@maudecode/talaria-web 1.21.0 → 1.23.2

package/sidecar/talaria_sidecar/methods/commands.py

@@ -239,7 +239,7 @@ def forget_profile_mcp_tools(home) -> None:
         _MCP_DISCOVERED_HOMES.discard(os.path.realpath(home))
 
 
-def _reload_mcp() -> str:
+def _reload_mcp(*, log_errors=True) -> str:
     with _RELOAD_MCP_LOCK:
         try:
             from agent.secret_scope import is_multiplex_active
@@ -274,7 +274,8 @@ def _reload_mcp() -> str:
                 with _lock:
                     tools = [name for name in tools if _mcp_tool_server_names.get(name) in connected]
         except Exception as exc:  # noqa: BLE001
-            log.warning("Failed to reload MCP servers", exc_info=True)
+            if log_errors:
+                log.warning("Failed to reload MCP servers", exc_info=True)
             raise RpcError("Failed to reload MCP servers", condition="mcp_reload_failed") from exc
     added, removed, reconnected = connected - old, old - connected, connected & old
     lines = ["Reloaded MCP servers from configuration."]
@@ -846,11 +847,12 @@ def register(registry) -> None:
             output = execute_agent_command(command, session_id, workspace)
             source = "agent"
             if output is None:
-                from .chat import _turn_identity
+                from .chat import _turn_identity, command_choices
 
                 # TAL-904: a chat's plugin command runs under that chat's session and workspace, as its turns do.
-                with _turn_identity(session_id, workspace) if session_id else contextlib.nullcontext():
+                with command_choices(ctx, params), (_turn_identity(session_id, workspace) if session_id else contextlib.nullcontext()):
                     output = execute_plugin_command(command, session_id)
+                ctx.check_cancelled()
                 source = "plugin"
         if output is None:
             raise RpcError(f"unknown command {parse_slash_command(command)[0]!r}", condition="command_not_found")

package/sidecar/talaria_sidecar/methods/config.py

@@ -133,9 +133,8 @@ def _split_config_aliases(text: str, desired: dict) -> str:
     return output.getvalue()
 
 
-def write_config(path: Path, config: dict, *, profile_home: Path | None = None) -> dict:
-    if not isinstance(config, dict):
-        raise InvalidParams("config must be an object")
+def assert_config_writable(profile_home: Path | None = None) -> None:
+    """Verify the owning profile policy before any config publication; uncertainty refuses."""
     try:
         managed = importlib.import_module("hermes_constants").get_managed_system(profile_home)
     except Exception as exc:  # noqa: BLE001
@@ -144,6 +143,12 @@ def write_config(path: Path, config: dict, *, profile_home: Path | None = None)
     if managed is not None:
         raise RpcError("config.yaml is package-managed. Update the declarative configuration instead.",
                        condition="config_write_refused")
+
+
+def write_config(path: Path, config: dict, *, profile_home: Path | None = None) -> dict:
+    if not isinstance(config, dict):
+        raise InvalidParams("config must be an object")
+    assert_config_writable(profile_home)
     target = _write_target(path)
     target.parent.mkdir(parents=True, exist_ok=True)
     try:

package/sidecar/talaria_sidecar/methods/connectors.py

@@ -8,10 +8,13 @@ registers its session operation here through ``remember_chat_operation``. Every
 
 from __future__ import annotations
 
+import contextvars
+import hashlib
 import inspect
 import json
 import logging
 import threading
+import uuid
 from collections import OrderedDict
 from pathlib import Path
 from types import SimpleNamespace
@@ -130,11 +133,46 @@ def accounts() -> dict:
     client = _portal()
     if not _authenticated(client):
         return {"accounts": []}
+    rows = client.list_accounts()
+    try:
+        from hermes_cli.free_tier_offer import note_connected_apps_seen
+        note_connected_apps_seen([{"connected": row.get("active") is True and not row.get("disabled")} for row in rows])
+    except ImportError:
+        pass  # older Agents have no connector offer
+    except Exception:
+        log.warning("connector sighting unavailable")
     return {"accounts": [{
         "connection_id": row["connectionId"], "connector": row["connector"], "status": row["status"],
         "status_reason": row.get("statusReason"), "label": row["label"], "alias": row.get("alias"),
         "active": bool(row["active"]), "disabled": bool(row.get("disabled")), "created_at": row["createdAt"],
-    } for row in client.list_accounts()]}
+    } for row in rows]}
+
+
+def sign_in_offer(home: Path, claim_guest: str | None = None) -> dict:
+    """Native policy and CAS only. The server owns retention of the delivered page result."""
+    result = {"available": False, "guest_id": None, "eligible": False, "due_in": None, "claimed": False}
+    try:
+        from hermes_cli import anon_auth, free_tier_offer as native
+        if not all(callable(getattr(native, name, None)) for name in ("_eligible", "offer_due_in", "claim_offer")):
+            return result
+
+        def identity():
+            state = anon_auth.current_nous_state()
+            token = state.get("anon_token") if anon_auth.is_guest_state(state) else None
+            return hashlib.sha256(f"{home.resolve()}\0{token}".encode()).hexdigest() if isinstance(token, str) and token else None
+
+        guest = identity()
+        result["guest_id"] = guest
+        eligible = bool(native._eligible(native.CONNECTOR))
+        due = native.offer_due_in(native.CONNECTOR)
+        claimed = bool(guest and guest == claim_guest and native.claim_offer(native.CONNECTOR)) if claim_guest else False
+        if identity() != guest:
+            return {**result, "guest_id": None}
+        return {"available": True, "guest_id": guest, "eligible": eligible, "due_in": due, "claimed": claimed}
+    except ImportError:
+        return result
+    except Exception:
+        return result  # retain a proven identity, never raw auth or native error details
 
 
 def remove(connection_id: str) -> dict:
@@ -201,6 +239,14 @@ def _operation(home: Path, op_id: str):
         operation = _OPS.get((str(home), op_id))
     if operation is None:
         raise RpcError("No connection operation with that id.", condition="operation_not_found")
+    account_id = getattr(operation, "_talaria_nous_account_id", None)
+    if account_id:
+        from . import nous_account
+        current = nous_account.read(home)
+        if not current or current["account_id"] != account_id:
+            from tools.connectors.contract import SettleReason
+            operation.settle(SettleReason.interrupt)
+            raise RpcError("No connection operation for the current account.", condition="operation_not_found")
     return operation
 
 
@@ -226,8 +272,62 @@ def operation_view(operation) -> dict:
     }
 
 
-def connect(home: Path, connector: str) -> dict:
+def _reconnect(home: Path, connector: str, account_id: str) -> dict:
+    """Compose the existing native operation with an account-fenced, noncreating client.
+
+    Native account.find_or_start_operation always uses a creating, live-credential client
+    in its later thread. Its lifecycle primitives accept the client this result needs.
+    """
+    from tools.connectors import account, live, managed
+    from tools.connectors.gateway.client import ConnectorClient
+    from tools.connectors.operation import ConnectionOperation, Target
+    from tools.connectors.run import drive_operation
+    from tools.connectors.contract import SettleReason
+    from . import nous_account
+
+    with account._start_lock:
+        existing = live.find_target(connector, profile_home=str(home))
+        if existing is not None:
+            if getattr(existing, "_talaria_nous_account_id", None) != account_id:
+                raise RpcError("Finish the current app connection before reconnecting this result.", condition="operation_refused")
+            _remember(home, existing)
+            return operation_view(_operation(home, existing.op_id))
+        client = ConnectorClient(initiator="desktop_page", header_provider=lambda url: nous_account.connector_headers(home, account_id, url))
+        operation = ConnectionOperation([Target(connector, "connector", "connect")], session_key=f"account:{uuid.uuid4().hex}")
+        operation._talaria_nous_account_id = account_id
+        operation._talaria_nous_client = client
+        start = account.AccountOperationStart(operation=operation, started=True)
+        context = contextvars.copy_context()
+
+        def run():
+            try:
+                drive_operation(operation, managed.managed_kind(client, "connect", force=False),
+                                connection_callback=lambda payload: start.done.set(),
+                                tick_seconds=managed.WATCH_TICK_SECONDS, with_urls_in_result=False)
+            except Exception:
+                start.failed = True
+                operation.settle(SettleReason.interrupt)
+            finally:
+                live.close(operation)
+                start.done.set()
+
+        live.open(operation)
+        _remember(home, operation)
+        try:
+            threading.Thread(target=lambda: context.run(run), daemon=True, name="connector-account-operation").start()
+        except Exception:
+            live.close(operation)
+            operation.settle(SettleReason.interrupt)
+            raise
+    if account.wait_for_prepare(start) and start.failed:
+        raise RpcError("Connector request failed.", condition="connectors_failed")
+    return operation_view(_operation(home, operation.op_id))
+
+
+def connect(home: Path, connector: str, *, account_id: str | None = None) -> dict:
     """Start (or rejoin) the account-owned connect for ``connector`` and wait for its authorization link."""
+    if account_id is not None:
+        return _reconnect(home, connector, account_id)
     from tools.connectors import account
     from tools.connectors.contract import TargetState
     from tools.connectors.run import reissue
@@ -236,8 +336,11 @@ def connect(home: Path, connector: str) -> dict:
     page = {"initiator": "desktop_page"} if "initiator" in inspect.signature(account.find_or_start_operation).parameters else {}
     start = account.find_or_start_operation([connector], action="connect", profile_home=str(home), **page)
     _remember(home, start.operation)
+    _operation(home, start.operation.op_id)
     if not start.started:
         target = start.operation.target(connector)
+        if target is not None and target.state in (TargetState.failed, TargetState.expired) and getattr(start.operation, "_talaria_nous_client", None) is not None:
+            return respond(home, start.operation.op_id, "retry", connector, {})
         if target is not None and target.state in (TargetState.failed, TargetState.expired) and reissue(start.operation, [connector], **page):
             raise RpcError("This connection cannot be started again.", condition="operation_refused")
         return operation_view(start.operation)
@@ -262,7 +365,14 @@ def respond(home: Path, op_id: str, action: str, target: str | None, env: dict)
         if action == "continue":
             apply_answer(operation, json.dumps({"settled_by": SettleReason.continue_.value}))
         elif action == "retry" and row.kind == "connector":
-            if reissue(operation, [row.name]):
+            client = getattr(operation, "_talaria_nous_client", None)
+            if client is not None:
+                from tools.connectors.managed import mint
+                from tools.connectors.contract import Actor, TargetState
+                if row.state not in (TargetState.failed, TargetState.expired):
+                    raise RpcError("This target cannot be run again.", condition="operation_refused")
+                mint(client, operation, [row.name], reinitiate=True, actor=Actor.user)
+            elif reissue(operation, [row.name]):
                 raise RpcError("This target cannot be run again.", condition="operation_refused")
         else:
             status = "skipped" if action == "skip" else "approved"
@@ -288,6 +398,21 @@ def remember_chat_operation(home: Path, payload: dict) -> dict | None:
 
 
 def register(registry_) -> None:
+    @registry_.method("connectors.offer.status")
+    def offer_status_(ctx: CallContext, params: dict) -> dict:
+        home = profile_home_param(params)
+        with scoped_home(home):
+            return sign_in_offer(home)
+
+    @registry_.method("connectors.offer.claim")
+    def offer_claim_(ctx: CallContext, params: dict) -> dict:
+        guest = params.get("guest_id")
+        if not isinstance(guest, str) or not guest:
+            raise InvalidParams("guest_id is required")
+        home = profile_home_param(params)
+        with scoped_home(home):
+            return sign_in_offer(home, guest)
+
     def page(params: dict, read, *, creates_guest: bool = False):
         with scoped_home(profile_home_param(params)):
             _open(creates_guest=creates_guest)
@@ -346,7 +471,16 @@ def register(registry_) -> None:
     def connect_(ctx: CallContext, params: dict) -> dict:
         slug = _slug(params)
         home = profile_home_param(params)
-        return page(params, lambda: connect(home, slug), creates_guest=True)
+        def begin():
+            if "nous_account_id" in params:
+                from . import nous_account
+                view = nous_account.read(home)
+                if not view or view["account_id"] != params["nous_account_id"] or slug not in view["reconnect"]:
+                    raise RpcError("The signed-in account or reconnect result changed. Refresh before reconnecting.", condition="connectors_forbidden")
+                if not any(row["slug"] == slug for row in catalog()["connectors"]):
+                    raise RpcError("This app is not available to reconnect.", condition="connectors_forbidden")
+            return connect(home, slug, account_id=params.get("nous_account_id"))
+        return page(params, begin, creates_guest="nous_account_id" not in params)
 
     def gated() -> None:
         # Reads and moves on an operation pass the availability gate too, without creating an identity.

package/sidecar/talaria_sidecar/methods/dashboard_plugins.py

@@ -190,6 +190,27 @@ def _plugins(home):
     return out
 
 
+def reviewed_producer(home, name, pin, sources):
+    """Verify a store adapter's native registration, profile consent and reviewed bytes without loading it."""
+    try:
+        from hermes_cli import plugins_cmd as pc
+        metadata = pc._read_install_metadata()
+        for plugin in _plugins(home):
+            if plugin['name'] != name or not plugin['enabled'] or plugin.get('source') != 'user':
+                continue
+            root, anchor = Path(plugin['_dir']).parent, Path(plugin['_asset_anchor'])
+            record = metadata.get(root.name, {})
+            catalog = record.get('catalog', {})
+            if catalog.get('name') != name or catalog.get('sha') != pin or record.get('revision') != pin:
+                continue
+            if all((body := _read(root, file, anchor=anchor)) is not None
+                   and hashlib.sha256(body).hexdigest() == digest for file, digest in sources.items()):
+                return pin
+    except (ImportError, AttributeError, OSError, ValueError, TypeError):
+        pass
+    return None
+
+
 def _named(home, name, *, require_panel=True):
     return next((p for p in _plugins(home) if p['name'] == name and p['enabled'] and (p['panel'] if require_panel else p.get('_api_file'))), None)
 

package/sidecar/talaria_sidecar/methods/delegation.py

@@ -0,0 +1,126 @@
+"""Native delegation registry and route validation for the auxiliary settings owner."""
+
+from __future__ import annotations
+
+from dataclasses import asdict
+
+from ..errors import InvalidParams, RpcError
+from ..home import profile_home_param, scoped_home
+
+
+def registry(config: dict) -> dict:
+    section = config.get("delegation")
+    section = section if isinstance(section, dict) else {}
+    try:
+        from agent.delegation_backends import list_backends
+        from agent.delegation_registry import backend_status, configured_backend
+    except ImportError:
+        configured = section.get("backend") or "default"
+        return {"supported": False, "configured": configured, "effective": None, "available": False,
+                "blocked_reason": "Update Hermes Agent to configure delegation modes.", "fixed_model_active": configured == "default",
+                "backends": [{"name": configured, "label": configured, "description": "", "available": False, "reason": "Update Hermes Agent."}], "profiles": []}
+    from hermes_cli.plugins import discover_plugins
+    from hermes_cli.profiles import list_profile_names
+
+    discover_plugins()
+    configured = configured_backend(section)
+    provider, reason = backend_status(configured)
+    available = provider is not None and not reason
+    backends = [asdict(info) for info in list_backends()]
+    if not any(info["name"] == configured for info in backends):
+        backends.append({"name": configured, "label": configured, "description": "", "available": False, "reason": reason})
+    return {"supported": True, "configured": configured, "effective": configured if available else None,
+            "available": available, "blocked_reason": reason or None, "fixed_model_active": available and configured == "default",
+            "backends": backends, "profiles": list_profile_names()}
+
+
+def clean_routes(backend: str, block: dict, current: dict) -> dict:
+    """Use native canonical keys and parsers, preserving credentials by original route identity."""
+    from agent.delegation_provider import ROUTE_KEYS
+    from agent.fast_mode import STATIC_TIERS, parse_exact_service_tier
+    from hermes_constants import parse_reasoning_effort
+    from hermes_cli.profiles import list_profile_names
+
+    field = "options" if backend == "model_map" else "profiles"
+    entries = block.get(field)
+    if not isinstance(entries, list):
+        raise InvalidParams(f"{field} must be a list")
+    stored = {row.get("name"): row for row in current.get(field, []) if isinstance(row, dict)}
+    known = set(list_profile_names()) if backend == "profile_routes" else set()
+    rows, names = [], []
+    for entry in entries:
+        if not isinstance(entry, dict):
+            raise InvalidParams("Each route must be an object")
+        name = str(entry.get("name") or "").strip()
+        if not name or name in names:
+            raise InvalidParams("Route names must be nonempty and unique")
+        names.append(name)
+        if backend == "profile_routes":
+            if name not in known:
+                raise InvalidParams(f"Profile {name!r} does not exist")
+            rows.append({"name": name, **({"description": entry["description"].strip()} if entry.get("description", "").strip() else {})})
+            continue
+        source = stored.get(entry.get("original_name") or name, {})
+        # Hidden canonical values survive both edits and renames.
+        row = {key: value for key, value in source.items() if key in ROUTE_KEYS}
+        row.update({key: value for key, value in entry.items() if key in ROUTE_KEYS or key in {"name", "description"}})
+        row["name"] = name
+        for key in ("description", "model", "provider", "base_url", "api_mode"):
+            if key in row:
+                row[key] = str(row[key] or "").strip()
+        if not row.get("description") or not row.get("model") or not (row.get("provider") or row.get("base_url")):
+            raise InvalidParams(f"Route {name!r} needs a description, model and provider or endpoint")
+        for key in ("reasoning_effort", "service_tier"):
+            if key in entry and not entry[key]:
+                row.pop(key, None)
+        effort = row.get("reasoning_effort")
+        if effort and parse_reasoning_effort(effort) is None:
+            raise InvalidParams("Unknown reasoning effort")
+        tier = row.get("service_tier")
+        if tier:
+            try:
+                parsed = parse_exact_service_tier(tier)
+            except ValueError:
+                raise InvalidParams("Unknown service tier") from None
+            if parsed is None or parsed and parsed not in STATIC_TIERS:
+                raise InvalidParams("Unknown service tier")
+        if entry.get("api_key_clear"):
+            row.pop("api_key", None)
+        elif not entry.get("api_key") and source.get("api_key"):
+            row["api_key"] = source["api_key"]
+        if "fallback_providers" in row and not isinstance(row["fallback_providers"], list):
+            raise InvalidParams("fallback_providers must be a list")
+        rows.append(row)
+    default = (block.get("default") or "").strip()
+    if default and default not in names:
+        raise InvalidParams("The default route must be in the list")
+    return {field: rows, **({"default": default} if default else {})}
+
+
+def register(methods) -> None:
+    @methods.method("aux.delegation")
+    def describe(ctx, params):
+        with scoped_home(profile_home_param(params)):
+            return registry(params.get("config") or {})
+
+    @methods.method("aux.delegation_routes")
+    def validate(ctx, params):
+        with scoped_home(profile_home_param(params)):
+            return {"block": clean_routes(params["backend"], params["block"], params["current"])}
+
+    @methods.method("aux.delegation_backend")
+    def select(ctx, params):
+        from hermes_cli.config import get_config_path
+        from agent.delegation_backends import set_global_backend
+        from .config import config_path_param
+
+        with scoped_home(profile_home_param(params)):
+            if get_config_path().resolve() != config_path_param(params).resolve():
+                raise RpcError("Native delegation config path differs from the configured file", condition="config_write_refused")
+            try:
+                set_global_backend(params["backend"])
+            except PermissionError:
+                raise RpcError("config.yaml is package-managed. Update the declarative configuration instead.", condition="config_write_refused") from None
+            except ValueError as exc:
+                raise InvalidParams(str(exc)) from None
+        return {"ok": True}

package/sidecar/talaria_sidecar/methods/gateway.py

@@ -243,6 +243,11 @@ def _run(action: str, home: Path, cli_profile: str | None, ctx: CallContext, *,
 
 
 def register(registry) -> None:
+    @registry.method("gateway.groups")
+    def groups_(ctx: CallContext, params: dict) -> dict:
+        from .groups import groups
+        return groups(ctx, params)
+
     @registry.method("gateway.session")
     def session_(ctx: CallContext, params: dict) -> dict:
         from .gateway_sessions import session

package/sidecar/talaria_sidecar/methods/gateway_sessions.py

@@ -70,6 +70,24 @@ def _control_refusal(home: Path, sid: str) -> str | None:
     return None
 
 
+def _todo_state(value: object) -> dict | None:
+    if not isinstance(value, dict) or not isinstance(value.get("todos"), list):
+        return None
+    fields = {"id": (str, int, float), "text": (str,), "content": (str,), "title": (str,),
+              "status": (str,), "done": (bool,), "completed": (bool,)}
+    revision = value.get("revision", 0)
+    if type(revision) is not int or revision < 0:
+        return None
+    return {"todos": [{k: v for k, v in item.items() if k in fields and type(v) in fields[k]}
+                      for item in value["todos"] if isinstance(item, dict)], "revision": revision}
+
+
+def _event(value: dict) -> dict:
+    if value.get("type") == "todo.updated":
+        return {**value, "payload": _todo_state(value.get("payload")) or {}}
+    return value
+
+
 def _snapshot(value: dict) -> dict:
     # Raw conversation rows contain private principal/admission metadata; the client needs
     # display rows, not those bindings or the inventory's system prompt and credential hint.
@@ -84,7 +102,8 @@ def _snapshot(value: dict) -> dict:
             {"author": reaction["author"], "emoji": reaction["emoji"]} for reaction in reactions
             if isinstance(reaction, dict) and reaction.get("author") in ("user", "agent")
             and isinstance(reaction.get("emoji"), str) and reaction["emoji"] in _REACTION_EMOJIS] if isinstance(reactions, list) else []})
-    return {**value, "messages": rows, "info": {k: v for k, v in value["info"].items() if k in info_keys}}
+    return {**value, "messages": rows, "info": {k: v for k, v in value["info"].items() if k in info_keys},
+            **({"todo_state": _todo_state(value["todo_state"])} if "todo_state" in value else {})}
 
 
 def _refused(state: str, reason: str) -> dict:
@@ -92,7 +111,7 @@ def _refused(state: str, reason: str) -> dict:
 
 
 @asynccontextmanager
-async def _connect(home: Path, endpoint):
+async def _connect(home: Path, endpoint, *, subject: str | None = None):
     from hermes_constants import get_hermes_home
     from hermes_cli.gateway_client import GatewayClientError, connect_gateway
 
@@ -100,7 +119,7 @@ async def _connect(home: Path, endpoint):
     # override is mandatory so its bootstrap ticket cannot fall back to the launch profile.
     if Path(get_hermes_home()).resolve() != home:
         raise GatewayClientError("profile_mismatch")
-    async with connect_gateway(endpoint) as client:
+    async with connect_gateway(endpoint, **({"subject": subject} if subject is not None else {})) as client:
         websocket = client.websocket
         # GatewayClient queues server requests as events. Drain continuously, including
         # during an RPC, so unsupported sudo/secure inputs never wait for a Web renderer.
@@ -211,7 +230,17 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
             subscription = value["subscription_id"]
             if reason := await asyncio.to_thread(_control_refusal, home, sid):
                 raise GatewayRPCError(reason)
-            return {**_snapshot(value), "reactions_supported": _verified_contract(endpoint, "message-reactions-v1")}
+            gauge = None
+            if params["action"] in {"snapshot", "watch"}:
+                try:
+                    stats = await client.rpc("session.stats", session_id=sid)
+                    after = await client.rpc("session.resume", session_id=sid)
+                    if all(value.get(k) == after.get(k) for k in ("session_id", "authority_epoch", "replay_epoch", "execution_generation")):
+                        gauge = stats.get("plan_gauge")
+                except GatewayRPCError:
+                    pass  # older owners have no stats capability
+            return {**_snapshot(value), "plan_gauge": gauge,
+                    "reactions_supported": _verified_contract(endpoint, "message-reactions-v1")}
 
         receipt = lock = None
         try:
@@ -332,7 +361,7 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
                     if (event.get("type") in {"session.updated", "notification.show", "notification.clear"}
                             or event.get("execution_generation") == snap["execution_generation"]
                             or event.get("type") == "session.info" and event.get("payload", {}).get("execution_generation") == snap["execution_generation"]):
-                        ctx.emit("event", event)
+                        ctx.emit("event", _event(event))
                 sequence = replay["last_sequence"]
             ctx.emit("replay_complete", {})
             checked = asyncio.get_running_loop().time()
@@ -386,7 +415,7 @@ async def _run(ctx, params: dict, home: Path, discovery) -> dict:
                 if event.get("seq", 0) <= sequence:
                     continue
                 sequence = event["seq"]
-                ctx.emit("event", event)
+                ctx.emit("event", _event(event))
             return result
         except GatewayRPCError as exc:
             if params["action"] == "react" and str(exc) not in {"invalid_params", "not_found", "permission_denied", "profile_mismatch"}:

package/sidecar/talaria_sidecar/methods/groups.py

@@ -0,0 +1,120 @@
+"""Closed native room operations. Attach only, with the Web principal's own grant."""
+from __future__ import annotations
+
+import asyncio
+import json
+from contextlib import suppress
+
+from ..errors import InvalidParams
+from ..home import profile_home_param
+from .gateway_sessions import _connect, _owner_refusal, _with_owner
+
+_FIELDS = {
+    "capabilities": set(), "list": {"offset", "limit"}, "state": {"room_id", "include_disbanded"},
+    "log": {"room_id", "since_seq", "limit"}, "create": {"room_id", "name", "members"},
+    "rename": {"room_id", "event_id", "name"}, "disband": {"room_id", "cancel_id"},
+    "send": {"room_id", "event_id", "payload"}, "stop": {"room_id", "cancel_id"},
+    "retry": {"room_id", "member_id", "task_id", "execution_generation"},
+    "discard": {"room_id", "member_id", "task_id", "execution_generation"},
+    "approve": {"room_id", "member_id", "task_id", "execution_generation", "request_id", "choice"},
+    "attachment.upload": {"room_id", "upload_id", "kind", "name", "mime", "data_base64"},
+    "attachment.download": {"room_id", "event_id", "attachment_id"},
+}
+_READS = {"capabilities", "list", "state", "log", "attachment.download"}
+_REFUSALS = {"permission_denied", "profile_mismatch", "invalid_params", "stale_generation", "unknown_execution",
+             "unsupported_operation", "session_busy", "runtime_coordination_required"}
+
+
+def _result(state, reason=None, value=None):
+    return {"state": state, "reason": reason, "value": value}
+
+
+async def _run(home, subject, operation, discovery, expected_room=None):
+    from hermes_cli.gateway_client import GatewayRPCError
+    action = operation["action"]
+    method = "groups." + action
+    dispatched = False
+    try:
+        if discovery.state != "ready":
+            return _result("unavailable", "stopped")
+        principal = 'auth:v1:' + json.dumps(['talaria', '', subject], separators=(',', ':'))
+        async with _connect(home, discovery.endpoint, subject=principal) as (client, _):
+            # A native 15 MB attachment expands to 20 MB on the wire. Keep the shared native client,
+            # with a bounded receiver large enough for the owner's supported attachment envelope.
+            client.websocket.protocol.max_size = 24 * 1024 * 1024
+            described = await client.rpc("runtime.describe")
+            if _owner_refusal(described, discovery.endpoint):
+                return _result("unavailable", "unsupported")
+            caps = await client.rpc("groups.capabilities")
+            if (not isinstance(caps, dict) or type(caps.get("driver")) is not bool
+                    or not isinstance(caps.get("methods"), list) or method not in caps["methods"]):
+                return _result("unavailable", "unsupported")
+            if not caps["driver"]:
+                return _result("unavailable", "driver_inactive")
+            if action == "capabilities":
+                return _result("available", value=caps)
+            if expected_room is not None:
+                current = await client.rpc("groups.state", room_id=expected_room["room_id"], include_disbanded=True)
+                room = current.get("room", {})
+                if (room.get("room_id") != expected_room["room_id"]
+                        or room.get("authority_gateway_id") != expected_room["gateway_id"]
+                        or room.get("authority_epoch") != expected_room["authority_epoch"]):
+                    return _result("refused", "refused")
+            if action == "send":
+                operation = {**operation, "payload": {**operation["payload"], "thread_id": operation["event_id"]}}
+            dispatched = True
+            value = await client.rpc(method, **{k: v for k, v in operation.items() if k != "action"}, _timeout=25)
+            if not isinstance(value, dict) or len(json.dumps(value).encode()) > 24 * 1024 * 1024:
+                return _result("unknown" if action not in _READS else "unavailable", "unknown")
+            return _result("available", value=value)
+    except GatewayRPCError as exc:
+        reason = str(exc)
+        # Native errors are data, never public diagnostics. Only fixed refusals prove non-admission.
+        if reason in _REFUSALS:
+            return _result("refused", "refused")
+        if "method" in reason.lower() and not dispatched:
+            return _result("unavailable", "unsupported")
+        return _result("unknown" if dispatched and action not in _READS else "unavailable", "unknown")
+    except Exception:  # noqa: BLE001 - a transport loss never authorizes automatic replay
+        return _result("unknown" if dispatched and action not in _READS else "unavailable", "unknown")
+
+
+async def _read(ctx, coroutine):
+    task = asyncio.create_task(coroutine)
+    try:
+        while not task.done():
+            await asyncio.wait({task}, timeout=.1)
+            ctx.check_cancelled()
+        return await task
+    finally:
+        if not task.done():
+            task.cancel()
+            with suppress(asyncio.CancelledError):
+                await task
+
+
+def groups(ctx, params):
+    operation, subject = params.get("operation"), params.get("subject")
+    if (set(params) - {"profile_home", "subject", "operation", "expected_room"}
+            or not {"profile_home", "subject", "operation"} <= set(params)
+            or not isinstance(subject, str) or not 0 < len(subject) <= 128
+            or not isinstance(operation, dict) or operation.get("action") not in _FIELDS
+            or set(operation) - (_FIELDS[operation["action"]] | {"action"})):
+        raise InvalidParams("invalid room operation")
+    expected = params.get("expected_room")
+    if expected is not None and (not isinstance(expected, dict)
+            or set(expected) != {"room_id", "gateway_id", "authority_epoch"}
+            or expected.get("room_id") != operation.get("room_id")
+            or not isinstance(expected.get("gateway_id"), str)
+            or type(expected.get("authority_epoch")) is not int):
+        raise InvalidParams("invalid room authority fence")
+    home = profile_home_param(params).resolve()
+    ctx.check_cancelled()
+    def run(discovery):
+        coroutine = _run(home, subject, operation, discovery, expected)
+        return _read(ctx, coroutine) if operation["action"] in _READS else coroutine
+    result = _with_owner(home, run)
+    if "value" not in result:
+        return _result("unavailable", "stopped" if result["state"] == "stopped" else "unsupported"
+                       if result["state"] == "incompatible" else "unavailable")
+    return result