@maudecode/talaria-web 1.14.0 → 1.16.1

package/sidecar/talaria_sidecar/methods/chat.py

@@ -11,6 +11,7 @@ through ``approval.respond`` / ``clarify.respond``; ``rpc.cancel`` or
 from __future__ import annotations
 
 import contextlib
+import contextvars
 import hashlib
 import inspect
 import json
@@ -257,13 +258,86 @@ def _clarify_timeout(params: dict) -> int:
         return 3600
 
 
+def _steer_slot_lock(agent):
+    """The Agent's own pending-steer lock (a plain ``Lock``), so a slot read or rewrite is atomic against its drains."""
+    lock = agent.__dict__.get("_pending_steer_lock") if hasattr(agent, "__dict__") else None
+    return contextlib.nullcontext() if lock is None else lock
+
+
+def _steer_slot(agent) -> str:
+    """The Agent's not-yet-applied steer text; call under ``_steer_slot_lock``."""
+    return str(getattr(agent, "_pending_steer", "") or "")
+
+
 def _agent_pending_steer_text(agent) -> str:
     """Predecessor ``_agent_pending_steer_text``: the Agent's not-yet-applied steer text."""
-    lock = agent.__dict__.get("_pending_steer_lock") if hasattr(agent, "__dict__") else None
-    if lock is None:
-        return str(getattr(agent, "_pending_steer", "") or "")
-    with lock:
-        return str(agent.__dict__.get("_pending_steer") or "")
+    with _steer_slot_lock(agent):
+        return _steer_slot(agent)
+
+
+def _slot_without(slot: str, pending: list[str], index: int) -> str | None:
+    """``slot`` without the steer ``pending[index]`` while the Agent still holds it, else None (it already took it).
+
+    The Agent keeps every not-yet-applied steer in one newline-joined slot, so the slot is the tail of ``pending``
+    (the server's steers, oldest first), possibly behind text another surface queued: the server's
+    ``pendingSteerSuffixStart`` rule. The longest tail that still holds the steer wins."""
+    for start in range(index + 1):
+        tail = "\n".join(pending[start:])
+        if slot == tail or slot.endswith("\n" + tail):
+            head = slot[: len(slot) - len(tail)].rstrip("\n")
+            return "\n".join(part for part in [head, *pending[start:index], *pending[index + 1:]] if part)
+    return None
+
+
+def withdraw_steer(agent, pending: list[str], index: int) -> bool:
+    """TAL-424: take a not-yet-applied steer back out of the Agent's slot, keeping the others in order. False when the
+    Agent already took it; the slot is then left as it was, so no text is ever lost."""
+    with _steer_slot_lock(agent):
+        rest = _slot_without(_steer_slot(agent), pending, index)
+        if rest is None:
+            return False
+        agent._pending_steer = rest or None
+        return True
+
+
+def steer_now(agent, pending: list[str], index: int) -> dict:
+    """TAL-424: deliver a pending steer now with the Agent's ``redirect``. During a model request that request restarts
+    with it (``delivery: redirect``); during tools it goes back on the slot and the tools yield (``delivery: steer``).
+    With no live request the steer stays pending: back in its place, or last when the slot changed meanwhile."""
+    text = pending[index]
+    with _steer_slot_lock(agent):
+        before = _steer_slot(agent)
+        rest = _slot_without(before, pending, index)
+        if rest is None:
+            return {"redirected": False, "withdrawn": False}
+        agent._pending_steer = rest or None
+    redirect = getattr(agent, "redirect", None)
+    try:
+        redirected = bool(redirect(text)) if callable(redirect) else False
+    except Exception as exc:  # noqa: BLE001
+        log.debug("redirect failed: %s", exc)
+        redirected = False
+    if not redirected:
+        with _steer_slot_lock(agent):
+            if _steer_slot(agent) == rest:
+                agent._pending_steer = before or None
+                return {"redirected": False, "withdrawn": True, "requeued": "kept"}
+        agent.steer(text)
+        return {"redirected": False, "withdrawn": True, "requeued": "last"}
+    with _steer_slot_lock(agent):
+        slot = _steer_slot(agent)
+    delivery = "steer" if slot == text or slot.endswith("\n" + text) else "redirect"
+    return {"redirected": True, "withdrawn": True, "delivery": delivery}
+
+
+def _steer_queue_params(params: dict) -> tuple[list[str], int]:
+    pending = params.get("pending")
+    index = params.get("index")
+    if not isinstance(pending, list) or not all(isinstance(t, str) and t.strip() for t in pending):
+        raise InvalidParams("pending must be a list of steer texts")
+    if not isinstance(index, int) or isinstance(index, bool) or not 0 <= index < len(pending):
+        raise InvalidParams("index must point into pending")
+    return [t.strip() for t in pending], index
 
 
 def _cancel_checkpoint(run: _Run) -> list | None:
@@ -299,7 +373,7 @@ def _resolve_runtime(provider: str | None, model: str) -> dict:
 def _turn_identity(session_id: str, workspace: str):
     """Bind this turn's identity to the calling context the way the predecessor's ``_set_turn_session_identity`` did:
     the approval session key (so ``register_gateway_notify`` cards reach this turn and dangerous commands are gated
-    instead of auto-approved), the gateway session vars (platform ``webui``, chat/ui session ids), and the session cwd
+    instead of auto-approved), the gateway session vars (platform ``webui``, chat/ui session ids, profile), and the session cwd
     (so terminals and AGENTS.md discovery run in the selected workspace, not the sidecar's launch directory). Every
     binding is a context variable, so concurrent turns cannot overwrite each other. Missing Agent surfaces are logged,
     not fatal."""
@@ -315,10 +389,14 @@ def _turn_identity(session_id: str, workspace: str):
         log.debug("per-turn approval session-key bind failed", exc_info=True)
     try:
         from gateway import session_context as sc
+        from hermes_cli.profiles import get_active_profile_name
+        from hermes_constants import get_hermes_home, profile_name_for_home
 
+        # The persistent Docker sandbox is keyed by the profile name; unbound, every profile reuses "default".
+        profile = profile_name_for_home(get_hermes_home()) or get_active_profile_name()
         pairs = [
             (sc._SESSION_KEY, session_id), (sc._SESSION_UI_SESSION_ID, session_id), (sc._SESSION_PLATFORM, "webui"),
-            (sc._SESSION_CHAT_ID, session_id), (sc._SESSION_ID, session_id),
+            (sc._SESSION_CHAT_ID, session_id), (sc._SESSION_ID, session_id), (sc._SESSION_PROFILE, profile),
         ]
         for var, value in pairs:
             tok = var.set(value)
@@ -342,6 +420,63 @@ def _turn_identity(session_id: str, workspace: str):
                 log.debug("per-turn identity reset failed", exc_info=True)
 
 
+#: Older configs named the CLI composite ``hermes``; the Agent registers it split in two (predecessor
+#: ``_LEGACY_CLI_TOOLSET_ALIASES``).
+_LEGACY_TOOLSET_ALIASES = {"hermes": ("hermes-cli", "hermes-api-server")}
+
+
+def _turn_toolsets(toolsets) -> list[str]:
+    """The session's override as sent, else the profile's configured toolsets. ``None`` would hand the Agent every
+    registered toolset."""
+    return toolsets if isinstance(toolsets, list) else _profile_toolsets()
+
+
+def _profile_toolsets() -> list[str]:
+    """The profile's ``platform_toolsets.cli`` through the Agent's own resolver (default-off toolsets stay off), like
+    ``hermes chat``. Runs under the call's ``scoped_home``."""
+    from hermes_cli.config import load_config
+    from hermes_cli.tools_config import _get_platform_tools
+
+    resolved = sorted(_get_platform_tools(load_config() or {}, "cli"))
+    return list(dict.fromkeys(name for raw in resolved for name in _LEGACY_TOOLSET_ALIASES.get(raw, (raw,))))
+
+
+def _discover_mcp_tools(run: _Run) -> None:
+    """Connect the profile's MCP servers before the turn's agent snapshots its tools, like the predecessor's turn start.
+    The Agent keys connections by profile scope and skips live ones, so later turns are cheap. Runs under the call's
+    ``scoped_home``; a failure leaves the turn without MCP tools rather than failing it. A Stop does not wait for a slow
+    server: the turn moves on to its cancelled end while the connect finishes in the background."""
+    from .commands import retire_unscoped_launch_mcp_servers
+
+    done = threading.Event()
+
+    def discover() -> None:
+        try:
+            from tools.mcp_tool_discovery import discover_mcp_tools
+
+            retire_unscoped_launch_mcp_servers()
+            discover_mcp_tools()
+        except Exception:  # noqa: BLE001
+            log.warning("MCP discovery failed", exc_info=True)
+        finally:
+            done.set()
+
+    # The copied context carries the turn's home override and secret scope into the worker.
+    threading.Thread(target=contextvars.copy_context().run, args=(discover,), daemon=True, name=f"chat-mcp-{run.stream_id[:8]}").start()
+    while not done.wait(0.25):
+        if run.cancel.is_set() or run.ctx.cancelled:
+            return
+
+
+def _profile_fallback_chain() -> list[dict] | None:
+    """The profile's fallback routes (``fallback_providers`` first, then legacy ``fallback_model``, deduplicated)
+    through the Agent's own resolver, like the CLI and gateway. Runs under the call's ``scoped_home``."""
+    from hermes_cli.config import load_config
+    from hermes_cli.fallback_config import get_fallback_chain
+
+    return get_fallback_chain(load_config() or {}) or None
+
+
 def _agent_signature(model: str, provider, runtime: dict, toolsets, home: str, kwargs: dict) -> str:
     """Cache identity of an ``AIAgent``: everything its constructor bound from the resolved runtime, so a rotated key,
     a different API mode, ACP command, or credential pool never reuses an agent built for the old bundle. The key
@@ -357,6 +492,8 @@ def _agent_signature(model: str, provider, runtime: dict, toolsets, home: str, k
         "max_iterations": kwargs.get("max_iterations"), "max_tokens": kwargs.get("max_tokens"),
         # Bound at construction too: a reasoning-effort change from the composer must build a fresh agent.
         "reasoning_config": kwargs.get("reasoning_config"),
+        # Entries may carry their own ``api_key``.
+        "fallback_model": hashlib.sha256(json.dumps(kwargs.get("fallback_model"), sort_keys=True, default=str).encode("utf-8")).hexdigest()[:16],
     }
     return json.dumps(bundle, sort_keys=True, default=str)
 
@@ -399,6 +536,34 @@ def _supported(cls, name: str) -> bool:
     return name in parameters or any(p.kind is inspect.Parameter.VAR_KEYWORD for p in parameters.values())
 
 
+def _approval_notifier(session_id: str, emit):
+    """The Agent's gateway notify callback for one turn: emits each parked approval, then ``approval_resolved``
+    (id plus the Agent's reason) once its wait ends by any path, an ``approvals.timeout`` expiry included (TAL-514)."""
+    try:
+        from tools.approval import register_gateway_settle
+    except Exception:  # noqa: BLE001
+        register_gateway_settle = None
+
+    def notify(data):
+        payload = dict(data or {})
+        payload.setdefault("session_id", session_id)
+        payload.setdefault("approval_id", str(payload.get("request_id") or uuid.uuid4().hex))
+        emit("approval", payload)
+        request_id = str(payload.get("request_id") or "")
+        if register_gateway_settle is None or not request_id:
+            return
+        approval_id = payload["approval_id"]
+
+        def settle(reason):
+            emit("approval_resolved", {"approval_id": approval_id, "session_id": session_id, "reason": str(reason or "")})
+
+        # False: the wait already ended between the emit and this registration.
+        if not register_gateway_settle(session_id, request_id, settle):
+            settle("resolved")
+
+    return notify
+
+
 def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn, one function
     session_id = str(params.get("session_id") or "").strip()
     stream_id = str(params.get("stream_id") or "").strip()
@@ -414,7 +579,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
         history = []
     if not isinstance(history, list):
         raise InvalidParams("conversation_history must be a list")
-    toolsets = params.get("enabled_toolsets")
+    toolsets = _turn_toolsets(params.get("enabled_toolsets"))
     system_message = params.get("system_message")
     run = _Run(stream_id, session_id, ctx)
     with _RUNS_LOCK:
@@ -437,6 +602,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
                 raw_emit("steer_pending", {"text": pending})
         raw_emit(event, data)
     try:
+        _discover_mcp_tools(run)
         runtime = _resolve_runtime(provider, model)
         resolved_model = model or str(runtime.get("model") or "")
         resolved_provider = provider or runtime.get("provider")
@@ -553,15 +719,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             from tools.approval import register_gateway_notify, unregister_gateway_notify
         except Exception:  # noqa: BLE001
             register_gateway_notify = unregister_gateway_notify = None
-        if register_gateway_notify is not None:
-            def _approval_cb(data):
-                payload = dict(data or {})
-                payload.setdefault("session_id", session_id)
-                payload.setdefault("approval_id", str(payload.get("request_id") or uuid.uuid4().hex))
-                emit("approval", payload)
-            approval_cb = _approval_cb
-        else:
-            approval_cb = None
+        approval_cb = _approval_notifier(session_id, emit) if register_gateway_notify is not None else None
 
         kwargs: dict = dict(
             model=resolved_model,
@@ -570,7 +728,7 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             api_key=runtime.get("api_key"),
             platform="webui",
             quiet_mode=True,
-            enabled_toolsets=toolsets if isinstance(toolsets, list) else None,
+            enabled_toolsets=toolsets,
             session_id=session_id,
             stream_delta_callback=on_token,
             reasoning_callback=on_reasoning,
@@ -598,6 +756,9 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
         reasoning_config = params.get("reasoning_config")
         if isinstance(reasoning_config, dict) and _supported(AIAgent, "reasoning_config"):
             kwargs["reasoning_config"] = reasoning_config
+        fallback_chain = _profile_fallback_chain()
+        if fallback_chain and _supported(AIAgent, "fallback_model"):
+            kwargs["fallback_model"] = fallback_chain
         signature = _agent_signature(resolved_model, resolved_provider, runtime, toolsets, str(params.get("profile_home")), kwargs)
         agent = None
         if not session_busy:
@@ -699,14 +860,22 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
             error = str(last_error)
         if not error and isinstance(result.get("error"), str) and result.get("error"):
             error = str(result["error"])
-        status = "cancelled" if cancelled else ("error" if error and not result.get("messages") else "completed")
+        # The Agent ends a failed turn with ``failed``/``partial`` (never ``status``), often after text streamed and with
+        # the turn's messages; a failed turn is an error whatever it carries.
+        failed = bool(result.get("failed"))
+        partial = bool(result.get("partial"))
+        if not error and failed and result.get("final_response"):
+            error = str(result["final_response"])
+        status = "cancelled" if cancelled else ("error" if failed or (error and not result.get("messages")) else "completed")
         pending_steer = str(result.get("pending_steer") or "") if isinstance(result, dict) else ""
         return {
             "status": status,
             "messages": [m for m in (result.get("messages") or []) if isinstance(m, dict)],
             "final_response": str(result.get("final_response") or ""),
             "error": error,
-            "result_status": str(result.get("status") or result.get("state") or ""),
+            "failed": failed,
+            "partial": partial,
+            "compression_exhausted": bool(result.get("compression_exhausted")),
             "tool_limit_reached": bool(result.get("tool_limit_reached") or result.get("max_iterations_reached")),
             "usage": _usage(agent),
             "context": _context_length(agent),
@@ -725,6 +894,131 @@ def start(ctx: CallContext, params: dict) -> dict:  # noqa: PLR0915 - one turn,
                 _RUNS_BY_SESSION.pop(session_id, None)
 
 
+def _checkpoint_required() -> bool:
+    """``compression.checkpoint_required`` needs the memory provider loaded to write the pre-compression checkpoint."""
+    try:
+        from hermes_cli.config import load_config
+
+        return ((load_config() or {}).get("compression") or {}).get("checkpoint_required") is True
+    except Exception:  # noqa: BLE001
+        return False
+
+
+#: Compressed results awaiting the server's write: ``commit_token -> (agent, profile home, expiry timer)``.
+_PENDING_COMPRESSIONS: dict[str, tuple[Any, Any, threading.Timer]] = {}
+_PENDING_COMPRESSIONS_LOCK = threading.Lock()
+#: A server that never answers (restart, crash) gets its compression discarded after this long.
+_PENDING_COMPRESSION_TTL = 600.0
+
+
+def _release_compression(agent, committed: bool) -> None:
+    """Emit (committed) or discard the Agent's deferred context-engine notification, then close the throwaway agent."""
+    from agent.conversation_compression import finalize_context_engine_compression_notification
+
+    try:
+        finalize_context_engine_compression_notification(agent, committed=committed)
+    finally:
+        with contextlib.suppress(Exception):
+            agent._end_session_on_close = False
+        close = getattr(agent, "close", None)
+        if callable(close):
+            try:
+                close()
+            except Exception:  # noqa: BLE001
+                log.debug("compression agent close failed", exc_info=True)
+
+
+def finalize_compression(token: str, committed: bool) -> bool:
+    """``chat.compress_finalize``: the server reports whether it installed the result; unknown tokens are a no-op."""
+    with _PENDING_COMPRESSIONS_LOCK:
+        entry = _PENDING_COMPRESSIONS.pop(token, None)
+    if entry is None:
+        return False
+    agent, home, expiry = entry
+    expiry.cancel()  # a no-op when the timer itself is finalizing
+    with scoped_home(home):
+        _release_compression(agent, committed=committed)
+    return True
+
+
+def compress(ctx: CallContext, params: dict) -> dict:
+    """Manual ``/compress`` of ``conversation_history`` through the Agent's shared core (``compress_now``) on a throwaway
+    agent, like the gateway's ``_run_manual_compression``. The server owns the transcript: it re-checks the session and
+    installs ``messages`` itself, so nothing here touches history or the cached turn agent. The agent has no session
+    store, so the Agent neither rotates nor writes state.db; its one deferred effect, the context-engine notification,
+    waits for ``chat.compress_finalize`` with the returned ``commit_token`` (two-phase, like the gateway's commit)."""
+    home = profile_home_param(params)
+    session_id = str(params.get("session_id") or "").strip()
+    if not session_id:
+        raise InvalidParams("session_id is required")
+    history = params.get("conversation_history")
+    if not isinstance(history, list):
+        raise InvalidParams("conversation_history must be a list")
+    model = str(params.get("model") or "").strip()
+    provider = str(params.get("model_provider") or "").strip() or None
+    focus_topic = str(params.get("focus_topic") or "").strip()[:500] or None
+    toolsets = _turn_toolsets(params.get("enabled_toolsets"))
+    runtime = _resolve_runtime(provider, model)
+    if not runtime.get("api_key"):
+        raise RpcError("No provider configured -- cannot compress.", condition="credential_missing")
+    from agent.conversation_compression_manual import CompressRequest, compress_now
+
+    AIAgent = _agent_class()
+    kwargs: dict = dict(
+        model=model or str(runtime.get("model") or ""),
+        provider=provider or runtime.get("provider"),
+        base_url=runtime.get("base_url"),
+        api_key=runtime.get("api_key"),
+        platform="webui",
+        quiet_mode=True,
+        enabled_toolsets=toolsets,
+        session_id=session_id,
+    )
+    for name, value in (
+        ("api_mode", runtime.get("api_mode")),
+        ("acp_command", runtime.get("acp_command")),
+        ("acp_args", runtime.get("acp_args")),
+        ("credential_pool", runtime.get("credential_pool")),
+        ("gateway_session_key", session_id),
+        ("skip_memory", not _checkpoint_required()),
+    ):
+        if _supported(AIAgent, name) and value is not None:
+            kwargs[name] = value
+    agent = AIAgent(**kwargs)
+    held = False
+    try:
+        result = compress_now(agent, history, CompressRequest(focus_topic=focus_topic), task_id=session_id)
+        message = None
+        if result.status != "compressed":
+            from agent.conversation_compression_manual import render_compress_result
+
+            message = "\n".join(render_compress_result(result)) or None
+        payload = {
+            "status": result.status,
+            "messages": json.loads(json.dumps([m for m in result.after_messages if isinstance(m, dict)], default=str)),
+            "before_tokens": int(result.before_tokens or 0),
+            "after_tokens": int(result.after_tokens or 0),
+            "summary": json.loads(json.dumps(result.summary, default=str)) if isinstance(result.summary, dict) else None,
+            "message": message,
+            "agent_session_id": str(getattr(agent, "session_id", None) or session_id),
+            "commit_token": None,
+        }
+        if result.status == "compressed":
+            token = uuid.uuid4().hex
+            # A server that never answers (restart, failed RPC) gets the compression discarded on its own.
+            expiry = threading.Timer(_PENDING_COMPRESSION_TTL, finalize_compression, args=(token, False))
+            expiry.daemon = True
+            with _PENDING_COMPRESSIONS_LOCK:
+                _PENDING_COMPRESSIONS[token] = (agent, home, expiry)
+            expiry.start()
+            held = True
+            payload["commit_token"] = token
+        return payload
+    finally:
+        if not held:
+            _release_compression(agent, committed=False)
+
+
 def _run_for(params: dict) -> _Run | None:
     stream_id = str(params.get("stream_id") or "").strip()
     session_id = str(params.get("session_id") or "").strip()
@@ -748,6 +1042,18 @@ def register(registry) -> None:
             with _turn_identity(session_id, workspace):
                 return start(ctx, params)
 
+    @registry.method("chat.compress")
+    def compress_(ctx: CallContext, params: dict) -> dict:
+        with scoped_home(profile_home_param(params)):
+            return compress(ctx, params)
+
+    @registry.method("chat.compress_finalize", requires_agent=False)
+    def compress_finalize_(ctx: CallContext, params: dict) -> dict:
+        token = str(params.get("commit_token") or "").strip()
+        if not token:
+            raise InvalidParams("commit_token is required")
+        return {"finalized": finalize_compression(token, params.get("committed") is True)}
+
     @registry.method("chat.interrupt", requires_agent=False)
     def interrupt_(ctx: CallContext, params: dict) -> dict:
         run = _run_for(params)
@@ -786,18 +1092,43 @@ def register(registry) -> None:
         except Exception as exc:  # noqa: BLE001
             log.debug("steer failed: %s", exc)
             return {"accepted": False, "fallback": "steer_error"}
-        return {"accepted": accepted, "fallback": None if accepted else "not_running"}
+        # `can_redirect`: whether this Agent can deliver a pending steer now (TAL-424 "Send now").
+        return {"accepted": accepted, "fallback": None if accepted else "not_running", "can_redirect": callable(getattr(run.agent, "redirect", None))}
+
+    @registry.method("chat.steer_withdraw", requires_agent=False)
+    def steer_withdraw_(ctx: CallContext, params: dict) -> dict:
+        pending, index = _steer_queue_params(params)
+        run = _run_for(params)
+        if run is None or run.agent is None:
+            return {"withdrawn": False}
+        return {"withdrawn": withdraw_steer(run.agent, pending, index)}
+
+    @registry.method("chat.steer_now", requires_agent=False)
+    def steer_now_(ctx: CallContext, params: dict) -> dict:
+        pending, index = _steer_queue_params(params)
+        run = _run_for(params)
+        if run is None or run.agent is None:
+            return {"redirected": False, "withdrawn": False}
+        return steer_now(run.agent, pending, index)
 
     @registry.method("chat.evict_agent", requires_agent=False)
     def evict_(ctx: CallContext, params: dict) -> dict:
+        """Drop a session's cached agent. Only delete/clear (``clear_session``) end its approval grants, parked
+        approvals and kernels; a model switch, truncate or compress leaves a running turn's agent in place."""
         session_id = str(params.get("session_id") or "").strip()
+        end_session = params.get("clear_session") is True
         with _AGENT_CACHE_LOCK:
+            with _RUNS_LOCK:
+                run = _RUNS.get(_RUNS_BY_SESSION.get(session_id) or "")
+            if not end_session and run is not None and not run.finished.is_set():
+                return {"evicted": False}
             evicted = _AGENT_CACHE.pop(session_id, None) is not None
-        try:
-            from tools.approval import clear_session
-            clear_session(session_id)
-        except Exception:  # noqa: BLE001
-            pass
+        if end_session:
+            try:
+                from tools.approval import clear_session
+                clear_session(session_id)
+            except Exception:  # noqa: BLE001
+                pass
         return {"evicted": evicted}
 
     @registry.method("chat.commit_memory", requires_agent=False)
@@ -874,7 +1205,9 @@ def register(registry) -> None:
         except Exception as exc:  # noqa: BLE001
             raise RpcError(f"approval module unavailable: {exc}", condition="agent_unavailable") from exc
         (enable_session_yolo if enabled else disable_session_yolo)(session_id)
-        released = resolve_gateway_approval(session_id, "session", resolve_all=True) if enabled else 0
+        # Parked approvals are released `once`: a `session` or `always` grant would keep their patterns approved after
+        # YOLO turns off, whatever choice the card that enabled it carried.
+        released = resolve_gateway_approval(session_id, "once", resolve_all=True) if enabled else 0
         return {"yolo_enabled": bool(is_session_yolo_enabled(session_id)), "released": int(released or 0)}
 
     @registry.method("clarify.respond", requires_agent=False)

package/sidecar/talaria_sidecar/methods/commands.py

@@ -7,8 +7,9 @@ import threading
 from typing import Any
 
 from ..errors import InvalidParams, RpcError
-from ..home import profile_home_param, scoped_home
+from ..home import _is_named_profile, profile_home_param, scoped_home
 from ..rpc import CallContext
+from .providers import plugin_providers
 
 log = logging.getLogger("talaria_sidecar.commands")
 
@@ -60,19 +61,54 @@ def list_commands() -> list[dict[str, Any]]:
     return out
 
 
+def retire_unscoped_launch_mcp_servers() -> set[str]:
+    """Close the launch profile's connections opened before multiplexing started; returns their server names.
+
+    Until the first named-profile call, the launch profile's connections and tools are unscoped (process-wide). Once
+    multiplexing is active, a scoped shutdown never selects them and scoped discovery opens duplicates beside them, so
+    the launch profile's own calls close them first and its scope reconnects them from the current config."""
+    from agent.secret_scope import is_multiplex_active
+    from hermes_constants import get_hermes_home
+    from tools.mcp_tool import _lock, _servers
+    from tools.mcp_tool_lifecycle import shutdown_mcp_servers
+    from tools.mcp_tool_scope import _key_name, _key_scope
+
+    if not is_multiplex_active() or _is_named_profile(get_hermes_home()):
+        return set()
+    with _lock:
+        names = {_key_name(key) for key in _servers if _key_scope(key) is None}
+    if names:
+        shutdown_mcp_servers(scope=None, names=names)
+    return names
+
+
 def _reload_mcp() -> str:
     with _RELOAD_MCP_LOCK:
         try:
-            from tools.mcp_tool import _lock, _servers, discover_mcp_tools, shutdown_mcp_servers
+            from agent.secret_scope import is_multiplex_active
+            from tools.mcp_tool import _lock, _mcp_tool_server_names, _server_visible_in_scope, _servers
+            from tools.mcp_tool_discovery import discover_mcp_tools
+            from tools.mcp_tool_lifecycle import shutdown_mcp_servers
+            from tools.mcp_tool_scope import _key_name
+            from tools.registry import registry
         except Exception as exc:  # noqa: BLE001
             raise RpcError("MCP runtime unavailable", condition="mcp_unavailable") from exc
-        try:
-            with _lock:
-                old = set(_servers.keys())
-            shutdown_mcp_servers()
-            tools = discover_mcp_tools()
+        # Like the gateway's ``_execute_mcp_reload``: under multiplexing only this profile's connections go down and
+        # come back. The bare shutdown is the process-wide wildcard, which would drop every other profile's servers.
+        scope = registry.current_scope_key() if is_multiplex_active() else None
+
+        def server_names() -> set[str]:
             with _lock:
-                connected = set(_servers.keys())
+                return {_key_name(key) for key in _servers if _server_visible_in_scope(key, scope)}
+
+        try:
+            old = server_names() | retire_unscoped_launch_mcp_servers()
+            shutdown_mcp_servers(scope=scope)
+            tools = discover_mcp_tools() or []
+            connected = server_names()
+            if scope is not None:
+                with _lock:
+                    tools = [name for name in tools if _mcp_tool_server_names.get(name) in connected]
         except Exception as exc:  # noqa: BLE001
             log.warning("Failed to reload MCP servers", exc_info=True)
             raise RpcError("Failed to reload MCP servers", condition="mcp_reload_failed") from exc
@@ -84,7 +120,7 @@ def _reload_mcp() -> str:
         lines.append(f"Added: {', '.join(sorted(added))}")
     if removed:
         lines.append(f"Removed: {', '.join(sorted(removed))}")
-    lines.append(f"{len(tools or [])} tool(s) available across {len(connected)} server(s)" if connected else "No MCP servers connected")
+    lines.append(f"{len(tools)} tool(s) available across {len(connected)} server(s)" if connected else "No MCP servers connected")
     if not reconnected and not added and not removed:
         lines.append("Tooling state was already current")
     return "\n".join(lines)
@@ -230,27 +266,6 @@ def resolve_moa_config(preset: str | None) -> dict:
     return resolved
 
 
-def plugin_provider_profiles() -> list[dict]:
-    """Model-provider plugins registered with the Agent's provider registry."""
-    try:
-        from providers import list_providers
-    except Exception:  # noqa: BLE001
-        return []
-    out = []
-    try:
-        for profile in list_providers():
-            name = str(getattr(profile, "name", "") or "").strip().lower()
-            if not name:
-                continue
-            env_vars = [str(v) for v in (getattr(profile, "env_vars", ()) or ())]
-            api_key_env = next((v for v in env_vars if not v.upper().endswith(("_BASE_URL", "_URL", "_FOLDER_ID"))), None)
-            out.append({"name": name, "display_name": str(getattr(profile, "display_name", "") or name).strip(), "env_vars": env_vars, "api_key_env": api_key_env})
-    except Exception:  # noqa: BLE001
-        log.debug("Failed to enumerate model-provider plugins", exc_info=True)
-        return []
-    return out
-
-
 PLUGIN_VISIBILITY_HOOKS = ("pre_tool_call", "post_tool_call", "pre_llm_call", "post_llm_call")
 
 
@@ -332,7 +347,7 @@ def register(registry) -> None:
     @registry.method("plugins.providers")
     def providers(ctx: CallContext, params: dict) -> dict:
         with scoped_home(profile_home_param(params)):
-            return {"providers": plugin_provider_profiles()}
+            return {"providers": plugin_providers()}
 
     @registry.method("plugins.list")
     def list_(ctx: CallContext, params: dict) -> dict: