@maudecode/talaria-web 1.20.0 → 1.21.0

package/sidecar/talaria_sidecar/agent_services.py

@@ -164,12 +164,15 @@ def snapshot(entry, *, records=None, expected=None):
     from gateway.status import get_process_start_time, _pid_exists
     service, pid = entry.get('service_pid', entry['pid']), entry['pid']
     anchors = {service, pid}
-    observed = dict(expected or {})
+    observed = {**entry.get('departed_processes', {}), **(expected or {})}
     seen_parents = {int(p): proof['parent'] for p, proof in observed.items() if 'parent' in proof}
-    departed = set()
+    departed = set(map(int, entry.get('departed_processes', {})))
 
     def exited(p):
-        if _pid_exists(p) is False:
+        live = _pid_exists(p)
+        if live is None:
+            raise RuntimeError(f'{_name(entry)} process {p} liveness is unreadable; source was not changed.')
+        if live is False:
             if p in anchors:
                 raise RuntimeError(f'{_name(entry)} anchor process {p} disappeared during discovery; source was not changed.')
             departed.add(p)
@@ -179,7 +182,7 @@ def snapshot(entry, *, records=None, expected=None):
     def inventory():
         parents = _process_table()
         if service not in _ancestors(pid, parents):
-            raise RuntimeError(f'{_name(entry)} does not own backend/gateway PID {pid}.')
+            raise RuntimeError(f'{_name(entry)} identity/ancestry changed: does not own backend/gateway PID {pid}.')
         if service in _ancestors(os.getpid(), parents):
             raise RuntimeError(f'{_name(entry)} owns the updater or an ancestor; source was not changed.')
         for p, parent in seen_parents.items():
@@ -188,6 +191,10 @@ def snapshot(entry, *, records=None, expected=None):
                     continue
                 raise RuntimeError(f'{_name(entry)} process {p} identity/ancestry changed during discovery; source was not changed.')
         descendants = _descendants(service, parents)
+        # Successor retries cannot discard a live writer from a previously observed tree.
+        for p in seen_parents.keys() - descendants - departed:
+            if not exited(p):
+                raise RuntimeError(f'{_name(entry)} process {p} remains live outside the attested tree; recovery remains owed.')
         seen_parents.update({p: parents[p] for p in descendants})
         # Zombies may remain in ps. Recheck departed PIDs at every inventory so
         # neither a recycled PID nor unknown liveness can be silently excluded.
@@ -205,6 +212,8 @@ def snapshot(entry, *, records=None, expected=None):
             if exited(p):
                 return None
             raise RuntimeError(f'{_name(entry)} process {p} birth identity is live or unreadable; source was not changed.')
+        if exited(p):
+            return None
         if any(proof.get(key) != value for key, value in observed.get(str(p), {}).items()):
             raise RuntimeError(f'{_name(entry)} process {p} identity/ancestry changed during discovery; source was not changed.')
         observed[str(p)] = proof
@@ -219,6 +228,8 @@ def snapshot(entry, *, records=None, expected=None):
         _, final = inventory()
         if live & departed or remaining != live or final != live:
             continue
+        if departed:
+            entry['departed_processes'] = {str(p): observed.get(str(p), {'parent': seen_parents[p]}) for p in departed}
         return proofs
     raise RuntimeError(f'{_name(entry)} process inventory kept changing after {SNAPSHOT_ATTEMPTS} samples; retry when descendants settle. Source was not changed and recovery remains owed.')
 
@@ -403,8 +414,23 @@ def _service_pid(entry):
 
 def verify_processes(entry, records, *, stopping=False, fenced=False):
     from gateway.status import get_process_start_time, _pid_exists
+    if not stopping:
+        # Reuse discovery's bounded proof without granting permission to lose an anchor.
+        candidate = dict(entry)
+        for boundary in range(2):
+            _, service_pid = _service_pid(entry)
+            if service_pid != entry['service_pid']:
+                raise RuntimeError(f'{_name(entry)} supervisor respawned during quiescence; source was not changed.')
+            if 'config_stamp' in entry and _config_stamp(entry) != entry['config_stamp']:
+                raise RuntimeError(f'{_name(entry)} service configuration changed; recovery remains owed.')
+            if boundary == 0:
+                candidate['processes'] = snapshot(candidate, records=records, expected=entry['processes'])
+        entry.update(processes=candidate['processes'])
+        if candidate.get('departed_processes'):
+            entry['departed_processes'] = candidate['departed_processes']
+        return True
     parents = _process_table()
-    departed = set()
+    departed = set(map(int, entry.get('departed_processes', {})))
     for pid, expected in entry['processes'].items():
         pid = int(pid)
         if _pid_exists(pid) is False:
@@ -442,7 +468,6 @@ def verify_processes(entry, records, *, stopping=False, fenced=False):
 
 def bind_processes(entry, records):
     if entry.get('processes'):
-        entry['processes'] = snapshot(entry, records=records, expected=entry['processes'])
         verify_processes(entry, records)
 
 
@@ -713,8 +738,20 @@ class ServiceRecovery:
                 or ('runtime_revision' in transaction and not re.fullmatch(r'[a-f0-9]{40}', str(transaction['runtime_revision'])))):
             raise RuntimeError('Service recovery transaction has an unknown identity or format; its evidence is retained.')
 
+        operation = self.state.get('update_operation')
+        if operation is not None and (
+                not isinstance(operation, dict)
+                or not re.fullmatch(r'[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}', str(operation.get('operation_id', '')))
+                or any(not re.fullmatch(r'[a-f0-9]{40}', str(operation.get(key, ''))) for key in ('baseline_revision', 'target_revision'))
+                or ('attempt_error' in operation and (not isinstance(operation['attempt_error'], str) or len(operation['attempt_error']) > 2000))
+                or ('source_moved' in operation and not isinstance(operation['source_moved'], bool))
+                or ('failed_stage' in operation and operation['failed_stage'] not in {'install', 'gateway_restart', 'agent_ready'})
+                or operation.get('stage') not in {'install', 'gateway_restart', 'agent_ready'}
+                or ('recovered_revision' in operation and not re.fullmatch(r'[a-f0-9]{40}', str(operation['recovered_revision'])))):
+            raise RuntimeError('Update operation correlation is malformed; its evidence is retained.')
+
     def save(self, token=None):
-        if not self.state['entries'] and not self.state.get('sync_failed') and not self.state.get('transaction'):
+        if not self.state['entries'] and not self.state.get('sync_failed') and not self.state.get('transaction') and not self.state.get('update_operation'):
             if self.path.exists():
                 self.path.unlink()
                 self._sync_directory()
@@ -734,9 +771,9 @@ class ServiceRecovery:
             with contextlib.suppress(FileNotFoundError):
                 os.unlink(temporary)
 
-    def _sync_directory(self):
+    def _sync_directory(self, directory=None):
         if os.name != 'nt':
-            fd = os.open(self.path.parent, os.O_RDONLY)
+            fd = os.open(directory if directory is not None else self.path.parent, os.O_RDONLY)
             try:
                 os.fsync(fd)
             finally:
@@ -767,10 +804,17 @@ class ServiceRecovery:
             self.records.write(token)
             self.save(token)
 
+    def verify_processes(self, entry, **permissions):
+        owed = next(e for e in self.state['entries'] if _service_key(e) == _service_key(entry))
+        result = verify_processes(owed, self.records, **permissions)
+        self.save()  # Updated custody must precede the next lifecycle effect.
+        return result
+
     def stop(self, entry, stopped):
         owed = next(e for e in self.state['entries'] if _service_key(e) == _service_key(entry))
-        verify_processes(owed, self.records)
+        self.verify_processes(owed)
         backend_request(owed)
+        self.verify_processes(owed)
         permit = backend_request(owed, 'prepare')
         if permit.get('ok') is not True or permit.get('idle') is not True or not isinstance(permit.get('token'), str):
             if owed['phase'] == 'recorded':
@@ -783,7 +827,7 @@ class ServiceRecovery:
         except BaseException:
             backend_request(owed, 'cancel', permit['token'])
             raise
-        verify_processes(owed, self.records)
+        self.verify_processes(owed)
         if backend_request(owed, 'commit', permit['token']).get('ok') is not True:
             raise RuntimeError(f'{_name(owed)} did not commit its backend retirement; recovery remains owed.')
         owed['backend_committed'] = True
@@ -794,14 +838,14 @@ class ServiceRecovery:
         # Disarm through the original manager before its KeepAlive can admit a successor.
         owed['backend_stop_requested'] = True
         self.save()
-        verify_processes(owed, self.records, stopping=stopping)
+        self.verify_processes(owed, stopping=stopping)
         if _config_stamp(owed) != owed['config_stamp']:
             raise RuntimeError(f'{_name(owed)} service configuration changed before backend stop; recovery remains owed.')
         if stopped.is_set():
             raise RuntimeError(f'{_name(owed)} backend stop was cancelled; recovery remains owed.')
         self.pause._disarm(service_entry(owed))
         wait_stopped(owed, self.records, stopped)
-        verify_processes(owed, self.records, stopping=True)
+        self.verify_processes(owed, stopping=True)
         owed['phase'] = 'stopped'
         self.save()
 
@@ -811,15 +855,15 @@ class ServiceRecovery:
             raise RuntimeError(f'{_name(entry)} legacy shutdown remains owed; no signal was replayed.')
         if _config_stamp(owed) != owed['config_stamp']:
             raise RuntimeError(f'{_name(entry)} configuration changed before legacy refresh.')
-        verify_processes(owed, self.records)
+        self.verify_processes(owed)
         verify_listener(owed)
         owed.update(legacy_refresh=True, phase='refreshing')
         self.save()  # Older readers reject this phase and retain debt; no reader replays its signal.
-        verify_processes(owed, self.records)
+        self.verify_processes(owed)
         verify_listener(owed)
         if _config_stamp(owed) != owed['config_stamp']:
             raise RuntimeError(f'{_name(owed)} configuration changed before legacy refresh.')
-        verify_processes(owed, self.records)
+        self.verify_processes(owed)
         try:
             if stopped.is_set():
                 raise InterruptedError('Legacy refresh was cancelled before interruption.')
@@ -883,6 +927,8 @@ class ServiceRecovery:
         if (_config_stamp(candidate) != entry['config_stamp']
                 or candidate.get('profile') != entry.get('profile')):
             raise RuntimeError(f'{_name(entry)} successor configuration/profile changed; recovery remains owed.')
+        if entry.get('departed_processes'):
+            candidate['departed_processes'] = entry['departed_processes']
         bind_processes(candidate, self.records)
         parents = {int(pid): p['parent'] for pid, p in candidate['processes'].items()}
         chain, pid = set(), candidate['pid']
@@ -894,7 +940,8 @@ class ServiceRecovery:
         if chain | _descendants(candidate['pid'], parents) != set(parents):
             raise RuntimeError(f'{_name(entry)} successor has unrelated descendants; recovery remains owed.')
         for pid, process in candidate['processes'].items():
-            old = entry['processes'].get(pid) or entry.get('retired_processes', {}).get(pid)
+            old = (entry['processes'].get(pid) or entry.get('departed_processes', {}).get(pid)
+                   or entry.get('retired_processes', {}).get(pid))
             if old is not None and old != process:
                 raise RuntimeError(f'{_name(entry)} successor reused a recorded process identity; recovery remains owed.')
         return candidate
@@ -966,7 +1013,7 @@ class ServiceRecovery:
                         if pending:
                             stopped.wait(.05)
                             continue
-                        if not verify_processes(entry, self.records, stopping=True, fenced=True):
+                        if not self.verify_processes(entry, stopping=True, fenced=True):
                             stopped.wait(.05)
                             continue
                         if self._gateway_writers_live(entry) or _config_stamp(entry) != entry['config_stamp']:
@@ -989,7 +1036,7 @@ class ServiceRecovery:
                 entry.update(candidate, retired_processes=retired, phase='retiring',
                              drain_acknowledged=False, drain_acknowledged_at=None, settle_attempts=attempts)
                 self.save()  # Successor custody precedes its cooperative lifecycle request.
-                verify_processes(entry, self.records)
+                self.verify_processes(entry)
                 if _config_stamp(entry) != entry['config_stamp']:
                     raise RuntimeError(f'{_name(entry)} service configuration changed; recovery remains owed.')
                 if not self.pause._ask_to_drain(entry):
@@ -1036,7 +1083,7 @@ class ServiceRecovery:
                         raise RuntimeError(f'{_name(entry)} uncommitted retirement could not yet be cancelled; recovery remains owed.')
                     self.stop(entry, threading.Event())
                 elif any(self.records.identity_is_live({'pid': int(pid), 'ct': p['ct']}) for pid, p in entry['processes'].items()):
-                    verify_processes(entry, self.records, stopping=True)
+                    self.verify_processes(entry, stopping=True)
                     if any(self.records.identity_is_live({'pid': int(pid), 'ct': p['ct']}) for pid, p in entry['processes'].items() if int(pid) != entry['service_pid']):
                         raise RuntimeError(f'{_name(entry)} still has live writer descendants; recovery remains owed.')
                     self._stop_backend_supervisor(entry, threading.Event(), stopping=True)
@@ -1062,6 +1109,18 @@ class ServiceRecovery:
                 raise RuntimeError(f'{_name(entry)} readiness is unverified at its original endpoint; recovery remains owed.')
             time.sleep(.1)
 
+    def _verify_candidate(self, candidate, entry):
+        # Readiness retries must retain both live observations and proved departures.
+        candidate['config_stamp'] = entry['config_stamp']
+        candidate['processes'] = {**candidate['processes'], **entry.get('readiness_processes', {})}
+        candidate['departed_processes'] = {**entry.get('departed_processes', {}),
+                                            **candidate.get('departed_processes', {})}
+        bind_processes(candidate, self.records)
+        entry['readiness_processes'] = candidate['processes']
+        if candidate['departed_processes']:
+            entry['departed_processes'] = candidate['departed_processes']
+        self.save()
+
     def _ready(self, entry, ledger):
         if _config_stamp(entry) != entry['config_stamp']:
             raise RuntimeError(f'{_name(entry)} service configuration changed; backend recovery remains owed.')
@@ -1075,8 +1134,9 @@ class ServiceRecovery:
             candidate = self._gateway_candidate(entry)
             if candidate is None:
                 return False
+            self._verify_candidate(candidate, entry)
             ready = _gateway_home_matches(entry['home'], (candidate['pid'], candidate['ct']), self.pause)
-            verify_processes(candidate, self.records)
+            self._verify_candidate(candidate, entry)
             return ready
         if entry.get('legacy_refresh') and any(self.records.identity_is_live({'pid': int(pid), 'ct': p['ct']})
                 for pid, p in entry['processes'].items()
@@ -1095,7 +1155,7 @@ class ServiceRecovery:
         if (candidate['profile'] != entry['profile'] or _service_key(candidate) != _service_key(entry)
                 or _config_stamp(candidate) != entry['config_stamp']):
             return False
-        bind_processes(candidate, self.records)
+        self._verify_candidate(candidate, entry)
         try:
             if entry.get('legacy_refresh'):
                 verify_listener(candidate)
@@ -1106,7 +1166,7 @@ class ServiceRecovery:
                     return False
                 if backend_request(candidate, 'cancel', permit['token']).get('ok') is not True:
                     return False
-            verify_processes(candidate, self.records)
+            self._verify_candidate(candidate, entry)
             if self.identity._pid_alive_matches(row['pid'], row['create_time'], strict=True) is not True:
                 return False
         except BackendLifecycleUnsupported:

package/sidecar/talaria_sidecar/methods/__init__.py

@@ -29,9 +29,9 @@ class Registry:
 
 def build_methods(runtime: AgentRuntime) -> dict[str, Handler]:
     registry = Registry(runtime)
-    from . import aux, chat, checkpoints, commands, config, connectors, cron, dashboard_plugins, gateway, goals, kanban, mcp, memory, oauth, plugin_oauth, process, profiles, providers, skills, state_db, stt, text, toolsets, usage, worktree, write_approval  # noqa: WPS433
+    from . import aux, chat, checkpoints, commands, config, connectors, cron, dashboard_plugins, gateway, goals, kanban, mcp, managed_buffers, memory, oauth, outbound_drafts, plugin_oauth, process, profiles, providers, skills, state_db, stt, text, toolsets, usage, worktree, write_approval  # noqa: WPS433
     from . import runtime as runtime_methods
 
-    for module in (runtime_methods, goals, commands, kanban, state_db, profiles, skills, mcp, stt, cron, providers, oauth, plugin_oauth, aux, text, process, usage, gateway, worktree, checkpoints, memory, chat, config, toolsets, write_approval, connectors, dashboard_plugins):
+    for module in (runtime_methods, goals, commands, kanban, state_db, profiles, skills, mcp, stt, cron, providers, oauth, plugin_oauth, aux, text, process, usage, gateway, worktree, checkpoints, memory, chat, config, toolsets, write_approval, connectors, dashboard_plugins, outbound_drafts, managed_buffers):
         module.register(registry)
     return registry.methods

package/sidecar/talaria_sidecar/methods/dashboard_plugins.py

@@ -190,15 +190,15 @@ def _plugins(home):
     return out
 
 
-def _named(home, name):
-    return next((p for p in _plugins(home) if p['name'] == name and p['enabled'] and p['panel']), None)
+def _named(home, name, *, require_panel=True):
+    return next((p for p in _plugins(home) if p['name'] == name and p['enabled'] and (p['panel'] if require_panel else p.get('_api_file'))), None)
 
 
 def _reply(status=404, body=b'', content_type='application/octet-stream'):
     return {'status': status, 'body': base64.b64encode(body).decode('ascii'), 'content_type': content_type}
 
 
-def _request(ctx, plugin, params):
+def _request(ctx, plugin, params, *, require_panel=True):
     ctx.check_cancelled()
     if params.get('authenticated') is not True:
         return _reply()
@@ -240,7 +240,7 @@ def _request(ctx, plugin, params):
     content_type = next((v for k, v in result.get('headers', []) if k.lower() == 'content-type'), 'application/octet-stream')
     if 'text/event-stream' in content_type.lower():
         return _reply(501, b'Agent plugin host supports buffered HTTP only', 'text/plain; charset=utf-8')
-    if _named(homes.profile_home_param(params), plugin['name']) is None:
+    if _named(homes.profile_home_param(params), plugin['name'], require_panel=require_panel) is None:
         return _reply()
     raw = result.get('body', b'')
     if not isinstance(raw, bytes) or len(raw) > _MAX_API:

package/sidecar/talaria_sidecar/methods/gateway_sessions.py

@@ -17,8 +17,9 @@ from ..errors import InvalidParams
 from ..home import profile_home_param, scoped_home
 
 _ACTIONS = {"snapshot", "watch", "context_detail", "submit", "receipt", "cancel", "steer_queued", "replace_queued", "interrupt", "approval", "clarify",
-            "clarify_lock", "discard", "mutate", "export"}
-_EXPORT_MAX_BYTES = 4 * 1024 * 1024
+            "clarify_lock", "discard", "mutate", "export", "checkpoint_diff", "terminal_info", "shell_exec", "react"}
+_OWNER_READ_MAX_BYTES = 4 * 1024 * 1024
+_REACTION_EMOJIS = {"👍", "👎", "❤️", "😂", "😮", "🎉"}
 # A restart's after-turn wait keeps the owner reachable only to finish its parked turn (the owner's
 # RESTART_WAIT_WS_METHODS); new work waits for the next owner.
 _RESTART_ACTIONS = {"snapshot", "watch", "receipt", "approval", "clarify", "clarify_lock", "interrupt"}
@@ -75,8 +76,15 @@ def _snapshot(value: dict) -> dict:
     message_keys = {"role", "content", "tool_calls", "tool_call_id", "name", "timestamp", "message_id", "row_id",
                     "reasoning", "reasoning_content", "display_kind", "finish_reason"}
     info_keys = {"title", "model", "cwd", "source", "provider", "config_warning"}
-    return {**value, "messages": [{k: v for k, v in row.items() if k in message_keys} for row in value["messages"]],
-            "info": {k: v for k, v in value["info"].items() if k in info_keys}}
+    rows = []
+    for row in value["messages"]:
+        metadata = row.get("display_metadata")
+        reactions = metadata.get("reactions", []) if isinstance(metadata, dict) else []
+        rows.append({**{k: v for k, v in row.items() if k in message_keys}, "reactions": [
+            {"author": reaction["author"], "emoji": reaction["emoji"]} for reaction in reactions
+            if isinstance(reaction, dict) and reaction.get("author") in ("user", "agent")
+            and isinstance(reaction.get("emoji"), str) and reaction["emoji"] in _REACTION_EMOJIS] if isinstance(reactions, list) else []})
+    return {**value, "messages": rows, "info": {k: v for k, v in value["info"].items() if k in info_keys}}
 
 
 def _refused(state: str, reason: str) -> dict:
@@ -120,16 +128,20 @@ def _served(home: Path, endpoint, *, allow_verified: bool = False) -> bool:
         return False
     if not allow_verified:
         return True
+    return not _verified_contract(endpoint, "served-local-policy-v1")
+
+
+def _verified_contract(endpoint, name: str) -> bool:
     # The private control socket reports the owner's boot revision, not the sidecar's
     # checkout or a version label. The authenticated describe must still match below.
     try:
         record = json.loads((Path(__file__).resolve().parents[2] / "agent_support.json").read_text())
-        revisions = record["nativeContracts"]["served-local-policy-v1"]
-        return (not isinstance(revisions, list)
-                or not all(isinstance(sha, str) and re.fullmatch(r"[0-9a-f]{40}", sha) for sha in revisions)
-                or getattr(endpoint, "code_sha", None) not in revisions)
+        revisions = record["nativeContracts"][name]
+        return (isinstance(revisions, list)
+                and all(isinstance(sha, str) and re.fullmatch(r"[0-9a-f]{40}", sha) for sha in revisions)
+                and getattr(endpoint, "code_sha", None) in revisions)
     except (OSError, ValueError, KeyError, TypeError):
-        return True
+        return False
 
 
 def _owner_refusal(described: dict, endpoint) -> dict | None:
@@ -145,12 +157,41 @@ def _owner_refusal(described: dict, endpoint) -> dict | None:
     return None
 
 
+def _checkpoint_read(value, *, no_baseline=False):
+    comparison = {"provenance": "native_owner", "baseline": "earliest_retained_project_checkpoint",
+                  "available": False, "reason": None, "truncated": False}
+    result = {"diff": "", "stat": "", "comparison": comparison}
+    reason = None
+    if not isinstance(value, dict) or type(value.get("enabled")) is not bool:
+        reason = "invalid_payload"
+    elif not value["enabled"]:
+        reason = "checkpoints_disabled"
+    elif value.get("success") is not True:
+        reason = "checkpoint_unavailable"
+    elif (not isinstance(value.get("diff"), str) or not isinstance(value.get("stat"), str)
+          or type(value.get("diff_lines")) is not int or value["diff_lines"] < 0
+          or type(value.get("empty")) is not bool):
+        reason = "invalid_payload"
+    elif sum(len(json.dumps(value[key], ensure_ascii=False).encode("utf-8", "surrogatepass")) - 2
+             for key in ("stat", "diff")) > _OWNER_READ_MAX_BYTES:
+        reason = "payload_too_large"
+    elif no_baseline:
+        reason = "no_baseline"
+    else:
+        result.update(diff=value["diff"], stat=value["stat"])
+        comparison.update(available=True, truncated=value["diff_lines"] > len(value["diff"].splitlines()))
+    comparison["reason"] = reason
+    return result
+
+
 async def _run(ctx, params: dict, home: Path, discovery) -> dict:
     from hermes_cli.gateway_client import GatewayRPCError
 
     endpoint = discovery.endpoint
     if _served(home, endpoint, allow_verified=True):
         return _refused("incompatible", "served_profile_sessions_unavailable")
+    if params["action"] in {"terminal_info", "shell_exec"} and not _verified_contract(endpoint, "captured-command-v1"):
+        return _refused("incompatible", "owner_shell_unsupported")
     restarting = discovery.state != "ready"
     if restarting and params["action"] not in _RESTART_ACTIONS:
         return _refused("refused", "gateway_restarting")
@@ -170,10 +211,22 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
             subscription = value["subscription_id"]
             if reason := await asyncio.to_thread(_control_refusal, home, sid):
                 raise GatewayRPCError(reason)
-            return _snapshot(value)
+            return {**_snapshot(value), "reactions_supported": _verified_contract(endpoint, "message-reactions-v1")}
 
         receipt = lock = None
         try:
+            if params["action"] == "checkpoint_diff":
+                # The owner resolves the physical target and frozen policy. Never resume or read host files.
+                value = await asyncio.wait_for(client.rpc("rollback.session_diff", session_id=sid, _timeout=25), timeout=30)
+                read = _checkpoint_read(value)
+                if read["comparison"]["available"] and value["empty"] and not value["diff"] and not value["stat"]:
+                    listed = await asyncio.wait_for(client.rpc("rollback.list", session_id=sid, _timeout=3), timeout=3)
+                    if (not isinstance(listed, dict) or listed.get("enabled") is not True
+                            or not isinstance(listed.get("checkpoints"), list)):
+                        read = _checkpoint_read(None)
+                    elif not listed["checkpoints"]:
+                        read = _checkpoint_read(value, no_baseline=True)
+                return {"state": "attached", "reason": None, "snapshot": None, "receipt": None, "checkpoint_diff": read}
             if params["action"] == "export":
                 # No resume/subscription or mutation: the owner selects its current physical target.
                 fmt = "md" if params["format"] == "markdown" else params["format"]
@@ -183,14 +236,34 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
                         or not isinstance(value.get("filename"), str) or not 0 < len(value["filename"]) <= 255
                         or not isinstance(value.get("content"), str)):
                     return _refused("refused", "owner_export_invalid")
-                if len(value["content"]) > _EXPORT_MAX_BYTES or len(value["content"].encode("utf-8")) > _EXPORT_MAX_BYTES:
+                if len(value["content"]) > _OWNER_READ_MAX_BYTES or len(value["content"].encode("utf-8")) > _OWNER_READ_MAX_BYTES:
                     return _refused("refused", "export_too_large")
                 return {"state": "attached", "reason": None, "snapshot": None, "receipt": None,
                         "export": {"format": params["format"], "filename": value["filename"], "content": value["content"]}}
             snap = await snapshot()
             action = params["action"]
             common = {"session_id": sid}
-            if action == "context_detail":
+            if action == "terminal_info":
+                return {"state": "attached", "reason": None, "snapshot": snap, "receipt": None}
+            if action == "shell_exec":
+                if (snap.get("session_id") != params["session_id"] or snap.get("authority_epoch") != params["authority_epoch"]
+                        or snap.get("replay_epoch") != params["replay_epoch"]):
+                    return _refused("refused", "owner_changed")
+                # The native owner alone authorizes the frozen backend/cwd and redacts before bounding.
+                # No second observation may discard a received result; no retry after an unknown ACK.
+                value = await client.rpc("shell.exec", **common, command=params["command"], _timeout=35)
+                if (not isinstance(value, dict) or not isinstance(value.get("stdout"), str)
+                        or not isinstance(value.get("stderr"), str) or type(value.get("code")) is not int
+                        or len(value["stdout"]) > 4000 or len(value["stderr"]) > 2000):
+                    return _refused("refused", "owner_shell_invalid")
+                return {"state": "attached", "reason": None, "snapshot": None, "receipt": None, "shell": value}
+            if action == "react":
+                if not snap["reactions_supported"]:
+                    return _refused("refused", "owner_reactions_unsupported")
+                if not any(row.get("row_id") == params["row_id"] and row.get("role") in {"user", "assistant"} for row in snap["messages"]):
+                    return _refused("refused", "reaction_row_unavailable")
+                await client.rpc("message.react", **common, row_id=params["row_id"], emoji=params["emoji"], author="user")
+            elif action == "context_detail":
                 from ..context_detail import project, unavailable
                 # The authorized native read owns lookup and prompt interpretation. No local Agent is built.
                 try:
@@ -264,16 +337,22 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
             ctx.emit("replay_complete", {})
             checked = asyncio.get_running_loop().time()
             while not ctx.cancelled:
+                now = asyncio.get_running_loop().time()
+                if not restarting and now - checked >= 2:
+                    checked = now
+                    if restarting := await asyncio.to_thread(_restart_wait, home):
+                        result["restarting"] = True
+                        ctx.emit("restarting", {"restarting": True})
+                    if not restarting and snap.get("reactions_supported"):
+                        # The owner emits no reaction event. Read through this viewer's existing subscription,
+                        # including while tokens keep the event queue busy.
+                        current = await snapshot()
+                        if [(r.get("row_id"), r.get("reactions")) for r in current["messages"] if r.get("reactions")] != [(r.get("row_id"), r.get("reactions")) for r in snap["messages"] if r.get("reactions")]:
+                            ctx.emit("snapshot", {**result, "snapshot": current, "reaction_only": True})
+                        snap = current
                 try:
                     frame = await asyncio.wait_for(events.get(), .25)
                 except TimeoutError:
-                    now = asyncio.get_running_loop().time()
-                    if not restarting and now - checked >= 2:
-                        checked = now
-                        # One-way for this owner: its next state is exit, which ends the watch.
-                        if restarting := await asyncio.to_thread(_restart_wait, home):
-                            result["restarting"] = True
-                            ctx.emit("restarting", {"restarting": True})
                     continue
                 if isinstance(frame, Exception):
                     raise frame
@@ -310,6 +389,8 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
                 ctx.emit("event", event)
             return result
         except GatewayRPCError as exc:
+            if params["action"] == "react" and str(exc) not in {"invalid_params", "not_found", "permission_denied", "profile_mismatch"}:
+                return _refused("unavailable", "reaction_outcome_unknown")
             if params["action"] == "export":
                 return _refused("refused", "export_too_large" if str(exc) == "export_too_large" else "owner_export_unsupported")
             return {**_refused("incompatible" if str(exc) in _CONTROL_REFUSALS else "refused", str(exc)), "receipt": receipt}
@@ -330,9 +411,18 @@ def session(ctx, params: dict) -> dict:
     if action not in _ACTIONS or not isinstance(sid, str) or not sid.strip() or sid != sid.strip():
         raise InvalidParams("session_id and supported action are required")
     params = {**params, "action": action}
+    if action == "react" and (set(params) - {"profile_home", "session_id", "action", "row_id", "emoji"}
+                              or type(params.get("row_id")) is not int or params["row_id"] <= 0
+                              or "emoji" not in params or (params["emoji"] is not None and (not isinstance(params["emoji"], str) or params["emoji"] not in _REACTION_EMOJIS))):
+        raise InvalidParams("react requires a visible row and an allowed emoji")
     if action == "export" and (params.get("format") not in ("json", "markdown", "html")
                                or not isinstance(params.get("redact"), bool)):
         raise InvalidParams("export requires an allowed format and redaction policy")
+    if action == "shell_exec" and (not isinstance(params.get("command"), str)
+            or not params["command"].strip() or len(params["command"]) > 8192
+            or type(params.get("authority_epoch")) is not int or params["authority_epoch"] < 0
+            or not isinstance(params.get("replay_epoch"), str) or not params["replay_epoch"]):
+        raise InvalidParams("captured command requires command and owner identity")
     required = {
         "submit": ("request_id", "text"), "receipt": ("admission_id",), "cancel": ("admission_id",),
         "steer_queued": ("admission_id",), "replace_queued": ("admission_id", "submission_id", "text"),

package/sidecar/talaria_sidecar/methods/kanban.py

@@ -10,8 +10,11 @@ from __future__ import annotations
 import functools
 import json
 import secrets
+import sqlite3
 import time
+from contextlib import closing
 from dataclasses import asdict, is_dataclass
+from pathlib import Path
 from typing import Any, NamedTuple
 
 from ..errors import InvalidParams, RpcError
@@ -463,6 +466,50 @@ def _bool(params: dict, key: str, default: bool = False) -> bool:
 
 # ── payload builders ──────────────────────────────────────────────────────
 
+def inspection_payload(params: dict) -> dict:
+    """Read only the selected profile's live boards, with shared global row/edge budgets."""
+    kb = _kb()
+    selected = _board(params)
+    boards = sorted((b for b in kb.list_boards(include_archived=False) if not b.get("archived")), key=lambda b: b["slug"])
+    if selected is not None:
+        boards = [b for b in boards if b["slug"] == selected]
+        if not boards:
+            raise NotFound("board not found")
+    nodes, edges = [], []
+    truncated = len(boards) > 32
+    for meta in boards[:32]:
+        slug = _normalize_existing_slug(meta["slug"])
+        if len(nodes) >= 500:
+            truncated = True
+            break
+        # An inspection must never initialize a missing database or run migrations.
+        uri = Path(kb.kanban_db_path(slug)).resolve().as_uri() + "?mode=ro"
+        with closing(sqlite3.connect(uri, uri=True)) as conn:
+            conn.row_factory = sqlite3.Row
+            conn.execute("BEGIN")
+            where = "" if _bool(params, "include_archived") else "WHERE t.status != 'archived'"
+            rows = conn.execute(
+                f"SELECT t.*, r.started_at AS current_run_started_at FROM tasks t LEFT JOIN task_runs r ON r.id = t.current_run_id {where} ORDER BY t.id LIMIT ?",
+                (501 - len(nodes),),
+            ).fetchall()
+            remaining = 500 - len(nodes)
+            truncated = truncated or len(rows) > remaining
+            rows = rows[:remaining]
+            ids = [row["id"] for row in rows]
+            for row in rows:
+                task = _task_dict(dict(row), conn)
+                nodes.append({"key": f"{slug}/{row['id']}", "board": slug, "board_name": meta.get("name") or slug, "task": task})
+            if ids:
+                placeholders = ",".join("?" for _ in ids)
+                links = conn.execute(
+                    f"SELECT parent_id, child_id FROM task_links WHERE parent_id IN ({placeholders}) AND child_id IN ({placeholders}) ORDER BY parent_id, child_id LIMIT ?",
+                    [*ids, *ids, 2001 - len(edges)],
+                ).fetchall()
+                remaining_edges = 2000 - len(edges)
+                truncated = truncated or len(links) > remaining_edges
+                edges.extend({"source": f"{slug}/{r['parent_id']}", "target": f"{slug}/{r['child_id']}"} for r in links[:remaining_edges])
+    return {"nodes": nodes, "edges": edges, "generated_at": time.time(), "truncated": truncated, "read_only": False}
+
 def board_payload(params: dict) -> dict:
     board = _board(params)
     kb = _kb()
@@ -852,6 +899,7 @@ def normalize_board_payload(params: dict) -> dict:
 
 
 METHODS = {
+    "kanban.inspection": inspection_payload,
     "kanban.normalize_board": normalize_board_payload,
     "kanban.board": board_payload,
     "kanban.boards": list_boards_payload,