@maudecode/talaria-web 1.20.0 → 1.22.0

package/sidecar/talaria_sidecar/methods/mcp.py

@@ -6,6 +6,8 @@ Config edits and health probes live in the server; this namespace only reads
 
 from __future__ import annotations
 
+import hashlib
+import json
 import logging
 
 from ..home import profile_home_param, scoped_home
@@ -48,7 +50,60 @@ def registry_tools() -> list[dict]:
     return out
 
 
+def cost_policies(servers: dict) -> dict:
+    """Read declarations using the native parser; inspect cached packages without discovering or connecting."""
+    try:
+        from tools.mcp_tool_costs import CONFIG_KEYS, _parse_cost, config_cost_policy
+        from hermes_cli.plugins import get_plugin_manager
+
+        portable = get_plugin_manager().get_portable_mcp_servers()
+    except (ImportError, AttributeError):
+        return {"supported": False, "policies": []}
+    rows = []
+    for name in sorted(servers.keys() | portable.keys()):
+        native, package = servers.get(name), portable.get(name, {})
+        if not isinstance(package, dict):
+            package = {}
+        editable = isinstance(native, dict) and ("command" in native or "url" in native)
+        own = {k: native[k] for k in CONFIG_KEYS if isinstance(native, dict) and k in native}
+        # The native loader rejects a malformed package before it can donate inherited keys.
+        if native is not None:
+            try:
+                config_cost_policy(name, package)
+            except (ValueError, TypeError):
+                package = {}
+        inherited = {k: package[k] for k in CONFIG_KEYS if k in package}
+        effective = {**inherited, **own}
+        sources = {k: "native" if k in own else "package" if k in inherited else "default" for k in CONFIG_KEYS}
+        row = {"name": name, "source": "native_override" if native is not None and package else "native" if native is not None else "package",
+               "valid": True, "can_edit": editable, "error": None,
+               "package_revision": hashlib.sha256(json.dumps(inherited, sort_keys=True, default=str).encode()).hexdigest(),
+               "overrides": {"tool_costs": None, "spend_limit": None, "cost_unit": None},
+               "tool_costs": [], "spend_limit": 0, "cost_unit": "credits", "budget_enabled": False, "field_sources": sources}
+        try:
+            # Validate the native entry separately as the Agent does before package inheritance.
+            config_cost_policy(name, own)
+            policy = config_cost_policy(name, effective)
+            costs = effective.get("tool_costs") or {}
+            row["tool_costs"] = [{"name": tool, "low": cost.low, "high": cost.high, "note": cost.note}
+                                 for tool, value in costs.items() for cost in [_parse_cost(value, "declared cost")]]
+            row["spend_limit"] = effective.get("spend_limit") or 0
+            row["cost_unit"] = (effective.get("cost_unit") or "credits").strip()
+            row["budget_enabled"] = policy is not None and policy.limit > 0
+            row["overrides"] = {k: own.get(k) for k in CONFIG_KEYS}
+        except (ValueError, TypeError):
+            # Native errors may quote arbitrary config values, including mistakenly pasted credentials.
+            row.update(valid=False, error="Invalid declared cost policy. Check tool estimates, limit and unit.")
+        rows.append(row)
+    return {"supported": True, "policies": rows}
+
+
 def register(registry_) -> None:
+    @registry_.method("mcp.cost_policies")
+    def policies(ctx: CallContext, params: dict) -> dict:
+        with scoped_home(profile_home_param(params), load_plugins=False):
+            return cost_policies(params.get("servers") or {})
+
     @registry_.method("mcp.status")
     def status_(ctx: CallContext, params: dict) -> dict:
         with scoped_home(profile_home_param(params)):

package/sidecar/talaria_sidecar/methods/memory.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from contextlib import contextmanager
 import errno
 import hashlib
 import os
@@ -45,22 +46,45 @@ def _digest(path: Path) -> str | None:
         return hashlib.sha256(handle.read()).hexdigest()
 
 
+@contextmanager
+def file_lock(path: Path, *, parent_fd=None):
+    """The native memory lock, with an anchored opening for descriptor-relative publishers."""
+    if parent_fd is None:
+        from tools.memory_tool_store import MemoryStore
+        native = getattr(MemoryStore, '_file_lock', None)
+        with native(path) if native else _SAVE_LOCK:
+            yield
+        return
+    import fcntl
+    # Same persistent .lock inode and flock protocol as MemoryStore._file_lock; never re-resolve its parent.
+    with _SAVE_LOCK:
+        fd = os.open(path.name + '.lock', os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600, dir_fd=parent_fd)
+        with os.fdopen(fd, 'r+') as lock:
+            info = os.fstat(lock.fileno())
+            if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:
+                raise OSError('Unsafe memory lock')
+            os.fchmod(lock.fileno(), 0o600)
+            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(lock.fileno(), fcntl.LOCK_UN)
+
+
 def write(home: Path, section: str, base: str, content: str) -> dict:
     """Replace ``section``'s file with ``content`` only while its bytes still hash to ``base``, the server's read.
 
     Each file is checked and written under the Agent's own per-file lock (``<file>.lock``), so neither a memory tool
     call nor a concurrent save can land between the two; an Agent without the lock helper gets this sidecar's lock.
     """
-    from tools.memory_tool_store import MemoryStore
     from utils import atomic_write_text
 
     if section not in ("memory", "user", "soul"):
         raise InvalidParams("section must be memory, user, or soul")
     # The files the server read: SOUL.md in the profile home, MEMORY.md / USER.md in its memories folder.
     path = home / "SOUL.md" if section == "soul" else home / "memories" / ("USER.md" if section == "user" else "MEMORY.md")
-    file_lock = getattr(MemoryStore, "_file_lock", None)
     try:
-        with file_lock(path) if file_lock else _SAVE_LOCK:
+        with file_lock(path):
             if _digest(path) != base:
                 return {"written": False}
             atomic_write_text(path, content, tmp_prefix=".mem_", preserve_mode=True)

package/sidecar/talaria_sidecar/methods/nous_account.py

@@ -0,0 +1,130 @@
+"""Safe, read-only account/handoff projection shared by OAuth and provider status.
+
+The Agent owns the record and retry worker. This bounded display cache only retains a
+confirmed view across read failures, keyed by the current profile and account.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+import threading
+from collections import OrderedDict
+from pathlib import Path
+from typing import Any
+
+_LAST: OrderedDict[str, dict] = OrderedDict()
+_LOCK = threading.RLock()
+_STATES = {"idle", "pending", "retrying", "claimed", "gone", "failed", "paused"}
+_ERRORS = {"client_not_allowed", "account_locked", "invalid_request", "retry_window_ended"}
+
+
+def _identity(home: Path) -> tuple[str, str | None] | None:
+    from hermes_cli.anon_auth import is_guest_state
+    from hermes_cli.auth import get_provider_auth_state
+
+    state = get_provider_auth_state("nous")
+    if not isinstance(state, dict) or is_guest_state(state):
+        return None
+    return _token_identity(home, state.get("access_token"))
+
+
+def _token_identity(home: Path, token: Any) -> tuple[str, str | None] | None:
+    from hermes_cli.auth_constants import _decode_jwt_claims
+
+    claims = _decode_jwt_claims(token)
+    subject = claims.get("sub")
+    if not isinstance(subject, str) or not subject:
+        return None
+    identity = hashlib.sha256(f"{home.resolve()}\0{subject}".encode()).hexdigest()
+    email = claims.get("email")
+    if not isinstance(email, str) or not re.fullmatch(r"[^@\s]+@[^@\s]+\.[^@\s]+", email) or len(email) > 254:
+        return identity, None
+    local, domain = email.rsplit("@", 1)
+    return identity, f"{local[0]}***@{domain}"
+
+
+def _apps(value: Any) -> list[str]:
+    if not isinstance(value, (list, tuple)):
+        return []
+    return list(dict.fromkeys(v for v in value[:100] if isinstance(v, str) and re.fullmatch(r"[a-z0-9][a-z0-9_-]{0,63}", v)))
+
+
+def read(home: Path, completed: Any = None) -> dict | None:
+    """One sequential read owner for flow/provider consumers, called under scoped_home."""
+    with _LOCK:
+        return _read(home, completed)
+
+
+def _read(home: Path, completed: Any = None) -> dict | None:
+    """No provisioning, refresh, drain, or retry dispatch."""
+    try:
+        from hermes_cli import guest_handoff as native
+    except ImportError:
+        return None  # older Agents keep generic success
+    try:
+        identity = _identity(home)
+    except Exception:  # no current identity proof means no cached account may be displayed
+        return None
+    if identity is None:
+        return None
+    account_id, email = identity
+    try:
+        status = native.handoff_status()
+        if status.get("state") == "idle" and completed is not None:
+            status = getattr(completed, "handoff_status", None) or status
+        state = status.get("state") if status.get("state") in _STATES else "unknown"
+        # The public native read only fences *active* records. Prove terminal ownership
+        # with the same native selector/binding helper before exposing any old app names.
+        if state not in {"idle", "unknown", "paused"}:
+            records = native._load(native._records_path())["records"].values()
+            mine = [r for r in records if native._home_key() in r.get("profiles", ())]
+            record = max(mine, key=lambda r: str(r.get("updated_at") or "")) if mine else None
+            if record is not None and native._status_of(record) != status:
+                raise RuntimeError("Native handoff changed during read")
+            if record is None or native._account_bound_to(record) is None:
+                state = "paused" if record else "unknown"
+        safe = {"state": state, "account_email": email,
+                "connectors_kind": status.get("connectors_kind") if status.get("connectors_kind") in {"moved", "swapped", "none", "conflict"} else None,
+                "moved_toolkits": _apps(status.get("moved_toolkits")) if state == "claimed" else [],
+                "dropped_toolkits": _apps(status.get("dropped_toolkits")) if state == "claimed" else [],
+                "probably_moved": status.get("probably_moved") is True,
+                "error": status.get("error") if status.get("error") in _ERRORS else None}
+        lines = native.wire_status(safe)["lines"] if state != "unknown" else ["Connected-app transfer status is unknown."]
+        if _identity(home) != identity:
+            return None
+        view = {"account_id": account_id, "email": email, "state": state, "lines": lines,
+                "moved": safe["moved_toolkits"], "dropped": safe["dropped_toolkits"],
+                "reconnect": safe["dropped_toolkits"],
+                "poll_after": 5 if state in {"pending", "retrying", "unavailable"} else None}
+        with _LOCK:
+            _LAST[account_id] = view
+            _LAST.move_to_end(account_id)
+            while len(_LAST) > 32:
+                _LAST.popitem(last=False)
+        return view
+    except Exception:  # raw native records and exception details never cross this boundary
+        try:
+            if _identity(home) != identity:
+                return None
+        except Exception:
+            return None
+        with _LOCK:
+            previous = _LAST.get(account_id)
+        return {**(previous or {"account_id": account_id, "email": email, "moved": [], "dropped": [], "lines": []}),
+                "state": "unavailable", "reconnect": [], "poll_after": 5,
+                "lines": [*(previous or {}).get("lines", []), "Connected-app transfer status is unavailable."]}
+
+
+def connector_headers(home: Path, account_id: str, url: str) -> dict:
+    """The native connector client reads this on every request, never provisioning or refreshing."""
+    from tools.managed_gateway_auth import managed_gateway_auth_headers
+    from tools.managed_tool_gateway import peek_nous_access_token
+
+    def token():
+        value = peek_nous_access_token()
+        current, bearer = _identity(home), _token_identity(home, value)
+        if current is None or bearer is None or current[0] != account_id or bearer[0] != account_id:
+            return None
+        return value
+
+    return managed_gateway_auth_headers(url, token_reader=token)

package/sidecar/talaria_sidecar/methods/oauth.py

@@ -26,7 +26,7 @@ from typing import Any, Callable
 from ..errors import InvalidParams, RpcError
 from ..home import profile_home_param, scoped_home
 from ..rpc import CallContext
-from . import plugin_oauth
+from . import plugin_oauth, nous_account
 
 log = logging.getLogger("talaria_sidecar.oauth")
 
@@ -65,6 +65,7 @@ class Flow:
     # The credential is saved but the sign-in has not finished (a guest sign-in still settles the account): a cancel or
     # an expiry can no longer undo it, and the flow stays pending until its own ending.
     committed: bool = False
+    nous_account_id: str | None = None
     # A browser sign-in also finishes from the redirect address the user pastes (``oauth.submit_redirect``).
     submit: Callable[[str], None] | None = None
     # Set once a browser sign-in's loopback listener is closed, so a replacing start can bind the same fixed port.
@@ -78,7 +79,12 @@ class Flow:
         self.status, self.error, self.ended_at = status, error, time.time()
 
     def view(self) -> dict:
-        return {"flow_id": self.flow_id, "provider": self.provider, "status": self.status, "error": self.error}
+        view = {"flow_id": self.flow_id, "provider": self.provider, "status": self.status, "error": self.error}
+        if self.status == "approved" and self.nous_account_id:
+            with scoped_home(self.home):
+                account = nous_account.read(self.home)
+            view["nous_account"] = account if account and account["account_id"] == self.nous_account_id else None
+        return view
 
 
 class _Watched:
@@ -156,6 +162,9 @@ def _nous_begin() -> tuple[dict, dict]:
 
     # v0.22.0 replaced ``guest_enabled`` with ``guest_allowed``; 0.21.x releases only have the former.
     guest_gate = getattr(anon_auth, "guest_allowed", None) or getattr(anon_auth, "guest_enabled")
+    native = getattr(anon_auth, "run_sign_in", None)
+    if native and "replace_account" in inspect.signature(native).parameters:
+        return _nous_sign_in(anon_auth)
     if guest_gate() and anon_auth.has_guest():
         # The native sign-in owns the guest's connector handoff for its installed protocol.
         if hasattr(anon_auth, "run_sign_in"):
@@ -191,6 +200,9 @@ def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
             yield may_persist
             if may_persist:
                 flow.committed = True
+                # Bind before native handoff/settlement releases this account to another sign-in.
+                account = nous_account.read(flow.home)
+                state["nous_account_id"] = account["account_id"] if account else None
 
     def scope():
         flow = state.get("flow")
@@ -198,11 +210,13 @@ def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
 
     # Older Agents use promotion; v0.22.5 removed its option in favor of plain device login and native handoff.
     options = {"cancel_wins_after_promotion": True} if "cancel_wins_after_promotion" in inspect.signature(anon_auth.run_sign_in).parameters else {}
+    if "replace_account" in inspect.signature(anon_auth.run_sign_in).parameters:
+        options["replace_account"] = True
     sign_in = anon_auth.run_sign_in(cancelled=cancelled, persist_guard=persist_guard, scope=scope, **options)
     first = next(sign_in)
     if first.kind != "code":
         sign_in.close()
-        raise RpcError(first.copy_terminal, condition="oauth_unsupported" if first.precondition else "oauth_failed")
+        raise RpcError(first.copy, condition="oauth_unsupported" if first.precondition else "oauth_failed")
     state["sign_in"] = sign_in
     return {"user_code": first.code, "verification_url": first.link, "expires_in": first.expires_in, "interval": first.interval}, state
 
@@ -226,6 +240,8 @@ def _nous_wait(flow: Flow, state: dict) -> dict:
             sign_in.close()
         if not ended.ok:
             raise _SignInEnded(ended)
+        with scoped_home(flow.home):
+            nous_account.read(flow.home, ended)
         return {}
     from hermes_cli.auth import _poll_for_token
 
@@ -406,6 +422,7 @@ def _run(flow: Flow, wait: Callable[[Flow, dict], dict], save: Callable[[Flow, d
                 return
             with scoped_home(flow.home):
                 save(flow, state, tokens)
+            flow.nous_account_id = state.get("nous_account_id")
             flow.end("approved")
         log.info("oauth: %s sign-in approved (flow=%s)", flow.provider, flow.flow_id[:6])
     except _Stop:
@@ -556,7 +573,11 @@ def register(reg) -> None:
 
     @reg.method("oauth.poll", requires_agent=False)
     def poll_(ctx: CallContext, params: dict) -> dict:
-        return poll(profile_home_param(params), _flow_id(params))
+        home, flow_id = profile_home_param(params), _flow_id(params)
+        flow = _flow(home, flow_id)
+        if flow.status == "approved" and flow.nous_account_id:
+            reg.runtime.ensure_current()  # a retired worker cannot promise background progress
+        return poll(home, flow_id)
 
     @reg.method("oauth.cancel", requires_agent=False)
     def cancel_(ctx: CallContext, params: dict) -> dict:

package/sidecar/talaria_sidecar/methods/outbound_drafts.py

@@ -0,0 +1,147 @@
+"""Typed adapter for the reviewed Draft Cards store. Never imports producer code or sends."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+import json
+from pathlib import Path
+import re
+import sqlite3
+import time
+from contextlib import closing
+
+from .. import home as homes
+from ..errors import InvalidParams, RpcError
+from . import dashboard_plugins
+
+_KEY = secrets.token_bytes(32)
+_PIN = '6e6ca659ece59b0ce1c28b3b188393491ee5a415'
+_SOURCES = {'__init__.py': '73388811ddc4f7cfc336c2a278dad9c0c032b0b15e4183ce8a157e61ce13695b',
+            'plugin.yaml': 'e2a8a92847f4519f1636ec542ae2b1599050d9552fb9a61d9c6d6afaca83d6eb',
+            'dashboard/manifest.json': '14e906a0e492669f0950e091f42d98ad607486dbea524b2a8e8691faa2139941',
+            'dashboard/plugin_api.py': '98e38f618c23ec266f1e171a958ffcf048339ea3c7876d1faa2d0b8910839336',
+            'store.py': '5815d4b106082b7f51d1b7e9d239fc655fa247a5e61ff7465e8c1865476eaaf6',
+            'tools.py': '29271409488efc39206a048dc2852effc156d9ca5d91721632e1219840f14db1'}
+_STATES = {'draft', 'approved', 'sent', 'saved', 'failed', 'discarded'}
+
+
+def _producer(home):
+    return dashboard_plugins.reviewed_producer(home, 'draft-cards', _PIN, _SOURCES)
+
+
+def _database(home):
+    """Only the producer's existing profile-local database; never creates storage on a read."""
+    path = Path(home) / 'plugin-data' / 'draft-cards' / 'drafts.db'
+    # No caller supplies a filesystem path, and no symlink may redirect native state.
+    for parent in [path, *path.parents]:
+        if parent.is_symlink():
+            raise OSError('Symlink in draft storage')
+    if not path.is_file():
+        raise OSError('Draft storage unavailable')
+    connection = sqlite3.connect(path.as_uri() + '?mode=rw', uri=True, timeout=5)
+    connection.row_factory = sqlite3.Row
+    return connection
+
+
+def _fields(value):
+    if not isinstance(value, dict) or set(value) != {'from', 'to', 'cc', 'bcc', 'subject', 'body'}:
+        raise InvalidParams('Invalid draft fields')
+    for key, limit in [('from', 320), ('subject', 300), ('body', 20_000)]:
+        if not isinstance(value[key], str) or len(value[key]) > limit or '\x00' in value[key]:
+            raise InvalidParams('Invalid draft fields')
+    for key in ('to', 'cc', 'bcc'):
+        if not isinstance(value[key], list) or len(value[key]) > 50 or any(
+                not isinstance(item, str) or len(item) > 320 or re.search(r'[\r\n\x00]', item) for item in value[key]):
+            raise InvalidParams('Invalid draft recipients')
+    if not value['body'].strip():
+        raise InvalidParams('A draft body is required')
+    return value
+
+
+def _snapshot(conn, home, params, producer):
+    row = conn.execute('SELECT * FROM drafts WHERE id = ?', (params['draft_id'],)).fetchone()
+    if row is None or not row['session_id'] or row['session_id'] != params['session_id']:
+        return None
+    versions = conn.execute('SELECT * FROM versions WHERE draft_id = ? ORDER BY v LIMIT 61', (params['draft_id'],)).fetchall()
+    if not versions or len(versions) > 60 or row['kind'] not in ('email', 'message') or row['status'] not in _STATES:
+        return None
+    matches = [v for v in versions if v['card'] == params['card']]
+    if not matches:
+        return None
+    selected, latest = matches[-1], versions[-1]
+    fields = _fields(json.loads(selected['fields']))
+    state = row['status'] if selected['v'] == latest['v'] else 'superseded'
+    if state == 'approved' and row['approved_version'] != latest['v']:
+        state = 'unavailable'
+    consumed = False
+    if conn.execute("SELECT 1 FROM sqlite_master WHERE type='table' AND name='talaria_outbound_approvals'").fetchone():
+        consumed = conn.execute('SELECT 1 FROM talaria_outbound_approvals WHERE draft_id = ? AND version = ?',
+                                (row['id'], selected['v'])).fetchone() is not None
+    revision = hmac.new(_KEY, json.dumps([str(home), producer, dict(row), [dict(v) for v in versions], consumed],
+                                        sort_keys=True, separators=(',', ':')).encode(), hashlib.sha256).hexdigest()
+    editable = state in ('draft', 'failed', 'approved')
+    return {'producer': 'draft-cards', 'producer_revision': producer, 'draft_id': row['id'], 'card': selected['card'],
+            'kind': row['kind'], 'platform': str(row['platform'])[:40], 'version': selected['v'], 'revision': revision,
+            'fields': fields, 'state': state, 'can_edit': editable, 'can_approve': state in ('draft', 'failed') and not consumed,
+            'masked': False}
+
+
+def _conflict():
+    raise RpcError('The draft changed or this version was already approved. Review it again.', condition='outbound_draft_conflict')
+
+
+def review(ctx, params):
+    ctx.check_cancelled()
+    action = params.get('action')
+    if (action not in ('read', 'edit', 'approve') or not isinstance(params.get('draft_id'), str)
+            or not re.fullmatch(r'd_[0-9a-f]{8}', params['draft_id']) or type(params.get('card')) is not int
+            or params['card'] < 1 or not isinstance(params.get('session_id'), str) or not params['session_id']):
+        raise InvalidParams('Invalid outbound draft reference')
+    home = homes.profile_home_param(params)
+    with homes.scoped_home(home, load_plugins=False):
+        producer = _producer(home)
+        if producer is None:
+            if action != 'read':
+                _conflict()
+            return {'draft': None}
+        try:
+            with closing(_database(home)) as conn, conn:
+                # The native tool writers share this database lock. Check and mutation have one snapshot.
+                conn.execute('BEGIN IMMEDIATE' if action != 'read' else 'BEGIN')
+                draft = _snapshot(conn, home, params, producer)
+                if action == 'read':
+                    ctx.check_cancelled()
+                    return {'draft': draft if _producer(home) == producer else None}
+                if (draft is None or params.get('version') != draft['version'] or params.get('revision') != draft['revision']
+                        or not draft['can_' + action] or _producer(home) != producer):
+                    _conflict()
+                now = time.time()
+                if action == 'edit':
+                    fields = _fields(params.get('fields'))
+                    if fields == draft['fields']:
+                        return {'draft': draft}
+                    if conn.execute('SELECT count(*) FROM versions WHERE draft_id = ?', (draft['draft_id'],)).fetchone()[0] >= 60:
+                        _conflict()
+                    conn.execute("INSERT INTO versions (draft_id,v,card,author,note,fields,created_at) VALUES (?,?,?,'user','Edited in Talaria',?,?)",
+                                 (draft['draft_id'], draft['version'] + 1, draft['card'], json.dumps(fields, ensure_ascii=False), now))
+                    conn.execute("UPDATE drafts SET status='draft', approved_version=NULL, status_detail='', status_at=?, updated_at=? WHERE id=?",
+                                 (now, now, draft['draft_id']))
+                else:
+                    # Additive native-store state: Stable producer readers ignore this per-version receipt.
+                    conn.execute('CREATE TABLE IF NOT EXISTS talaria_outbound_approvals (draft_id TEXT NOT NULL, version INTEGER NOT NULL, revision TEXT NOT NULL, PRIMARY KEY(draft_id,version))')
+                    conn.execute('INSERT INTO talaria_outbound_approvals VALUES (?,?,?)', (draft['draft_id'], draft['version'], draft['revision']))
+                    conn.execute("UPDATE drafts SET status='approved', approved_version=?, status_detail='', status_at=?, updated_at=? WHERE id=?",
+                                 (draft['version'], now, now, draft['draft_id']))
+                ctx.check_cancelled()
+                if _producer(home) != producer:
+                    _conflict()
+                return {'draft': _snapshot(conn, home, params, producer)}
+        except (OSError, sqlite3.Error, ValueError, KeyError, TypeError, InvalidParams) as exc:
+            if action != 'read':
+                raise RpcError('Draft outcome unconfirmed; read its state before trying again.', condition='outbound_draft_unconfirmed') from exc
+            return {'draft': None}
+
+
+def register(registry):
+    registry.method('drafts.review')(review)

package/sidecar/talaria_sidecar/methods/plugin_catalog.py

@@ -27,9 +27,14 @@ def _agent():
         return None
 
 
-def _refusal(entry, pc, native):
+def _refusal(entry, pc, native, *, removed_entries=None):
     try:
-        native.raise_if_removed(entry.name, entry.repo)
+        if removed_entries is None:
+            native.raise_if_removed(entry.name, entry.repo)
+        else:
+            from hermes_cli.plugin_catalog import match_removed
+            if any(match_removed(value, removed_entries) for value in (entry.name, entry.repo)):
+                return 'This plugin was removed from the catalog.'
         native._refuse_unsupported_catalog_platform(entry)
         from hermes_cli.plugins_manifest import requires_hermes_error
         reason = requires_hermes_error({'requires_hermes': entry.requires_hermes})
@@ -196,3 +201,69 @@ def install(name, consent_token=None):
             del _receipts[next(iter(_receipts))]
         _receipts[token] = {'identity': identity, 'preview': preview, 'expires': time.monotonic() + 300}
     return {'name': name, 'status': 'needs_consent', 'findings': findings, 'consent_token': token}
+
+
+def reviewed_importer(home):
+    """Load only attested native structured APIs, sharing catalog identity and enablement policy."""
+    import sys
+    import types
+    from . import dashboard_plugins
+    reviewed = json.loads((Path(__file__).parents[2] / 'agent_importer.json').read_text())
+    pin, hashes = reviewed['revision'], reviewed['files']
+    # Older Agent config imports initialize files. Check the pure in-tree catalog before importing their command owner.
+    try:
+        from hermes_cli import plugin_catalog as source
+        entry = next((e for e in source.load_catalog() if e.name == 'agent-importers'), None)
+        if entry is None or entry.sha != pin:
+            return None
+    except (ImportError, AttributeError, OSError, ValueError):
+        return None
+    agent = _agent()
+    if agent is None or not dashboard_plugins._supported():
+        return None
+    source, pc, native = agent
+    try:
+        from pm.workspace import enabled_plugin_dirs
+        from hermes_cli.web_server_dashboard import _plugin_enable_sets_here
+        enabled, disabled = _plugin_enable_sets_here()
+        if not (Path(home) / 'plugins').is_dir():
+            return None
+        metadata = pc._read_install_metadata()
+        matches = [(key, record) for key, record in metadata.items() if isinstance(record, dict)
+                   and isinstance(record.get('catalog'), dict) and record['catalog'].get('name') == 'agent-importers']
+        if len(matches) != 1:
+            return None
+        key, record = matches[0]
+        root = pc._sanitize_plugin_name(key, Path(home) / 'plugins')
+        # Admission must not fetch or populate the profile's live catalog cache on a preview.
+        cached = dashboard_plugins._read(Path(home), 'cache/plugin-catalog.json', 4 * 1024 * 1024, anchor=Path(home))
+        if cached is None and ((Path(home) / 'cache/plugin-catalog.json').exists() or (Path(home) / 'cache/plugin-catalog.json').is_symlink()):
+            return None
+        cached = json.loads(cached) if cached is not None else {}
+        if not isinstance(cached, dict) or not isinstance(cached.get('entries', []), list):
+            return None
+        if any(e.get('name') == 'agent-importers' and e.get('sha') != pin for e in cached.get('entries', []) if isinstance(e, dict)):
+            return None
+        removed = source.load_removed_list() + source._removed_from_list(cached.get('removed'))
+        if (entry is None or entry.sha != pin or _refusal(entry, pc, native, removed_entries=removed)
+                or record.get('revision') != pin or record['catalog'].get('sha') != pin
+                or record['catalog'].get('repo') != entry.repo
+                or key not in enabled or key in disabled or root.resolve() not in {p.resolve() for p in enabled_plugin_dirs()}):
+            return None
+        bodies = {name: dashboard_plugins._read(root, name, anchor=Path(home)) for name in hashes}
+        if any(body is None or hashlib.sha256(body).hexdigest() != hashes[name] for name, body in bodies.items()):
+            return None
+        # Compile verified bytes, never re-open a mutable plugin path or execute its entry point.
+        package = '_talaria_reviewed_agent_importers'
+        if package not in sys.modules:
+            module = types.ModuleType(package)
+            module.__path__ = []
+            sys.modules[package] = module
+            for name in ('importer', 'sync'):
+                module = types.ModuleType(f'{package}.{name}')
+                module.__package__ = package
+                sys.modules[module.__name__] = module
+                exec(compile(bodies[name + '.py'], f'<reviewed-agent-importers/{name}.py>', 'exec'), module.__dict__)
+        return sys.modules[package + '.importer'].AgentImporter, sys.modules[package + '.sync'], [pin, str(root), _tree_digest(root)]
+    except (ImportError, AttributeError, OSError, ValueError, TypeError, RpcError):
+        return None