@maudecode/talaria-web 1.21.0 → 1.23.2

package/sidecar/talaria_sidecar/methods/memory.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from contextlib import contextmanager
 import errno
 import hashlib
 import os
@@ -45,22 +46,45 @@ def _digest(path: Path) -> str | None:
         return hashlib.sha256(handle.read()).hexdigest()
 
 
+@contextmanager
+def file_lock(path: Path, *, parent_fd=None):
+    """The native memory lock, with an anchored opening for descriptor-relative publishers."""
+    if parent_fd is None:
+        from tools.memory_tool_store import MemoryStore
+        native = getattr(MemoryStore, '_file_lock', None)
+        with native(path) if native else _SAVE_LOCK:
+            yield
+        return
+    import fcntl
+    # Same persistent .lock inode and flock protocol as MemoryStore._file_lock; never re-resolve its parent.
+    with _SAVE_LOCK:
+        fd = os.open(path.name + '.lock', os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600, dir_fd=parent_fd)
+        with os.fdopen(fd, 'r+') as lock:
+            info = os.fstat(lock.fileno())
+            if not stat.S_ISREG(info.st_mode) or info.st_nlink != 1:
+                raise OSError('Unsafe memory lock')
+            os.fchmod(lock.fileno(), 0o600)
+            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                fcntl.flock(lock.fileno(), fcntl.LOCK_UN)
+
+
 def write(home: Path, section: str, base: str, content: str) -> dict:
     """Replace ``section``'s file with ``content`` only while its bytes still hash to ``base``, the server's read.
 
     Each file is checked and written under the Agent's own per-file lock (``<file>.lock``), so neither a memory tool
     call nor a concurrent save can land between the two; an Agent without the lock helper gets this sidecar's lock.
     """
-    from tools.memory_tool_store import MemoryStore
     from utils import atomic_write_text
 
     if section not in ("memory", "user", "soul"):
         raise InvalidParams("section must be memory, user, or soul")
     # The files the server read: SOUL.md in the profile home, MEMORY.md / USER.md in its memories folder.
     path = home / "SOUL.md" if section == "soul" else home / "memories" / ("USER.md" if section == "user" else "MEMORY.md")
-    file_lock = getattr(MemoryStore, "_file_lock", None)
     try:
-        with file_lock(path) if file_lock else _SAVE_LOCK:
+        with file_lock(path):
             if _digest(path) != base:
                 return {"written": False}
             atomic_write_text(path, content, tmp_prefix=".mem_", preserve_mode=True)

package/sidecar/talaria_sidecar/methods/nous_account.py

@@ -0,0 +1,130 @@
+"""Safe, read-only account/handoff projection shared by OAuth and provider status.
+
+The Agent owns the record and retry worker. This bounded display cache only retains a
+confirmed view across read failures, keyed by the current profile and account.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+import threading
+from collections import OrderedDict
+from pathlib import Path
+from typing import Any
+
+_LAST: OrderedDict[str, dict] = OrderedDict()
+_LOCK = threading.RLock()
+_STATES = {"idle", "pending", "retrying", "claimed", "gone", "failed", "paused"}
+_ERRORS = {"client_not_allowed", "account_locked", "invalid_request", "retry_window_ended"}
+
+
+def _identity(home: Path) -> tuple[str, str | None] | None:
+    from hermes_cli.anon_auth import is_guest_state
+    from hermes_cli.auth import get_provider_auth_state
+
+    state = get_provider_auth_state("nous")
+    if not isinstance(state, dict) or is_guest_state(state):
+        return None
+    return _token_identity(home, state.get("access_token"))
+
+
+def _token_identity(home: Path, token: Any) -> tuple[str, str | None] | None:
+    from hermes_cli.auth_constants import _decode_jwt_claims
+
+    claims = _decode_jwt_claims(token)
+    subject = claims.get("sub")
+    if not isinstance(subject, str) or not subject:
+        return None
+    identity = hashlib.sha256(f"{home.resolve()}\0{subject}".encode()).hexdigest()
+    email = claims.get("email")
+    if not isinstance(email, str) or not re.fullmatch(r"[^@\s]+@[^@\s]+\.[^@\s]+", email) or len(email) > 254:
+        return identity, None
+    local, domain = email.rsplit("@", 1)
+    return identity, f"{local[0]}***@{domain}"
+
+
+def _apps(value: Any) -> list[str]:
+    if not isinstance(value, (list, tuple)):
+        return []
+    return list(dict.fromkeys(v for v in value[:100] if isinstance(v, str) and re.fullmatch(r"[a-z0-9][a-z0-9_-]{0,63}", v)))
+
+
+def read(home: Path, completed: Any = None) -> dict | None:
+    """One sequential read owner for flow/provider consumers, called under scoped_home."""
+    with _LOCK:
+        return _read(home, completed)
+
+
+def _read(home: Path, completed: Any = None) -> dict | None:
+    """No provisioning, refresh, drain, or retry dispatch."""
+    try:
+        from hermes_cli import guest_handoff as native
+    except ImportError:
+        return None  # older Agents keep generic success
+    try:
+        identity = _identity(home)
+    except Exception:  # no current identity proof means no cached account may be displayed
+        return None
+    if identity is None:
+        return None
+    account_id, email = identity
+    try:
+        status = native.handoff_status()
+        if status.get("state") == "idle" and completed is not None:
+            status = getattr(completed, "handoff_status", None) or status
+        state = status.get("state") if status.get("state") in _STATES else "unknown"
+        # The public native read only fences *active* records. Prove terminal ownership
+        # with the same native selector/binding helper before exposing any old app names.
+        if state not in {"idle", "unknown", "paused"}:
+            records = native._load(native._records_path())["records"].values()
+            mine = [r for r in records if native._home_key() in r.get("profiles", ())]
+            record = max(mine, key=lambda r: str(r.get("updated_at") or "")) if mine else None
+            if record is not None and native._status_of(record) != status:
+                raise RuntimeError("Native handoff changed during read")
+            if record is None or native._account_bound_to(record) is None:
+                state = "paused" if record else "unknown"
+        safe = {"state": state, "account_email": email,
+                "connectors_kind": status.get("connectors_kind") if status.get("connectors_kind") in {"moved", "swapped", "none", "conflict"} else None,
+                "moved_toolkits": _apps(status.get("moved_toolkits")) if state == "claimed" else [],
+                "dropped_toolkits": _apps(status.get("dropped_toolkits")) if state == "claimed" else [],
+                "probably_moved": status.get("probably_moved") is True,
+                "error": status.get("error") if status.get("error") in _ERRORS else None}
+        lines = native.wire_status(safe)["lines"] if state != "unknown" else ["Connected-app transfer status is unknown."]
+        if _identity(home) != identity:
+            return None
+        view = {"account_id": account_id, "email": email, "state": state, "lines": lines,
+                "moved": safe["moved_toolkits"], "dropped": safe["dropped_toolkits"],
+                "reconnect": safe["dropped_toolkits"],
+                "poll_after": 5 if state in {"pending", "retrying", "unavailable"} else None}
+        with _LOCK:
+            _LAST[account_id] = view
+            _LAST.move_to_end(account_id)
+            while len(_LAST) > 32:
+                _LAST.popitem(last=False)
+        return view
+    except Exception:  # raw native records and exception details never cross this boundary
+        try:
+            if _identity(home) != identity:
+                return None
+        except Exception:
+            return None
+        with _LOCK:
+            previous = _LAST.get(account_id)
+        return {**(previous or {"account_id": account_id, "email": email, "moved": [], "dropped": [], "lines": []}),
+                "state": "unavailable", "reconnect": [], "poll_after": 5,
+                "lines": [*(previous or {}).get("lines", []), "Connected-app transfer status is unavailable."]}
+
+
+def connector_headers(home: Path, account_id: str, url: str) -> dict:
+    """The native connector client reads this on every request, never provisioning or refreshing."""
+    from tools.managed_gateway_auth import managed_gateway_auth_headers
+    from tools.managed_tool_gateway import peek_nous_access_token
+
+    def token():
+        value = peek_nous_access_token()
+        current, bearer = _identity(home), _token_identity(home, value)
+        if current is None or bearer is None or current[0] != account_id or bearer[0] != account_id:
+            return None
+        return value
+
+    return managed_gateway_auth_headers(url, token_reader=token)

package/sidecar/talaria_sidecar/methods/oauth.py

@@ -26,7 +26,7 @@ from typing import Any, Callable
 from ..errors import InvalidParams, RpcError
 from ..home import profile_home_param, scoped_home
 from ..rpc import CallContext
-from . import plugin_oauth
+from . import plugin_oauth, nous_account
 
 log = logging.getLogger("talaria_sidecar.oauth")
 
@@ -65,6 +65,7 @@ class Flow:
     # The credential is saved but the sign-in has not finished (a guest sign-in still settles the account): a cancel or
     # an expiry can no longer undo it, and the flow stays pending until its own ending.
     committed: bool = False
+    nous_account_id: str | None = None
     # A browser sign-in also finishes from the redirect address the user pastes (``oauth.submit_redirect``).
     submit: Callable[[str], None] | None = None
     # Set once a browser sign-in's loopback listener is closed, so a replacing start can bind the same fixed port.
@@ -78,7 +79,12 @@ class Flow:
         self.status, self.error, self.ended_at = status, error, time.time()
 
     def view(self) -> dict:
-        return {"flow_id": self.flow_id, "provider": self.provider, "status": self.status, "error": self.error}
+        view = {"flow_id": self.flow_id, "provider": self.provider, "status": self.status, "error": self.error}
+        if self.status == "approved" and self.nous_account_id:
+            with scoped_home(self.home):
+                account = nous_account.read(self.home)
+            view["nous_account"] = account if account and account["account_id"] == self.nous_account_id else None
+        return view
 
 
 class _Watched:
@@ -156,6 +162,9 @@ def _nous_begin() -> tuple[dict, dict]:
 
     # v0.22.0 replaced ``guest_enabled`` with ``guest_allowed``; 0.21.x releases only have the former.
     guest_gate = getattr(anon_auth, "guest_allowed", None) or getattr(anon_auth, "guest_enabled")
+    native = getattr(anon_auth, "run_sign_in", None)
+    if native and "replace_account" in inspect.signature(native).parameters:
+        return _nous_sign_in(anon_auth)
     if guest_gate() and anon_auth.has_guest():
         # The native sign-in owns the guest's connector handoff for its installed protocol.
         if hasattr(anon_auth, "run_sign_in"):
@@ -191,6 +200,9 @@ def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
             yield may_persist
             if may_persist:
                 flow.committed = True
+                # Bind before native handoff/settlement releases this account to another sign-in.
+                account = nous_account.read(flow.home)
+                state["nous_account_id"] = account["account_id"] if account else None
 
     def scope():
         flow = state.get("flow")
@@ -198,11 +210,13 @@ def _nous_sign_in(anon_auth: Any) -> tuple[dict, dict]:
 
     # Older Agents use promotion; v0.22.5 removed its option in favor of plain device login and native handoff.
     options = {"cancel_wins_after_promotion": True} if "cancel_wins_after_promotion" in inspect.signature(anon_auth.run_sign_in).parameters else {}
+    if "replace_account" in inspect.signature(anon_auth.run_sign_in).parameters:
+        options["replace_account"] = True
     sign_in = anon_auth.run_sign_in(cancelled=cancelled, persist_guard=persist_guard, scope=scope, **options)
     first = next(sign_in)
     if first.kind != "code":
         sign_in.close()
-        raise RpcError(first.copy_terminal, condition="oauth_unsupported" if first.precondition else "oauth_failed")
+        raise RpcError(first.copy, condition="oauth_unsupported" if first.precondition else "oauth_failed")
     state["sign_in"] = sign_in
     return {"user_code": first.code, "verification_url": first.link, "expires_in": first.expires_in, "interval": first.interval}, state
 
@@ -226,6 +240,8 @@ def _nous_wait(flow: Flow, state: dict) -> dict:
             sign_in.close()
         if not ended.ok:
             raise _SignInEnded(ended)
+        with scoped_home(flow.home):
+            nous_account.read(flow.home, ended)
         return {}
     from hermes_cli.auth import _poll_for_token
 
@@ -406,6 +422,7 @@ def _run(flow: Flow, wait: Callable[[Flow, dict], dict], save: Callable[[Flow, d
                 return
             with scoped_home(flow.home):
                 save(flow, state, tokens)
+            flow.nous_account_id = state.get("nous_account_id")
             flow.end("approved")
         log.info("oauth: %s sign-in approved (flow=%s)", flow.provider, flow.flow_id[:6])
     except _Stop:
@@ -556,7 +573,11 @@ def register(reg) -> None:
 
     @reg.method("oauth.poll", requires_agent=False)
     def poll_(ctx: CallContext, params: dict) -> dict:
-        return poll(profile_home_param(params), _flow_id(params))
+        home, flow_id = profile_home_param(params), _flow_id(params)
+        flow = _flow(home, flow_id)
+        if flow.status == "approved" and flow.nous_account_id:
+            reg.runtime.ensure_current()  # a retired worker cannot promise background progress
+        return poll(home, flow_id)
 
     @reg.method("oauth.cancel", requires_agent=False)
     def cancel_(ctx: CallContext, params: dict) -> dict:

package/sidecar/talaria_sidecar/methods/outbound_drafts.py

@@ -27,25 +27,7 @@ _STATES = {'draft', 'approved', 'sent', 'saved', 'failed', 'discarded'}
 
 
 def _producer(home):
-    """Native registration, explicit profile consent and reviewed source, without loading a plugin."""
-    try:
-        from hermes_cli import plugins_cmd as pc
-        metadata = pc._read_install_metadata()
-        for plugin in dashboard_plugins._plugins(home):
-            if plugin['name'] != 'draft-cards' or not plugin['enabled'] or plugin.get('source') != 'user':
-                continue
-            root, anchor = Path(plugin['_dir']).parent, Path(plugin['_asset_anchor'])
-            record = metadata.get(root.name, {})
-            catalog = record.get('catalog', {})
-            if catalog.get('name') != 'draft-cards' or catalog.get('sha') != _PIN or record.get('revision') != _PIN:
-                continue
-            if not all((body := dashboard_plugins._read(root, name, anchor=anchor)) is not None
-                       and hashlib.sha256(body).hexdigest() == digest for name, digest in _SOURCES.items()):
-                continue
-            return _PIN
-    except (ImportError, AttributeError, OSError, ValueError, TypeError):
-        pass
-    return None
+    return dashboard_plugins.reviewed_producer(home, 'draft-cards', _PIN, _SOURCES)
 
 
 def _database(home):

package/sidecar/talaria_sidecar/methods/plugin_catalog.py

@@ -27,9 +27,14 @@ def _agent():
         return None
 
 
-def _refusal(entry, pc, native):
+def _refusal(entry, pc, native, *, removed_entries=None):
     try:
-        native.raise_if_removed(entry.name, entry.repo)
+        if removed_entries is None:
+            native.raise_if_removed(entry.name, entry.repo)
+        else:
+            from hermes_cli.plugin_catalog import match_removed
+            if any(match_removed(value, removed_entries) for value in (entry.name, entry.repo)):
+                return 'This plugin was removed from the catalog.'
         native._refuse_unsupported_catalog_platform(entry)
         from hermes_cli.plugins_manifest import requires_hermes_error
         reason = requires_hermes_error({'requires_hermes': entry.requires_hermes})
@@ -196,3 +201,69 @@ def install(name, consent_token=None):
             del _receipts[next(iter(_receipts))]
         _receipts[token] = {'identity': identity, 'preview': preview, 'expires': time.monotonic() + 300}
     return {'name': name, 'status': 'needs_consent', 'findings': findings, 'consent_token': token}
+
+
+def reviewed_importer(home):
+    """Load only attested native structured APIs, sharing catalog identity and enablement policy."""
+    import sys
+    import types
+    from . import dashboard_plugins
+    reviewed = json.loads((Path(__file__).parents[2] / 'agent_importer.json').read_text())
+    pin, hashes = reviewed['revision'], reviewed['files']
+    # Older Agent config imports initialize files. Check the pure in-tree catalog before importing their command owner.
+    try:
+        from hermes_cli import plugin_catalog as source
+        entry = next((e for e in source.load_catalog() if e.name == 'agent-importers'), None)
+        if entry is None or entry.sha != pin:
+            return None
+    except (ImportError, AttributeError, OSError, ValueError):
+        return None
+    agent = _agent()
+    if agent is None or not dashboard_plugins._supported():
+        return None
+    source, pc, native = agent
+    try:
+        from pm.workspace import enabled_plugin_dirs
+        from hermes_cli.web_server_dashboard import _plugin_enable_sets_here
+        enabled, disabled = _plugin_enable_sets_here()
+        if not (Path(home) / 'plugins').is_dir():
+            return None
+        metadata = pc._read_install_metadata()
+        matches = [(key, record) for key, record in metadata.items() if isinstance(record, dict)
+                   and isinstance(record.get('catalog'), dict) and record['catalog'].get('name') == 'agent-importers']
+        if len(matches) != 1:
+            return None
+        key, record = matches[0]
+        root = pc._sanitize_plugin_name(key, Path(home) / 'plugins')
+        # Admission must not fetch or populate the profile's live catalog cache on a preview.
+        cached = dashboard_plugins._read(Path(home), 'cache/plugin-catalog.json', 4 * 1024 * 1024, anchor=Path(home))
+        if cached is None and ((Path(home) / 'cache/plugin-catalog.json').exists() or (Path(home) / 'cache/plugin-catalog.json').is_symlink()):
+            return None
+        cached = json.loads(cached) if cached is not None else {}
+        if not isinstance(cached, dict) or not isinstance(cached.get('entries', []), list):
+            return None
+        if any(e.get('name') == 'agent-importers' and e.get('sha') != pin for e in cached.get('entries', []) if isinstance(e, dict)):
+            return None
+        removed = source.load_removed_list() + source._removed_from_list(cached.get('removed'))
+        if (entry is None or entry.sha != pin or _refusal(entry, pc, native, removed_entries=removed)
+                or record.get('revision') != pin or record['catalog'].get('sha') != pin
+                or record['catalog'].get('repo') != entry.repo
+                or key not in enabled or key in disabled or root.resolve() not in {p.resolve() for p in enabled_plugin_dirs()}):
+            return None
+        bodies = {name: dashboard_plugins._read(root, name, anchor=Path(home)) for name in hashes}
+        if any(body is None or hashlib.sha256(body).hexdigest() != hashes[name] for name, body in bodies.items()):
+            return None
+        # Compile verified bytes, never re-open a mutable plugin path or execute its entry point.
+        package = '_talaria_reviewed_agent_importers'
+        if package not in sys.modules:
+            module = types.ModuleType(package)
+            module.__path__ = []
+            sys.modules[package] = module
+            for name in ('importer', 'sync'):
+                module = types.ModuleType(f'{package}.{name}')
+                module.__package__ = package
+                sys.modules[module.__name__] = module
+                exec(compile(bodies[name + '.py'], f'<reviewed-agent-importers/{name}.py>', 'exec'), module.__dict__)
+        return sys.modules[package + '.importer'].AgentImporter, sys.modules[package + '.sync'], [pin, str(root), _tree_digest(root)]
+    except (ImportError, AttributeError, OSError, ValueError, TypeError, RpcError):
+        return None

package/sidecar/talaria_sidecar/methods/providers.py

@@ -228,6 +228,18 @@ def _unavailable_plugin(provider_id: str) -> bool:
     return not any(p is profile for _name, p in installed_plugin_profiles())
 
 
+def require_runtime_ownership(requested: str | None) -> None:
+    """A process-wide Agent registry must not lend another home's plugin to this runtime."""
+    if not requested:
+        return
+    try:
+        if not _unavailable_plugin(requested.strip().lower()):
+            return
+    except Exception:  # noqa: BLE001 - an unverified plugin owner cannot authorize execution
+        log.debug("runtime plugin ownership check failed", exc_info=True)
+    raise RpcError("Requested provider is unavailable in this profile", condition="credential_missing")
+
+
 def _agent_knows_provider(name: str) -> bool:
     """Whether the Agent's auth layer can resolve this provider id at all.
 
@@ -323,6 +335,35 @@ def model_ids(provider_id: str, *, force_refresh: bool) -> tuple[list[str], bool
         return [], False
 
 
+def model_allowance_snapshot(provider_id: str, *, force_refresh: bool) -> dict:
+    """Native picker metadata in this call's scoped home; no billing write or second usage poll."""
+    if provider_id != "nous":
+        return {}
+    try:
+        from hermes_cli.inventory import build_model_options_payload, load_picker_context
+        from hermes_cli.model_picker_usage import nous_picker_usage
+    except ImportError:
+        return {"metadata_status": "unsupported"}
+    try:
+        payload = build_model_options_payload(load_picker_context(), refresh=force_refresh)
+        row = next((r for r in payload.get("providers", []) if r.get("slug") == provider_id), {})
+        pending = row.get("pricing_pending") is True or row.get("free_tier_pending") is True
+        plan = row.get("plan_usage")
+        fresh = nous_picker_usage() if isinstance(plan, dict) else None
+        return {
+            "metadata_status": "pending" if pending else "stale" if plan and fresh is None else "current",
+            "plan_usage": plan if isinstance(plan, dict) else None,
+            "usage_levels": {mid: level for mid, level in (row.get("usage_levels") or {}).items()
+                             if isinstance(mid, str) and level in ("free", "low", "medium", "top_tier")},
+            "unavailable_model_ids": [mid for mid in row.get("unavailable_models", []) if isinstance(mid, str)] if not pending else [],
+            "allowance_pending": pending,
+            "free_tier": row.get("free_tier") if isinstance(row.get("free_tier"), bool) else None,
+        }
+    except Exception:  # noqa: BLE001 - unknown entitlement is not unavailability
+        log.debug("native picker allowance unavailable", exc_info=True)
+        return {"metadata_status": "error"}
+
+
 def _requests_local_runtime(requested: str | None) -> bool:
     """Whether a resolution asks for the Agent's managed llama.cpp provider, picked the way the Agent picks it: the
     named provider, else the profile's, else ``HERMES_INFERENCE_PROVIDER``."""
@@ -367,6 +408,7 @@ def local_models() -> dict:
 
 
 def resolve_runtime(*, requested: str | None, api_key: str | None, base_url: str | None, target_model: str | None) -> dict:
+    require_runtime_ownership(requested)
     try:
         from hermes_cli.runtime_provider import format_runtime_provider_error, resolve_runtime_provider
     except Exception as exc:  # noqa: BLE001
@@ -535,6 +577,13 @@ def register(reg) -> None:
         with scoped_home(profile_home_param(params)):
             return {"providers": registry()}
 
+    @reg.method("providers.nous_account")
+    def nous_account_(ctx: CallContext, params: dict) -> dict:
+        from . import nous_account
+        home = profile_home_param(params)
+        with scoped_home(home):
+            return {"nous_account": nous_account.read(home)}
+
     @reg.method("providers.auth_status")
     def auth(ctx: CallContext, params: dict) -> dict:
         with scoped_home(profile_home_param(params)):
@@ -547,7 +596,8 @@ def register(reg) -> None:
             raise InvalidParams("provider is required")
         with scoped_home(profile_home_param(params)):
             ids, fallback = model_ids(provider, force_refresh=bool(params.get("force_refresh", False)))
-            return {"provider": provider, "model_ids": ids, "fallback": fallback}
+            return {"provider": provider, "model_ids": ids, "fallback": fallback,
+                    **model_allowance_snapshot(provider, force_refresh=bool(params.get("force_refresh", False)))}
 
     @reg.method("providers.local_models")
     def local(ctx: CallContext, params: dict) -> dict:

package/sidecar/talaria_sidecar/methods/skill_revisions.py

@@ -0,0 +1,177 @@
+"""Read the reviewed Hermetic store without executing its API or migrating legacy data."""
+from contextlib import contextmanager
+from datetime import datetime, timezone
+import difflib
+import hashlib
+import itertools
+import json
+import os
+from pathlib import Path
+import re
+import stat
+
+from ..errors import InvalidParams
+from . import dashboard_plugins
+
+_PIN = 'f7026c949d8831b26910f2ebd3434e8c58cdff89'
+_SOURCES = {
+    '__init__.py': '9dfb815be185965bf06c7c5a0fec401f6f376569d1a6830497502898fffcf01d',
+    'plugin.yaml': 'b4fbd03f70f50d2cc391e530b3e4079ecbe249ab6e5c2e4702d475911327b50e',
+    'dashboard/manifest.json': '466cada1eb3345f6fa7e12a5eaef44f8a19bb02546b9456fa0576d81ff89b6c1',
+    'dashboard/plugin_api.py': '23f1c612559f0086ff5c7da6d3cc8fe0c596a05c6f6eaa89db94c8c4d8c99d1d',
+}
+_NAME = re.compile(r'[A-Za-z0-9][A-Za-z0-9._ -]{0,127}')
+_FILE = re.compile(r'([a-f0-9]{16})-SKILL[.]md')
+_MAX_TEXT = 32 * 1024
+_MAX_REVISIONS = 64
+
+
+@contextmanager
+def _directory(anchor, parts=()):
+    """Hold every traversal no-follow, including the profile's ancestors, through the read."""
+    anchor = Path(anchor).absolute()
+    components = (*anchor.parts[1:], *parts)
+    if any(p in ('', '.', '..') or '/' in p or '\\' in p for p in components):
+        raise ValueError('Invalid history path')
+    fd = os.open(anchor.anchor, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)
+    try:
+        for part in components:
+            child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+            os.close(fd)
+            fd = child
+        yield fd
+    finally:
+        os.close(fd)
+
+
+def _read(fd, name, limit):
+    child = os.open(name, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK, dir_fd=fd)
+    with os.fdopen(child, 'rb') as file:
+        info = os.fstat(file.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_size > limit:
+            raise ValueError('History file is too large or not regular')
+        data = file.read(limit + 1)
+        if len(data) > limit:
+            raise ValueError('History file is too large')
+        return data, info.st_mtime
+
+
+def _timestamp(value):
+    try:
+        date = datetime.fromtimestamp(value, timezone.utc) if type(value) in (int, float) else datetime.fromisoformat(value.replace('Z', '+00:00'))
+        return date.astimezone(timezone.utc).isoformat() if date.tzinfo else None
+    except (TypeError, ValueError, OverflowError, OSError, AttributeError):
+        return None
+
+
+def _result(state, reason=None, **fields):
+    return dict(state=state, reason=reason, backend_revision=None, revisions=[], selected=None,
+                comparison=None, replay_available=False) | fields
+
+
+def _identity(catalog, name):
+    entries = catalog(skip_disabled=True, include_hidden=True)
+    matches = [entry for entry in entries if entry.get('load_name') == name]
+    if len(matches) != 1:
+        return None
+    selected = matches[0]
+    declared = selected.get('name')
+    # Hermetic keys storage by declared name; two catalog copies cannot be attributed safely.
+    if not isinstance(declared, str) or not _NAME.fullmatch(declared) or '..' in declared:
+        return None
+    return selected if len([entry for entry in entries if entry.get('name') == declared]) == 1 else None
+
+
+def inspect_revisions(home, name, revision=None, compare_to=None):
+    from .skills import _skill_helper
+
+    if not isinstance(name, str) or not 0 < len(name) <= 256:
+        raise InvalidParams('Invalid skill identity')
+    if any(v is not None and (not isinstance(v, str) or not re.fullmatch('[a-f0-9]{64}', v)) for v in (revision, compare_to)):
+        raise InvalidParams('Invalid revision identity')
+    if not getattr(os, 'O_NOFOLLOW', 0) or not dashboard_plugins.reviewed_producer(home, 'hermetic', _PIN, _SOURCES):
+        return _result('unavailable', 'backend_unavailable')
+    try:
+        catalog = _skill_helper('skill_catalog')
+        selected = _identity(catalog, name) if catalog else None
+        if selected is None:
+            return _result('unavailable', 'identity_unavailable')
+        declared = selected['name']
+        local = Path(selected['path']).relative_to(home / 'skills')
+        if local.name != 'SKILL.md':
+            raise ValueError('Not a local skill')
+        with _directory(home, ('skills', *local.parts[:-1])) as fd:
+            current, _ = _read(fd, 'SKILL.md', _MAX_TEXT)
+        provenance = {}
+        with _directory(home, ('skills',)) as fd:
+            try:
+                ledger, _ = _read(fd, '.curator_ledger.jsonl', 256 * 1024)
+            except FileNotFoundError:
+                ledger = b''
+        for line in ledger.decode('utf-8').splitlines():
+            row = json.loads(line)
+            if not isinstance(row, dict):
+                raise ValueError('Invalid ledger')
+            if row.get('skill') == declared:
+                after = row.get('after') or []
+                if not isinstance(after, list):
+                    raise ValueError('Invalid ledger provenance')
+                for item in after:
+                    if isinstance(item, dict) and isinstance(item.get('sha256'), str):
+                        actor = row.get('actor')
+                        actor = actor if isinstance(actor, str) and len(actor) <= 80 and not any(ord(c) < 32 for c in actor) else None
+                        provenance[item['sha256']] = (_timestamp(row.get('ts')), actor)
+        try:
+            with _directory(home, ('hermetic', 'skill-versions', declared)) as fd:
+                with os.scandir(fd) as iterator:
+                    files = list(itertools.islice(iterator, _MAX_REVISIONS + 1))
+                if len(files) > _MAX_REVISIONS:
+                    raise ValueError('Too many revisions')
+                rows = []
+                for file in files:
+                    match = _FILE.fullmatch(file.name)
+                    if not match:
+                        continue
+                    data, modified = _read(fd, file.name, _MAX_TEXT)
+                    sha = hashlib.sha256(data).hexdigest()
+                    if not sha.startswith(match[1]):
+                        raise ValueError('Revision hash does not match saved bytes')
+                    text = data.decode('utf-8')
+                    if len(text.splitlines()) > 512:
+                        raise ValueError('Too many revision lines')
+                    saved_at, actor = provenance.get(sha, (_timestamp(modified), None))
+                    identity = hashlib.sha256(json.dumps([str(home), name, sha]).encode()).hexdigest()
+                    rows.append(dict(id=identity, sha256=sha, label=sha[:12], saved_at=saved_at, actor=actor,
+                                     current=sha == hashlib.sha256(current).hexdigest(), content=text))
+        except FileNotFoundError:
+            rows = []
+        if not rows:
+            if revision or compare_to:
+                raise InvalidParams('Revision no longer exists; reload history')
+            return _result('missing', 'history_unavailable', backend_revision=_PIN)
+        rows.sort(key=lambda row: (row['saved_at'] or '', row['sha256']), reverse=True)
+        by_id = {row['id']: row for row in rows}
+        target = by_id.get(revision) if revision else rows[0]
+        if target is None:
+            raise InvalidParams('Revision no longer exists; reload history')
+        source = by_id.get(compare_to) if compare_to else next((r for r in rows if r['id'] != target['id']), None)
+        if compare_to and source is None:
+            raise InvalidParams('Revision no longer exists; reload history')
+        comparison = None
+        if source:
+            lines = difflib.unified_diff(source['content'].splitlines(keepends=True), target['content'].splitlines(keepends=True),
+                                        fromfile=source['label'], tofile=target['label'])
+            diff = ''.join(line if line.endswith('\n') else line + '\n\\n' for line in lines)
+            comparison = dict(from_revision=source['id'], to_revision=target['id'], diff=diff)
+        # Native admission can be revoked while filesystem reads are in progress.
+        if not dashboard_plugins.reviewed_producer(home, 'hermetic', _PIN, _SOURCES):
+            return _result('unavailable', 'backend_unavailable')
+        if _identity(catalog, name) != selected:
+            return _result('unavailable', 'identity_unavailable')
+        return dict(state='available', reason=None, backend_revision=_PIN,
+                    revisions=[{k: v for k, v in row.items() if k != 'content'} for row in rows],
+                    selected=dict(revision=target['id'], content=target['content']), comparison=comparison, replay_available=False)
+    except InvalidParams:
+        raise
+    except (ImportError, AttributeError, OSError, ValueError, TypeError, KeyError):
+        return _result('unavailable', 'invalid_history')