scope the six sessionKey commands to their caller

The control surface half of 7cb402b, and the code-side blocker on the gates.
kill, interrupt, clear-session, is-generating, find-session and list all took a
bare sessionKey, so any caller who could reach them could act on whichever
session happened to match — and list returned every session in the sidecar,
which host rightly called a disclosure on its own, before anyone kills anything.

All six now carry userId, resolved from the authenticated request and never
taken from the client, and every handler enforces it through one ownedSession
helper. list is filtered rather than labelled. find-session is scoped because it
is the reattach hinge: a browser holding a transcript uuid it should not have
would otherwise be handed the session key that drives it.

"Not yours" and "does not exist" answer identically everywhere, which is the
same choice getClaudeSession made: every caller treats them the same, and a
distinct answer for the second confirms to a guesser that a session exists under
a key they do not own.

One behaviour change beyond the scoping. endTurnIfAgentIsGone sweeps sessions on
a sidecar restart, and a session with no recorded userId now has no safe id to
ask as — asking as the owner would answer a member's orphaned session with the
owner's authority. It is skipped, so it stays marked generating until the next
reconnect corrects it, which is what happened before that loop existed.

This removes the code-side reason the gates cannot move. It does not make them
movable: no member has signed in, no member turn has run, spawnClaudeCodeProcess
has still never been called, and lifting them was never mine to decide.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/sidecar/protocol.ts

@@ -49,20 +49,24 @@ export type SidecarCommand =
   // Claude Code
   | { type: 'claude:spawn'; id: string; params: ClaudeSpawnParams }
   | { type: 'claude:spawn-streaming'; id: string; params: ClaudeSpawnStreamingParams }
-  | { type: 'claude:kill'; id: string; sessionKey: string }
-  | { type: 'claude:interrupt'; id: string; sessionKey: string }
-  | { type: 'claude:clear-session'; id: string; sessionKey: string }
+  // Every one of these carries `userId` for the same reason `ClaudeSpawnStreamingParams.member` does: the
+  // sidecar's session map is global and `sessionKey` arrives in a client message, so a command without an
+  // identity is a command that acts on whoever's session happens to match. Resolved by the platform from the
+  // authenticated request, never taken from the client.
+  | { type: 'claude:kill'; id: string; sessionKey: string; userId: number }
+  | { type: 'claude:interrupt'; id: string; sessionKey: string; userId: number }
+  | { type: 'claude:clear-session'; id: string; sessionKey: string; userId: number }
   // Is a turn still running for this session? Only the process that owns the session can say, which is
   // exactly why it is asked over the wire — see `isClaudeGenerating` in sidecar-registry.
-  | { type: 'claude:is-generating'; id: string; sessionKey: string }
+  | { type: 'claude:is-generating'; id: string; sessionKey: string; userId: number }
   // Which session key owns this transcript? The map lives on the agent's disk, so only it can answer —
   // see `findClaudeSessionKey` in sidecar-registry, and `attach` in the chat socket for why it is asked.
-  | { type: 'claude:find-session'; id: string; claudeSessionId: string }
+  | { type: 'claude:find-session'; id: string; claudeSessionId: string; userId: number }
   // Everything the agent is holding right now. `claude:is-generating` answers for a session you can
   // already name; this is for the case where officer has forgotten every name it had — its session
   // records are in memory and die with `pm2 restart officer`, while the agent keeps running. Without it
   // a live session is invisible until a browser happens to reconnect to it by id.
-  | { type: 'claude:list'; id: string }
+  | { type: 'claude:list'; id: string; userId: number }
   // OpenCode — drive a turn through the serve (POST /api/session/{id}/prompt), anchored to the chat cwd
   // by a per-request location header. Was an `opencode run` subprocess until 2026-08-10.
   | { type: 'opencode:run-streaming'; id: string; params: OpenCodeRunParams }