@maudecode/talaria-web 1.19.0 → 1.20.0

package/sidecar/talaria_sidecar/methods/checkpoints.py

@@ -12,13 +12,13 @@ from ..home import profile_home_param, scoped_home
 from ..rpc import CallContext
 
 
-def checkpoint_kwargs() -> dict:
+def checkpoint_kwargs(cfg: dict | None = None) -> dict:
     """The profile's ``checkpoints`` config as ``AIAgent`` kwargs, resolved as the Agent's gateway does
     (``gateway/run.py::_checkpoint_agent_kwargs``): the legacy ``checkpoints: true`` form, else the section over
     ``DEFAULT_CONFIG``. Only a real ``true`` turns them on, so a quoted ``"false"`` stays off."""
     from hermes_cli.config import DEFAULT_CONFIG, load_config
 
-    section = (load_config() or {}).get("checkpoints", {})
+    section = ((load_config() or {}) if cfg is None else cfg).get("checkpoints", {})
     if isinstance(section, bool):
         section = {"enabled": section}
     elif not isinstance(section, dict):
@@ -54,6 +54,19 @@ def _agent_result(result: dict) -> dict:
     return result
 
 
+def _paths(result: dict, key: str) -> list[str]:
+    return [str(f) for f in result.get(key) or []]
+
+
+def _has_agent_writes(manager, workspace: str) -> bool:
+    """Whether the Agent's agent-write ledger for ``workspace`` has entries: the same file and key its safe restore reads
+    (``_safe_restore_plan``), which takes the full-restore branch when it is empty. A write only adds an entry, so a ledger
+    seen here is not empty when the restore reads it."""
+    from tools.checkpoint_manager import _load_ledger, _normalize_path, _store_path
+
+    return bool(_load_ledger(_store_path(), manager._ledger_key(str(_normalize_path(workspace)))))
+
+
 def _owned(manager, workspace: str, checkpoint: str) -> str:
     """The full hash of ``checkpoint`` among ``workspace``'s own checkpoints. The store is shared by every project and the
     Agent's diff and restore accept any commit in it, so another workspace's hash would check that tree out here."""
@@ -82,8 +95,20 @@ def register(registry) -> None:
 
     @registry.method("checkpoints.restore")
     def restore(ctx: CallContext, params: dict) -> dict:
+        """Safe by default, as the Agent's own ``rollback.restore`` (TAL-1260): only files whose content is still what the
+        Agent last wrote are reverted, and the hand-edited ones it kept are reported. ``all`` restores every file, and only
+        then is ``restored_files`` null. Without an agent-write ledger the Agent would fall back to a full restore, so a
+        default restore is refused there instead: it cannot tell the user's edits apart."""
         workspace, checkpoint = _param(params, "workspace"), _param(params, "checkpoint")
+        safe = params.get("all") is not True
         with scoped_home(profile_home_param(params)):
             manager = _manager()
-            result = _agent_result(manager.restore(workspace, _owned(manager, workspace, checkpoint)))
-        return {"restored_to": str(result.get("restored_to") or ""), "reason": str(result.get("reason") or "")}
+            owned = _owned(manager, workspace, checkpoint)
+            if safe and not _has_agent_writes(manager, workspace):
+                raise RpcError("The Agent has no record of the files it wrote here, so your own edits cannot be told apart. "
+                               "Use Restore everything to restore every file.", condition="checkpoint_failed")
+            result = _agent_result(manager.restore(workspace, owned, safe=safe))
+        return {"restored_to": str(result.get("restored_to") or ""), "reason": str(result.get("reason") or ""),
+                "restored_files": _paths(result, "restored_files") if isinstance(result.get("restored_files"), list) else None,
+                "kept_user_edits": _paths(result, "skipped_user_edits"), "skipped_oversize": _paths(result, "skipped_oversize"),
+                "failed_deletes": _paths(result, "failed_deletes")}

package/sidecar/talaria_sidecar/methods/commands.py

@@ -3,11 +3,15 @@
 from __future__ import annotations
 
 import contextlib
+import hashlib
 import importlib.util
+import json
 import logging
 import os
 import pathlib
+import secrets
 import threading
+import time
 from typing import Any
 
 from ..errors import InvalidParams, RpcError
@@ -26,13 +30,21 @@ _RUNTIME_COMMANDS = {
     "codex-runtime": ("Toggle codex app-server runtime for OpenAI/Codex models", "Configuration", "[auto|codex_app_server]"),
     "credits": ("Show your Nous credits", "Info", ""),
 }
-_ALLOWED = frozenset(_RUNTIME_COMMANDS)
+# Commands ``commands.exec`` runs through the Agent's registry executor (``hermes_cli.slash_exec``), so the reply is the
+# Agent's own; an Agent whose registry lacks one neither lists nor runs it.
+_REGISTRY_EXECUTED = frozenset({"autoprune"})
+_ALLOWED = frozenset(_RUNTIME_COMMANDS) | _REGISTRY_EXECUTED
 _RELOAD_MCP_LOCK = threading.Lock()
 _RELOAD_SKILLS_LOCK = threading.Lock()
 _CODEX_RUNTIME_LOCK = threading.Lock()
+_MCP_DISCOVERED_HOMES: set[str] = set()
+_MCP_DISCOVERED_LOCK = threading.Lock()
+_PLUGIN_UPDATE_CONSENTS: dict[str, dict] = {}
+_PLUGIN_UPDATE_CONSENT_LOCK = threading.Lock()
 
 
-def parse_slash_command(command: str) -> tuple[str, str]:
+def _split_slash_command(command: str) -> tuple[str, str]:
+    """The command name as typed (lowercase, no slash) and its raw arguments."""
     raw = str(command or "").strip()
     if not raw:
         raise InvalidParams("command is required")
@@ -41,7 +53,12 @@ def parse_slash_command(command: str) -> tuple[str, str]:
     base = (parts[0] if parts else "").strip().lower()
     if not base:
         raise InvalidParams("command is required")
-    return _ALIASES.get(base, base), parts[1] if len(parts) > 1 else ""
+    return base, parts[1] if len(parts) > 1 else ""
+
+
+def parse_slash_command(command: str) -> tuple[str, str]:
+    base, args = _split_slash_command(command)
+    return _ALIASES.get(base, base), args
 
 
 def _expand_plan(args: str, **_turn) -> str:
@@ -115,7 +132,7 @@ def _prompt_mode(name: str) -> str | None:
     return "expand" if _prompt_expander(name) else "unsupported"
 
 
-def expand_prompt(command: str, workspace: str, enabled_toolsets) -> dict[str, Any]:
+def expand_prompt(command: str, workspace: str, enabled_toolsets, session_id: str = "") -> dict[str, Any]:
     """``/<prompt built-in> [args]`` as the turn text the Agent's own builder writes. ``name`` is the built-in's (None
     when the command is not one) and ``message`` None when this Agent has no builder for it."""
     try:
@@ -126,6 +143,8 @@ def expand_prompt(command: str, workspace: str, enabled_toolsets) -> dict[str, A
     cmd = resolve_command(name)
     if cmd is None or cmd.name not in _PROMPT_BUILTINS:
         return {"name": None, "message": None}
+    # TAL-1279: as the CLI does, before it expands or refuses the built-in.
+    _fire_pre_command(command, session_id, cmd.name, workspace)
     expander = _prompt_expander(cmd.name)
     if expander is None:
         return {"name": cmd.name, "message": None}
@@ -198,10 +217,26 @@ def retire_unscoped_launch_mcp_servers() -> set[str]:
 
 def discover_profile_mcp_tools() -> list[str]:
     """Connect this profile's configured servers, retiring pre-multiplex launch connections first."""
+    from hermes_constants import get_hermes_home
     from tools.mcp_tool_discovery import discover_mcp_tools
 
     retire_unscoped_launch_mcp_servers()
-    return discover_mcp_tools()
+    tools = discover_mcp_tools()
+    with _MCP_DISCOVERED_LOCK:
+        _MCP_DISCOVERED_HOMES.add(os.path.realpath(get_hermes_home()))
+    return tools
+
+
+def profile_mcp_tools_discovered(home) -> bool:
+    """A completed discovery, including an empty registry, establishes this process's profile baseline."""
+    with _MCP_DISCOVERED_LOCK:
+        return os.path.realpath(home) in _MCP_DISCOVERED_HOMES
+
+
+def forget_profile_mcp_tools(home) -> None:
+    """A successfully deleted profile must start cold if its path is recreated."""
+    with _MCP_DISCOVERED_LOCK:
+        _MCP_DISCOVERED_HOMES.discard(os.path.realpath(home))
 
 
 def _reload_mcp() -> str:
@@ -211,7 +246,6 @@ def _reload_mcp() -> str:
             from hermes_constants import get_hermes_home
             from tools.mcp_tool import _lock, _mcp_tool_server_names, _server_visible_in_scope, _servers
             from tools.mcp_tool_agent import reprobe_tool_availability
-            from tools.mcp_tool_discovery import discover_mcp_tools
             from tools.mcp_tool_lifecycle import shutdown_mcp_servers
             from tools.mcp_tool_scope import _key_name
             from tools.registry import registry
@@ -233,7 +267,7 @@ def _reload_mcp() -> str:
             # As the gateway does: drop the cached tool availability verdicts, then hand the profile's open chats the
             # rediscovered tools.
             reprobe_tool_availability()
-            tools = discover_mcp_tools() or []
+            tools = discover_profile_mcp_tools() or []
             refresh_profile_agents_mcp_tools(get_hermes_home())
             connected = server_names()
             if scope is not None:
@@ -327,11 +361,43 @@ def _credits() -> str:
     return "\n".join(lines)
 
 
-def execute_agent_command(command: str) -> str | None:
+def _fire_pre_command(command: str, session_id: str, canonical: str | None = None, workspace: str = "") -> None:
+    """The Agent's observer-only ``pre_command`` hook, which every local surface fires before a recognised command runs.
+    A chat's observers run under that chat's session and workspace, as its plugin commands and turns do."""
+    from hermes_cli.plugins import fire_pre_command_hook
+
+    from .chat import _turn_identity
+
+    typed, arg = _split_slash_command(command)
+    with _turn_identity(session_id, workspace) if session_id else contextlib.nullcontext():
+        fire_pre_command_hook(surface="webui", command=canonical or _ALIASES.get(typed, typed), alias_used=typed, args_raw=arg,
+                              session_key=session_id or None, platform="webui")
+
+
+def _registry_executor(name: str):
+    """The Agent registry's shared executor for ``name``; None when this Agent has none."""
+    try:
+        from hermes_cli.commands import resolve_command
+        from hermes_cli.slash_exec import resolve_executor
+    except ImportError:
+        return None
+    cmd = resolve_command(name)
+    return resolve_executor(cmd) if cmd is not None else None
+
+
+def execute_agent_command(command: str, session_id: str = "", workspace: str = "") -> str | None:
     """Run one of the allowlisted agent-side runtime commands; None when not one."""
     canonical, arg_string = parse_slash_command(command)
     if canonical not in _ALLOWED:
         return None
+    executor = _registry_executor(canonical) if canonical in _REGISTRY_EXECUTED else None
+    if canonical in _REGISTRY_EXECUTED and executor is None:
+        return None
+    _fire_pre_command(command, session_id, workspace=workspace)
+    if executor is not None:
+        from hermes_cli.slash_exec import CommandContext
+
+        return str(executor(CommandContext(surface="webui", args=arg_string)).text or "(no output)")
     if canonical == "reload-mcp":
         return _reload_mcp()
     if canonical == "reload-skills":
@@ -341,7 +407,16 @@ def execute_agent_command(command: str) -> str | None:
     return _credits()
 
 
-def execute_plugin_command(command: str) -> str | None:
+def _invoke_plugin_handler(handler, arg: str, session_id: str):
+    """``handler(arg)`` plus the session context it declares, as every Agent surface calls it (v0.22.3+)."""
+    try:
+        from hermes_cli.plugin_command_dispatch import invoke_plugin_command
+    except ImportError:  # Delete this fallback once v0.22.3 is the oldest supported Agent.
+        return handler(arg)
+    return invoke_plugin_command(handler, arg, source=None, session_id=session_id, session_key=session_id, platform="webui")
+
+
+def execute_plugin_command(command: str, session_id: str = "") -> str | None:
     """Run a plugin-registered slash command; None when no plugin owns it."""
     base, arg = parse_slash_command(command)
     try:
@@ -354,8 +429,9 @@ def execute_plugin_command(command: str) -> str | None:
         raise RpcError("plugin command lookup failed", condition="plugins_unavailable") from exc
     if not handler:
         return None
+    _fire_pre_command(command, session_id)
     try:
-        return str(resolve_plugin_command_result(handler(arg)) or "(no output)")
+        return str(resolve_plugin_command_result(_invoke_plugin_handler(handler, arg, session_id)) or "(no output)")
     except Exception as exc:  # noqa: BLE001 - user-facing text, never a transport error
         log.warning("Plugin command %r execution failed", base, exc_info=True)
         return f"Plugin command error: {type(exc).__name__}"
@@ -477,6 +553,103 @@ def _clean_text(value, limit: int = 240) -> str:
     return text[: limit - 1].rstrip() + "…" if len(text) > limit else text
 
 
+def _plugin_update_modules():
+    try:
+        from hermes_cli import plugins_cmd, plugins_transaction
+        from hermes_cli.plugins_cadence import cached_git_updates
+    except ImportError:
+        return None
+    return plugins_cmd, plugins_transaction, cached_git_updates
+
+
+def update_plugin(key: str, accept_caution: bool, consent_token: str | None = None) -> dict:
+    """The Agent owns Git staging, scan consent and publication, under the caller's profile scope."""
+    if not key or not isinstance(accept_caution, bool) or (consent_token is not None and not isinstance(consent_token, str)):
+        raise InvalidParams("plugins.update requires a key and boolean accept_caution")
+    modules = _plugin_update_modules()
+    if modules is None:
+        raise RpcError("This Hermes Agent cannot update plugins from Web", condition="plugin_update_unsupported")
+    pc, transaction, _cached = modules
+    found = pc._find_plugin_entry(key)
+    if found is None or not found[4]:
+        raise RpcError(f"plugin {key!r} not found", condition="plugin_not_found")
+    from hermes_constants import get_hermes_home
+    target = pathlib.Path(str(found[4])).resolve()
+    # Only profile-owned installs, never bundled, project or entrypoint plugins.
+    if target.parent != (get_hermes_home() / "plugins").resolve():
+        raise InvalidParams("Only profile-installed Git plugins can be updated")
+    from pm.store import tree_digest
+    from tools.plugin_guard import format_scan_report
+
+    def installed_identity():
+        return (str(get_hermes_home().resolve()), str(target.resolve()), found[5], tree_digest(target),
+                json.dumps(pc._read_install_metadata().get(target.name, {}), sort_keys=True))
+
+    identity = installed_identity()
+    with _PLUGIN_UPDATE_CONSENT_LOCK:
+        now = time.monotonic()
+        for token, receipt in list(_PLUGIN_UPDATE_CONSENTS.items()):
+            if receipt["expires"] <= now:
+                _PLUGIN_UPDATE_CONSENTS.pop(token)
+        consent = _PLUGIN_UPDATE_CONSENTS.pop(consent_token, None) if accept_caution and consent_token else None
+    if accept_caution and consent_token and (consent is None or consent["identity"] != identity):
+        raise RpcError("Plugin update confirmation expired or the installation changed; update again to review its scan",
+                       condition="plugin_update_consent_changed")
+
+    revision = ""
+    consent_changed = False
+    changed_message = "The plugin installation or revision changed; update again to review its scan"
+
+    # The Agent staging hook exposes the candidate commit before its scan and publication gates.
+    def capture_revision(staged):
+        nonlocal revision, consent_changed
+        if not staged.resolve().is_relative_to(target.parent) or installed_identity() != identity:
+            consent_changed = True
+            raise pc.PluginOperationError(changed_message)
+        revision = pc._git_head_revision(staged, pc._resolve_git_executable())
+        if consent and consent["revision"] != revision:
+            consent_changed = True
+            raise pc.PluginOperationError(changed_message)
+        return []
+
+    def scan_binding(scan):
+        payload = json.dumps([format_scan_report(scan), getattr(scan, "scan_provenance", {}),
+                              [vars(finding) for finding in getattr(scan, "findings", [])]], sort_keys=True)
+        return hashlib.sha256(payload.encode()).hexdigest()
+
+    def accept_scan(scan):
+        nonlocal consent_changed
+        if installed_identity() != identity:
+            consent_changed = True
+            return False
+        return consent is not None and consent["revision"] == revision and consent["scan"] == scan_binding(scan)
+
+    try:
+        # A blanket force would bypass the callback: only the exact scanned identity can accept caution.
+        transaction.update_plugin(target, force=False, scan_decision_cb=accept_scan, carry_user_files=capture_revision)
+    except pc.PluginScanBlocked as exc:
+        if consent_changed:
+            raise RpcError(changed_message, condition="plugin_update_consent_changed") from exc
+        scan = exc.scan_result
+        verdict = getattr(scan, "verdict", "dangerous")
+        result = {"key": found[5], "status": "needs_consent" if verdict == "caution" else "blocked",
+                  "verdict": verdict, "findings": str(exc)}
+        if verdict == "caution":
+            token = secrets.token_urlsafe(32)
+            with _PLUGIN_UPDATE_CONSENT_LOCK:
+                if len(_PLUGIN_UPDATE_CONSENTS) >= 64:
+                    _PLUGIN_UPDATE_CONSENTS.pop(next(iter(_PLUGIN_UPDATE_CONSENTS)))
+                _PLUGIN_UPDATE_CONSENTS[token] = {"identity": identity, "revision": revision, "scan": scan_binding(scan),
+                                                 "expires": time.monotonic() + 300}
+            result["consent_token"] = token
+        return result
+    except pc.PluginOperationError as exc:
+        raise RpcError(str(exc), condition="plugin_update_consent_changed" if consent_changed else "plugin_update_refused") from exc
+    from hermes_cli.plugins import discover_plugins
+    discover_plugins(force=True)
+    return {"key": found[5], "status": "updated"}
+
+
 def plugin_visibility(selected_providers: dict) -> dict:
     """Sanitized plugin/hook rows for Settings (Python ``_plugin_visibility_payload``); no paths or callbacks."""
     try:
@@ -486,6 +659,12 @@ def plugin_visibility(selected_providers: dict) -> dict:
         manager.discover_and_load(force=False)
     except Exception as exc:  # noqa: BLE001
         raise RpcError(f"plugin manager unavailable: {exc}", condition="plugins_unavailable") from exc
+    modules = _plugin_update_modules()
+    updates = None
+    if modules:
+        from hermes_cli.plugins_provenance import read_sidecar_rows
+        from hermes_constants import get_hermes_home
+        updates = modules[2](read_sidecar_rows(get_hermes_home() / "plugins"))
     rows = []
     for key, loaded in sorted((getattr(manager, "_plugins", {}) or {}).items(), key=lambda item: str(item[0])):
         manifest = getattr(loaded, "manifest", None)
@@ -517,6 +696,13 @@ def plugin_visibility(selected_providers: dict) -> dict:
                 row["is_active_provider"] = bool(selected) and slug == selected
         else:
             row["is_active_provider"] = kind == "model-provider" and enabled
+        if updates is not None:
+            installed = pathlib.Path(str(getattr(manifest, "path", "") or "")).resolve()
+            owned = installed.parent == (get_hermes_home() / "plugins").resolve() and (installed / ".git").is_dir()
+            revision = updates.get(installed.name) if owned else None
+            row["update_available"] = bool(revision)
+            if revision:
+                row["latest_revision"] = revision
         rows.append(row)
     return {"plugins": rows, "supported_hooks": list(PLUGIN_VISIBILITY_HOOKS)}
 
@@ -560,6 +746,60 @@ def plugin_settings() -> dict:
     return {"supported": True, "plugins": rows}
 
 
+def _apply_plugin_mcp_settings(plugins_cmd, plugin_dir, key: str) -> str:
+    """Reconcile package-owned launch inputs on the RPC worker, preserving the request's profile scope."""
+    try:
+        if not plugin_dir or not plugins_cmd._is_portable_plugin_dir(plugin_dir):
+            return "applied"
+        from hermes_cli.agent_plugins import load_agent_plugin
+        from hermes_cli.plugins_manifest import portable_mcp_server_name
+
+        package = load_agent_plugin(plugin_dir, plugin_dir)
+        if any(d.scope == "mcp" or d.scope.startswith("mcp:") for d in package.diagnostics):
+            return "unknown"
+        names = {portable_mcp_server_name(key, server) for server in package.mcp_servers}
+        if not names:
+            return "applied"
+        from hermes_cli.config import load_config_readonly
+        from hermes_cli.plugins import get_plugin_manager
+
+        manager = get_plugin_manager()
+        manager.discover_and_load(force=False)
+        owners = getattr(manager, "_portable_mcp_server_plugins", None)
+        if owners is None:
+            return "restart_required"
+        native = (load_config_readonly() or {}).get("mcp_servers") or {}
+        names = {name for name in names if owners.get(name) == key and name not in native}
+        if not names:
+            return "applied"
+        from tools import mcp_tool_discovery as discovery
+
+        reconnect = getattr(discovery, "restart_mcp_servers_with_new_inputs", None)
+        if reconnect is None:
+            return "restart_required"
+        # Also exclude the explicit Reload MCP path. The native helper serializes settings-driven reconnects.
+        with _RELOAD_MCP_LOCK:
+            live = {row["name"] for row in discovery.get_mcp_status() if row["name"] in names and row.get("connected")}
+            restarted = reconnect(names)
+            if restarted:
+                from hermes_constants import get_hermes_home
+
+                from .chat import refresh_profile_agents_mcp_tools
+
+                refresh_profile_agents_mcp_tools(get_hermes_home())
+            statuses = {row["name"]: row["status"] for row in discovery.get_mcp_status() if row["name"] in names}
+            if any(status == "failed" for status in statuses.values()):
+                return "restart_required"
+            if any(status == "connecting" for status in statuses.values()) or any(name not in statuses for name in live | set(restarted)):
+                return "unknown"
+        return "applied"
+    except ImportError:
+        return "restart_required"
+    except Exception:  # noqa: BLE001
+        # Persistence already succeeded. Neither expose launch inputs in an exception nor retry an uncertain reconnect.
+        return "unknown"
+
+
 def save_plugin_settings(key: str, values: Any, secret_envs: Any = None) -> dict:
     """Write manifest-declared, non-secret settings through the Agent's locked writer; returns the refreshed fields.
 
@@ -586,7 +826,9 @@ def save_plugin_settings(key: str, values: Any, secret_envs: Any = None) -> dict
         raise RpcError(str(exc), condition="plugin_settings_managed") from exc
     except ValueError as exc:
         raise InvalidParams(str(exc)) from exc
-    return {"key": found[5], "written": written, "fields": plugins_settings.plugin_settings_fields(found[5], plugin_dir)}
+    fields = plugins_settings.plugin_settings_fields(found[5], plugin_dir)
+    application = _apply_plugin_mcp_settings(plugins_cmd, plugin_dir, found[5])
+    return {"key": found[5], "written": written, "fields": fields, "runtime_application": application}
 
 
 def register(registry) -> None:
@@ -598,16 +840,17 @@ def register(registry) -> None:
     @registry.method("commands.exec")
     def exec_(ctx: CallContext, params: dict) -> dict:
         command = str(params.get("command") or "")
+        session_id = str(params.get("session_id") or "").strip()
+        workspace = str(params.get("workspace") or "")
         with scoped_home(profile_home_param(params)):
-            output = execute_agent_command(command)
+            output = execute_agent_command(command, session_id, workspace)
             source = "agent"
             if output is None:
                 from .chat import _turn_identity
 
                 # TAL-904: a chat's plugin command runs under that chat's session and workspace, as its turns do.
-                session_id = str(params.get("session_id") or "").strip()
-                with _turn_identity(session_id, str(params.get("workspace") or "")) if session_id else contextlib.nullcontext():
-                    output = execute_plugin_command(command)
+                with _turn_identity(session_id, workspace) if session_id else contextlib.nullcontext():
+                    output = execute_plugin_command(command, session_id)
                 source = "plugin"
         if output is None:
             raise RpcError(f"unknown command {parse_slash_command(command)[0]!r}", condition="command_not_found")
@@ -616,7 +859,8 @@ def register(registry) -> None:
     @registry.method("commands.expand_prompt")
     def expand_prompt_(ctx: CallContext, params: dict) -> dict:
         with scoped_home(profile_home_param(params)):
-            return expand_prompt(str(params.get("command") or ""), str(params.get("workspace") or ""), params.get("enabled_toolsets"))
+            return expand_prompt(str(params.get("command") or ""), str(params.get("workspace") or ""), params.get("enabled_toolsets"),
+                                 str(params.get("session_id") or "").strip())
 
     @registry.method("commands.bundles")
     def bundles(ctx: CallContext, params: dict) -> dict:
@@ -643,6 +887,23 @@ def register(registry) -> None:
         with scoped_home(profile_home_param(params)):
             return plugin_visibility(params.get("selected_providers") if isinstance(params.get("selected_providers"), dict) else {})
 
+    @registry.method("plugins.catalog")
+    def catalog_(ctx: CallContext, params: dict) -> dict:
+        from .plugin_catalog import catalog
+        with scoped_home(profile_home_param(params)):
+            return catalog(params.get('query', ''), params.get('offset', 0), params.get('limit', 20))
+
+    @registry.method("plugins.install")
+    def install_(ctx: CallContext, params: dict) -> dict:
+        from .plugin_catalog import install
+        with scoped_home(profile_home_param(params)):
+            return install(params.get('name'), params.get('consent_token'))
+
+    @registry.method("plugins.update")
+    def update(ctx: CallContext, params: dict) -> dict:
+        with scoped_home(profile_home_param(params)):
+            return update_plugin(str(params.get("key") or "").strip(), params.get("accept_caution", False), params.get("consent_token"))
+
     @registry.method("plugins.isolation")
     def isolation(ctx: CallContext, params: dict) -> dict:
         return {"profiles": isolation_survey(profile_home_param(params, "base_home"))}

package/sidecar/talaria_sidecar/methods/config.py

@@ -11,7 +11,9 @@ gateway, CLI and plugins also take, so concurrent writers never drop a key.
 from __future__ import annotations
 
 import contextlib
+import copy
 import importlib
+import io
 import logging
 import os
 import re
@@ -73,9 +75,75 @@ def _write_target(path: Path) -> Path:
     return target
 
 
-def write_config(path: Path, config: dict) -> dict:
+def _same_config_value(left, right) -> bool:
+    """Compare decoded JSON values without treating booleans as numbers."""
+    if type(left) is not type(right):
+        return False
+    if isinstance(left, dict):
+        return left.keys() == right.keys() and all(_same_config_value(left[key], right[key]) for key in left)
+    if isinstance(left, list):
+        return len(left) == len(right) and all(_same_config_value(a, b) for a, b in zip(left, right))
+    return left == right
+
+
+def _split_config_aliases(text: str, desired: dict) -> str:
+    """Keep the Agent's round-trip document, separating aliases with different requested values."""
+    roundtrip = getattr(yaml_parser(), "roundtrip_yaml", None)
+    if roundtrip is None:
+        return text
+    parser = roundtrip()
+    document = parser.load(text)
+    seen = {}
+    changed = False
+
+    def split(node, value):
+        nonlocal changed
+        if not (isinstance(node, dict) and isinstance(value, dict) or isinstance(node, list) and isinstance(value, list)):
+            return node
+        previous = seen.get(id(node))
+        if previous is not None:
+            if _same_config_value(previous[1], value):
+                return node
+            node = copy.deepcopy(node)
+            # Copied explicit anchor names must not collide with the original subtree.
+            pending, cleared = [node], set()
+            while pending:
+                child = pending.pop()
+                if id(child) in cleared:
+                    continue
+                cleared.add(id(child))
+                if hasattr(child, "yaml_set_anchor"):
+                    child.yaml_set_anchor(None)
+                if isinstance(child, dict):
+                    pending.extend(child.values())
+                elif isinstance(child, list):
+                    pending.extend(child)
+            changed = True
+        seen[id(node)] = (node, value)
+        for key in value if isinstance(value, dict) else range(min(len(node), len(value))):
+            if not isinstance(node, dict) or key in node:
+                node[key] = split(node[key], value[key])
+        return node
+
+    split(document, desired)
+    if not changed:
+        return text
+    output = io.StringIO()
+    parser.dump(document, output)
+    return output.getvalue()
+
+
+def write_config(path: Path, config: dict, *, profile_home: Path | None = None) -> dict:
     if not isinstance(config, dict):
         raise InvalidParams("config must be an object")
+    try:
+        managed = importlib.import_module("hermes_constants").get_managed_system(profile_home)
+    except Exception as exc:  # noqa: BLE001
+        raise RpcError("Cannot verify config.yaml management policy; repair the Agent installation before saving.",
+                       condition="config_policy_unavailable") from exc
+    if managed is not None:
+        raise RpcError("config.yaml is package-managed. Update the declarative configuration instead.",
+                       condition="config_write_refused")
     target = _write_target(path)
     target.parent.mkdir(parents=True, exist_ok=True)
     try:
@@ -94,7 +162,7 @@ def write_config(path: Path, config: dict) -> dict:
             if replace is not None:
                 # Stage the original document so the Agent retains comments; check the real link before committing.
                 try:
-                    handle.write(target.read_text(encoding="utf-8"))
+                    handle.write(_split_config_aliases(target.read_text(encoding="utf-8"), config))
                 except FileNotFoundError:
                     pass
             else:
@@ -107,6 +175,8 @@ def write_config(path: Path, config: dict) -> dict:
             replace(Path(tmp), config)
         if mode is not None:
             os.chmod(tmp, mode)
+        if not _same_config_value(read_config(Path(tmp))["config"], config):
+            raise RpcError("Staged config.yaml does not match the requested values", condition="config_invalid")
         # A link retargeted while the temp file was being written would otherwise send the write to the wrong file.
         if _write_target(path) != target:
             raise RpcError(f"{path} was retargeted while config.yaml was being written; retry", condition="config_changed")
@@ -240,7 +310,7 @@ def register(registry) -> None:
 
     @registry.method("config.set", requires_agent=False)
     def set_(ctx: CallContext, params: dict) -> dict:
-        return write_config(config_path_param(params), params.get("config"))
+        return write_config(config_path_param(params), params.get("config"), profile_home=profile_home_param(params))
 
     @registry.method("config.env_write")
     def env_write_(ctx: CallContext, params: dict) -> dict: