@maudecode/talaria-web 1.19.0 → 1.21.0

package/sidecar/talaria_sidecar/methods/managed_buffers.py

@@ -0,0 +1,110 @@
+"""Fixed devkit REST adapter through the existing admitted Agent plugin host."""
+import base64
+import json
+import re
+
+from .. import home as homes
+from ..errors import InvalidParams, RpcError
+from . import dashboard_plugins as host
+
+MAX_BYTES = 256 * 1024
+_NAME = re.compile(r'[A-Za-z0-9][A-Za-z0-9._-]{0,127}')
+_DIR = re.compile(r'[A-Za-z0-9_-]{1,96}')
+
+
+def _text_size(value):
+    try:
+        return len(value.encode('utf-8')) if isinstance(value, str) else -1
+    except UnicodeError:
+        return -1
+
+
+def _bad():
+    raise RpcError('Managed buffer response is invalid or too large', condition='buffer_invalid')
+
+
+def _json(ctx, plugin, home, method, path, content=None):
+    # Recheck admission for each native call, including the PUT after inventory.
+    current = host._named(home, 'devkit', require_panel=False)
+    if current is None or current['_dir'] != plugin['_dir'] or current.get('_api_file') != plugin.get('_api_file'):
+        raise RpcError('Managed buffer backend changed or was disabled', condition='buffer_unavailable')
+    body = b'' if content is None else json.dumps({'content': content}, ensure_ascii=False).encode()
+    result = host._request(ctx, plugin, dict(profile_home=str(home), authenticated=True, method=method, path=path, query='',
+        headers={'content-type': 'application/json'}, body=base64.b64encode(body).decode()), require_panel=False)
+    if result['status'] != 200:
+        # A PUT may have committed before an error or malformed acknowledgement. Never replay it here.
+        raise RpcError('Managed buffer unavailable' if method == 'GET' else 'Save outcome is unknown; reload before retrying',
+                       condition='buffer_unavailable' if method == 'GET' else 'buffer_save_unconfirmed')
+    try:
+        value = json.loads(base64.b64decode(result['body']))
+    except (ValueError, UnicodeDecodeError):
+        _bad()
+    if not isinstance(value, dict):
+        _bad()
+    return value
+
+
+def run(ctx, params):
+    action, sid = params.get('action'), params.get('session_id')
+    if action not in ('list', 'read', 'save') or not isinstance(sid, str) or not 0 < len(sid) <= 200:
+        raise InvalidParams('Invalid managed buffer request')
+    name = params.get('name')
+    if action != 'list' and (not isinstance(name, str) or not _NAME.fullmatch(name)):
+        raise InvalidParams('Invalid managed buffer name')
+    content = params.get('content')
+    if action == 'save' and (not 0 <= _text_size(content) <= MAX_BYTES):
+        raise InvalidParams('Managed buffer content is too large or is not text')
+    home = homes.profile_home_param(params)
+    with homes.scoped_home(home, load_plugins=False):
+        plugin = host._named(home, 'devkit', require_panel=False) if host._supported() else None
+        result = {'supported': plugin is not None, 'buffers': [], 'write_semantics': 'unconditional'}
+        if plugin is None:
+            if action != 'list':
+                raise RpcError('Enable and approve the devkit backend in Plugins', condition='buffer_unavailable')
+            return result
+        rows = _json(ctx, plugin, home, 'GET', '/sessions').get('sessions')
+        if not isinstance(rows, list) or len(rows) > 2000 or any(not isinstance(r, dict) for r in rows):
+            _bad()
+        matches = [r for r in rows if r.get('session_id') == sid]
+        if len(matches) > 1:
+            _bad()
+        row = matches[0] if matches else None
+        if row is None:
+            if action != 'list':
+                raise RpcError('Managed buffer no longer exists', condition='buffer_unavailable')
+            return result
+        directory, buffers = row.get('dir'), row.get('buffers')
+        if not isinstance(directory, str) or not _DIR.fullmatch(directory) or not isinstance(buffers, list) or len(buffers) > 200:
+            _bad()
+        seen = set()
+        for buf in buffers:
+            if not isinstance(buf, dict):
+                _bad()
+            key, size = buf.get('name'), buf.get('bytes')
+            if not isinstance(key, str) or not _NAME.fullmatch(key) or key in seen or type(size) is not int or not 0 <= size <= MAX_BYTES:
+                _bad()
+            seen.add(key)
+            result['buffers'].append({'name': key, 'size': size, 'read_only': row.get('exists') is not True})
+        if action == 'list':
+            return result
+        selected = next((b for b in result['buffers'] if b['name'] == name), None)
+        if selected is None:
+            raise RpcError('Managed buffer no longer exists', condition='buffer_unavailable')
+        if action == 'save' and selected['read_only']:
+            raise RpcError('Managed session is deleted or cannot be verified', condition='buffer_read_only')
+        value = _json(ctx, plugin, home, 'PUT' if action == 'save' else 'GET', f'/sessions/{directory}/buffers/{name}', content if action == 'save' else None)
+        if action == 'read':
+            text = value.get('content')
+            if value.get('session_id') != sid or value.get('name') != name or not 0 <= _text_size(text) <= MAX_BYTES:
+                _bad()
+            result.update(content=text, size=_text_size(text), read_only=selected['read_only'])
+        else:
+            # Native PUT acknowledgements may omit session_id, but an explicit identity must match.
+            if value.get('session_id', sid) != sid or value.get('name') != name or type(value.get('bytes')) is not int or not 0 <= value['bytes'] <= MAX_BYTES:
+                raise RpcError('Save outcome is unknown; reload before retrying', condition='buffer_save_unconfirmed')
+            result.update(size=value['bytes'], read_only=False)
+        return result
+
+
+def register(registry):
+    registry.method('plugins.buffers')(run)

package/sidecar/talaria_sidecar/methods/mcp.py

@@ -6,6 +6,8 @@ Config edits and health probes live in the server; this namespace only reads
 
 from __future__ import annotations
 
+import hashlib
+import json
 import logging
 
 from ..home import profile_home_param, scoped_home
@@ -48,7 +50,60 @@ def registry_tools() -> list[dict]:
     return out
 
 
+def cost_policies(servers: dict) -> dict:
+    """Read declarations using the native parser; inspect cached packages without discovering or connecting."""
+    try:
+        from tools.mcp_tool_costs import CONFIG_KEYS, _parse_cost, config_cost_policy
+        from hermes_cli.plugins import get_plugin_manager
+
+        portable = get_plugin_manager().get_portable_mcp_servers()
+    except (ImportError, AttributeError):
+        return {"supported": False, "policies": []}
+    rows = []
+    for name in sorted(servers.keys() | portable.keys()):
+        native, package = servers.get(name), portable.get(name, {})
+        if not isinstance(package, dict):
+            package = {}
+        editable = isinstance(native, dict) and ("command" in native or "url" in native)
+        own = {k: native[k] for k in CONFIG_KEYS if isinstance(native, dict) and k in native}
+        # The native loader rejects a malformed package before it can donate inherited keys.
+        if native is not None:
+            try:
+                config_cost_policy(name, package)
+            except (ValueError, TypeError):
+                package = {}
+        inherited = {k: package[k] for k in CONFIG_KEYS if k in package}
+        effective = {**inherited, **own}
+        sources = {k: "native" if k in own else "package" if k in inherited else "default" for k in CONFIG_KEYS}
+        row = {"name": name, "source": "native_override" if native is not None and package else "native" if native is not None else "package",
+               "valid": True, "can_edit": editable, "error": None,
+               "package_revision": hashlib.sha256(json.dumps(inherited, sort_keys=True, default=str).encode()).hexdigest(),
+               "overrides": {"tool_costs": None, "spend_limit": None, "cost_unit": None},
+               "tool_costs": [], "spend_limit": 0, "cost_unit": "credits", "budget_enabled": False, "field_sources": sources}
+        try:
+            # Validate the native entry separately as the Agent does before package inheritance.
+            config_cost_policy(name, own)
+            policy = config_cost_policy(name, effective)
+            costs = effective.get("tool_costs") or {}
+            row["tool_costs"] = [{"name": tool, "low": cost.low, "high": cost.high, "note": cost.note}
+                                 for tool, value in costs.items() for cost in [_parse_cost(value, "declared cost")]]
+            row["spend_limit"] = effective.get("spend_limit") or 0
+            row["cost_unit"] = (effective.get("cost_unit") or "credits").strip()
+            row["budget_enabled"] = policy is not None and policy.limit > 0
+            row["overrides"] = {k: own.get(k) for k in CONFIG_KEYS}
+        except (ValueError, TypeError):
+            # Native errors may quote arbitrary config values, including mistakenly pasted credentials.
+            row.update(valid=False, error="Invalid declared cost policy. Check tool estimates, limit and unit.")
+        rows.append(row)
+    return {"supported": True, "policies": rows}
+
+
 def register(registry_) -> None:
+    @registry_.method("mcp.cost_policies")
+    def policies(ctx: CallContext, params: dict) -> dict:
+        with scoped_home(profile_home_param(params), load_plugins=False):
+            return cost_policies(params.get("servers") or {})
+
     @registry_.method("mcp.status")
     def status_(ctx: CallContext, params: dict) -> dict:
         with scoped_home(profile_home_param(params)):

package/sidecar/talaria_sidecar/methods/oauth.py

@@ -1,4 +1,5 @@
-"""``oauth.*``: the Agent's device-code sign-ins for Nous Portal, OpenAI Codex, xAI and MiniMax (TAL-398).
+"""``oauth.*``: the Agent's device-code sign-ins for Nous Portal, OpenAI Codex, xAI and MiniMax (TAL-398), and the
+browser sign-in of a plugin-declared OAuth client (``plugin:<key>:<id>``, TAL-1276, in ``plugin_oauth``).
 
 ``oauth.start`` asks the provider for a code and answers what the user has to see; a daemon thread then waits for the
 approval and saves the credential with the Agent's own auth-store helpers under the flow's profile home, the steps its
@@ -9,9 +10,12 @@ Flows live in this process only.
 
 from __future__ import annotations
 
+import contextlib
+import inspect
 import logging
 import os
 import secrets
+import ssl
 import threading
 import time
 from dataclasses import dataclass, field
@@ -22,6 +26,7 @@ from typing import Any, Callable
 from ..errors import InvalidParams, RpcError
 from ..home import profile_home_param, scoped_home
 from ..rpc import CallContext
+from . import plugin_oauth
 
 log = logging.getLogger("talaria_sidecar.oauth")
 
@@ -31,6 +36,8 @@ _CODEX_EXPIRES_IN = 15 * 60  # OpenAI's device-code lifetime, as the Agent dashb
 _ENDED_TTL = 10 * 60
 # A pending flow past its code's expiry by this much ends expired even if its provider call has not returned yet.
 _EXPIRY_GRACE = 60
+# How long a start waits for the flows it replaces to close their loopback listeners.
+_RELEASE_WAIT = 5.0
 
 _DENIED = "Sign-in was declined."
 _EXPIRED = "The sign-in code expired before it was approved."
@@ -55,6 +62,17 @@ class Flow:
     cancelled: threading.Event = field(default_factory=threading.Event)
     # Serialises the cancel check with the credential save: a cancel cannot land between them.
     lock: threading.Lock = field(default_factory=threading.Lock)
+    # The credential is saved but the sign-in has not finished (a guest sign-in still settles the account): a cancel or
+    # an expiry can no longer undo it, and the flow stays pending until its own ending.
+    committed: bool = False
+    # A browser sign-in also finishes from the redirect address the user pastes (``oauth.submit_redirect``).
+    submit: Callable[[str], None] | None = None
+    # Set once a browser sign-in's loopback listener is closed, so a replacing start can bind the same fixed port.
+    closed: threading.Event | None = None
+
+    @property
+    def stoppable(self) -> bool:
+        return self.status == "pending" and not self.committed
 
     def end(self, status: str, error: str | None = None) -> None:
         self.status, self.error, self.ended_at = status, error, time.time()
@@ -107,9 +125,24 @@ def _now_z() -> str:
 
 
 def _client(timeout: float, **kwargs: Any) -> Any:
+    """Every flow's HTTP client, verifying TLS as the Agent's own sign-in does: the OS trust store, and (v0.22.3+) a
+    certifi bundle an install-environment rotation deleted under this process, re-derived process-wide."""
     import httpx
 
-    return httpx.Client(timeout=httpx.Timeout(timeout), headers={"Accept": "application/json"}, **kwargs)
+    return httpx.Client(timeout=httpx.Timeout(timeout), headers={"Accept": "application/json"}, verify=_verify(), **kwargs)
+
+
+def _verify() -> Any:
+    try:
+        from agent.ssl_verify import resolve_httpx_verify
+    except ImportError:  # an Agent without it keeps httpx's default
+        return True
+    verify = resolve_httpx_verify()
+    # The resolver hands over the platform store alone when SSL_CERT_FILE/SSL_CERT_DIR is set; httpx's default trusted
+    # that bundle, so keep it, on top of the platform store the resolver installed (as ``platform_ssl_context`` does).
+    cafile, capath = os.environ.get("SSL_CERT_FILE", "").strip(), os.environ.get("SSL_CERT_DIR", "").strip()
+    cafile, capath = (cafile if os.path.isfile(cafile) else None), (capath if os.path.isdir(capath) else None)
+    return ssl.create_default_context(cafile=cafile, capath=capath) if cafile or capath else verify
 
 
 # ── providers: (begin, wait, save) over the Agent's own steps ──────────
@@ -124,8 +157,9 @@ def _nous_begin() -> tuple[dict, dict]:
     # v0.22.0 replaced ``guest_enabled`` with ``guest_allowed``; 0.21.x releases only have the former.
     guest_gate = getattr(anon_auth, "guest_allowed", None) or getattr(anon_auth, "guest_enabled")
     if guest_gate() and anon_auth.has_guest():
-        # The free tier's sign-in moves its connectors to the account (``anon_auth.run_sign_in``); a plain device-code
-        # sign-in here would orphan them.
+        # The native sign-in owns the guest's connector handoff for its installed protocol.
+        if hasattr(anon_auth, "run_sign_in"):
+            return _nous_sign_in(anon_auth)
         hint = getattr(anon_auth, "UPGRADE_HINT", None) or "Sign in from Hermes with `hermes auth upgrade`."
         raise RpcError(f"This profile uses the Nous free tier. {hint}", condition="oauth_unsupported")
     pconfig = PROVIDER_REGISTRY["nous"]
@@ -136,7 +170,63 @@ def _nous_begin() -> tuple[dict, dict]:
     return display, {"portal": portal, "client_id": pconfig.client_id, "scope": pconfig.scope, "device_code": str(data["device_code"])}
 
 
+def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
+    """Over a guest, the Agent's own sign-in (``anon_auth.run_sign_in``, as its dashboard runs it): it moves the guest's
+    connected apps to the account, then persists and settles the account itself. Its cancel check, persist guard and
+    home scope read the flow ``_nous_wait`` binds into the state; before that only ``start``'s first step runs, already
+    under the flow's home."""
+    state: dict = {}
+
+    def cancelled() -> bool:
+        flow = state.get("flow")
+        return flow is not None and flow.cancelled.is_set()
+
+    @contextlib.contextmanager
+    def persist_guard():
+        # As ``_run`` does for a plain save, the final cancel check and the save share the flow's lock; the flow ends
+        # approved only when the Agent has also settled the account, through ``_run``.
+        flow = state["flow"]
+        with flow.lock:
+            may_persist = flow.status == "pending"
+            yield may_persist
+            if may_persist:
+                flow.committed = True
+
+    def scope():
+        flow = state.get("flow")
+        return scoped_home(flow.home) if flow is not None else contextlib.nullcontext()
+
+    # Older Agents use promotion; v0.22.5 removed its option in favor of plain device login and native handoff.
+    options = {"cancel_wins_after_promotion": True} if "cancel_wins_after_promotion" in inspect.signature(anon_auth.run_sign_in).parameters else {}
+    sign_in = anon_auth.run_sign_in(cancelled=cancelled, persist_guard=persist_guard, scope=scope, **options)
+    first = next(sign_in)
+    if first.kind != "code":
+        sign_in.close()
+        raise RpcError(first.copy_terminal, condition="oauth_unsupported" if first.precondition else "oauth_failed")
+    state["sign_in"] = sign_in
+    return {"user_code": first.code, "verification_url": first.link, "expires_in": first.expires_in, "interval": first.interval}, state
+
+
+class _SignInEnded(Exception):
+    """A guest sign-in that ended without an account; ``code`` lets ``_ending`` classify a decline and an expiry."""
+
+    def __init__(self, ended: Any):
+        super().__init__(ended.copy)
+        self.code = {"declined": "access_denied", "timed_out": "expired_token"}.get(ended.kind, ended.kind)
+
+
 def _nous_wait(flow: Flow, state: dict) -> dict:
+    sign_in = state.get("sign_in")
+    if sign_in is not None:
+        state["flow"] = flow
+        try:
+            for ended in sign_in:  # the generator always ends on one terminal state
+                pass
+        finally:
+            sign_in.close()
+        if not ended.ok:
+            raise _SignInEnded(ended)
+        return {}
     from hermes_cli.auth import _poll_for_token
 
     with _client(15.0) as client:
@@ -145,6 +235,8 @@ def _nous_wait(flow: Flow, state: dict) -> dict:
 
 
 def _nous_save(flow: Flow, state: dict, token_data: dict) -> None:
+    if "sign_in" in state:  # the guest sign-in persisted and settled the account itself
+        return
     from hermes_cli import anon_auth
     from hermes_cli.auth import persist_nous_credentials, refresh_nous_oauth_from_state
 
@@ -213,8 +305,10 @@ def _codex_save(flow: Flow, state: dict, tokens: dict) -> None:
 def _xai_begin() -> tuple[dict, dict]:
     from hermes_cli.auth import _xai_oauth_discovery, _xai_oauth_request_device_code
 
-    discovery = _xai_oauth_discovery(20.0)
     with _client(20.0) as client:
+        # The Agent's discovery is a bare ``httpx.get``: building the client first gives it the platform store and a
+        # certifi re-derived after a rotation.
+        discovery = _xai_oauth_discovery(20.0)
         data = _xai_oauth_request_device_code(client)
     display = {"user_code": str(data["user_code"]), "verification_url": str(data.get("verification_uri_complete") or data["verification_uri"]),
                "expires_in": int(data["expires_in"]), "interval": int(data["interval"])}
@@ -323,9 +417,16 @@ def _run(flow: Flow, wait: Callable[[Flow, dict], dict], save: Callable[[Flow, d
         log.info("oauth: %s sign-in ended %s (flow=%s)", flow.provider, flow.status, flow.flow_id[:6])
 
 
+def _discard(state: dict) -> None:
+    """Releases a begun sign-in that is never published: a guest sign-in's generator holds its HTTP client."""
+    if "sign_in" in state:
+        state["sign_in"].close()
+    plugin_oauth.discard(state)
+
+
 def _cancel(flow: Flow) -> None:
     with flow.lock:
-        if flow.status == "pending":
+        if flow.stoppable:
             flow.cancelled.set()
             flow.end("cancelled")
 
@@ -357,7 +458,7 @@ def _pending(home: Path, provider: str) -> list[Flow]:
 
 
 def start(home: Path, provider: str, *, providers: dict[str, Provider] | None = None) -> dict:
-    steps = (providers or PROVIDERS).get(provider)
+    steps = (providers or PROVIDERS).get(provider) or plugin_oauth.steps(provider)
     if steps is None:
         raise InvalidParams(f"{provider} has no device-code sign-in")
     begin, wait, save = steps
@@ -369,6 +470,11 @@ def start(home: Path, provider: str, *, providers: dict[str, Provider] | None =
     # old code that lands while the provider answers can no longer save.
     for old in _pending(home, provider):
         _cancel(old)
+    # A cancelled browser sign-in closes its listener from its own thread; a fixed redirect port is free only after that.
+    with _FLOWS_LOCK:
+        listening = [f for f in _FLOWS.values() if f.provider == provider and f.closed is not None and not f.closed.is_set() and _same_home(f.home, home)]
+    for old in listening:
+        old.closed.wait(_RELEASE_WAIT)
     try:
         with scoped_home(home):
             display, state = begin()
@@ -379,11 +485,13 @@ def start(home: Path, provider: str, *, providers: dict[str, Provider] | None =
         raise RpcError(_first_line(exc), condition="oauth_failed") from exc
     if not str(display["verification_url"]).lower().startswith(("https://", "http://")):
         # The browser opens this link: anything but a web address is refused before a flow exists.
+        _discard(state)
         raise RpcError("The provider answered an invalid sign-in link.", condition="oauth_failed")
-    flow = Flow(secrets.token_urlsafe(16), provider, home, time.time() + int(display["expires_in"]), max(1, int(display["interval"])))
+    flow = Flow(secrets.token_urlsafe(16), provider, home, time.time() + int(display["expires_in"]), max(1, int(display["interval"])), submit=state.get("submit"), closed=state.get("closed"))
     with _FLOWS_LOCK:
         if _GENERATIONS.get(key) != generation:
             # A newer start for this home and provider began while this one waited on the provider: it owns the sign-in.
+            _discard(state)
             raise RpcError("A newer sign-in for this provider replaced this one.", condition="oauth_superseded")
         superseded = [f for f in _FLOWS.values() if f.provider == provider and f.status == "pending" and _same_home(f.home, home)]
         _FLOWS[flow.flow_id] = flow
@@ -403,10 +511,10 @@ def _flow(home: Path, flow_id: str) -> Flow:
 
 def poll(home: Path, flow_id: str) -> dict:
     flow = _flow(home, flow_id)
-    if flow.status == "pending" and time.time() > flow.expires_at + _EXPIRY_GRACE:
+    if flow.stoppable and time.time() > flow.expires_at + _EXPIRY_GRACE:
         # The provider call outlived its code: end it now, and a late approval can no longer save.
         with flow.lock:
-            if flow.status == "pending":
+            if flow.stoppable:
                 flow.cancelled.set()
                 flow.end("expired", _EXPIRED)
     return flow.view()
@@ -418,6 +526,18 @@ def cancel(home: Path, flow_id: str) -> dict:
     return flow.view()
 
 
+def submit_redirect(home: Path, flow_id: str, url: str) -> dict:
+    """Finish a browser sign-in with the address its redirect reached, when the browser runs on another machine."""
+    flow = _flow(home, flow_id)
+    if flow.submit is None:
+        raise InvalidParams("This sign-in takes no redirect address.")
+    with flow.lock:
+        if not flow.stoppable or time.time() >= flow.expires_at:
+            raise RpcError("This sign-in already ended.", condition="oauth_flow_ended")
+    flow.submit(url)
+    return flow.view()
+
+
 def _flow_id(params: dict) -> str:
     flow_id = str(params.get("flow_id") or "").strip()
     if not flow_id:
@@ -428,7 +548,8 @@ def _flow_id(params: dict) -> str:
 def register(reg) -> None:
     @reg.method("oauth.start")
     def start_(ctx: CallContext, params: dict) -> dict:
-        provider = str(params.get("provider") or "").strip().lower()
+        provider = str(params.get("provider") or "").strip()
+        provider = provider if provider.startswith(plugin_oauth.PREFIX) else provider.lower()
         if not provider:
             raise InvalidParams("provider is required")
         return start(profile_home_param(params), provider)
@@ -440,3 +561,10 @@ def register(reg) -> None:
     @reg.method("oauth.cancel", requires_agent=False)
     def cancel_(ctx: CallContext, params: dict) -> dict:
         return cancel(profile_home_param(params), _flow_id(params))
+
+    @reg.method("oauth.submit_redirect", requires_agent=False)
+    def submit_(ctx: CallContext, params: dict) -> dict:
+        url = str(params.get("url") or "").strip()
+        if not url:
+            raise InvalidParams("url is required")
+        return submit_redirect(profile_home_param(params), _flow_id(params), url)

package/sidecar/talaria_sidecar/methods/outbound_drafts.py

@@ -0,0 +1,165 @@
+"""Typed adapter for the reviewed Draft Cards store. Never imports producer code or sends."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+import json
+from pathlib import Path
+import re
+import sqlite3
+import time
+from contextlib import closing
+
+from .. import home as homes
+from ..errors import InvalidParams, RpcError
+from . import dashboard_plugins
+
+_KEY = secrets.token_bytes(32)
+_PIN = '6e6ca659ece59b0ce1c28b3b188393491ee5a415'
+_SOURCES = {'__init__.py': '73388811ddc4f7cfc336c2a278dad9c0c032b0b15e4183ce8a157e61ce13695b',
+            'plugin.yaml': 'e2a8a92847f4519f1636ec542ae2b1599050d9552fb9a61d9c6d6afaca83d6eb',
+            'dashboard/manifest.json': '14e906a0e492669f0950e091f42d98ad607486dbea524b2a8e8691faa2139941',
+            'dashboard/plugin_api.py': '98e38f618c23ec266f1e171a958ffcf048339ea3c7876d1faa2d0b8910839336',
+            'store.py': '5815d4b106082b7f51d1b7e9d239fc655fa247a5e61ff7465e8c1865476eaaf6',
+            'tools.py': '29271409488efc39206a048dc2852effc156d9ca5d91721632e1219840f14db1'}
+_STATES = {'draft', 'approved', 'sent', 'saved', 'failed', 'discarded'}
+
+
+def _producer(home):
+    """Native registration, explicit profile consent and reviewed source, without loading a plugin."""
+    try:
+        from hermes_cli import plugins_cmd as pc
+        metadata = pc._read_install_metadata()
+        for plugin in dashboard_plugins._plugins(home):
+            if plugin['name'] != 'draft-cards' or not plugin['enabled'] or plugin.get('source') != 'user':
+                continue
+            root, anchor = Path(plugin['_dir']).parent, Path(plugin['_asset_anchor'])
+            record = metadata.get(root.name, {})
+            catalog = record.get('catalog', {})
+            if catalog.get('name') != 'draft-cards' or catalog.get('sha') != _PIN or record.get('revision') != _PIN:
+                continue
+            if not all((body := dashboard_plugins._read(root, name, anchor=anchor)) is not None
+                       and hashlib.sha256(body).hexdigest() == digest for name, digest in _SOURCES.items()):
+                continue
+            return _PIN
+    except (ImportError, AttributeError, OSError, ValueError, TypeError):
+        pass
+    return None
+
+
+def _database(home):
+    """Only the producer's existing profile-local database; never creates storage on a read."""
+    path = Path(home) / 'plugin-data' / 'draft-cards' / 'drafts.db'
+    # No caller supplies a filesystem path, and no symlink may redirect native state.
+    for parent in [path, *path.parents]:
+        if parent.is_symlink():
+            raise OSError('Symlink in draft storage')
+    if not path.is_file():
+        raise OSError('Draft storage unavailable')
+    connection = sqlite3.connect(path.as_uri() + '?mode=rw', uri=True, timeout=5)
+    connection.row_factory = sqlite3.Row
+    return connection
+
+
+def _fields(value):
+    if not isinstance(value, dict) or set(value) != {'from', 'to', 'cc', 'bcc', 'subject', 'body'}:
+        raise InvalidParams('Invalid draft fields')
+    for key, limit in [('from', 320), ('subject', 300), ('body', 20_000)]:
+        if not isinstance(value[key], str) or len(value[key]) > limit or '\x00' in value[key]:
+            raise InvalidParams('Invalid draft fields')
+    for key in ('to', 'cc', 'bcc'):
+        if not isinstance(value[key], list) or len(value[key]) > 50 or any(
+                not isinstance(item, str) or len(item) > 320 or re.search(r'[\r\n\x00]', item) for item in value[key]):
+            raise InvalidParams('Invalid draft recipients')
+    if not value['body'].strip():
+        raise InvalidParams('A draft body is required')
+    return value
+
+
+def _snapshot(conn, home, params, producer):
+    row = conn.execute('SELECT * FROM drafts WHERE id = ?', (params['draft_id'],)).fetchone()
+    if row is None or not row['session_id'] or row['session_id'] != params['session_id']:
+        return None
+    versions = conn.execute('SELECT * FROM versions WHERE draft_id = ? ORDER BY v LIMIT 61', (params['draft_id'],)).fetchall()
+    if not versions or len(versions) > 60 or row['kind'] not in ('email', 'message') or row['status'] not in _STATES:
+        return None
+    matches = [v for v in versions if v['card'] == params['card']]
+    if not matches:
+        return None
+    selected, latest = matches[-1], versions[-1]
+    fields = _fields(json.loads(selected['fields']))
+    state = row['status'] if selected['v'] == latest['v'] else 'superseded'
+    if state == 'approved' and row['approved_version'] != latest['v']:
+        state = 'unavailable'
+    consumed = False
+    if conn.execute("SELECT 1 FROM sqlite_master WHERE type='table' AND name='talaria_outbound_approvals'").fetchone():
+        consumed = conn.execute('SELECT 1 FROM talaria_outbound_approvals WHERE draft_id = ? AND version = ?',
+                                (row['id'], selected['v'])).fetchone() is not None
+    revision = hmac.new(_KEY, json.dumps([str(home), producer, dict(row), [dict(v) for v in versions], consumed],
+                                        sort_keys=True, separators=(',', ':')).encode(), hashlib.sha256).hexdigest()
+    editable = state in ('draft', 'failed', 'approved')
+    return {'producer': 'draft-cards', 'producer_revision': producer, 'draft_id': row['id'], 'card': selected['card'],
+            'kind': row['kind'], 'platform': str(row['platform'])[:40], 'version': selected['v'], 'revision': revision,
+            'fields': fields, 'state': state, 'can_edit': editable, 'can_approve': state in ('draft', 'failed') and not consumed,
+            'masked': False}
+
+
+def _conflict():
+    raise RpcError('The draft changed or this version was already approved. Review it again.', condition='outbound_draft_conflict')
+
+
+def review(ctx, params):
+    ctx.check_cancelled()
+    action = params.get('action')
+    if (action not in ('read', 'edit', 'approve') or not isinstance(params.get('draft_id'), str)
+            or not re.fullmatch(r'd_[0-9a-f]{8}', params['draft_id']) or type(params.get('card')) is not int
+            or params['card'] < 1 or not isinstance(params.get('session_id'), str) or not params['session_id']):
+        raise InvalidParams('Invalid outbound draft reference')
+    home = homes.profile_home_param(params)
+    with homes.scoped_home(home, load_plugins=False):
+        producer = _producer(home)
+        if producer is None:
+            if action != 'read':
+                _conflict()
+            return {'draft': None}
+        try:
+            with closing(_database(home)) as conn, conn:
+                # The native tool writers share this database lock. Check and mutation have one snapshot.
+                conn.execute('BEGIN IMMEDIATE' if action != 'read' else 'BEGIN')
+                draft = _snapshot(conn, home, params, producer)
+                if action == 'read':
+                    ctx.check_cancelled()
+                    return {'draft': draft if _producer(home) == producer else None}
+                if (draft is None or params.get('version') != draft['version'] or params.get('revision') != draft['revision']
+                        or not draft['can_' + action] or _producer(home) != producer):
+                    _conflict()
+                now = time.time()
+                if action == 'edit':
+                    fields = _fields(params.get('fields'))
+                    if fields == draft['fields']:
+                        return {'draft': draft}
+                    if conn.execute('SELECT count(*) FROM versions WHERE draft_id = ?', (draft['draft_id'],)).fetchone()[0] >= 60:
+                        _conflict()
+                    conn.execute("INSERT INTO versions (draft_id,v,card,author,note,fields,created_at) VALUES (?,?,?,'user','Edited in Talaria',?,?)",
+                                 (draft['draft_id'], draft['version'] + 1, draft['card'], json.dumps(fields, ensure_ascii=False), now))
+                    conn.execute("UPDATE drafts SET status='draft', approved_version=NULL, status_detail='', status_at=?, updated_at=? WHERE id=?",
+                                 (now, now, draft['draft_id']))
+                else:
+                    # Additive native-store state: Stable producer readers ignore this per-version receipt.
+                    conn.execute('CREATE TABLE IF NOT EXISTS talaria_outbound_approvals (draft_id TEXT NOT NULL, version INTEGER NOT NULL, revision TEXT NOT NULL, PRIMARY KEY(draft_id,version))')
+                    conn.execute('INSERT INTO talaria_outbound_approvals VALUES (?,?,?)', (draft['draft_id'], draft['version'], draft['revision']))
+                    conn.execute("UPDATE drafts SET status='approved', approved_version=?, status_detail='', status_at=?, updated_at=? WHERE id=?",
+                                 (draft['version'], now, now, draft['draft_id']))
+                ctx.check_cancelled()
+                if _producer(home) != producer:
+                    _conflict()
+                return {'draft': _snapshot(conn, home, params, producer)}
+        except (OSError, sqlite3.Error, ValueError, KeyError, TypeError, InvalidParams) as exc:
+            if action != 'read':
+                raise RpcError('Draft outcome unconfirmed; read its state before trying again.', condition='outbound_draft_unconfirmed') from exc
+            return {'draft': None}
+
+
+def register(registry):
+    registry.method('drafts.review')(review)