fix(gateway): /model off the event loop; distribution allowlist enforced; hindsight env file 0600

[teknium1]

salvage: gateway /model loop offload, distribution_owned enforcement, hindsight env perms

Combines three narrowed community fixes onto main (branch salvage/gateway-misc-fixes).

Fixes #74373

---

1. /model context-length resolution off the gateway event loop — credit @Drexuxux (#74155)

Cherry-picked as-authored: the sync resolve_display_context_length() (route
comparison + provider probe ladder of blocking requests calls) was invoked
directly inside the async /model handlers in gateway/slash_commands.py,
freezing the whole event loop (~2s measured, worse on cold caches). The PR adds
resolve_display_context_length_async() — a thin asyncio.to_thread wrapper
mirroring the existing get_model_context_length_async() /
should_clear_context_pin_async() siblings — and awaits it at both handlers.

Our follow-up commit:

• Covered the missed path: enrich_model_switch_warnings_for_gateway() →
  merge_preflight_compression_warning() still called the sync resolver inline
  at both gateway call sites; both now dispatch via asyncio.to_thread.
• Dropped/replaced: the 4th test used inspect.getsource() on
  gateway.slash_commands (source-reading tests are banned by AGENTS.md).
  Replaced with behavioral tests in
  tests/gateway/test_model_command_context_offload.py that drive the real
  _handle_model_command with a mocked switch pipeline and assert (a) the
  resolver runs off the loop thread and (b) the warning enrichment is
  dispatched through a spied asyncio.to_thread. The other 3 behavioral tests
  from the PR are kept unchanged.

2. distribution_owned allowlist enforcement — credit @webtecnica (#74414, issue #74373)

Cherry-picked only the allowlist-enforcement commit (a329bac):
_copy_dist_payload() iterated every staged entry and never consulted the
manifest's distribution_owned, making the documented allowlist declaration-only.

Dropped: commit 1b82637 (credential_pool/gateway/electron token
write-through) — unrelated to the allowlist bug and introduces a token with no
reader; out of scope for this salvage.

Our follow-up commit fixed two defects in the cherry-picked filter:

• Omitted-list narrowing: the cherry-picked code filtered through
  owned_paths(), which falls back to DEFAULT_DIST_OWNED — so distributions
  that omit distribution_owned (the common case) would silently stop copying
  undeclared-but-legitimate top-level payload. Restored the legacy contract:
  when the list is omitted, everything outside USER_OWNED_EXCLUDE is copied.
  Enforcement now applies only when an explicit allowlist is declared.
• Path-aware matching: the top-level name comparison dropped documented
  nested entries like skills/research/ and cron/digest.json. Explicit
  allowlists are now resolved path-aware: nested entries select exactly that
  subtree/file (siblings under the same parent are not dragged along), and
  traversal segments (.., absolute paths) and USER_OWNED_EXCLUDE roots are
  rejected.
• Regression tests for both (omitted-list legacy behavior, nested-path
  allowlist) on top of the PR's own tests.

On Fixes #74373: yes — the salvaged behavior resolves the issue. The core
defect (allowlist never consulted from the mutation path) is fixed; unlisted
entries are no longer installed or updated when a manifest declares
distribution_owned. The issue's secondary concern (target-only children
removed by wholesale directory replacement) is also addressed by the path-aware
semantics: in the issue's repro (distribution_owned: [SOUL.md]), skills/ is
no longer touched at all, so skills/local-only/ survives update; and authors
can now scope ownership to skills/research/ to keep sibling subtrees
user-owned. Wholesale replacement remains only for paths an author explicitly
declares as distribution-owned, which is the documented ownership boundary the
issue asked to make unambiguous.

3. Hindsight embedded profile env file permissions — credit @carrion256 (#74236)

Reimplemented as a minimal fix confined to plugins/memory/hindsight/
(authored by us with Co-authored-by: carrion256 <carrion256@proton.me>):
_materialize_embedded_profile_env() wrote the plaintext
HINDSIGHT_API_LLM_API_KEY via bare write_text(), leaving the file with
umask-derived (typically world-readable) permissions.

• File is created/truncated via os.open(..., O_CREAT|O_TRUNC, 0o600); a
  pre-existing file is chmod'd to 0600 before the new secret bytes land.
• Post-write validation on POSIX verifies 0600 (with one chmod retry) and
  raises PermissionError otherwise.
• On validation failure the secret file is unlinked — no plaintext key is left
  behind with unverified permissions.
• Perms regression tests in tests/plugins/memory/test_hindsight_env_perms.py
  (fresh write under a permissive umask, tightening an existing 0644 file,
  cleanup on validation failure).

Dropped from the PR: the core utils.py atomic-replace opt-out
(allow_copy_fallback=False) and the mkstemp/fsync/atomic-rename machinery
plus the daemon-restart metadata plumbing built on it — that changes a shared
core utility for a plugin-local concern and violates the plugin-boundary rule
(plugin fixes touch only plugins/ + tests/plugins/). The 0600 + cleanup
guarantee is achieved without it.

---

Verification

• tests/hermes_cli/test_model_switch_context_offload.py,
  tests/gateway/test_model_command_context_offload.py,
  tests/gateway/test_model_command_async_offload.py,
  tests/gateway/test_model_switch_persistence.py,
  tests/hermes_cli/test_profile_distribution.py,
  tests/plugins/memory/ — 288 passed.
• ruff check clean on all touched files.
• Branch rebased onto current origin/main before push.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on dfef31e}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

3 visual diffs.

_{inline evidence upload failed.}

Failed to upload diff-1508682a2ae8-boot-ready-diff.png with gh image (exit code 1): Error uploading /home/runner/work/_temp/e2e-evidence/diff-1508682a2ae8-boot-ready-diff.png: step 0 (get upload token): uploadToken not found on repo page — do you have write access to NousResearch/hermes-agent? (or, if NousResearch enforces SAML SSO, authorize at https://github.com/orgs/NousResearch/sso)

[webtecnica]

Thanks @teknium1 for the salvage — the allowlist enforcement from #74414 landed cleanly, and the follow-ups (omitted-list legacy behavior + path-aware matching) are solid improvements over my original. Appreciate the credit! 🙏