@maudecode/talaria-web 1.21.0 → 1.22.0

package/sidecar/talaria_sidecar/methods/delegation.py

@@ -0,0 +1,126 @@
+"""Native delegation registry and route validation for the auxiliary settings owner."""
+
+from __future__ import annotations
+
+from dataclasses import asdict
+
+from ..errors import InvalidParams, RpcError
+from ..home import profile_home_param, scoped_home
+
+
+def registry(config: dict) -> dict:
+    section = config.get("delegation")
+    section = section if isinstance(section, dict) else {}
+    try:
+        from agent.delegation_backends import list_backends
+        from agent.delegation_registry import backend_status, configured_backend
+    except ImportError:
+        configured = section.get("backend") or "default"
+        return {"supported": False, "configured": configured, "effective": None, "available": False,
+                "blocked_reason": "Update Hermes Agent to configure delegation modes.", "fixed_model_active": configured == "default",
+                "backends": [{"name": configured, "label": configured, "description": "", "available": False, "reason": "Update Hermes Agent."}], "profiles": []}
+    from hermes_cli.plugins import discover_plugins
+    from hermes_cli.profiles import list_profile_names
+
+    discover_plugins()
+    configured = configured_backend(section)
+    provider, reason = backend_status(configured)
+    available = provider is not None and not reason
+    backends = [asdict(info) for info in list_backends()]
+    if not any(info["name"] == configured for info in backends):
+        backends.append({"name": configured, "label": configured, "description": "", "available": False, "reason": reason})
+    return {"supported": True, "configured": configured, "effective": configured if available else None,
+            "available": available, "blocked_reason": reason or None, "fixed_model_active": available and configured == "default",
+            "backends": backends, "profiles": list_profile_names()}
+
+
+def clean_routes(backend: str, block: dict, current: dict) -> dict:
+    """Use native canonical keys and parsers, preserving credentials by original route identity."""
+    from agent.delegation_provider import ROUTE_KEYS
+    from agent.fast_mode import STATIC_TIERS, parse_exact_service_tier
+    from hermes_constants import parse_reasoning_effort
+    from hermes_cli.profiles import list_profile_names
+
+    field = "options" if backend == "model_map" else "profiles"
+    entries = block.get(field)
+    if not isinstance(entries, list):
+        raise InvalidParams(f"{field} must be a list")
+    stored = {row.get("name"): row for row in current.get(field, []) if isinstance(row, dict)}
+    known = set(list_profile_names()) if backend == "profile_routes" else set()
+    rows, names = [], []
+    for entry in entries:
+        if not isinstance(entry, dict):
+            raise InvalidParams("Each route must be an object")
+        name = str(entry.get("name") or "").strip()
+        if not name or name in names:
+            raise InvalidParams("Route names must be nonempty and unique")
+        names.append(name)
+        if backend == "profile_routes":
+            if name not in known:
+                raise InvalidParams(f"Profile {name!r} does not exist")
+            rows.append({"name": name, **({"description": entry["description"].strip()} if entry.get("description", "").strip() else {})})
+            continue
+        source = stored.get(entry.get("original_name") or name, {})
+        # Hidden canonical values survive both edits and renames.
+        row = {key: value for key, value in source.items() if key in ROUTE_KEYS}
+        row.update({key: value for key, value in entry.items() if key in ROUTE_KEYS or key in {"name", "description"}})
+        row["name"] = name
+        for key in ("description", "model", "provider", "base_url", "api_mode"):
+            if key in row:
+                row[key] = str(row[key] or "").strip()
+        if not row.get("description") or not row.get("model") or not (row.get("provider") or row.get("base_url")):
+            raise InvalidParams(f"Route {name!r} needs a description, model and provider or endpoint")
+        for key in ("reasoning_effort", "service_tier"):
+            if key in entry and not entry[key]:
+                row.pop(key, None)
+        effort = row.get("reasoning_effort")
+        if effort and parse_reasoning_effort(effort) is None:
+            raise InvalidParams("Unknown reasoning effort")
+        tier = row.get("service_tier")
+        if tier:
+            try:
+                parsed = parse_exact_service_tier(tier)
+            except ValueError:
+                raise InvalidParams("Unknown service tier") from None
+            if parsed is None or parsed and parsed not in STATIC_TIERS:
+                raise InvalidParams("Unknown service tier")
+        if entry.get("api_key_clear"):
+            row.pop("api_key", None)
+        elif not entry.get("api_key") and source.get("api_key"):
+            row["api_key"] = source["api_key"]
+        if "fallback_providers" in row and not isinstance(row["fallback_providers"], list):
+            raise InvalidParams("fallback_providers must be a list")
+        rows.append(row)
+    default = (block.get("default") or "").strip()
+    if default and default not in names:
+        raise InvalidParams("The default route must be in the list")
+    return {field: rows, **({"default": default} if default else {})}
+
+
+def register(methods) -> None:
+    @methods.method("aux.delegation")
+    def describe(ctx, params):
+        with scoped_home(profile_home_param(params)):
+            return registry(params.get("config") or {})
+
+    @methods.method("aux.delegation_routes")
+    def validate(ctx, params):
+        with scoped_home(profile_home_param(params)):
+            return {"block": clean_routes(params["backend"], params["block"], params["current"])}
+
+    @methods.method("aux.delegation_backend")
+    def select(ctx, params):
+        from hermes_cli.config import get_config_path
+        from agent.delegation_backends import set_global_backend
+        from .config import config_path_param
+
+        with scoped_home(profile_home_param(params)):
+            if get_config_path().resolve() != config_path_param(params).resolve():
+                raise RpcError("Native delegation config path differs from the configured file", condition="config_write_refused")
+            try:
+                set_global_backend(params["backend"])
+            except PermissionError:
+                raise RpcError("config.yaml is package-managed. Update the declarative configuration instead.", condition="config_write_refused") from None
+            except ValueError as exc:
+                raise InvalidParams(str(exc)) from None
+        return {"ok": True}

package/sidecar/talaria_sidecar/methods/gateway.py

@@ -243,6 +243,11 @@ def _run(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *,
 
 
 def register(registry) -> None:
+    @registry.method("gateway.groups")
+    def groups_(ctx: CallContext, params: dict) -> dict:
+        from .groups import groups
+        return groups(ctx, params)
+
     @registry.method("gateway.session")
     def session_(ctx: CallContext, params: dict) -> dict:
         from .gateway_sessions import session

package/sidecar/talaria_sidecar/methods/gateway_sessions.py

@@ -70,6 +70,24 @@ def _control_refusal(home: Path, sid: str) -> str | None:
     return None
 
 
+def _todo_state(value: object) -> dict | None:
+    if not isinstance(value, dict) or not isinstance(value.get("todos"), list):
+        return None
+    fields = {"id": (str, int, float), "text": (str,), "content": (str,), "title": (str,),
+              "status": (str,), "done": (bool,), "completed": (bool,)}
+    revision = value.get("revision", 0)
+    if type(revision) is not int or revision < 0:
+        return None
+    return {"todos": [{k: v for k, v in item.items() if k in fields and type(v) in fields[k]}
+                      for item in value["todos"] if isinstance(item, dict)], "revision": revision}
+
+
+def _event(value: dict) -> dict:
+    if value.get("type") == "todo.updated":
+        return {**value, "payload": _todo_state(value.get("payload")) or {}}
+    return value
+
+
 def _snapshot(value: dict) -> dict:
     # Raw conversation rows contain private principal/admission metadata; the client needs
     # display rows, not those bindings or the inventory's system prompt and credential hint.
@@ -84,7 +102,8 @@ def _snapshot(value: dict) -> dict:
             {"author": reaction["author"], "emoji": reaction["emoji"]} for reaction in reactions
             if isinstance(reaction, dict) and reaction.get("author") in ("user", "agent")
             and isinstance(reaction.get("emoji"), str) and reaction["emoji"] in _REACTION_EMOJIS] if isinstance(reactions, list) else []})
-    return {**value, "messages": rows, "info": {k: v for k, v in value["info"].items() if k in info_keys}}
+    return {**value, "messages": rows, "info": {k: v for k, v in value["info"].items() if k in info_keys},
+            **({"todo_state": _todo_state(value["todo_state"])} if "todo_state" in value else {})}
 
 
 def _refused(state: str, reason: str) -> dict:
@@ -92,7 +111,7 @@ def _refused(state: str, reason: str) -> dict:
 
 
 @asynccontextmanager
-async def _connect(home: Path, endpoint):
+async def _connect(home: Path, endpoint, *, subject: str | None = None):
     from hermes_constants import get_hermes_home
     from hermes_cli.gateway_client import GatewayClientError, connect_gateway
 
@@ -100,7 +119,7 @@ async def _connect(home: Path, endpoint):
     # override is mandatory so its bootstrap ticket cannot fall back to the launch profile.
     if Path(get_hermes_home()).resolve() != home:
         raise GatewayClientError("profile_mismatch")
-    async with connect_gateway(endpoint) as client:
+    async with connect_gateway(endpoint, **({"subject": subject} if subject is not None else {})) as client:
         websocket = client.websocket
         # GatewayClient queues server requests as events. Drain continuously, including
         # during an RPC, so unsupported sudo/secure inputs never wait for a Web renderer.
@@ -211,7 +230,17 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
             subscription = value["subscription_id"]
             if reason := await asyncio.to_thread(_control_refusal, home, sid):
                 raise GatewayRPCError(reason)
-            return {**_snapshot(value), "reactions_supported": _verified_contract(endpoint, "message-reactions-v1")}
+            gauge = None
+            if params["action"] in {"snapshot", "watch"}:
+                try:
+                    stats = await client.rpc("session.stats", session_id=sid)
+                    after = await client.rpc("session.resume", session_id=sid)
+                    if all(value.get(k) == after.get(k) for k in ("session_id", "authority_epoch", "replay_epoch", "execution_generation")):
+                        gauge = stats.get("plan_gauge")
+                except GatewayRPCError:
+                    pass  # older owners have no stats capability
+            return {**_snapshot(value), "plan_gauge": gauge,
+                    "reactions_supported": _verified_contract(endpoint, "message-reactions-v1")}
 
         receipt = lock = None
         try:
@@ -332,7 +361,7 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
                     if (event.get("type") in {"session.updated", "notification.show", "notification.clear"}
                             or event.get("execution_generation") == snap["execution_generation"]
                             or event.get("type") == "session.info" and event.get("payload", {}).get("execution_generation") == snap["execution_generation"]):
-                        ctx.emit("event", event)
+                        ctx.emit("event", _event(event))
                 sequence = replay["last_sequence"]
             ctx.emit("replay_complete", {})
             checked = asyncio.get_running_loop().time()
@@ -386,7 +415,7 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
                 if event.get("seq", 0) <= sequence:
                     continue
                 sequence = event["seq"]
-                ctx.emit("event", event)
+                ctx.emit("event", _event(event))
             return result
         except GatewayRPCError as exc:
             if params["action"] == "react" and str(exc) not in {"invalid_params", "not_found", "permission_denied", "profile_mismatch"}:

package/sidecar/talaria_sidecar/methods/groups.py

@@ -0,0 +1,120 @@
+"""Closed native room operations. Attach only, with the Web principal's own grant."""
+from __future__ import annotations
+
+import asyncio
+import json
+from contextlib import suppress
+
+from ..errors import InvalidParams
+from ..home import profile_home_param
+from .gateway_sessions import _connect, _owner_refusal, _with_owner
+
+_FIELDS = {
+    "capabilities": set(), "list": {"offset", "limit"}, "state": {"room_id", "include_disbanded"},
+    "log": {"room_id", "since_seq", "limit"}, "create": {"room_id", "name", "members"},
+    "rename": {"room_id", "event_id", "name"}, "disband": {"room_id", "cancel_id"},
+    "send": {"room_id", "event_id", "payload"}, "stop": {"room_id", "cancel_id"},
+    "retry": {"room_id", "member_id", "task_id", "execution_generation"},
+    "discard": {"room_id", "member_id", "task_id", "execution_generation"},
+    "approve": {"room_id", "member_id", "task_id", "execution_generation", "request_id", "choice"},
+    "attachment.upload": {"room_id", "upload_id", "kind", "name", "mime", "data_base64"},
+    "attachment.download": {"room_id", "event_id", "attachment_id"},
+}
+_READS = {"capabilities", "list", "state", "log", "attachment.download"}
+_REFUSALS = {"permission_denied", "profile_mismatch", "invalid_params", "stale_generation", "unknown_execution",
+             "unsupported_operation", "session_busy", "runtime_coordination_required"}
+
+
+def _result(state, reason=None, value=None):
+    return {"state": state, "reason": reason, "value": value}
+
+
+async def _run(home, subject, operation, discovery, expected_room=None):
+    from hermes_cli.gateway_client import GatewayRPCError
+    action = operation["action"]
+    method = "groups." + action
+    dispatched = False
+    try:
+        if discovery.state != "ready":
+            return _result("unavailable", "stopped")
+        principal = 'auth:v1:' + json.dumps(['talaria', '', subject], separators=(',', ':'))
+        async with _connect(home, discovery.endpoint, subject=principal) as (client, _):
+            # A native 15 MB attachment expands to 20 MB on the wire. Keep the shared native client,
+            # with a bounded receiver large enough for the owner's supported attachment envelope.
+            client.websocket.protocol.max_size = 24 * 1024 * 1024
+            described = await client.rpc("runtime.describe")
+            if _owner_refusal(described, discovery.endpoint):
+                return _result("unavailable", "unsupported")
+            caps = await client.rpc("groups.capabilities")
+            if (not isinstance(caps, dict) or type(caps.get("driver")) is not bool
+                    or not isinstance(caps.get("methods"), list) or method not in caps["methods"]):
+                return _result("unavailable", "unsupported")
+            if not caps["driver"]:
+                return _result("unavailable", "driver_inactive")
+            if action == "capabilities":
+                return _result("available", value=caps)
+            if expected_room is not None:
+                current = await client.rpc("groups.state", room_id=expected_room["room_id"], include_disbanded=True)
+                room = current.get("room", {})
+                if (room.get("room_id") != expected_room["room_id"]
+                        or room.get("authority_gateway_id") != expected_room["gateway_id"]
+                        or room.get("authority_epoch") != expected_room["authority_epoch"]):
+                    return _result("refused", "refused")
+            if action == "send":
+                operation = {**operation, "payload": {**operation["payload"], "thread_id": operation["event_id"]}}
+            dispatched = True
+            value = await client.rpc(method, **{k: v for k, v in operation.items() if k != "action"}, _timeout=25)
+            if not isinstance(value, dict) or len(json.dumps(value).encode()) > 24 * 1024 * 1024:
+                return _result("unknown" if action not in _READS else "unavailable", "unknown")
+            return _result("available", value=value)
+    except GatewayRPCError as exc:
+        reason = str(exc)
+        # Native errors are data, never public diagnostics. Only fixed refusals prove non-admission.
+        if reason in _REFUSALS:
+            return _result("refused", "refused")
+        if "method" in reason.lower() and not dispatched:
+            return _result("unavailable", "unsupported")
+        return _result("unknown" if dispatched and action not in _READS else "unavailable", "unknown")
+    except Exception:  # noqa: BLE001 - a transport loss never authorizes automatic replay
+        return _result("unknown" if dispatched and action not in _READS else "unavailable", "unknown")
+
+
+async def _read(ctx, coroutine):
+    task = asyncio.create_task(coroutine)
+    try:
+        while not task.done():
+            await asyncio.wait({task}, timeout=.1)
+            ctx.check_cancelled()
+        return await task
+    finally:
+        if not task.done():
+            task.cancel()
+            with suppress(asyncio.CancelledError):
+                await task
+
+
+def groups(ctx, params):
+    operation, subject = params.get("operation"), params.get("subject")
+    if (set(params) - {"profile_home", "subject", "operation", "expected_room"}
+            or not {"profile_home", "subject", "operation"} <= set(params)
+            or not isinstance(subject, str) or not 0 < len(subject) <= 128
+            or not isinstance(operation, dict) or operation.get("action") not in _FIELDS
+            or set(operation) - (_FIELDS[operation["action"]] | {"action"})):
+        raise InvalidParams("invalid room operation")
+    expected = params.get("expected_room")
+    if expected is not None and (not isinstance(expected, dict)
+            or set(expected) != {"room_id", "gateway_id", "authority_epoch"}
+            or expected.get("room_id") != operation.get("room_id")
+            or not isinstance(expected.get("gateway_id"), str)
+            or type(expected.get("authority_epoch")) is not int):
+        raise InvalidParams("invalid room authority fence")
+    home = profile_home_param(params).resolve()
+    ctx.check_cancelled()
+    def run(discovery):
+        coroutine = _run(home, subject, operation, discovery, expected)
+        return _read(ctx, coroutine) if operation["action"] in _READS else coroutine
+    result = _with_owner(home, run)
+    if "value" not in result:
+        return _result("unavailable", "stopped" if result["state"] == "stopped" else "unsupported"
+                       if result["state"] == "incompatible" else "unavailable")
+    return result

package/sidecar/talaria_sidecar/methods/memory.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from contextlib import contextmanager
 import errno
 import hashlib
 import os
@@ -45,22 +46,45 @@ def _digest(path: Path) -> str | None:
         return hashlib.sha256(handle.read()).hexdigest()
 
 
+@contextmanager
+def file_lock(path: Path, *, parent_fd=None):
+    """The native memory lock, with an anchored opening for descriptor-relative publishers."""
+    if parent_fd is None:
+        from tools.memory_tool_store import MemoryStore
+        native = getattr(MemoryStore, '_file_lock', None)
+        with native(path) if native else _SAVE_LOCK:
+            yield
+        return
+    import fcntl
+    # Same persistent .lock inode and flock protocol as MemoryStore._file_lock; never re-resolve its parent.
+    with _SAVE_LOCK:
+        fd = os.open(path.name + '.lock', os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600, dir_fd=parent_fd)
+        with os.fdopen(fd, 'r+') as lock:
+            info = os.fstat(lock.fileno())
+            if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:
+                raise OSError('Unsafe memory lock')
+            os.fchmod(lock.fileno(), 0o600)
+            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(lock.fileno(), fcntl.LOCK_UN)
+
+
 def write(home: Path, section: str, base: str, content: str) -> dict:
     """Replace ``section``'s file with ``content`` only while its bytes still hash to ``base``, the server's read.
 
     Each file is checked and written under the Agent's own per-file lock (``<file>.lock``), so neither a memory tool
     call nor a concurrent save can land between the two; an Agent without the lock helper gets this sidecar's lock.
     """
-    from tools.memory_tool_store import MemoryStore
     from utils import atomic_write_text
 
     if section not in ("memory", "user", "soul"):
         raise InvalidParams("section must be memory, user, or soul")
     # The files the server read: SOUL.md in the profile home, MEMORY.md / USER.md in its memories folder.
     path = home / "SOUL.md" if section == "soul" else home / "memories" / ("USER.md" if section == "user" else "MEMORY.md")
-    file_lock = getattr(MemoryStore, "_file_lock", None)
     try:
-        with file_lock(path) if file_lock else _SAVE_LOCK:
+        with file_lock(path):
             if _digest(path) != base:
                 return {"written": False}
             atomic_write_text(path, content, tmp_prefix=".mem_", preserve_mode=True)

package/sidecar/talaria_sidecar/methods/nous_account.py

@@ -0,0 +1,130 @@
+"""Safe, read-only account/handoff projection shared by OAuth and provider status.
+
+The Agent owns the record and retry worker. This bounded display cache only retains a
+confirmed view across read failures, keyed by the current profile and account.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+import threading
+from collections import OrderedDict
+from pathlib import Path
+from typing import Any
+
+_LAST: OrderedDict[str, dict] = OrderedDict()
+_LOCK = threading.RLock()
+_STATES = {"idle", "pending", "retrying", "claimed", "gone", "failed", "paused"}
+_ERRORS = {"client_not_allowed", "account_locked", "invalid_request", "retry_window_ended"}
+
+
+def _identity(home: Path) -> tuple[str, str | None] | None:
+    from hermes_cli.anon_auth import is_guest_state
+    from hermes_cli.auth import get_provider_auth_state
+
+    state = get_provider_auth_state("nous")
+    if not isinstance(state, dict) or is_guest_state(state):
+        return None
+    return _token_identity(home, state.get("access_token"))
+
+
+def _token_identity(home: Path, token: Any) -> tuple[str, str | None] | None:
+    from hermes_cli.auth_constants import _decode_jwt_claims
+
+    claims = _decode_jwt_claims(token)
+    subject = claims.get("sub")
+    if not isinstance(subject, str) or not subject:
+        return None
+    identity = hashlib.sha256(f"{home.resolve()}\0{subject}".encode()).hexdigest()
+    email = claims.get("email")
+    if not isinstance(email, str) or not re.fullmatch(r"[^@\s]+@[^@\s]+\.[^@\s]+", email) or len(email) > 254:
+        return identity, None
+    local, domain = email.rsplit("@", 1)
+    return identity, f"{local[0]}***@{domain}"
+
+
+def _apps(value: Any) -> list[str]:
+    if not isinstance(value, (list, tuple)):
+        return []
+    return list(dict.fromkeys(v for v in value[:100] if isinstance(v, str) and re.fullmatch(r"[a-z0-9][a-z0-9_-]{0,63}", v)))
+
+
+def read(home: Path, completed: Any = None) -> dict | None:
+    """One sequential read owner for flow/provider consumers, called under scoped_home."""
+    with _LOCK:
+        return _read(home, completed)
+
+
+def _read(home: Path, completed: Any = None) -> dict | None:
+    """No provisioning, refresh, drain, or retry dispatch."""
+    try:
+        from hermes_cli import guest_handoff as native
+    except ImportError:
+        return None  # older Agents keep generic success
+    try:
+        identity = _identity(home)
+    except Exception:  # no current identity proof means no cached account may be displayed
+        return None
+    if identity is None:
+        return None
+    account_id, email = identity
+    try:
+        status = native.handoff_status()
+        if status.get("state") == "idle" and completed is not None:
+            status = getattr(completed, "handoff_status", None) or status
+        state = status.get("state") if status.get("state") in _STATES else "unknown"
+        # The public native read only fences *active* records. Prove terminal ownership
+        # with the same native selector/binding helper before exposing any old app names.
+        if state not in {"idle", "unknown", "paused"}:
+            records = native._load(native._records_path())["records"].values()
+            mine = [r for r in records if native._home_key() in r.get("profiles", ())]
+            record = max(mine, key=lambda r: str(r.get("updated_at") or "")) if mine else None
+            if record is not None and native._status_of(record) != status:
+                raise RuntimeError("Native handoff changed during read")
+            if record is None or native._account_bound_to(record) is None:
+                state = "paused" if record else "unknown"
+        safe = {"state": state, "account_email": email,
+                "connectors_kind": status.get("connectors_kind") if status.get("connectors_kind") in {"moved", "swapped", "none", "conflict"} else None,
+                "moved_toolkits": _apps(status.get("moved_toolkits")) if state == "claimed" else [],
+                "dropped_toolkits": _apps(status.get("dropped_toolkits")) if state == "claimed" else [],
+                "probably_moved": status.get("probably_moved") is True,
+                "error": status.get("error") if status.get("error") in _ERRORS else None}
+        lines = native.wire_status(safe)["lines"] if state != "unknown" else ["Connected-app transfer status is unknown."]
+        if _identity(home) != identity:
+            return None
+        view = {"account_id": account_id, "email": email, "state": state, "lines": lines,
+                "moved": safe["moved_toolkits"], "dropped": safe["dropped_toolkits"],
+                "reconnect": safe["dropped_toolkits"],
+                "poll_after": 5 if state in {"pending", "retrying", "unavailable"} else None}
+        with _LOCK:
+            _LAST[account_id] = view
+            _LAST.move_to_end(account_id)
+            while len(_LAST) > 32:
+                _LAST.popitem(last=False)
+        return view
+    except Exception:  # raw native records and exception details never cross this boundary
+        try:
+            if _identity(home) != identity:
+                return None
+        except Exception:
+            return None
+        with _LOCK:
+            previous = _LAST.get(account_id)
+        return {**(previous or {"account_id": account_id, "email": email, "moved": [], "dropped": [], "lines": []}),
+                "state": "unavailable", "reconnect": [], "poll_after": 5,
+                "lines": [*(previous or {}).get("lines", []), "Connected-app transfer status is unavailable."]}
+
+
+def connector_headers(home: Path, account_id: str, url: str) -> dict:
+    """The native connector client reads this on every request, never provisioning or refreshing."""
+    from tools.managed_gateway_auth import managed_gateway_auth_headers
+    from tools.managed_tool_gateway import peek_nous_access_token
+
+    def token():
+        value = peek_nous_access_token()
+        current, bearer = _identity(home), _token_identity(home, value)
+        if current is None or bearer is None or current[0] != account_id or bearer[0] != account_id:
+            return None
+        return value
+
+    return managed_gateway_auth_headers(url, token_reader=token)

package/sidecar/talaria_sidecar/methods/oauth.py

@@ -26,7 +26,7 @@ from typing import Any, Callable
 from ..errors import InvalidParams, RpcError
 from ..home import profile_home_param, scoped_home
 from ..rpc import CallContext
-from . import plugin_oauth
+from . import plugin_oauth, nous_account
 
 log = logging.getLogger("talaria_sidecar.oauth")
 
@@ -65,6 +65,7 @@ class Flow:
     # The credential is saved but the sign-in has not finished (a guest sign-in still settles the account): a cancel or
     # an expiry can no longer undo it, and the flow stays pending until its own ending.
     committed: bool = False
+    nous_account_id: str | None = None
     # A browser sign-in also finishes from the redirect address the user pastes (``oauth.submit_redirect``).
     submit: Callable[[str], None] | None = None
     # Set once a browser sign-in's loopback listener is closed, so a replacing start can bind the same fixed port.
@@ -78,7 +79,12 @@ class Flow:
         self.status, self.error, self.ended_at = status, error, time.time()
 
     def view(self) -> dict:
-        return {"flow_id": self.flow_id, "provider": self.provider, "status": self.status, "error": self.error}
+        view = {"flow_id": self.flow_id, "provider": self.provider, "status": self.status, "error": self.error}
+        if self.status == "approved" and self.nous_account_id:
+            with scoped_home(self.home):
+                account = nous_account.read(self.home)
+            view["nous_account"] = account if account and account["account_id"] == self.nous_account_id else None
+        return view
 
 
 class _Watched:
@@ -156,6 +162,9 @@ def _nous_begin() -> tuple[dict, dict]:
 
     # v0.22.0 replaced ``guest_enabled`` with ``guest_allowed``; 0.21.x releases only have the former.
     guest_gate = getattr(anon_auth, "guest_allowed", None) or getattr(anon_auth, "guest_enabled")
+    native = getattr(anon_auth, "run_sign_in", None)
+    if native and "replace_account" in inspect.signature(native).parameters:
+        return _nous_sign_in(anon_auth)
     if guest_gate() and anon_auth.has_guest():
         # The native sign-in owns the guest's connector handoff for its installed protocol.
         if hasattr(anon_auth, "run_sign_in"):
@@ -191,6 +200,9 @@ def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
             yield may_persist
             if may_persist:
                 flow.committed = True
+                # Bind before native handoff/settlement releases this account to another sign-in.
+                account = nous_account.read(flow.home)
+                state["nous_account_id"] = account["account_id"] if account else None
 
     def scope():
         flow = state.get("flow")
@@ -198,11 +210,13 @@ def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
 
     # Older Agents use promotion; v0.22.5 removed its option in favor of plain device login and native handoff.
     options = {"cancel_wins_after_promotion": True} if "cancel_wins_after_promotion" in inspect.signature(anon_auth.run_sign_in).parameters else {}
+    if "replace_account" in inspect.signature(anon_auth.run_sign_in).parameters:
+        options["replace_account"] = True
     sign_in = anon_auth.run_sign_in(cancelled=cancelled, persist_guard=persist_guard, scope=scope, **options)
     first = next(sign_in)
     if first.kind != "code":
         sign_in.close()
-        raise RpcError(first.copy_terminal, condition="oauth_unsupported" if first.precondition else "oauth_failed")
+        raise RpcError(first.copy, condition="oauth_unsupported" if first.precondition else "oauth_failed")
     state["sign_in"] = sign_in
     return {"user_code": first.code, "verification_url": first.link, "expires_in": first.expires_in, "interval": first.interval}, state
 
@@ -226,6 +240,8 @@ def _nous_wait(flow: Flow, state: dict) -> dict:
             sign_in.close()
         if not ended.ok:
             raise _SignInEnded(ended)
+        with scoped_home(flow.home):
+            nous_account.read(flow.home, ended)
         return {}
     from hermes_cli.auth import _poll_for_token
 
@@ -406,6 +422,7 @@ def _run(flow: Flow, wait: Callable[[Flow, dict], dict], save: Callable[[Flow, d
                 return
             with scoped_home(flow.home):
                 save(flow, state, tokens)
+            flow.nous_account_id = state.get("nous_account_id")
             flow.end("approved")
         log.info("oauth: %s sign-in approved (flow=%s)", flow.provider, flow.flow_id[:6])
     except _Stop:
@@ -556,7 +573,11 @@ def register(reg) -> None:
 
     @reg.method("oauth.poll", requires_agent=False)
     def poll_(ctx: CallContext, params: dict) -> dict:
-        return poll(profile_home_param(params), _flow_id(params))
+        home, flow_id = profile_home_param(params), _flow_id(params)
+        flow = _flow(home, flow_id)
+        if flow.status == "approved" and flow.nous_account_id:
+            reg.runtime.ensure_current()  # a retired worker cannot promise background progress
+        return poll(home, flow_id)
 
     @reg.method("oauth.cancel", requires_agent=False)
     def cancel_(ctx: CallContext, params: dict) -> dict:

package/sidecar/talaria_sidecar/methods/outbound_drafts.py

@@ -27,25 +27,7 @@ _STATES = {'draft', 'approved', 'sent', 'saved', 'failed', 'discarded'}
 
 
 def _producer(home):
-    """Native registration, explicit profile consent and reviewed source, without loading a plugin."""
-    try:
-        from hermes_cli import plugins_cmd as pc
-        metadata = pc._read_install_metadata()
-        for plugin in dashboard_plugins._plugins(home):
-            if plugin['name'] != 'draft-cards' or not plugin['enabled'] or plugin.get('source') != 'user':
-                continue
-            root, anchor = Path(plugin['_dir']).parent, Path(plugin['_asset_anchor'])
-            record = metadata.get(root.name, {})
-            catalog = record.get('catalog', {})
-            if catalog.get('name') != 'draft-cards' or catalog.get('sha') != _PIN or record.get('revision') != _PIN:
-                continue
-            if not all((body := dashboard_plugins._read(root, name, anchor=anchor)) is not None
-                       and hashlib.sha256(body).hexdigest() == digest for name, digest in _SOURCES.items()):
-                continue
-            return _PIN
-    except (ImportError, AttributeError, OSError, ValueError, TypeError):
-        pass
-    return None
+    return dashboard_plugins.reviewed_producer(home, 'draft-cards', _PIN, _SOURCES)
 
 
 def _database(home):