@maudecode/talaria-web 1.19.0 → 1.21.0

package/sidecar/talaria_sidecar/methods/connectors.py

@@ -38,11 +38,12 @@ def available() -> bool:
     return bool(connectors_available())
 
 
-def _open() -> None:
-    """The gate every page action passes: connectors available, and on an Agent with guest identities, one created
-    for a user who has none (the page asking for apps is the user asking, as on the Agent's desktop)."""
+def _open(*, creates_guest: bool = False) -> None:
+    """Only explicit Connect may provision; every other page action is noncreating."""
     if not available():
         raise RpcError("Connectors are not available.", condition="connectors_unavailable")
+    if not creates_guest:
+        return
     try:
         from tools.connectors import ensure_guest_identity
     except Exception:  # noqa: BLE001 - an Agent before guest identities
@@ -51,10 +52,32 @@ def _open() -> None:
         raise RpcError(failure, condition="connectors_failed")
 
 
-def _portal():
+def _portal(*, refresh_auth: bool = False):
     from tools.connectors.portal.client import PortalConnectorClient
 
-    return PortalConnectorClient()
+    # Explicit writes retain native refresh; reads never acquire that authority.
+    if refresh_auth:
+        return PortalConnectorClient()
+    from tools.managed_tool_gateway import peek_nous_access_token
+
+    # The normal token reader may refresh and replace a dead guest. Page reads must never own auth writes.
+    def headers(_url):
+        token = peek_nous_access_token()
+        return {"Authorization": f"Bearer {token}"} if token else {}
+
+    return PortalConnectorClient(header_provider=headers)
+
+
+def _authenticated(client) -> bool:
+    from tools.connectors.gateway.errors import GatewayAuthError
+
+    try:
+        client.require_authentication()
+    except GatewayAuthError as exc:
+        if getattr(exc, "code", None) == "NO_TOKEN":
+            return False
+        raise
+    return True
 
 
 def _failure(exc: Exception) -> RpcError:
@@ -76,7 +99,7 @@ def _failure(exc: Exception) -> RpcError:
         return RpcError("Connector rule change is invalid.", condition="policy_invalid")
     if code == "connection_not_found":
         return RpcError("Connector account not found.", condition="connection_not_found")
-    log.warning("connector request failed: %s", exc)
+    log.warning("connector request failed: %s", type(exc).__name__)
     return RpcError("Connector request failed.", condition="connectors_failed")
 
 
@@ -93,20 +116,29 @@ def _slug(params: dict, key: str = "connector") -> str:
 
 
 def catalog() -> dict:
-    rows = _portal().catalog().connectors
+    client = _portal()
+    if _authenticated(client):
+        rows = client.catalog().connectors
+    elif callable(public_catalog := getattr(client, "public_catalog", None)):
+        rows = public_catalog().connectors
+    else:
+        raise RpcError("Sign in to Nous Portal to use connectors.", condition="connectors_sign_in")
     return {"connectors": [row.model_dump(mode="json") for row in rows]}
 
 
 def accounts() -> dict:
+    client = _portal()
+    if not _authenticated(client):
+        return {"accounts": []}
     return {"accounts": [{
         "connection_id": row["connectionId"], "connector": row["connector"], "status": row["status"],
         "status_reason": row.get("statusReason"), "label": row["label"], "alias": row.get("alias"),
         "active": bool(row["active"]), "disabled": bool(row.get("disabled")), "created_at": row["createdAt"],
-    } for row in _portal().list_accounts()]}
+    } for row in client.list_accounts()]}
 
 
 def remove(connection_id: str) -> dict:
-    removed = _portal().delete_account(connection_id)
+    removed = _portal(refresh_auth=True).delete_account(connection_id)
     return {"connection_id": removed["connectionId"], "connector": removed["connector"], "status": removed["status"]}
 
 
@@ -139,7 +171,7 @@ def set_policy(connector: str, expected_revision: str, *, enabled: bool | None =
     The portal refuses the write when ``expected_revision`` is no longer its member revision."""
     from tools.connectors.portal.policy import InvalidMemberPolicy, compose_connector_write, compose_tools_write
 
-    client = _portal()
+    client = _portal(refresh_auth=True)
     client.require_authentication()
     member = next((layer.body for layer in client.policy().layers if layer.kind == "member"), None)
     try:
@@ -256,9 +288,9 @@ def remember_chat_operation(home: Path, payload: dict) -> dict | None:
 
 
 def register(registry_) -> None:
-    def page(params: dict, read):
+    def page(params: dict, read, *, creates_guest: bool = False):
         with scoped_home(profile_home_param(params)):
-            _open()
+            _open(creates_guest=creates_guest)
             try:
                 return read()
             except RpcError:
@@ -314,7 +346,7 @@ def register(registry_) -> None:
     def connect_(ctx: CallContext, params: dict) -> dict:
         slug = _slug(params)
         home = profile_home_param(params)
-        return page(params, lambda: connect(home, slug))
+        return page(params, lambda: connect(home, slug), creates_guest=True)
 
     def gated() -> None:
         # Reads and moves on an operation pass the availability gate too, without creating an identity.

package/sidecar/talaria_sidecar/methods/cron.py

@@ -914,7 +914,8 @@ def register(registry) -> None:
 
     @registry.method("cron.delivery_options", requires_agent=False)
     def delivery_options(ctx: CallContext, params: dict) -> dict:
-        known: frozenset = frozenset()
+        home = profile_home_param(params)
+        known: set = set()
         for module_name in ("cron.scheduler_delivery", "cron.scheduler"):
             try:
                 module = importlib.import_module(module_name)
@@ -922,7 +923,12 @@ def register(registry) -> None:
                 continue
             candidates = getattr(module, "_KNOWN_DELIVERY_PLATFORMS", None)
             if candidates:
-                known = frozenset(candidates)
+                known = set(candidates)
+                # Agent 0.22.3+ keeps messaging platforms in the plugin registry; mirror its `_is_known_delivery_platform`.
+                plugin_platforms = getattr(module, "_iter_home_target_platforms", None)
+                if plugin_platforms is not None:
+                    with scoped_home(home):
+                        known.update(plugin_platforms())
                 break
         platforms = [{"value": "local", "label": "Local (save output only)"}, {"value": "origin", "label": "Origin (reply to creator)"}]
         platforms.extend({"value": name, "label": name.capitalize()} for name in sorted(known))

package/sidecar/talaria_sidecar/methods/dashboard_plugins.py

@@ -0,0 +1,301 @@
+"""Agent-owned dashboard discovery, consent and buffered HTTP. Never imports plugin code here."""
+from __future__ import annotations
+
+import base64
+import hashlib
+import inspect
+import json
+import os
+import re
+import stat
+import tempfile
+import threading
+from pathlib import Path
+from urllib.parse import parse_qsl, urlencode
+
+from .. import home as homes
+from ..errors import InvalidParams, RpcError
+
+_NAME = re.compile(r'^[a-z][a-z0-9_-]{0,63}$')
+_MIME = {'.html': 'text/html; charset=utf-8', '.js': 'application/javascript; charset=utf-8',
+         '.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml', '.png': 'image/png',
+         '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp',
+         '.ico': 'image/x-icon', '.woff': 'font/woff', '.woff2': 'font/woff2', '.ttf': 'font/ttf',
+         '.otf': 'font/otf', '.txt': 'text/plain; charset=utf-8'}
+# An allowlist, rather than a denylist, keeps current and future gateway/Talaria credentials out.
+_HEADERS = {'accept', 'content-type', 'if-none-match', 'if-modified-since'}
+_QUERY_CREDENTIALS = {'token', 'ticket', 'internal', 'display_ticket', 'attach', 'profile', 'native_dial', 'api_key', 'access_token'}
+_MAX_ASSET = 8 * 1024 * 1024
+_MAX_API = 512 * 1024
+# Resolve only the operator-selected launch home, never a plugin-controlled descendant.
+_RAW_BASE_HOME = homes._PROCESS_HOME.parent.parent if homes._PROCESS_HOME.parent.name == 'profiles' else homes._PROCESS_HOME
+_BASE_HOME = _RAW_BASE_HOME.resolve()
+_SOURCE_LOCK = threading.Lock()
+_SOURCE_DIRECTORY = None
+_SOURCES = {}
+_SOURCE_BYTES = 0
+_SOURCE_CLOSED = False
+_MAX_SOURCE_BYTES = 64 * 1024 * 1024
+
+
+def close_dashboard_sources():
+    """Release the native loader's source cache after the RPC server has stopped admitting calls."""
+    global _SOURCE_DIRECTORY, _SOURCE_BYTES, _SOURCE_CLOSED
+    with _SOURCE_LOCK:
+        _SOURCE_CLOSED = True
+        if _SOURCE_DIRECTORY is not None:
+            _SOURCE_DIRECTORY.cleanup()
+            _SOURCE_DIRECTORY = None
+        _SOURCES.clear()
+        _SOURCE_BYTES = 0
+
+
+def _api_source(root, api, source):
+    """Give the unchanged native loader a private, stable copy of the bytes we verified.
+
+    Preserve the plugin module's original location for relative resources and tracebacks.
+    Content-addressing reuses its cached app; retain files through timeouts/late host work,
+    bounded by count/bytes and owned by the sidecar until shutdown.
+    """
+    global _SOURCE_DIRECTORY, _SOURCE_BYTES
+    origin = str(Path(root) / api)
+    key = hashlib.sha256(os.fsencode(origin) + b'\0' + source).hexdigest()
+    with _SOURCE_LOCK:
+        if _SOURCE_CLOSED:
+            raise RpcError('Agent dashboard source cache is shutting down', condition='plugin_host_unavailable')
+        if key in _SOURCES:
+            return _SOURCES[key]
+        payload = (f'__talaria_source__ = {source!r}\n'
+                   f'__file__ = {origin!r}\n'
+                   "__loader__ = __import__('importlib.machinery', fromlist=['SourceFileLoader']).SourceFileLoader(__name__, __file__)\n"
+                   "__cached__ = __import__('importlib.util', fromlist=['cache_from_source']).cache_from_source(__file__)\n"
+                   "if __spec__ is not None:\n    __spec__.origin = __file__\n    __spec__.loader = __loader__\n    __spec__.cached = __cached__\n"
+                   "exec(compile(globals().pop('__talaria_source__'), __file__, 'exec'), globals())\n").encode()
+        if len(_SOURCES) >= 512 or _SOURCE_BYTES + len(payload) > _MAX_SOURCE_BYTES:
+            raise RpcError('Agent dashboard source cache is full', condition='plugin_host_unavailable')
+        path = None
+        try:
+            if _SOURCE_DIRECTORY is None:
+                _SOURCE_DIRECTORY = tempfile.TemporaryDirectory(prefix='talaria-dashboard-source-')
+            path = Path(_SOURCE_DIRECTORY.name) / f'{key}.py'
+            with path.open('xb') as file:
+                file.write(payload)
+            path.chmod(0o400)
+        except OSError as exc:
+            if path is not None:
+                path.unlink(missing_ok=True)
+            raise RpcError('Agent dashboard source unavailable', condition='plugin_host_unavailable') from exc
+        _SOURCES[key] = (str(path.parent), path.name)
+        _SOURCE_BYTES += len(payload)
+        return _SOURCES[key]
+
+
+def _path(raw):
+    if not isinstance(raw, str) or not raw or len(raw) > 512 or re.search(r'[\s\\?#\x00-\x1f]', raw):
+        return None
+    # No encoded path components: the caller decodes once before this trust boundary.
+    if '%' in raw or any(not p or p.startswith('.') for p in raw.split('/')):
+        return None
+    return raw
+
+
+def _asset_root(plugin, home):
+    root = Path(plugin['_dir'])
+    if plugin.get('source') == 'user':
+        allowed = {Path(home) / 'plugins', _RAW_BASE_HOME / 'plugins', _BASE_HOME / 'plugins'}
+        if root.parent.parent not in allowed:
+            return None
+        for base in (_RAW_BASE_HOME, _BASE_HOME):
+            try:
+                relative = root.relative_to(base)
+            except ValueError:
+                continue
+            return _BASE_HOME / relative, _BASE_HOME
+        return None
+    from hermes_cli.plugins import get_bundled_plugins_dir
+    bundled = Path(get_bundled_plugins_dir())
+    if root.parent.parent not in {bundled, bundled / 'memory'}:
+        return None
+    # The Agent source is trusted; its plugins directory and every descendant are still opened no-follow.
+    anchor = bundled.parent.resolve()
+    return anchor / root.relative_to(bundled.parent), anchor
+
+
+def _read(root: Path, rel: str, limit=_MAX_ASSET, *, anchor: Path):
+    """Open from the trusted home/source, rejecting symlinks in every root and asset component."""
+    if not _path(rel):
+        return None
+    fd = None
+    try:
+        relative = root.relative_to(anchor)
+        if any(part == '..' for part in relative.parts):
+            return None
+        # Even an ancestor replaced after anchor canonicalization cannot redirect this traversal.
+        parts = [*anchor.parts[1:], *relative.parts, *rel.split('/')]
+        fd = os.open(anchor.anchor, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+        for i, part in enumerate(parts):
+            child = os.open(part, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK |
+                            (os.O_DIRECTORY if i < len(parts) - 1 else 0), dir_fd=fd)
+            os.close(fd)
+            fd = child
+        if not stat.S_ISREG(os.fstat(fd).st_mode) or os.fstat(fd).st_size > limit:
+            return None
+        with os.fdopen(fd, 'rb') as file:
+            fd = None
+            body = file.read(limit + 1)
+        return body if len(body) <= limit else None
+    except (OSError, ValueError):
+        return None
+    finally:
+        if fd is not None:
+            os.close(fd)
+
+
+def _supported():
+    if not getattr(os, 'O_NOFOLLOW', 0) or os.open not in os.supports_dir_fd:
+        return False
+    try:
+        from hermes_cli.plugin_host import PluginHost
+        from hermes_cli.web_server_plugin_profiles import _scan_profile_plugins  # noqa: F401
+        return 'authenticated' in inspect.signature(PluginHost.asgi_request).parameters
+    except (ImportError, AttributeError, ValueError):
+        return False
+
+
+def _plugins(home):
+    from hermes_cli.web_server_plugin_profiles import _scan_profile_plugins
+    from hermes_cli.web_server_dashboard import _plugin_api_mount_skip_reason, _plugin_enable_sets_here
+    enabled, disabled = _plugin_enable_sets_here()
+    out = []
+    for plugin in _scan_profile_plugins(home):
+        name = plugin.get('name')
+        if not isinstance(name, str) or not _NAME.fullmatch(name) or plugin.get('source') not in ('user', 'bundled'):
+            continue
+        located = _asset_root(plugin, home)
+        if located is None:
+            continue
+        root, anchor = located
+        raw = _read(root, 'manifest.json', 64 * 1024, anchor=anchor)
+        try:
+            manifest = json.loads(raw) if raw else {}
+        except (ValueError, UnicodeDecodeError):
+            continue
+        if not isinstance(manifest, dict):
+            continue
+        # The existing Web protocol's panel opt-in distinguishes Web documents from native Desktop SDK bundles.
+        panel = manifest.get('panel')
+        compatible = isinstance(panel, str) and len(panel) <= 256 and _path(panel) and panel.startswith(('dist/', 'static/')) and panel.endswith('.html')
+        out.append({**plugin, '_dir': str(root), '_asset_anchor': str(anchor), 'panel': panel if compatible else None,
+                    'enabled': _plugin_api_mount_skip_reason(plugin, enabled, disabled) is None})
+    return out
+
+
+def _named(home, name, *, require_panel=True):
+    return next((p for p in _plugins(home) if p['name'] == name and p['enabled'] and (p['panel'] if require_panel else p.get('_api_file'))), None)
+
+
+def _reply(status=404, body=b'', content_type='application/octet-stream'):
+    return {'status': status, 'body': base64.b64encode(body).decode('ascii'), 'content_type': content_type}
+
+
+def _request(ctx, plugin, params, *, require_panel=True):
+    ctx.check_cancelled()
+    if params.get('authenticated') is not True:
+        return _reply()
+    path = params.get('path', '')
+    rel = path.lstrip('/')
+    if path != '/' and (_path(rel) is None or path != '/' + rel):
+        return _reply()
+    headers = [(k.lower(), str(v)) for k, v in params.get('headers', {}).items() if k.lower() in _HEADERS]
+    if params.get('websocket') or any(k == 'accept' and 'text/event-stream' in v.lower() for k, v in headers):
+        return _reply(501, b'Agent plugin host supports buffered HTTP only', 'text/plain; charset=utf-8')
+    api = plugin.get('_api_file')
+    if not isinstance(api, str) or not _path(api):
+        return _reply()
+    source = _read(Path(plugin['_dir']), api, anchor=Path(plugin['_asset_anchor']))
+    if source is None:
+        return _reply()
+    from hermes_cli.plugins import get_plugin_manager
+    body = base64.b64decode(params.get('body') or '', validate=True)
+    if len(body) > _MAX_API:
+        return _reply(413)
+    query = urlencode([(k, v) for k, v in parse_qsl(params.get('query', ''), keep_blank_values=True)
+                       if k.lower() not in _QUERY_CREDENTIALS])
+    method = params.get('method', 'GET')
+    if method not in {'GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'}:
+        raise InvalidParams('Unsupported plugin HTTP method')
+    root, snapshot_api = _api_source(plugin['_dir'], api, source)
+    ctx.check_cancelled()
+    try:
+        result = get_plugin_manager()._plugin_host().asgi_request(
+            plugin['name'], root, snapshot_api, method, path, query, headers, body,
+            timeout=10.0, authenticated=True)
+    except TimeoutError:
+        ctx.check_cancelled()
+        return _reply(504)
+    except Exception as exc:
+        # Third-party errors may contain credentials or file paths.
+        raise RpcError('Agent plugin request failed', condition='plugin_host_unavailable') from exc
+    ctx.check_cancelled()
+    content_type = next((v for k, v in result.get('headers', []) if k.lower() == 'content-type'), 'application/octet-stream')
+    if 'text/event-stream' in content_type.lower():
+        return _reply(501, b'Agent plugin host supports buffered HTTP only', 'text/plain; charset=utf-8')
+    if _named(homes.profile_home_param(params), plugin['name'], require_panel=require_panel) is None:
+        return _reply()
+    raw = result.get('body', b'')
+    if not isinstance(raw, bytes) or len(raw) > _MAX_API:
+        return _reply(502)
+    status = result.get('status', 502)
+    return _reply(status if isinstance(status, int) and 200 <= status <= 599 else 502, raw, content_type)
+
+
+def register(registry):
+    def run(ctx, params, action):
+        ctx.check_cancelled()
+        if not _supported():
+            if action == 'list':
+                return {'supported': False, 'plugins': []}
+            if action == 'toggle':
+                raise RpcError('Agent dashboard host unsupported', condition='agent_incompatible')
+            return _reply(501)
+        home = homes.profile_home_param(params)
+        with homes.scoped_home(home, load_plugins=False):
+            if action == 'list':
+                return {'supported': True, 'plugins': [
+                    {'name': p['name'], 'label': str(p.get('label') or p['name'])[:80],
+                     'version': str(p.get('version') or '')[:40], 'description': str(p.get('description') or '')[:300],
+                     'enabled': p['enabled'], 'panel': p['panel'], 'has_api': bool(p.get('_api_file'))}
+                    for p in _plugins(home)]}
+            name = params.get('name')
+            if not isinstance(name, str) or not _NAME.fullmatch(name):
+                if action == 'toggle':
+                    raise InvalidParams('Unknown Web dashboard plugin')
+                return _reply()
+            if action == 'toggle':
+                plugin = next((p for p in _plugins(home) if p['name'] == name and p['panel']), None)
+                if plugin is None or not isinstance(params.get('enabled'), bool):
+                    raise InvalidParams('Unknown Web dashboard plugin or invalid enablement')
+                from hermes_cli.plugins_cmd import _activate_key, _resolve_plugin_key
+                key = _resolve_plugin_key(name)
+                if key is None:
+                    raise InvalidParams('Plugin is not installed')
+                # Use the Agent admission transaction, without activate_plugin_now (in-process imports).
+                _activate_key(key, enable=params['enabled'])
+                return {'ok': True}
+            plugin = _named(home, name)
+            if plugin is None:
+                return _reply()
+            if action == 'request':
+                return _request(ctx, plugin, params)
+            path = params.get('path', '')
+            if not isinstance(path, str) or not path.startswith(('dist/', 'static/')):
+                return _reply()
+            content_type = _MIME.get(Path(path).suffix.lower())
+            body = _read(Path(plugin['_dir']), path, anchor=Path(plugin['_asset_anchor'])) if content_type else None
+            ctx.check_cancelled()
+            return _reply(200, body, content_type) if body is not None else _reply()
+
+    for action in ('list', 'toggle', 'asset', 'request'):
+        def handler(ctx, params, action=action):
+            return run(ctx, params, action)
+        registry.method(f'plugins.dashboard_{action}')(handler)

package/sidecar/talaria_sidecar/methods/gateway.py

@@ -80,7 +80,7 @@ def _host_serves(home: Path, budget_deadline: float) -> bool:
         time.sleep(0.5)
 
 
-def control(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *, quick_timeout: float, background_wait: float) -> dict:
+def control(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *, quick_timeout: float, background_wait: float, interrupt: bool = False) -> dict:
     if action not in ACTIONS:
         raise InvalidParams("unsupported gateway action")
     if not _ACTION_LOCK.acquire(blocking=False):
@@ -94,7 +94,7 @@ def control(action: str, home: Path, cli_profile: str | None, ctx: CallContext,
             if left <= 0:
                 return {"status": "failed", "message": f"Gateway {action} ran out of time before it could start", "timed_out": True}
             quick = min(quick_timeout, left)
-            return _run(action, home, cli_profile, ctx, quick_timeout=quick, background_wait=left - quick)
+            return _run(action, home, cli_profile, ctx, quick_timeout=quick, background_wait=left - quick, interrupt=interrupt)
 
         result = run(action, home, cli_profile)
         root = _host_root(home)
@@ -164,7 +164,7 @@ def _restart_wait(home: Path, cli_profile: str | None = None) -> float:
         return _RESTART_FALLBACK_SECONDS
 
 
-def _run(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *, quick_timeout: float, background_wait: float) -> dict:
+def _run(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *, quick_timeout: float, background_wait: float, interrupt: bool = False) -> dict:
     """One ``hermes --profile <name> gateway <action>`` subprocess for ``home``; the caller holds ``_ACTION_LOCK``."""
     try:
         profile = cli_profile or _profile_selector(home)
@@ -180,6 +180,15 @@ def _run(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *,
     if profile:
         cmd.extend(["--profile", profile])
     cmd.extend(["gateway", action])
+    try:
+        from hermes_cli import gateway_lifecycle_guards  # noqa: F401 - installed CLI capability
+    except ImportError:
+        pass
+    else:
+        if interrupt and action in ("stop", "restart"):
+            cmd.append("--yes")
+        if action == "restart":
+            cmd.append("--detach")
     log.info("Running gateway %s via %s (HERMES_HOME=%s)", action, " ".join(cmd), home)
     try:
         proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, env=env)
@@ -203,6 +212,8 @@ def _run(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *,
             return {"status": "completed", "message": f"Gateway service {_DONE[action]} successfully", "detail": stdout or stderr}
         failed = {"status": "failed", "message": f"{action.capitalize()} failed: {stderr or stdout}", "detail": stdout or stderr, "returncode": proc.returncode}
         reason = _reason(stdout, stderr)
+        if proc.returncode == 1 and action in ("stop", "restart") and reason and re.fullmatch(rf"Refusing to {action} the gateway: \d+ live session\(s\) would be interrupted\.", reason):
+            return {**failed, "status": "busy_live_work", "reason": reason, "message": reason}
         return {**failed, "reason": reason} if reason else failed
 
     ctx.emit("progress", {"phase": "started"})
@@ -238,14 +249,23 @@ def register(registry) -> None:
 
         return session(ctx, params)
 
+    @registry.method("gateway.create")
+    def create_(ctx: CallContext, params: dict) -> dict:
+        from .gateway_sessions import create
+
+        return create(params)
+
     def run(ctx: CallContext, params: dict, action: str) -> dict:
         home = profile_home_param(params)
         cli_profile = params.get("cli_profile")
         if cli_profile is not None and not isinstance(cli_profile, str):
             raise InvalidParams("cli_profile must be a string")
+        interrupt = params.get("interrupt", False)
+        if not isinstance(interrupt, bool):
+            raise InvalidParams("interrupt must be a boolean")
         # A restart drains the old gateway first, for as long as the CLI's own budget allows (infinite: no deadline).
         wait = params.get("background_wait_seconds") or (_restart_wait(home, cli_profile or None) if action == "restart" else 60.0)
-        return control(action, home, cli_profile or None, ctx, quick_timeout=float(params.get("quick_timeout_seconds") or 2.0), background_wait=float(wait))
+        return control(action, home, cli_profile or None, ctx, quick_timeout=float(params.get("quick_timeout_seconds") or 2.0), background_wait=float(wait), interrupt=interrupt)
 
     @registry.method("gateway.control", requires_agent=False)
     def control_(ctx: CallContext, params: dict) -> dict: