolean\n  /** Report a renderer-owned scrollport; passing `null` restores the shared body as the owner. */\n  readonly scrollportRef: RefCallback<HTMLElement>\n}"],
 				ownerPropsReferences: ["DocumentContent"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5577,6 +5994,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -5617,13 +6035,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5631,6 +6051,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -5671,13 +6092,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5685,6 +6108,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -5711,13 +6135,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5725,6 +6151,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -5751,13 +6178,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Resolved guide copy and entry identity supplied to a provider's card renderer. */\nexport interface SidebarRightGuideEntryOwnerProps {\n  readonly entryId: string\n  readonly kind: string\n  readonly title: string\n  readonly description?: string\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5765,6 +6194,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -5805,13 +6235,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of one tab-menu item occurrence. */\nexport interface SidebarRightTabMenuOwnerProps {\n  /** The tab whose menu is open. */\n  tab: TabRecord\n  /**\n   * Dismiss the menu.\n   *\n   * An item that acts MUST call this: the menu is the kit's, and it closes on\n   * its own actions only. An item that leaves it open leaves a menu floating\n   * over content the action may have just replaced.\n   */\n  dismiss: () => void\n}"],
 				ownerPropsReferences: ["TabRecord"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -5819,6 +6251,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -5859,13 +6292,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of the two Session-row schedule seats. Both receive only the\n * row's Session identity: the occupant reads that Session's own scheduled\n * tasks, and reading them activates nothing.\n */\nexport interface SessionRowScheduleOwnerProps {\n  /** Session this row shows; the occupant addresses its own data by this id. */\n  readonly sessionId: SessionId\n}"],
 				ownerPropsReferences: ["SessionId"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5874,7 +6309,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-schedule SessionScheduleHover id 'schedule-tasks'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('sidebar.session.row.hover', () => ctx.slots.register(\n      { name: 'sidebar.session.row.hover', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-workspace/src/client/contract/slots.ts:135"
+				source: "packages/client/ui-workspace/src/client/contract/slots.ts:136"
 			},
 			{
 				key: "sidebar.session.row.leading",
@@ -5905,13 +6340,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of the two Session-row schedule seats. Both receive only the\n * row's Session identity: the occupant reads that Session's own scheduled\n * tasks, and reading them activates nothing.\n */\nexport interface SessionRowScheduleOwnerProps {\n  /** Session this row shows; the occupant addresses its own data by this id. */\n  readonly sessionId: SessionId\n}"],
 				ownerPropsReferences: ["SessionId"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5920,7 +6357,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-schedule SessionScheduleMark id 'schedule-mark'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('sidebar.session.row.leading', () => ctx.slots.register(\n      { name: 'sidebar.session.row.leading', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-workspace/src/client/contract/slots.ts:130"
+				source: "packages/client/ui-workspace/src/client/contract/slots.ts:131"
 			},
 			{
 				key: "sidebar.settings",
@@ -5932,13 +6369,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of the sidebar settings seat: the column display state the\n * occupant's trigger row must render against (wide row vs rail icon).\n */\nexport interface SidebarSettingsOwnerProps {\n  /** Whether the sidebar renders wide content (false = 56px rail). */\n  wide: boolean\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5959,13 +6398,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: [],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -5986,13 +6427,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of the browser hole — the only facts crossing the shell/region\n * boundary. Business data and actions arrive through the region's own inject.\n */\nexport interface SidebarSectionOwnerProps {\n  /** Shell fold-state output: wide renders the full browser, rail the icon column. */\n  wide: boolean\n  /** Rail icons request expansion; the browser rides the wide flip for focus. */\n  expandSidebar: () => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -6013,13 +6456,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/**\n * Owner share of the directory-flow holes: the complete conversation between\n * the trigger surface and the picking interaction. The occupant reads `open`\n * to run/render its interaction and reports exactly one outcome per open.\n */\nexport interface DirectoryFlowOwnerProps {\n  /** True while a picking interaction is requested; flipping back to false withdraws the request. */\n  open: boolean\n  /** True while the owner adopts a picked path (`createWorkspace` in flight); occupants disable their commit affordances. */\n  busy: boolean\n  /** The operator picked a directory (absolute host path); the owner adopts it. */\n  onPicked: (path: string) => void\n  /** The operator dismissed the interaction; the owner just closes the flow. */\n  onCancel: () => void\n  /** The interaction itself failed (chooser missing, listing denied); the owner shows its error surface. */\n  onError: (message: string) => void\n}"],
 				ownerPropsReferences: [],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -6028,14 +6473,14 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-directory-picker-browse BrowseDirectoryFlow", "client-ui-directory-picker-native NativeDirectoryFlow"],
 				replaceRisk: "shadows-shipped-ui",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('sidebar.workspaces.directoryFlow', () => ctx.slots.register(\n      { name: 'sidebar.workspaces.directoryFlow' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-workspace/src/client/contract/slots.ts:120"
+				source: "packages/client/ui-workspace/src/client/contract/slots.ts:121"
 			},
 			{
 				key: "sidebar.workspaces.session.menu.item",
 				kind: "list",
 				scope: "root",
 				summary: "The rows of one Session's \"...\" menu, in ascending `order`.",
-				doc: "The rows of one Session's \"...\" menu, in ascending `order`. ui-workspace\nregisters the shipped rows here — `pin` (100), `rename` (200), `fork`\n(300), `archive` (400) — so a plugin row is placed by its own `order`\namong them. Use a package-namespaced `id`; reusing a shipped id at\nanother `priority` shadows that row. Each entry renders one\n`role=\"menuitem\"` `<button>` (the shipped rows use ui-primitives'\n`MenuItemButton`, which adds the host styling and `separatorBefore`),\ndecides its own visibility from its own state, and dismisses the menu\nthrough the injected `useMenuOpenState` hook after acting; the list's\nkeyboard walk and focus return read the DOM, so any such button joins\nthem. Labels come from the contributing package's locale namespace.",
+				doc: "The rows of one Session's \"...\" menu, in ascending `order`. ui-workspace\nregisters the shipped rows here — `pin` (100), `rename` (200), `fork`\n(300), `archive` (400), and `session-id` (450) — so a plugin row is placed\nby its own `order` among them. Use a package-namespaced `id`; reusing a shipped id at\nanother `priority` shadows that row. Each entry renders one\n`role=\"menuitem\"` `<button>` (the shipped rows use ui-primitives'\n`MenuItemButton`, which adds the host styling and `separatorBefore`),\ndecides its own visibility from its own state, and dismisses the menu\nthrough the injected `useMenuOpenState` hook after acting; the list's\nkeyboard walk and focus return read the DOM, so any such button joins\nthem. Labels come from the contributing package's locale namespace.",
 				registerOptions: [
 					{
 						name: "id",
@@ -6059,13 +6504,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of one Session row action occurrence: the row the action belongs to. */\nexport interface SessionRowOwnerProps {\n  /** Session the row shows. */\n  sessionId: SessionId\n  /** Row display title: persisted title, or empty when the Session has none. */\n  displayTitle: string\n}"],
 				ownerPropsReferences: ["SessionId"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "MenuOpenState",
@@ -6075,11 +6522,12 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"client-ui-workspace PinSessionMenuItem id 'pin'",
 					"client-ui-workspace RenameSessionMenuItem id 'rename'",
 					"client-ui-workspace ForkSessionMenuItem id 'fork'",
-					"client-ui-workspace ArchiveSessionMenuItem id 'archive'"
+					"client-ui-workspace ArchiveSessionMenuItem id 'archive'",
+					"client-ui-workspace SessionIdMenuItem id 'session-id'"
 				],
 				replaceRisk: "none",
-				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    const copyLabel = 'Copy Session ID' // Localize in the contributing package.\n    ctx.slots.inject('sidebar.workspaces.session.menu.item', () => ctx.slots.register(\n      { name: 'sidebar.workspaces.session.menu.item', id: 'copy-session-id', order: 500 },\n      ({ sessionId, useMenuOpenState }) => {\n        const [, setMenuOpen] = useMenuOpenState()\n        return React.createElement(\n          'button',\n          { type: 'button', role: 'menuitem', onClick: () => { setMenuOpen(false); void navigator.clipboard.writeText(sessionId) } },\n          copyLabel,\n        )\n      },\n    ))\n  },\n}",
-				source: "packages/client/ui-workspace/src/client/contract/slots.ts:167"
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    const copyLabel = 'Copy session title' // Localize in the contributing package.\n    ctx.slots.inject('sidebar.workspaces.session.menu.item', () => ctx.slots.register(\n      { name: 'sidebar.workspaces.session.menu.item', id: 'copy-session-title', order: 500 },\n      ({ displayTitle, useMenuOpenState }) => {\n        const [, setMenuOpen] = useMenuOpenState()\n        return React.createElement(\n          'button',\n          {\n            type: 'button', role: 'menuitem',\n            onClick: () => { setMenuOpen(false); void navigator.clipboard.writeText(displayTitle) },\n          },\n          copyLabel,\n        )\n      },\n    ))\n  },\n}",
+				source: "packages/client/ui-workspace/src/client/contract/slots.ts:171"
 			},
 			{
 				key: "sidebar.workspaces.session.row.action",
@@ -6110,13 +6558,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner share of one Session row action occurrence: the row the action belongs to. */\nexport interface SessionRowOwnerProps {\n  /** Session the row shows. */\n  sessionId: SessionId\n  /** Row display title: persisted title, or empty when the Session has none. */\n  displayTitle: string\n}"],
 				ownerPropsReferences: ["SessionId"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>"
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
 				],
 				keyDomain: "",
 				hookContext: "",
@@ -6125,7 +6575,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				occupants: ["client-ui-workspace ArchiveSessionRowButton id 'archive'", "client-ui-workspace PinSessionRowButton id 'pin'"],
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('sidebar.workspaces.session.row.action', () => ctx.slots.register(\n      { name: 'sidebar.workspaces.session.row.action', id: 'my-entry', order: 100, label: 'My entry' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
-				source: "packages/client/ui-workspace/src/client/contract/slots.ts:185"
+				source: "packages/client/ui-workspace/src/client/contract/slots.ts:189"
 			},
 			{
 				key: "tool.call.images",
@@ -6137,13 +6587,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				ownerProps: ["/** Owner currency of the Tool image gallery slot: references plus the loader. */\nexport interface ToolImagesOwnerProps {\n  /** Durable references or submission-echo previews in result order. */\n  images: readonly MessageImageSource[]\n  /** Session-authorized image URL loader for the durable arm. */\n  loadImage: MessageImageLoader\n  /** Horizontal placement inside the owning record. */\n  align: 'start' | 'end'\n}"],
 				ownerPropsReferences: ["MessageImageLoader", "MessageImageSource"],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -6151,6 +6603,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "",
@@ -6188,13 +6641,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"UseDisclosure"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -6202,6 +6657,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), already taken: ask_user_question, bash, cordis_define, cordis_inspect_list, cordis_inspect_query, cordis_inspect_self, cordis_run, cordis_stop, cordis_undefine, create_goal, edit, get_goal, glob, grep, interrupt_agent, job_kill, job_list, job_output, list_agents, list_subagent_models, lsp, present, ralph, read, read_image, schedule_create, schedule_delete, schedule_list, schedule_update, send_message, session_event_read, session_event_search, session_event_trace, session_search, session_trace, skill, spawn_teammate, subagent, team_task_create, team_task_get, team_task_list, team_task_update, terminal_close, terminal_list, terminal_open, terminal_read, terminal_signal, todo_write, update_goal, wait_agent, web_fetch, web_search, workflow, write",
@@ -6287,13 +6743,15 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"CordisDynamicPluginRunId"
 				],
 				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
 					"useResource: UseResource",
 					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
 					"usePanelInfo: UsePanelInfo",
 					"useSessions: UseSessions",
 					"useSessionStatus: UseSessionStatus",
 					"useSessionRetainInfo: UseSessionRetainInfo",
-					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean",
 					"useChat: UseChat",
 					"useConversation: UseConversation",
 					"useInput: SnapshotSelectorHook<InputState>",
@@ -6301,6 +6759,7 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 					"useSession: SessionSnapshotSelector",
 					"sessionId: SessionId",
 					"useProjection: UseProjection",
+					"useAccess: (action: RemoteEndpoint) => boolean",
 					"useTrajectory: UseTrajectory"
 				],
 				keyDomain: "open: any string the owner dispatches (no compile-time key set), none are taken yet",
@@ -6311,6 +6770,52 @@ call: (method, args = null) => env.invoke(method, args) }, harnessTrap(), ...Obj
 				replaceRisk: "none",
 				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('tool.view.cordis', () => ctx.slots.register(\n      { name: 'tool.view.cordis', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
 				source: "packages/extensions/ui-cordis/src/client/slots.ts:31"
+			},
+			{
+				key: "workspace.toast",
+				kind: "keyed",
+				scope: "root",
+				summary: "Workspace notices selected by their existing business discriminator.",
+				doc: "Workspace notices selected by their existing business discriminator.",
+				registerOptions: [{
+					name: "key",
+					requirement: "required",
+					type: "string",
+					doc: "Your cell key: the entry renders where the owner dispatches this exact key. Registering an already-occupied key replaces that occupant."
+				}],
+				ownerProps: ["/** Owner operations available to every keyed Workspace notice. */\nexport interface WorkspaceToastOwnerProps {\n  /** Dismiss the displayed notice. */\n  dismissToast: () => void\n}"],
+				ownerPropsReferences: ["Workspace"],
+				standardProps: [
+					"useRemoteAccess: (action: RemoteEndpoint) => boolean",
+					"useResource: UseResource",
+					"useWorkspaces: SnapshotSelectorHook<WorkspaceSnapshot>",
+					"usePanelInfo: UsePanelInfo",
+					"useSessions: UseSessions",
+					"useSessionStatus: UseSessionStatus",
+					"useSessionRetainInfo: UseSessionRetainInfo",
+					"useSessionAccess: (sessionId: SessionId, action: RemoteEndpoint) => boolean",
+					"useWorkspaceAccess: (workspaceId: WorkspaceId, action: RemoteEndpoint) => boolean"
+				],
+				keyDomain: "fixed by the owner's key table { [K in ToastKind]: ToastNotice<K> }, already taken: archived, archivedNotOpenable, createFailed, defaultWorkspaceFailed, forkRequiresOpen, pinFailed, sessionIdCopied, sessionIdCopyFailed, shortcutForkFailed, stoppedAndArchived, unpinFailed",
+				hookContext: "",
+				slotInject: "",
+				declaredBy: "an entry in 'shell.overlay' (client-ui-workspace), so it exists while that entry is mounted",
+				occupants: [
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'sessionIdCopi… key 'sessionIdCopied'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'sessionIdCopy… key 'sessionIdCopyFailed'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'pinFailed'>> key 'pinFailed'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'unpinFailed'>> key 'unpinFailed'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'archivedNotOp… key 'archivedNotOpenable'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'defaultWorksp… key 'defaultWorkspaceFailed'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'shortcutForkF… key 'shortcutForkFailed'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'createFailed'>> key 'createFailed'",
+					"client-ui-workspace ToastEntry<PropsRuntime<'workspace.toast', 'forkRequiresO… key 'forkRequiresOpen'",
+					"client-ui-workspace ArchiveToastEntry key 'archived'",
+					"client-ui-workspace ArchiveToastEntry key 'stoppedAndArchived'"
+				],
+				replaceRisk: "shadows-shipped-ui",
+				example: "return {\n  inject: ['slots'],\n  apply(ctx) {\n    ctx.slots.inject('workspace.toast', () => ctx.slots.register(\n      { name: 'workspace.toast', key: '<one key the owner dispatches>' },\n      () => React.createElement('div', null, 'hello'),\n    ))\n  },\n}",
+				source: "packages/client/ui-workspace/src/client/contract/toast.ts:53"
 			}
 		];
 		//#endregion