talon-agent 1.12.0 → 1.34.0

package/src/backend/claude-sdk/options.ts

@@ -5,25 +5,30 @@
  * MCP servers, system prompt) into the Options shape expected by the SDK.
  */
 
-import { resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+import { SYSTEM_PROMPT_DYNAMIC_BOUNDARY } from "@anthropic-ai/claude-agent-sdk";
 import type {
   Options,
   PostToolBatchHookInput,
+  PostToolUseFailureHookInput,
   NotificationHookInput,
   StopFailureHookInput,
   HookCallback,
   HookJSONOutput,
 } from "@anthropic-ai/claude-agent-sdk";
+import type { PreparedSystemPrompt } from "../shared/system-prompt.js";
 import { getSession } from "../../storage/sessions.js";
 import { getChatSettings } from "../../storage/chat-settings.js";
-import { getPluginMcpServers } from "../../core/plugin.js";
-import { resolveModelId } from "../../core/models.js";
-import { wrapMcpServer } from "../../util/mcp-launcher.js";
+import { resolveModelId } from "../../core/models/catalog.js";
 import { isTurnTerminator } from "../../core/tools/index.js";
+import {
+  talonHubUrl,
+  pluginHubUrl,
+  hubPluginServerNames,
+} from "../../core/mcp-hub/index.js";
+import { nonTerminalFrontends, frontendsForChat } from "../shared/frontends.js";
 import { log, logError } from "../../util/log.js";
 import { getConfig, getBridgePort } from "./state.js";
-import { DISALLOWED_TOOLS_CHAT, EFFORT_MAP } from "./constants.js";
+import { ALLOWED_TOOLS_CHAT, EFFORT_MAP } from "./constants.js";
 
 // ── Types ────────────────────────────────────────────────────────────────────
 
@@ -48,123 +53,189 @@ export type BuildSdkOptionsResult = {
  * should wrap in try/catch and treat as "no frontends available").
  */
 export function getActiveFrontends(): readonly string[] {
-  const config = getConfig();
-  const allFrontends = Array.isArray(config.frontend)
-    ? config.frontend
-    : [config.frontend];
-  return allFrontends.filter((f) => f !== "terminal");
+  return nonTerminalFrontends(getConfig().frontend);
 }
 
+/** Hub-backed MCP server entry — the SDK's `type: "http"` config. */
+export type HubMcpEntry = {
+  type: "http";
+  url: string;
+  alwaysLoad?: boolean;
+};
+
 /**
  * Build the MCP servers map for a chat query.
  * Includes frontend-specific tool servers and Brave Search, if configured.
+ *
+ * Every entry points at the daemon's MCP hub (`core/mcp-hub`) over
+ * streamable HTTP: the Talon tool servers run in-process there (zero
+ * subprocesses per chat — chat binding travels in the URL, not env),
+ * and brave-search is a single hub-managed child shared by all chats.
  */
-export function buildMcpServers(
-  chatId: string,
-): Record<
-  string,
-  { command: string; args: string[]; env: Record<string, string> }
-> {
+export function buildMcpServers(chatId: string): Record<string, HubMcpEntry> {
   const config = getConfig();
   const bridgeUrl = `http://127.0.0.1:${getBridgePort()}`;
 
-  // tsx as a Node loader is passed via `--import <url>`. Node accepts URLs
-  // or absolute paths, but on Windows a raw backslash path (`D:\…\tsx`) is
-  // ambiguous between path and URL — the loader hook fails to register and
-  // every subsequent `import` of a .ts file throws. `pathToFileURL` produces
-  // a cross-platform `file://` URL that Node always treats as a loader URL.
-  const tsxImport = pathToFileURL(
-    resolve(
-      import.meta.dirname ?? ".",
-      "../../../node_modules/tsx/dist/esm/index.mjs",
-    ),
-  ).href;
-  const mcpServerPath = resolve(
-    import.meta.dirname ?? ".",
-    "../../core/tools/mcp-server.ts",
-  );
-
-  // Frontend-specific MCP tool servers (one per non-terminal frontend)
-  const frontends = getActiveFrontends();
+  const servers: Record<string, HubMcpEntry> = {};
 
-  const servers: Record<
-    string,
-    { command: string; args: string[]; env: Record<string, string> }
-  > = {};
-
-  for (const frontend of frontends) {
-    const serverName = `${frontend}-tools`;
-    const mcpEnv = {
-      TALON_BRIDGE_URL: bridgeUrl,
-      TALON_CHAT_ID: chatId,
-      TALON_FRONTEND: frontend,
+  // Scope to the chat's owning frontend: a native-app chat gets
+  // native-tools only, not every configured frontend's server (stray
+  // mcp__telegram-tools__* in a native chat is confusing UI and a
+  // wrong-surface delivery hazard). Cross-surface contexts (heartbeat,
+  // one-shots) keep the full set.
+  for (const frontend of frontendsForChat(chatId, getActiveFrontends())) {
+    servers[`${frontend}-tools`] = {
+      type: "http",
+      url: talonHubUrl(bridgeUrl, frontend, chatId),
+      // Always include the frontend's tools in the turn-1 prompt instead of
+      // deferring them behind the SDK's tool search. These are the bot's
+      // primary surface — it needs `end_turn`/`send`/`react` on EVERY turn to
+      // reply at all. When deferred, the SDK evicts their schemas between
+      // turns, so a bare `end_turn` fails with "no such tool" and the user's
+      // reply silently doesn't send (the model has to burn a round-trip
+      // re-fetching the schema via tool_search first). `alwaysLoad` also
+      // blocks startup until this server is connected (capped at the 5s MCP
+      // connect timeout) so the tools are present when the first prompt is
+      // built — fixing the post-restart race where turn-1 ran before the
+      // server finished connecting. Per-tool `_meta['anthropic/alwaysLoad']`
+      // does NOT add that blocking, which is why server-level is the correct
+      // lever here. Cost: ~50 frontend tool schemas loaded every turn (~10k
+      // tokens, cached, negligible on the 1M-context models Talon runs).
+      alwaysLoad: true,
     };
-    // `node --import <tsx-loader>` everywhere — tsx as a Node loader works
-    // identically on Windows and POSIX, and avoids spawning `npx.cmd` (which
-    // Node 20.19+ refuses to execute via child_process.spawn without
-    // shell:true; CVE-2024-27980 mitigation). The wrapping launcher would
-    // hit the same .cmd ban when calling its child.
-    servers[serverName] = wrapMcpServer({
-      command: "node",
-      args: ["--import", tsxImport, mcpServerPath],
-      env: mcpEnv,
-    });
   }
 
   // Brave Search MCP server (if configured)
   if (config.braveApiKey) {
-    servers["brave-search"] = wrapMcpServer({
-      command: resolve(
-        import.meta.dirname ?? ".",
-        "../../../node_modules/.bin/brave-search-mcp-server",
-      ),
-      args: [],
-      env: { BRAVE_API_KEY: config.braveApiKey },
-    });
+    servers["brave-search"] = {
+      type: "http",
+      url: pluginHubUrl(bridgeUrl, "brave-search", chatId),
+    };
   }
 
   return servers;
 }
 
+/**
+ * Build the plugin MCP server map for a chat query — hub URLs for every
+ * registry-provided plugin server, optionally filtered to `only` plugin
+ * names (heartbeat/dream tiers restrict their tool surface this way).
+ */
+export function buildPluginMcpServers(
+  chatId: string,
+  only?: string[],
+): Record<string, HubMcpEntry> {
+  const bridgeUrl = `http://127.0.0.1:${getBridgePort()}`;
+  const servers: Record<string, HubMcpEntry> = {};
+  for (const name of hubPluginServerNames(only)) {
+    servers[name] = {
+      type: "http",
+      url: pluginHubUrl(bridgeUrl, name, chatId),
+    };
+  }
+  return servers;
+}
+
 // ── Hooks ───────────────────────────────────────────────────────────────────
 
 /**
- * PostToolBatch hook: terminate the SDK query loop the moment a turn-terminator
- * tool (e.g. `end_turn`) resolves in the assistant's tool batch.
+ * Build the turn-terminator hook pair (PostToolUseFailure + PostToolBatch).
+ *
+ * These two hooks coordinate through a per-session `Set<tool_use_id>` of
+ * terminator tools whose `execute()` threw. The set is shared by closure —
+ * one Set per `buildSdkOptions` call, so concurrent chat sessions never
+ * leak failure flags into each other.
  *
- * Why PostToolBatch and not PostToolUse:
- *   - PostToolUse fires per-tool and may run concurrently for parallel tool
- *     calls. Returning `continue: false` from there can race with sibling MCP
- *     tools whose AbortControllers haven't yet completed — the same race that
- *     killed the previous `qi.interrupt()` approach (see handler.ts comment
- *     and commit `d5ce30f`).
- *   - PostToolBatch fires exactly ONCE after every tool in the batch has
- *     resolved. By definition there are no in-flight siblings to race with.
+ * Design choices:
  *
- * What this saves:
- *   - The ~2-3s "phantom typing" round-trip the SDK makes after `end_turn`
- *     returns (the model has nothing to say, generates a stop_turn anyway).
- *   - Trailing prose that gets generated during that round-trip and was
- *     previously suppressed only at the delivery layer (real tokens spent).
+ * - **Why PostToolBatch for the terminate decision** (vs PostToolUse): batch
+ *   fires exactly once after every tool in the batch has resolved, so there
+ *   are no in-flight siblings to race with. PostToolUse fires per-tool and
+ *   can race with sibling MCP tools whose AbortControllers haven't completed
+ *   — the same race that killed the earlier `qi.interrupt()` approach (commit
+ *   `d5ce30f`).
  *
- * Returns `{ continue: false, stopReason: ... }` → SDK exits with TerminalReason
- * `'hook_stopped'`, no further model generation.
+ * - **Why also PostToolUseFailure**: when a terminator tool's `execute()`
+ *   throws (e.g. `end_turn` throws because the bridge returned `{ok:false}`),
+ *   the SDK fires PostToolUseFailure with `{tool_name, error, is_interrupt}`.
+ *   That's a typed, content-free signal that the call failed — vastly more
+ *   robust than sniffing `tool_response` bodies for `"ok":false` substrings.
+ *   The hook records the failed `tool_use_id`; PostToolBatch consults the
+ *   set when deciding whether to terminate.
+ *
+ * - **Why `is_interrupt: true` is ignored**: an interrupted tool isn't a
+ *   delivery failure — it's the user (or the harness) cancelling the call
+ *   mid-flight. Treating that as "preserve the loop" would leak interrupted
+ *   sessions into zombie state.
+ *
+ * What this preserves:
+ *
+ * - Happy path: terminator succeeds → loop terminates → no phantom-typing
+ *   round-trip (the ~2-3s perf win from PR #122).
+ * - Failure path: terminator's execute() threw → loop stays alive → model
+ *   sees the error in the next assistant turn and can retry / message the
+ *   user. The bug fixed: prior to this hook pair, a failed terminator
+ *   terminated the loop silently and the user saw nothing (canonical
+ *   incident: 2026-05-13 13:11Z 4096-char overflow).
  */
-const turnTerminatorHook: HookCallback = async (
-  input,
-): Promise<HookJSONOutput> => {
-  if (input.hook_event_name !== "PostToolBatch") {
+function buildTurnTerminatorHooks(): {
+  postToolUseFailureHook: HookCallback;
+  postToolBatchHook: HookCallback;
+} {
+  const failedTerminatorIds = new Set<string>();
+
+  const postToolUseFailureHook: HookCallback = async (
+    input,
+  ): Promise<HookJSONOutput> => {
+    if (input.hook_event_name !== "PostToolUseFailure") {
+      return { continue: true };
+    }
+    const failure = input as PostToolUseFailureHookInput;
+    // Interrupts are not delivery failures — don't treat them as recoverable.
+    if (failure.is_interrupt) return { continue: true };
+
+    // Pass tool_input so soft-terminator react (`end_turn: false`) doesn't
+    // get tracked here. If the call wasn't acting as a terminator, the
+    // PostToolBatch path would have continued the loop anyway.
+    if (!isTurnTerminator(failure.tool_name, failure.tool_input)) {
+      return { continue: true };
+    }
+
+    failedTerminatorIds.add(failure.tool_use_id);
+    log(
+      "agent",
+      `PostToolUseFailure: ${failure.tool_name} (${failure.tool_use_id}) ` +
+        `failed — flagging for loop preservation. error: ${failure.error}`,
+    );
     return { continue: true };
-  }
-  const batch = input as PostToolBatchHookInput;
-  // Pass `tool_input` so the soft-terminator opt-out (e.g. react with
-  // `end_turn: false`) can keep the loop alive. Without the input, the
-  // check is name-only and reacts that meant to keep going would still
-  // terminate.
-  const terminator = batch.tool_calls.find((tc) =>
-    isTurnTerminator(tc.tool_name, tc.tool_input),
-  );
-  if (terminator) {
+  };
+
+  const postToolBatchHook: HookCallback = async (
+    input,
+  ): Promise<HookJSONOutput> => {
+    if (input.hook_event_name !== "PostToolBatch") {
+      return { continue: true };
+    }
+    const batch = input as PostToolBatchHookInput;
+    const terminator = batch.tool_calls.find((tc) =>
+      isTurnTerminator(tc.tool_name, tc.tool_input),
+    );
+    if (!terminator) {
+      return { continue: true };
+    }
+
+    // If the terminator failed, the failure hook flagged its tool_use_id.
+    // Preserve the loop so the model can react to the error.
+    if (failedTerminatorIds.has(terminator.tool_use_id)) {
+      failedTerminatorIds.delete(terminator.tool_use_id);
+      log(
+        "agent",
+        `PostToolBatch: ${terminator.tool_name} failed — keeping SDK loop ` +
+          `alive so the model can read the error and retry`,
+      );
+      return { continue: true };
+    }
+
     log(
       "agent",
       `PostToolBatch: terminating SDK loop on ${terminator.tool_name} ` +
@@ -174,9 +245,10 @@ const turnTerminatorHook: HookCallback = async (
       continue: false,
       stopReason: "turn terminated by end_turn / send",
     };
-  }
-  return { continue: true };
-};
+  };
+
+  return { postToolUseFailureHook, postToolBatchHook };
+}
 
 /**
  * Notification hook: log SDK-generated notifications (e.g. context compaction,
@@ -234,10 +306,33 @@ const stopFailureHook: HookCallback = async (
 
 // ── Options builder ─────────────────────────────────────────────────────────
 
-export function buildSdkOptions(chatId: string): BuildSdkOptionsResult {
+/**
+ * Build the SDK `systemPrompt` option from a prepared prompt.
+ *
+ * When a dynamic part exists, the prompt is sent as blocks split by
+ * `SYSTEM_PROMPT_DYNAMIC_BOUNDARY`: everything before the marker is the
+ * static prefix the API can cache across sessions; everything after is
+ * the volatile tail (workspace listing, daily-memory pointer) that
+ * changes between rebuilds without invalidating the prefix.
+ */
+function toSdkSystemPrompt(prepared: PreparedSystemPrompt): string | string[] {
+  if (!prepared.dynamicText) return prepared.staticText;
+  return [
+    prepared.staticText,
+    SYSTEM_PROMPT_DYNAMIC_BOUNDARY,
+    prepared.dynamicText,
+  ];
+}
+
+export function buildSdkOptions(
+  chatId: string,
+  abortController?: AbortController,
+  modelOverride?: string,
+  preparedPrompt?: PreparedSystemPrompt,
+): BuildSdkOptionsResult {
   const config = getConfig();
   const chatSettings = getChatSettings(chatId);
-  const activeModel = chatSettings.model ?? config.model;
+  const activeModel = modelOverride ?? chatSettings.model ?? config.model;
   const activeEffort = chatSettings.effort ?? "adaptive";
   const resolvedActiveModel = resolveModelId(activeModel);
 
@@ -247,9 +342,26 @@ export function buildSdkOptions(chatId: string): BuildSdkOptionsResult {
 
   const session = getSession(chatId);
 
+  // Per-session closure-shared state for the terminator hook pair (see
+  // buildTurnTerminatorHooks docstring). Each chat gets its own failure set
+  // so concurrent sessions never leak flags into each other.
+  const { postToolUseFailureHook, postToolBatchHook } =
+    buildTurnTerminatorHooks();
+
   const options: Options = {
     model: resolvedActiveModel,
-    systemPrompt: config.systemPrompt,
+    // Prefer the caller's frozen per-session prompt; fall back to the
+    // global config split (warm-up and legacy callers), then to the
+    // plain string for configs built without parts (tests).
+    systemPrompt: preparedPrompt
+      ? toSdkSystemPrompt(preparedPrompt)
+      : config.systemPromptParts
+        ? toSdkSystemPrompt({
+            text: config.systemPrompt,
+            staticText: config.systemPromptParts.staticText,
+            dynamicText: config.systemPromptParts.dynamicText,
+          })
+        : config.systemPrompt,
     cwd: config.workspace,
     // The SDK's permission system is designed for an interactive Claude
     // Code IDE session where a human approves each tool call. Talon runs
@@ -262,17 +374,29 @@ export function buildSdkOptions(chatId: string): BuildSdkOptionsResult {
     // these as a unit — flipping either alone is a configuration bug.
     permissionMode: "bypassPermissions",
     allowDangerouslySkipPermissions: true,
+    // Cancellation signal — when aborted, the SDK tears down the spawned
+    // subprocess and stops streaming. The chat handler uses this both as a
+    // shutdown hook for the daemon and as the kill-switch for a watchdog
+    // that fires if the SDK iterator hangs after emitting `result`. The
+    // happy-path SDK exit is owned by the PostToolBatch hook below; this
+    // is defence in depth, not the primary terminator.
+    ...(abortController ? { abortController } : {}),
     ...(config.claudeBinary
       ? { pathToClaudeCodeExecutable: config.claudeBinary }
       : {}),
-    disallowedTools: [...DISALLOWED_TOOLS_CHAT],
+    // Whitelist of SDK built-in tools. Anything not listed (e.g. WebSearch,
+    // WebFetch, Monitor, PushNotification, RemoteTrigger, Plan/Worktree/Todo
+    // helpers, AskUserQuestion, ScheduleWakeup) is unavailable to the model.
+    // MCP tools are governed independently via `mcpServers` below.
+    tools: [...ALLOWED_TOOLS_CHAT],
     ...thinkingConfig,
     mcpServers: {
       ...buildMcpServers(chatId),
-      ...getPluginMcpServers(`http://127.0.0.1:${getBridgePort()}`, chatId),
+      ...buildPluginMcpServers(chatId),
     },
     hooks: {
-      PostToolBatch: [{ hooks: [turnTerminatorHook] }],
+      PostToolUseFailure: [{ hooks: [postToolUseFailureHook] }],
+      PostToolBatch: [{ hooks: [postToolBatchHook] }],
       Notification: [{ hooks: [notificationHook] }],
       StopFailure: [{ hooks: [stopFailureHook] }],
     },

package/src/backend/claude-sdk/state.ts

@@ -6,7 +6,7 @@
  */
 
 import type { TalonConfig } from "../../util/config.js";
-import { registerClaudeModels } from "./models.js";
+import { registerClaudeModels } from "./models/index.js";
 
 // ── State ────────────────────────────────────────────────────────────────────